August 2008 - Freeradius-Users - lists.freeradius.org

RE: radsniff
by Lemaster, Rob 24 Aug '08

24 Aug '08

Thank you for your quick reply. I tried radsniff -h before posting. What I'm hoping to do is to troubleshoot a particular user, but I don't think I'm using the -r option correctly. # ./radsniff -i lo -rFOO -ssecret -X radsniff: Invalid RADIUS filter "(null)": expecting operator No matter what I use for -r, I get the same reply. When I use it without -r, I get basically the same as radtest output. Could you reply with some examples of the correct usage of this command? Is it possible to do a regex on a username or on Access-Rejects with radsniff? thanks ------------------------------ Message: 5 Date: Fri, 22 Aug 2008 20:54:53 -0700 From: "Lemaster, Rob" <rlemaste(a)covad.com> Subject: radsniff To: <freeradius-users(a)lists.freeradius.org> Message-ID: <3BC5D44AB71A754FAE3CA68A7597EABE0F82C86C(a)ZANEVS03.cc-ntd1.covad.com> Content-Type: text/plain; charset="iso-8859-1" I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? ------------------------------ Message: 6 Date: Sat, 23 Aug 2008 06:51:31 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: radsniff To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48AF9753.8040602(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Lemaster, Rob wrote: > I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? $ radsniff -h It's a simple wrapper around libpcap. It can also print out the contents of RADIUS packets using the FreeRADIUS dictionaries. Wireshark does more, but it's dictionaries aren't as up to date, and it's a *lot* bigger. Alan DeKok.

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 01:51:24 +0100 > How? What do you think we know about "network Roaming > test2" setup? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 22/8/2008, "Venkata LK Mula" > <vlkmula(a)saitechnology.com> piše: > > > Hi, > > Can any body respond to my earlier requst please. > > > > regards, > > Venkat > > > > > >----- Forwarded Message ----- > >From: "Venkata LK Mula" > >To: > >Subject: Certificate problem on Windows XP clinet ... > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > Hi, > > > > Regarding the above mentioned subject, we are facing the > > problem of "Windows was unable to find the certificate > > to log on to the network Roaming test2". > > > > Though the certificates are installed properly, and when > > we are using the same certificates for 'PEAP-MSCHAPv2' > > with 'validate server certificate' working fine. > > > > Can any one look into the same and respond me back > please. > > > regards, > > Venkat > > > > > > > > [Attachment: cacert.der] > > [Attachment: clinet.p12] > > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Venkata LK Mula" To: FreeRadius users mailing list Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 08:31:01 +0530 > Hi Ivan, > > "network Roaming test2" in which "Roaming test2" is the > SSID. > > regards, > Venkat > > ----- Original Message ----- > From: "Ivan Kalik" > To: "FreeRadius users mailing list" > > Subject: Re: Fwd: Certificate problem on Windows XP clinet > .. > Date: Sat, 23 Aug 2008 01:51:24 +0100 > > > How? What do you think we know about "network Roaming > > test2" setup? > > > > Ivan Kalik > > Kalik Informatika ISP > > > > > > Dana 22/8/2008, "Venkata LK Mula" > > piše: > > > > > Hi, > > > Can any body respond to my earlier requst please. > > > > > > regards, > > > Venkat > > > > > > > > >----- Forwarded Message ----- > > >From: "Venkata LK Mula" > > >To: > > >Subject: Certificate problem on Windows XP clinet ... > > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > > > > > Hi, > > > > > > Regarding the above mentioned subject, we are facing > > > the problem of "Windows was unable to find the > > > certificate to log on to the network Roaming test2". > > > > > > Though the certificates are installed properly, and > > > when we are using the same certificates for > > > 'PEAP-MSCHAPv2' with 'validate server certificate' > > working fine. > > > > Can any one look into the same and respond me back > > please. > > > > regards, > > > Venkat > > > > > > > > > > > > [Attachment: cacert.der] > > > [Attachment: clinet.p12] > > > > > > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

2 1

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)
by William Hegardt 23 Aug '08

23 Aug '08

I hate to resurrect this long thread from July 22-28, but I have the same problem and never saw a resolution. I'm using FreeRadius 2.0.5 on CentOS 5.2 with wpa_supplicant 0.6.4 (latest to date). I'm using the bootstrap script to generate example certificates. I also created a client certificate using make client.pem. I configured wpa_supplicant with ca.pem, client.pem and client.key. EAP-TLS authentication fails with the "fatal unknown ca" message. If I hack the Makefile like Sergio mentioned last month to sign the client certificate with the CA key, then authentication succeeds. In last month's thread, Alan DeKok posted: > You need to follow the documentation in eap.conf. > > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > certificate_file = ${certdir}/server.pem > > Have you done that? In my case, CA_file does indeed refer to ca.pem as created by the bootstrap script. So I'm assuming that I don't need to touch the server.pem file as created. I'd really like to understand what's wrong. Could wpa_supplicant be somehow incompatible with the bootstrap certificate chain? Thanks

5 9

3Com 4500 and 5500 local login
by Oxiel 23 Aug '08

23 Aug '08

Hello gurus. Is me again :), trying to authenticate local users to the switch through freeradius 2.0.5, but no success with 3Com 4500/5500. My users file has: admin Cleartext-Password := "XXXXX" Framed-IP-Address = "%{Framed-IP-Address}", 3Com-User-Access-Level = 3Com-Administrator, Reply-Message = "Hola usuario, %{User-Name}" radiusd -X shows this, as you can see i'm getting the access-accept message: rad_recv: Access-Request packet from host 192.168.100.246 port 5001, id=72, length=204 User-Name = "admin" User-Password = "XXXXX" NAS-IP-Address = 192.168.100.246 NAS-Identifier = "001cc53e1b02" NAS-Port = 16809985 NAS-Port-Id = "unit=1;subslot=0;port=8;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Login-User Login-IP-Host = 192.168.100.246 Calling-Station-Id = "0000-0000-0000" Framed-IP-Address = 192.168.100.241 H3C-Connect_Id = 72 H3C-Product-ID = "4500" H3C-Ip-Host-Addr = "192.168.100.241 00:00:00:00:00:00" H3C-NAS-Startup-Timestamp = 954633321 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry admin at line 220 expand: %{Framed-IP-Address} -> 192.168.100.241 expand: Hola usuario, %{User-Name} -> Hola usuario, admin ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "XXXXX" rlm_pap: Using clear text password "XXXXX" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 72 to 192.168.100.246 port 5001 Framed-IP-Address = 192.168.100.241 3Com-User-Access-Level = 3Com-Administrator Reply-Message = "Hola usuario, admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 72 with timestamp +15 Ready to process requests. The switch shows me this: debugging radius packet terminal debugging *0.683215396 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=Normal auth request Index = 72, ulParam3=2185152212] *0.683215397 4500 RDS/8/DEBUG:- 1 -Send attribute list: *0.683215398 4500 RDS/8/DEBUG:- 1 - [1 User-name ] [7 ] [admin] [2 Password ] [18] [B9CE88BA96205FBFF301351E5ED4A8C5] [4 NAS-IP-Address ] [6 ] [192.168.100.246] [32 NAS-Identifier ] [14] [001cc53e1b02] [5 NAS-Port ] [6 ] [16809985] [87 NAS_Port_Id ] [34] [unit=1;subslot=0;port=8;vlanid=1] *0.683215399 4500 RDS/8/DEBUG:- 1 - [61 NAS-Port-Type ] [6 ] [15] [3com-26 Connect_ID ] [6 ] [72] [6 Service-Type ] [6 ] [1] [14 Login-Host ] [6 ] [192.168.100.246] [31 Caller-ID ] [16] [303030302D303030302D30303030] [8 Framed-Address ] [6 ] [192.168.100.241] *0.683215400 4500 RDS/8/DEBUG:- 1 - [3com-255Product-ID ] [6 ] [4500] [3com-60 Ip-Host-Addr ] [35] [192.168.100.241 00:00:00:00:00:00] [3com-59 NAS-Startup-Timestamp ] [6 ] [954633321] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send: IP=[192.168.100.91], UserIndex=[72], ID=[72], RetryTimes=[0], Code=[1], Length=[204] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send Raw Packet is: *0.683215402 4500 RDS/8/DEBUG:- 1 - 01 48 00 cc e4 54 00 00 e7 22 00 00 b1 26 00 00 29 3b 00 00 01 07 61 64 6d 69 6e 02 12 b9 ce 88 ba 96 20 5f bf f3 01 35 1e 5e d4 a8 c5 04 06 c0 a8 64 f6 20 0e 30 30 31 63 63 35 33 65 31 62 30 32 05 06 01 00 80 01 57 22 75 6e 69 74 3d 31 3b 73 75 62 73 6c 6f 74 3d 30 3b 70 6f 72 74 3d 38 3b 76 6c 61 6e 69 64 3d 31 3d 06 00 00 00 0f 06 06 00 00 00 01 0e 06 c0 a8 64 f6 1f 10 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 08 06 c0 a8 64 f1 1a 3b 00 00 63 a2 1a 06 00 00 00 48 ff 06 34 35 30 30 3c 23 31 39 32 2e 31 36 38 2e 31 30 30 2e 32 34 31 20 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3b 06 38 e6 8c 69 *0.683215413 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=PKT response Index = 59, ulParam3=2182466612] *0.683215414 4500 RDS/8/DEBUG:- 1 -Receive Raw Packet is: *0.683215415 4500 RDS/8/DEBUG:- 1 - 02 48 00 3b 22 a0 e3 77 89 0b 9f f0 0f 82 02 71 a6 81 7b 68 08 06 c0 a8 64 f1 1a 0c 00 00 00 2b 01 06 00 00 00 03 12 15 48 6f 6c 61 20 75 73 75 61 72 69 6f 2c 20 61 64 6d 69 6e *0.683215416 4500 RDS/8/DEBUG:- 1 -Receive:IP=[192.168.100.91],Code=[2],Length=[59] *0.683215417 4500 RDS/8/DEBUG:- 1 - [8 Framed-Address ] [6 ] [192.168.100.241] [3com-1 User_Access_Level ] [6 ] [3] [18 Reply-Message ] [21] [Hola usuario, admin] Has anybody done this?, should i sent something else on the reply? Best regards. Oxiel __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.es

2 1

radsniff
by Lemaster, Rob 23 Aug '08

23 Aug '08

I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples?

2 1

Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 22 Aug '08

22 Aug '08

Hi, Can any body respond to my earlier requst please. regards, Venkat ----- Forwarded Message ----- From: "Venkata LK Mula" To: Subject: Certificate problem on Windows XP clinet ... Date: Thu, 21 Aug 2008 00:33:26 +0530 Hi, Regarding the above mentioned subject, we are facing the problem of "Windows was unable to find the certificate to log on to the network Roaming test2". Though the certificates are installed properly, and when we are using the same certificates for 'PEAP-MSCHAPv2' with 'validate server certificate' working fine. Can any one look into the same and respond me back please. regards, Venkat [Attachment: cacert.der] [Attachment: clinet.p12]

2 1

TLS_accept:error in SSLv3 read client certificate A
by Martin Silvero 22 Aug '08

22 Aug '08

hello friends! solved the problem we had, I did a test and works well, but now every time the user wants to connect I get this error in the logs: Thu Aug 21 11:14:56 2008 : Info: rlm_eap_md5: Issuing Challenge Thu Aug 21 11:14:56 2008 : Error: TLS_accept:error in SSLv3 read client certificate A Thu Aug 21 11:14:56 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Thu Aug 21 11:14:56 2008 : Error: TLS Alert read:fatal:bad certificate Thu Aug 21 11:14:56 2008 : Error: TLS_accept:failed in SSLv3 read client certificate A Thu Aug 21 11:14:56 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Thu Aug 21 11:14:56 2008 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. someone could give me a hand please, thank you very much now. -- -- Silvero Martin

2 1

specifying back end to proxy on per-user basis
by Greg Woods 22 Aug '08

22 Aug '08

We have a freeradius instance that talks to the world, and proxies requests to a back end server that does token authentication via the "otp" module. This all works fine. What we need is something we can do when a user forgets or loses their card. We thought to use S/key for this. To that end, I have another back end server that does s/key authentication via a PAM module. This too works, but I have to find a way to specify in the front end proxy on a per-user basis which back end server should be used. The first step to doing this was to set up a realm for the s/key server. In the proxy.conf file for the front end proxy, the NULL realm has authhost and secret are set up for the otp back end server. I created an SKEY realm that sets authhost and secret for the s/key back end server. So far so good; I can run "radtest" against the front end proxy server, and if I specify "user@SKEY" as the username, it proxies to the s/key back end and everything works great. The problem is that I can't figure out the magic incantation for the proxy front end to tell it that certain users should be in the SKEY realm. Am I basically on the right track as to the correct way to accomplish what I want? If so, what is the magic incantation to specify which users should be in the SKEY realm? If somebody could just point me down the right path, I'll be happy to read the relevant documentation to come up with the correct syntax, but I haven't found it yet. Thanks, --Greg

3 6

RE: clients.conf - identifying a "client" - sql/ldap
by Johan Meiring 22 Aug '08

22 Aug '08

Hi all, Received no responses to the post below. Any ideas would be greatly appreciated! Thanks, Johan Meiring Cape PC Services CC / Amobia Communications Tel: (021) 883-8271 / (0861) AMOBIA Fax: (021) 886-7782 / (0861) AMOFAX > -----Original Message----- > From: Johan Meiring [mailto:jmeiring@pcservices.co.za] > Sent: 28 July 2008 11:55 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: clients.conf - identifying a "client" - sql/ldap > > > Hi, > > I have the following setup. > > Various clients (chillispot) behind broadband (read: dynamic > IP) connections. > Basically I am selling AAA services. > > I would like to authotize a nas to use my services in the > first place by using the NAS-Identifier and the radius secret. > > Both the NAS SQL table and the clients.conf file seem to > identify the client by IP address. > > As my clients can be from ANY address, it seems that the only > way is to create an entry in clients.conf is as follows: > > client 0.0.0.0/0 { > shortname = myclient > secret = abcde > } > > This now implies again that all clients have to have the same secret. > > I am using the perl modules, but according to another post > you cannot use perl as replacement for clients.conf. > Also the sql nas table simply mimics the clients. (I.e. > still uses IP address to find entry). > > Is there any way to handle clients with dynamic IPs, and use > the NAS-Identifier and radius secret to allow/disallow the NAS? > > Thanks! > > Cheers, > > Johan Meiring > Cape PC Services CC / Amobia Communications > Tel: (021) 883-8271 / (0861) AMOBIA > Fax: (021) 886-7782 / (0861) AMOFAX > >

3 6