September 2008 - Freeradius-Users - lists.freeradius.org

Users can't authenticate through PEAP
by Alex Wong 19 Sep '08

19 Sep '08

I'm using Fedora Core 9 with freeradius 2.1.0. I've follow the steps in http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html#confradius to configure it. However, when I key in the username and password in Windows XP SP2, it doesn't seems to be able to authenticate. It goes into loop and I can't see PEAP anywhere. Any ideas what went wrong? Many thanks. FreeRADIUS Version 2.1.0, for host i686-pc-linux-gnu, built on Sep 16 2008 at 16:38:41 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.2.0/24 { require_message_authenticator = no secret = "testing123" shortname = "private-network-1" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.117 port 1025, id=87, length=216 User-Name = "exsuser" NAS-IP-Address = 192.168.2.117 NAS-Port = 4 Framed-MTU = 1400 Called-Station-Id = "00-05-7b-04-1b-37:EXS_OFFICE_GATEWAY" Calling-Station-Id = "00-0d-54-98-e8-4a" NAS-Identifier = "AVS linux-wlan 802.1x/802.11i/WPA/WPA2 Authenticator" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT IEEE802.11" EAP-Message = 0x0200000c0165787375736572 Message-Authenticator = 0xa8240cddac8821a4f9faf3822a96f0c5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "exsuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry exsuser at line 93 expand: Hello, %{User-Name} -> Hello, exsuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 87 to 192.168.2.117 port 1025 Reply-Message = "Hello, exsuser" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfa7d8bfffa7c92dc232b87d04c03522d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.117 port 1025, id=88, length=216 User-Name = "exsuser" NAS-IP-Address = 192.168.2.117 NAS-Port = 4 Framed-MTU = 1400 Called-Station-Id = "00-05-7b-04-1b-37:EXS_OFFICE_GATEWAY" Calling-Station-Id = "00-0d-54-98-e8-4a" NAS-Identifier = "AVS linux-wlan 802.1x/802.11i/WPA/WPA2 Authenticator" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT IEEE802.11" EAP-Message = 0x0200000c0165787375736572 Message-Authenticator = 0xeccc7c6cc291ba7bd18b4c9820be7aec +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "exsuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry exsuser at line 93 expand: Hello, %{User-Name} -> Hello, exsuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 88 to 192.168.2.117 port 1025 Reply-Message = "Hello, exsuser" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x27571bf82756027367de47dcbb8c3045 Finished request 1. Going to the next request Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 192.168.2.117 port 1025, id=89, length=216 User-Name = "exsuser" NAS-IP-Address = 192.168.2.117 NAS-Port = 4 Framed-MTU = 1400 Called-Station-Id = "00-05-7b-04-1b-37:EXS_OFFICE_GATEWAY" Calling-Station-Id = "00-0d-54-98-e8-4a" NAS-Identifier = "AVS linux-wlan 802.1x/802.11i/WPA/WPA2 Authenticator" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT IEEE802.11" EAP-Message = 0x0200000c0165787375736572 Message-Authenticator = 0x5b514e6397ff6042a12f11dab561e120 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "exsuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry exsuser at line 93 expand: Hello, %{User-Name} -> Hello, exsuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 89 to 192.168.2.117 port 1025 Reply-Message = "Hello, exsuser" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x55edec7355ecf5de5078463e21b79a0a Finished request 2. Going to the next request Cleaning up request 0 ID 87 with timestamp +13 Waking up in 1.9 seconds. -- View this message in context: http://www.nabble.com/Users-can%27t-authenticate-through-PEAP-tp19549078p19… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

MySQL not in the default port
by Marcelo Freitas 19 Sep '08

19 Sep '08

Hello, I had to install my MySQL not in the default port (3306), and I'm not able to connect to the server ... I tried everything in the sql.conf like localhost:5999, my.IP:5999, hostname, etc and nothing makes it to connect ... Is there any (right) way to specify a port to connect ? is it possible ? P.S: I tried to make FreeRadius to connect to an outside MySQL server (standard port) and it connected without problems ... Thanks in advance,

2 1

Freeradius Accounting using different virtual server
by Ryan Setiawan H 19 Sep '08

19 Sep '08

Hi, I'm using freeradius 2.0.5... many client authenticate againt us that is segmented by realm ( / IPASS). the server will strip the username realm and proxying to localhost with different port number ( so i create many listen section with point to their own virtual server ) ex like this : realm test1/username --> will go to 127.0.0.1:1912( auth) 127.0.0.1:1913 (acct) using virtual server link1 realm test2/username --> will go to 127.0.0.1:2012 ( auth) 127.0.0.1:2013 (acct) using virtual server link2 .. etc for 127.0.0.1 I'm using per socket client to differentiate each client the problem rise when I want to differentiate each virtual server accounting ( radutmp, radwtmp, and detail file), because using default accounting file each realm will be "muddle" into one file. In module authorization and authentication I can create many instance ex( ldap1 ldap2 ldap3), but *not work* at accounting module ex ( detail1 detail2 detail3 ). is there a way to do this? could someone give some example? Thank you Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

Chillispot on different machine
by Tanya Muluw 18 Sep '08

18 Sep '08

Dear all, I have just install eashyhotspot, a linux captive portal distro based on Xubuntu, which consist of Chillispot, Freeradius, and billing application, in a single machine. It's work fine. Now I want to install another Chillispot in a different Gentoo Linux machine, which will connect to previously installed Freeradius server. I have inserted the new Chillispot IP address into Freeradius clients.conf : client 10.10.48.18 { secret = easyhotspot shortname = cafe1 nastype = other } I also granted access on freeradius database to chillispot machine (I have no idea whether it is necessary or not). Chillispot iptables rules on freeradius machin have also been modified to open port 1812, 1813,1814 and 3990 (mysql port). For testing purpose, I have set input policy of iptables rule to ACCEPT. Iptables rules related to freeradius on freeradius machine : /bin/echo 1 > /proc/sys/net/ipv4/ip_forward IPTABLES="/sbin/iptables" EXTIF="eth0" INTIF="eth1" TUN="tun0" $IPTABLES -P INPUT ACCEPT $IPTABLES -P FORWARD ACCEPT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 80 --syn -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 443 --syn -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 3306 --syn -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 3390 --syn -j ACCEPT $IPTABLES -A OUTPUT -o $EXTIF -p tcp -m tcp --dport 3390 --syn -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --sport 3306 --syn -j ACCEPT $IPTABLES -A OUTPUT -o $EXTIF -p tcp -m tcp --dport 3306 --syn -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --dport 1812 -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --sport 1812 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --dport 1812 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --sport 1812 -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --dport 1813 -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --sport 1813 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --dport 1813 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --sport 1813 -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --dport 1814 -j ACCEPT $IPTABLES -A INPUT -p tcp -m tcp -i $EXTIF --sport 1814 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --dport 1814 -j ACCEPT $IPTABLES -A INPUT -p udp -m udp -i $EXTIF --sport 1814 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --dport 1812 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --sport 1812 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --dport 1812 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --sport 1812 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --dport 1813 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --sport 1813 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --dport 1813 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --sport 1813 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --dport 1814 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp -o $EXTIF --sport 1814 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --dport 1814 -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp -o $EXTIF --sport 1814 -j ACCEPT ==== Iptables rules related to freeradius on other chillispot machine : -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth1 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i tun0 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -i lo -p tcp -m tcp --dport 3990 -j ACCEPT -A OUTPUT -o eth1 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -i tun0 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --sport 3306 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 3306 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --dport 1812 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --sport 1812 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --dport 1812 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --sport 1812 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --dport 1813 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --sport 1813 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --dport 1813 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --sport 1813 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --dport 1814 -j ACCEPT -A INPUT -p tcp -m tcp -i eth1 --sport 1814 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --dport 1814 -j ACCEPT -A INPUT -p udp -m udp -i eth1 --sport 1814 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --dport 1812 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --sport 1812 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --dport 1812 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --sport 1812 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --dport 1813 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --sport 1813 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --dport 1813 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --sport 1813 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --dport 1814 -j ACCEPT -A OUTPUT -p tcp -m tcp -o eth1 --sport 1814 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --dport 1814 -j ACCEPT -A OUTPUT -p udp -m udp -o eth1 --sport 1814 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -s 10.10.48.33 -d 127.0.0.1 -j ACCEPT # from freeradius machine === When I test the chillispot by connecting to the Internet, login page was appear, but login was always failed. I tried freeradius debugging and didn't see any request from the other machine. In chillispot linux log, I got : chillispot[8069]: redir.c: 1046: Radius request timed out Please someone help me for the solusion. Thank you in advance, and sorry for my bad English Best Regards

1 0

Cisco IOS - rlm_pap
by Sturgis, Grant 18 Sep '08

18 Sep '08

Good day all, Trying to get Cisco IOS to authenticate to FR 2.0.5 using rlm_pap. I've followed the instructions from here: http://wiki.freeradius.org/index.php/Cisco but am still having problems. I'm hoping someone can point out my error. Thanks in advance: FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jul 10 2008 at 03:00:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/radius/new/etc/raddb//radiusd.conf including configuration file /usr/local/radius/new/etc/raddb//proxy.conf including configuration file /usr/local/radius/new/etc/raddb//clients.conf including configuration file /usr/local/radius/new/etc/raddb//snmp.conf including files in directory /usr/local/radius/new/etc/raddb//modules/ including configuration file /usr/local/radius/new/etc/raddb//modules/mac2ip including configuration file /usr/local/radius/new/etc/raddb//modules/etc_group including configuration file /usr/local/radius/new/etc/raddb//modules/files including configuration file /usr/local/radius/new/etc/raddb//modules/always including configuration file /usr/local/radius/new/etc/raddb//modules/unix including configuration file /usr/local/radius/new/etc/raddb//modules/acct_unique including configuration file /usr/local/radius/new/etc/raddb//modules/passwd including configuration file /usr/local/radius/new/etc/raddb//modules/counter including configuration file /usr/local/radius/new/etc/raddb//modules/pap including configuration file /usr/local/radius/new/etc/raddb//modules/sradutmp including configuration file /usr/local/radius/new/etc/raddb//modules/echo including configuration file /usr/local/radius/new/etc/raddb//modules/detail including configuration file /usr/local/radius/new/etc/raddb//modules/exec including configuration file /usr/local/radius/new/etc/raddb//modules/checkval including configuration file /usr/local/radius/new/etc/raddb//modules/sql_log including configuration file /usr/local/radius/new/etc/raddb//modules/expr including configuration file /usr/local/radius/new/etc/raddb//modules/policy including configuration file /usr/local/radius/new/etc/raddb//modules/attr_rewrite including configuration file /usr/local/radius/new/etc/raddb//modules/ldap including configuration file /usr/local/radius/new/etc/raddb//modules/logintime including configuration file /usr/local/radius/new/etc/raddb//modules/expiration including configuration file /usr/local/radius/new/etc/raddb//modules/attr_filter including configuration file /usr/local/radius/new/etc/raddb//modules/krb5 including configuration file /usr/local/radius/new/etc/raddb//modules/mac2vlan including configuration file /usr/local/radius/new/etc/raddb//modules/realm including configuration file /usr/local/radius/new/etc/raddb//modules/chap including configuration file /usr/local/radius/new/etc/raddb//modules/smbpasswd including configuration file /usr/local/radius/new/etc/raddb//modules/pam including configuration file /usr/local/radius/new/etc/raddb//modules/radutmp including configuration file /usr/local/radius/new/etc/raddb//modules/preprocess including configuration file /usr/local/radius/new/etc/raddb//modules/detail.log including configuration file /usr/local/radius/new/etc/raddb//modules/digest including configuration file /usr/local/radius/new/etc/raddb//modules/ippool including configuration file /usr/local/radius/new/etc/raddb//modules/mschap including configuration file /usr/local/radius/new/etc/raddb//eap.conf including configuration file /usr/local/radius/new/etc/raddb//sql.conf including configuration file /usr/local/radius/new/etc/raddb//sql/mysql/dialup.conf including configuration file /usr/local/radius/new/etc/raddb//sql/mysql/counter.conf including configuration file /usr/local/radius/new/etc/raddb//policy.conf including files in directory /usr/local/radius/new/etc/raddb//sites-enabled/ including configuration file /usr/local/radius/new/etc/raddb//sites-enabled/default including configuration file /usr/local/radius/new/etc/raddb//sites-enabled/inner-tunnel including dictionary file /usr/local/radius/new/etc/raddb//dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/radius/new/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/radius/new/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.10.2.35 { require_message_authenticator = no secret = "<my key>" shortname = "sw06" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/radius/new/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/radius/new/etc/raddb//certs/server.key" certificate_file = "/usr/local/radius/new/etc/raddb//certs/aaa01pbldr.cer" CA_file = "/usr/local/radius/new/etc/raddb//certs/dc01bldr.cer" private_key_password = "<key passwd>" dh_file = "/usr/local/radius/new/etc/raddb//certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/radius/new/etc/raddb//users" acctusersfile = "/usr/local/radius/new/etc/raddb//acct_users" preproxy_usersfile = "/usr/local/radius/new/etc/raddb//preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/radius/new/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/radius/new/etc/raddb//attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/radius/new/etc/raddb//huntgroups" hints = "/usr/local/radius/new/etc/raddb//hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/radius/new/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/radius/new/etc/raddb//attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1815 } listen { type = "acct" ipaddr = * port = 1816 } Listening on authentication address * port 1815 Listening on accounting address * port 1816 Listening on proxy address * port 1817 Ready to process requests. rad_recv: Access-Request packet from host 10.10.2.35 port 21645, id=8, length=78 NAS-IP-Address = 10.10.2.35 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "gsturgis" Calling-Station-Id = "10.10.10.7" User-Password = "password" +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "gsturgis", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop users: Matched entry gsturgis at line 61 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "password" rlm_pap: Using clear text password "password" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 8 to 10.10.2.35 port 21645 Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.2.35 port 21645, id=8, length=78 Sending duplicate reply to client sw06 port 21645 - ID: 8 Sending Access-Accept of id 8 to 10.10.2.35 port 21645 Waking up in 1.6 seconds. Cleaning up request 0 ID 8 with timestamp +10 Ready to process requests. rad_recv: Access-Request packet from host 10.10.2.35 port 21645, id=8, length=78 NAS-IP-Address = 10.10.2.35 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "gsturgis" Calling-Station-Id = "10.10.10.7" User-Password = "password" +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "gsturgis", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop users: Matched entry gsturgis at line 61 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "password" rlm_pap: Using clear text password "password" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 8 to 10.10.2.35 port 21645 Service-Type = NAS-Prompt-User Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.2.35 port 21645, id=8, length=78 Sending duplicate reply to client sw06 port 21645 - ID: 8 Sending Access-Accept of id 8 to 10.10.2.35 port 21645 Waking up in 1.7 seconds. Cleaning up request 1 ID 8 with timestamp +17 Ready to process requests. This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

2 2

WARNING! No "known good" password found for the user
by Martin Silvero 18 Sep '08

18 Sep '08

Is what we mean is that access point is wrong? Is this bad set? Is this bad or configured in the notebook user?

2 1

WARNING! No "known good" password found for the user
by Martin Silvero 18 Sep '08

18 Sep '08

Hello comrades again. I have been presented the following problem and by what I see is a user problem, teachme if I am wrong. The theme is already created certificates and installed on the user as I read in the howto but does not connect to the network. I put all passwords equally by the doubts, which can be wrong? This is the error log: Ready to process requests. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=3, length=128 Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x59eaaf3452a4d4924059fd281add53cd EAP-Message = 0x0202000501 NAS-Port-Type = Wireless-802.11 NAS-Port = 261 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 2 length 5 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: UserIdentity Unknown rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Sending Access-Reject of id 3 to 10.0.31.40 port 1645 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 3 with timestamp +115 Ready to process requests.

2 1

Create EAP TLS with Windows CA
by JasonBrown＠ferris.edu 18 Sep '08

18 Sep '08

Has anyone created certificates for EAP through a Windows CA? Thanks Jason Brown Systems Administrator Enterprise Technology Services Ferris State University (231) 591-2687

3 2

Fedora 9 EAP issue
by Casartello, Thomas 18 Sep '08

18 Sep '08

I have two servers with identical configuration and identical versions of freeradius, one running Fedora 8, one running Fedora 9. The Fedora 8 one works issueless, however with Fedora 9 I simply cannot get PEAP authentication to work with it. I am constantly getting this debug output: rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 User-Name = "tcasartello" Calling-Station-Id = "00-13-02-08-C8-B2" Called-Station-Id = "00-1F-9D-DB-94-40:s-wsc" NAS-Port = 29 NAS-IP-Address = 172.20.5.252 NAS-Identifier = "Chaplin_Controller_A" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "191" EAP-Message = 0x020100100174636173617274656c6c6f Message-Authenticator = 0x4079116973b9e650df19cf63def7d564 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tcasartello", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "tcasartello", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb276c10db274d82ffb970fb6bdf4b058 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 Sending duplicate reply to client chaplin-wism-a.wsc.ma.edu port 32769 - ID: 4 Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 Sending duplicate reply to client chaplin-wism-a.wsc.ma.edu port 32769 - ID: 4 Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 Waking up in 0.9 seconds. Cleaning up request 9 ID 4 with timestamp +377 Ready to process requests. Any suggestions on what I can do to try to debug this further? This happens on every version of FreeRADIUS I try so I have a feeling it's not directly a problem with freeradius perhaps some library broken or missing in Fedora 9. As I said in my fedora 8 box I have an identical configuration that works flawlessly. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

5 11

Download/use luser error
by Alex Moen 18 Sep '08

18 Sep '08

Hey all, I am having a problem connecting to a Cisco 10k. Here's the user: user(a)wherever.com Password == "ctdn" Service-Type = Framed-User, Framed-Protocol = PPP, Context-Name = "wherever.com", Cisco-Account-Info = "Andtc_512", Cisco-AVPair = "ip:addr-pool=wherever", Cisco-AVPair = "ip:vrf-id=WHEREVER", Cisco-AVPair = "ip:ip-unnumbered=loopback 1", Cisco-AVPair = "subscriber:sg-service-type=primary" When I test this, I get the following: radtest user(a)wherever.com ctdn 127.0.0.1:1812 10 testing123 Sending Access-Request of id 183 to 127.0.0.1:1812 User-Name = "user(a)wherever.com" User-Password = "ctdn" NAS-IP-Address = server NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=183, length=92 Service-Type = Framed-User Framed-Protocol = PPP Context-Name = "wherever.com" Cisco-Account-Info = "Andtc_512" Cisco-AVPair = "ip:addr-pool=wherever" Note that I don't get the last 3 "Cisco-AVPair" options. OK, I am running Version 0.9.3... Big deal! It's been working great for years until the network guy decided to change to the Cisco 10k. Anticipating a flood of "Upgrade, stupid!" e-mails, I decided to upgrade, just to see if that would help. So I downloaded the latest and greatest, gunzipped it (even tried the bunzip version), but when I try to untar the file, I get "tar: directory checksum error"... The 10k guy says that he can use this user config in his Steel Belted Radius server (actually kinda funny, he's a 10k guy using Juniper software)... Am I just using the wrong syntax that SBR fixes automagically? Any ideas? TIA, Alex

3 2