September 2008 - Freeradius-Users - lists.freeradius.org

FreeRadius2 + MySQL: NAS x Usergroup
by Carlos Eduardo Tavares Terra 12 Sep '08

12 Sep '08

Dear freeradius users, I have a special scenario. Today I have many freeradius servers, each one responsible for differente services. Now I want to group this freeradius servers into one master server, but I have users in many differente usergroups (one for each service). How can I associate an usergroup to a nas? Example: NAS (192.168.2.1) -> Usergroup (Dialup) NAS (192.168.2.2) -> Usergroup (Broadband) NAS (192.168.2.3) -> Usergroup (Hotspot) I saw how to do this using huntgroups, but I want to use a mysql database with all clients. There are another ways to implement this different services into one radius server, maybe the right way? If not, how can I associate the usergroups and nas using mysql? Thank you -- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org] Slackware Linux

4 6

Logging problem
by Norbert Wegener 12 Sep '08

12 Sep '08

Hello Alan, I want logging information, if a client shows up with an expired certificate. Therefor in authorize I have: ... eap if ( invalid ) { update reply { Tmp-String-5="INVALID Certificate" } } .... in post-auth : .. Post-Auth-Type REJECT { sql_log } and in modules/sql_log: Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES \ ('%{User-Name}', '%{User-Password}', \ '%{reply:Packet-Type}', '%S', '%{NAS-Identifier}','%{Client-IP-Address}','${RADIP}',\ '%{Port-Message}','%{NAS-Port-Id}','%{reply:Tmp-String-5}','%{Calling-Station-Id}');" When a client shows up with an expired certificate I would expect to see the message "INVALID Certificate". ..... Here is what I get with 2.1.0: [tls] >>> TLS 1.0 Alert [length 0002], fatal certificate_expired TLS Alert write:fatal:certificate expired TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server cisco Using Post-Auth-Type Reject +- entering group REJECT {...} [sql_log] Processing sql_log_postauth expand: %{User-Name} -> HOST/osd02red.ww901.mycompany.net expand: %{%{User-Name}:-DEFAULT} -> HOST/osd02red.ww901.mycompany.net [sql_log] sql_set_user escaped user --> 'HOST/osd02red.ww901.mycompany.net' expand: INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES ('%{User-Name}', '%{User-Password}', '%{reply:Packet-Type}', '%S', '%{NAS-Identifier}','%{Client-IP-Address}','1.2.3.4', '%{Port-Message}','%{NAS-Port-Id}','%{reply:Tmp-String-5}','%{Calling-Station-Id}'); -> INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES ('HOST/osd02red.ww901.mycompany.net', '', 'Access-Reject', '2008-09-12 09:58:09', '','123.246.185.169','1.2.3.4', '','','','00-00-00-00-00-02'); It seems, "if (invalid) " is not entered and I don't see why. Norbert Wegener

2 4

Failed to link EAP-Type/tls: rlm_eap_tls.so - Need Help
by niel m 11 Sep '08

11 Sep '08

Hello Sir/Madam, Good Evening I have a problem with my Radius server with LDAP Authentication support. Below are some logs; ==================================================================== // when i run "freeradius -X" for test run of freeradius rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. ==================================================================== // this is the acutal logs that i got during the execution of this command "/etc/init.d/freeradius start" in a separate terminal window Thu Sep 11 06:14:12 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Sep 11 06:14:12 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Sep 11 06:14:12 2008 : Error: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[10]: eap: Module instantiation failed. Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[1962] Unknown module "eap". Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[1909] Failed to parse authenticate section. ==================================================================== I will highly appreciate any help that you can give. Thanks, Niel

3 3

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

TNT perfect!! thank colleagues for their help, and we want to try it in my next doubt! thanks!

1 0

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

already achieved what !!!!!!!!!, restart the service, I started from scratch, cree certificates again. said the error was like your ..... was the password, which is in eap.conf Now I have a doubt .... AT THE howto tls two files that need to install the computer user is "root.der" and "cert-clt.p12" but in the folder cert/ have client's certificate but not the root.der ... Does the latest version which would file.der replacing root.der? thanks!!

2 1

logging unknown clients
by Greg Woods 11 Sep '08

11 Sep '08

Is there any way to get the freeradius 2.1 server to log requests coming from unknown clients? As far as I can tell, these are just silently discarded. I have read through all the comments on the log section in radiusd.conf but I don't see anything about this. Is there anywhere else where the logging capabilities are more fully documented that I just haven't been able to find? Thanks, --Greg

3 2

kick the frozen session
by Przemysław Backiel 11 Sep '08

11 Sep '08

hey, I have freeradius-1.1.0-6.amd64 connected with rp-pppoe-server and now I have one frozen session how Can I drop this session from Freeradius? I have of cors username of that frozen user :) -- Z powazaniem Przemyslaw Backiel

2 3

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

I wrote the documentation as redundancy, forgiveness if disturbed. What can be wrong password CA file? I got one at random, should be like any other? thanks!! -- -- Silvero Martin

1 0

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

the truth is that follow in the footsteps of the file certs / readme I looked at the howto -> http://freeradius.org/doc/EAPTLS.pdf and says nothing of the buildup of certificates. I follow these steps: README *********************************************************************************************** This directory contains scripts to create the server certificates. To make a set of default (i.e. test) certificates, simply type: $ ./bootstrap The "openssl" command will be run against the sample configuration files included here, and will make a self-signed certificate authority (i.e. root CA), and a server certificate. This "root CA" should be installed on any client machine needing to do EAP-TLS, PEAP, or EAP-TTLS. The Microsoft "XP Extensions" will be automatically included in the server certificate. Without those extensions Windows clients will refuse to authenticate to FreeRADIUS. In general, you should use self-signed certificates for 802.1x (EAP) authentication. When you list root CAs from other organizations in the "CA_file", you permit them to masquerade as you, to authenticate your users, and to issue client certificates for EAP-TLS. If FreeRADIUS was configured to use OpenSSL, then simply starting the server in root in debugging mode should also create test certificates, i.e.: $ radiusd -X That will cause the EAP-TLS module to run the "bootstrap" script in this directory. The script will be executed only once, the first time the server has been installed on a particular machine. This bootstrap script SHOULD be run on installation of any pre-built binary package for your OS. In any case, the script will ensure that it is not run twice, and that it does not over-write any existing certificates. If you already have CA and server certificates, rename (or delete) this directory, and create a new "certs" directory containing your certificates. Note that the "make install" command will NOT over-write your existing "raddb/certs" directory, which means that the "bootstrap" command will not be run. NEW INSTALLATIONS OF FREERADIUS We suggest that new installations use the test certificates for initial tests, and then create real certificates to use for normal user authentication. See the instructions below for how to create the various certificates. The old test certificates can be deleted by running the following command: $ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* Then, follow the instructions below for creating real certificates. Once the final certificates have been created, you can delete the "bootstrap" command from this directory, and delete the "make_cert_command" configuration from the "tls" sub-section of eap.conf. If you do not want to enable EAP-TLS, PEAP, or EAP-TTLS, then delete the relevant sub-sections from the "eap.conf" file. MAKING A ROOT CERTIFICATE $ vi ca.cnf Edit the "input_password" and "output_password" fields to be the password for the CA certificate. Edit the [certificate_authority] section to have the correct values for your country, state, etc. $ make ca.pem This step creates the CA certificate. $ make ca.der This step creates the DER format of the self-signed certificate, which is can be imported into Windows. MAKING A SERVER CERTIFICATE $ vi server.cnf Edit the "input_password" and "output_password" fields to be the password for the server certificate. Edit the [server] section to have the correct values for your country, state, etc. Be sure that the commonName field here is different from the commonName for the CA certificate. $ make server.pem This step creates the server certificate. If you have an existing certificate authority, and wish to create a certificate signing request for the server certificate, edit server.cnf as above, and type the following command. $ make server.csr You will have to ensure that the certificate contains the XP extensions needed by Microsoft clients. MAKING A CLIENT CERTIFICATE Client certificates are used by EAP-TLS, and optionally by EAP-TTLS and PEAP. The following steps outline how to create a client certificate that is signed by the server certificate created above. You will have to have the password for the server certificate in the "input_password" and "output_password" fields of the server.cnf file. $ vi client.cnf Edit the "input_password" and "output_password" fields to be the password for the client certificate. You will have to give these passwords to the end user who will be using the certificates. Edit the [client] section to have the correct values for your country, state, etc. Be sure that the commonName field here is the User-Name that will be used for logins! $ make client.pem The users certificate will be in "commonName.pem", i.e. "user(a)example.com.pem". To create another client certificate, just repeat the steps for making a client certificate, being sure to enter a different login name for "commonName", and a different password. PERFORMANCE EAP performance for EAP-TLS, TTLS, and PEAP is dominated by SSL calculations. That is, a normal system can handle PAP authentication at a rate of 10k packets/s. However, SSL involves RSA calculations, which are very expensive. To benchmark your system, do: $ openssl speed rsa or $ openssl speed rsa2048 to test 2048 bit keys. A 1GHz system will likely do 30 calculations/s. A 2Ghz system may do 50 calculations/s, or more. That number is also the number of authentications/s that can be done for EAP-TLS (or TTLS, or PEAP). *************************************************************************************************** What is the password that this wrong? thank you!! -- --

2 1

How To Install Freeradius with LDAP - Need Help
by niel m 11 Sep '08

11 Sep '08

Hello Sir/Madam, Good Evening Im niel, I was researching about this topic Freeradius with LDAP support for authentication. I am very pressured because i want to implement such as this one using my AP in the office. If anyone can help me with this problem. Either some of below; - URL of a web that states step-by-step procedure on how to implement such system - or giving me some personal advice. I appreciate any help I can get to solve this system Thanks, Niel

2 1