September 2008 - Freeradius-Users - lists.freeradius.org

freeradius for windows + mssql problem
by rodolfor 30 Oct '08

30 Oct '08

Hi all. I have installed freeradius for windows (www.freeradius.net) and it works well. Now I want to connect the service to an mssql database in the same machine. The error I receive (starting in debug mode) is (using mssql.conf): rlm_sql (sql): Could not link driver rlm_sql_unixodbc: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[10]: sql: Module instantiation failed. Could someone help me ? thanks -- View this message in context: http://www.nabble.com/freeradius-for-windows-%2B-mssql-problem-tf3731743.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

rlm_unix cannot find users (2.1.0)
by Martin Pauly 28 Oct '08

28 Oct '08

Hi all, I am trying to upgrade from an ancient 1.0.5 to 2.1.0, and ran into trouble where I least expected it. Underneath is Debian Lenny system run as Linux vserver. I have a large set of users handled by LDAP, and a small group (admins with only a few logins) that I used to handle by setting up a bunch of local unix accounts and doing Auth-Type := System. So my users file looks like pauly Auth-Type := System, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Matched local user entry %{User-Name} in users file", [ more local accounts ...] DEFAULT Auth-Type := Reject, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Illegal username %{User-Name} for this type of request" DEFAULT User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry with User-Name %{User-Name}" In sites-available/default, I have 'unix' in both the authorize and authenticate section. The debug output upon a request reads: rad_recv: Access-Request packet from host 192.168.x.y port 1645, id=204, length=77 NAS-IP-Address = 192.168.x.y NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "pauly" Calling-Station-Id = "our-special-id" User-Password = "xxxxxx" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "pauly", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{Calling-Station-Id} -> our-special-id [files] users: Matched entry pauly at line 17 expand: Matched local user entry %{User-Name} in users file -> Matched local user entry pauly in users file ++[files] returns ok [ the whole thing is sent to LDAP for authorization now which succeeds, but could perhaps be avoided anyway] ++- entering policy redundant {...} [ldap stuff ...] [ldap2] user pauly authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap2] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> pauly attr_filter: Matched entry DEFAULT at line 11 So to me it looks like rlm_unix can't find me :-( I've read about rlm_passwd, but I don't need any caching or the like. Oh, and user freerad is in group shadow. But as I understand it, this is no longer relevant for my case since rlm_unix uses getpwent which is supposed to handle access to /etc/shadow, right? Thanks for any hint Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

wpa_supplicant(eapol_test) with freeradius: error coming in TLS
by Gaurav Kansal 21 Oct '08

21 Oct '08

Hi I am trying to use EAP-TLS between wpa_supplicant and freeradius. I created the certificates (ca/server/client) as mentioned in freeradius-server-2.0.5/raddb/certs/README. In freeradius-server-2.0.5/raddb/users, following line is added at end: testuser Cleartext-Password := "password" On wpa_supplicant-0.5.10, created eapol_test.conf.tls with following contents: network={ eap=TLS eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/testuser(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" } Executed wpa_supplicant (eapol_test) with following command (wpa_supplicant side logs are after radius logs at end): eapol_test -c eapol_test.conf.tls -a127.0.0.1 -p1812 -stesting123 -r1 On executing /usr/local/sbin/radiusd -X, I get following log and error too: rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=0, length=124 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000d017465737475736572 Message-Authenticator = 0x0e5f593f30507d677e8d7e68b072b55f +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 32770 EAP-Message = 0x01010016041017695d19037d705af68ca37a7262ddcb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x267673582677771a69809cb3876d58ea Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=1, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02010006030d State = 0x267673582677771a69809cb3876d58ea Message-Authenticator = 0x6dd1d34467725c79f19b72ff9612e3ce +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 32770 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735827747e1a69809cb3876d58ea Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=2, length=236 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202006b0d0016030100600100005c03014874ff7ae4659071f23a8aac506f1f25b7c9f1272eca 77a38aaea1b9788b532d00003400390038003500160013000a00330032002f006600050004006300 62006100150012000900650064006000140011000800060003020100 State = 0x2676735827747e1a69809cb3876d58ea Message-Authenticator = 0x1a18c152c7a7d0032d7876c2e02214d3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 107 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0060], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a7], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 32770 EAP-Message = 0x010304000dc000000b70160301004a0200004603014874ff7af840e0ce0c0562387841cbf363e6 be64f8dd2def0915579fb271a7d320bc89e200ccdb1ad9ae9498442013c69878623fb1e470357891 b9df6651cbf029003901160301085e0b00085a0008570003a6308203a23082028aa0030201020201 01300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d06035504 0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c 4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d70 6c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d303830 3730393138313131375a170d3039303730393138313131375a307c310b3009060355040613024652 310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e 312330210603550403131a4578616d706c6520536572766572204365727469666963617465312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a 864886f70d01010105000382010f003082010a0282010100c296eb2d169b654435a174fd8ead1b26 d65b1298d9a7bcc561a051d2b667 EAP-Message = 0x28a6c693620ce3c06c032ebe4dbeedff9020f24d06430433091b7e9762575c12fdb988ad5d6dfe e570df9a0aa1ce55de2d308c162bbcf917c8441071ea895cfb102721f2a5059f402317457a104650 b4fea1975e04fb83fc4d0a2cf72167830d5281398c981ac2f27370a34aa49b07e007fa955ebf187a 8fd476174e7493ffa02bf466b07846382b4eaf03551fef5ca60ab3fc3aa19983aeb5015147ed3317 f659f0355a43091eb19ab0c4a8d07651627d1fad596cc5ee44fa2ccfcd92d6c63d778a9d958a6ca4 a02409c546d3b8400928e1b635c26ef5ab7fc54b68b8aa2e98b2830203010001a317301530130603 551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100095935837d63c395fca941ae947c03fa c66f843b37c9969c2f46cb8b26348bfbd6348ac0d13b6a752886f1e83579122942dd8d0ab6b27578 49735dccfd82d06d3a07d1a2de3097c76cbb431042062e26df240d5d40ada6bc999bade14ebc0661 362f9a7f8644943e78a29e329c67ec32cf393205408021e56e461ce3320127b27df474f4c37be7cc cf46754c32ee8243500a194759ba6c5b2fcd563117b2ea94b9c63eb1678ff836afd92118a98b93fc 51992e9de619a9c7576fe3cae6a1e9988a2b10b0685ca7e58e5b100ec0817d511f34f59f794bcde2 5c247259a57ab8b1d686fce7c7cd EAP-Message = 0x3f8d16472d4a3eb1ee492fd3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735824757e1a69809cb3876d58ea Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=3, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0x2676735824757e1a69809cb3876d58ea Message-Authenticator = 0x86f3e31b265162f7716d461a9aae98f2 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 32770 EAP-Message = 0x010404000dc000000b70bf312a81c68194ac03b073abf2410004ab308204a73082038fa0030201 02020900ac4ad85feeea230a300d06092a864886f70d0101050500308193310b3009060355040613 024652310f300d060355040813065261646975733112301006035504071309536f6d657768657265 31153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d0109011611 61646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479301e170d3038303730393138313131325a170d30383038 30383138313131325a308193310b EAP-Message = 0x3009060355040613024652310f300d060355040813065261646975733112301006035504071309 536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a86 4886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d 01010105000382010f003082010a0282010100ccff47e75ebf3d06a9472810c0352b254cca71cbb5 2cb8202d29ae967c715640e4d2b6c3e60641c4d54fdc03fe6ebdfb1953dc1b8c1f44202cf488249d 37f2b7902efdf546fabb283a9653 EAP-Message = 0xfa065f9b063843f36456ac437df7cefeaad4d44004939d63ae9c4df03f1b856d8340ab4e6317a1 11aecfd860639f0056069404c4d2f9f10e9048b10f4bd65dfe2a61470543b7b323895dfbb54053f8 4cb0417f5eafdf8aa236a2afea06047be624e1f7b85e757be3749e6946439ad4e85de0d4f66f35e1 a4ee8258727033035877b43232c0697a2baf3d09e8aa337366b1cbbccf72a509b977d426d546c7b1 65f873308f0a6964f430ee01b74cc0a561d9869fd84f0203010001a381fb3081f8301d0603551d0e 041604141c71c3ab8dbd86f36bbf4b24d5b72d291bc88aaf3081c80603551d230481c03081bd8014 1c71c3ab8dbd86f36bbf4b24d5b7 EAP-Message = 0x2d291bc88aafa18199a48196308193310b3009060355040613024652310f300d06035504081306 5261646975733112301006035504071309536f6d65776865726531153013060355040a130c457861 6d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e 636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72 697479820900ac4ad85feeea230a300c0603551d13040530030101ff300d06092a864886f70d0101 05050003820101005925971768cfc1bb8f4b1dd4b9d0abd84cca91dc19d344451da159ae0925f192 4022b20ea548d56947a26c987dc0 EAP-Message = 0xfb36d1078bef2f36de91d2b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735825727e1a69809cb3876d58ea Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=4, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0x2676735825727e1a69809cb3876d58ea Message-Authenticator = 0xd88cda63a2776910572007659978dff0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 32770 EAP-Message = 0x0105038e0d8000000b7083ce8bd2a2e5a3df721979638d83518a19e079bf804773b82753a039b6 b053a357acb9d1954ecb25330390d4d54583a6fdeb74f039f492238f8d93bdc53d3acc2366af2771 253c218dbc3a006b911f1e4bb6fd491b99ed05b1520cf14d08d12119b177f754cae89d065edb4868 0f35d8df3c0e7fcec9c6e84d52a1136f7a56a90f539addc1ad3c44e25de731f0443844dbfe83d043 2ad61f7ed89184a407e0b41a9ffbc0389637071d937e63e136311e467b914839fd7382c216734b1d e93368e4fb6b2303f4160301020d0c0002090080b3afe7fd33f61741e813a2a82d3e2e44f4e3a6cb a8ba274ff2a14cdee764e7ec4e45 EAP-Message = 0x4df9c4b18aa0bb45b4dcbe5022790ed79559ec10e6b017165192ca92ee664df49dd6de389d1eba 0400804b550239ffca80cdd27f3cc0ce1fc851463b672a8e260e415d3d3a40e8ae5102105bddc30b 8c1a3031af0bc0a78b4ea69f5e66630001020080a0cc4357af8865d129c3e7c20c4283e7a4a4c522 e23e0f3cb9b462c2923ea92c3a2781665e6d1fe4096f9832e39c33424106d2429f569da06ac67c9b 0800351a1b7c512cd541edf0a135330412dbccd37885e35ce75111476fe045e0a85c70abf40a3008 9c4d4302179e1f084bffe853b1845c99010515a1970a03a87449615a010060149cd09ea980ec82c5 5cfe09857dbb7c5811f45c64e0fe EAP-Message = 0x9d59d03e704806e99f1cb29f0286c1015c81d7824e617a53bd69dacefe51425fec76315ad4861b 81d8aff93491a3b7a18988a9a9ee16acba071272b143c7bb8106d29ac8e6087a066498b3f47cf216 fb2a96f19d7ccd8459646ed27ce02852c2c402000778e68ec419b9f14059fea1eaaad700a5c1d71f 8ba516d820a6b0520e9a808736de80b97588f6b72b6b405b1f8a5a8779e01cd882c352aabb41e4a6 0fd2e4c64382e2a12deb09e8fb2caaa26a86aec4606044a283b9d20b0bf2637a953e8716d0b90958 aebeb9995898714edb927fb52e51c4a1a2ff1157ae26402265dbbbb03f99e23f2416030100a70d00 009f040304010200980096308193 EAP-Message = 0x310b3009060355040613024652310f300d06035504081306526164697573311230100603550407 1309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e0609 2a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d45 78616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735822737e1a69809cb3876d58ea Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=5, length=1532 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020505710d0016030103950b00039100038e00038b308203873082026fa003020102020102300d 06092a864886f70d0101040500307c310b3009060355040613024652310f300d0603550408130652 616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a45 78616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901 161161646d696e406578616d706c652e636f6d301e170d3038303730393138313132345a170d3039 303730393138313132345a3079310b3009060355040613024652310f300d06035504081306526164 69757331153013060355040a130c EAP-Message = 0x4578616d706c6520496e632e311d301b060355040314147465737475736572406578616d706c65 2e636f6d3123302106092a864886f70d01090116147465737475736572406578616d706c652e636f 6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b510efbf58ad 201585beac3f327bba71b761612df254a3e44ffe4f5a182852e2a64d11912ca27013be01dae059ef 3d8a9b2ca7a81c9da01b2291b6e38f07339c7668c6b7ce6c936bef181c33c16d5c34e17b0c878648 bb73199645bb81febb577aff69f4881080ea593f31b5efcccebd3772dda5666a5e139a38e89b9ca1 3712462098dbfc5c526253985609 EAP-Message = 0x583e54d9d74b9b263cda9647c523d9922c1992736d176c3b869b373a9824a8c046dfd49118a90d 5c8e9504cae9209d8254c31f98c3979a307f0515e88e820c29c9092c0de6c9af76c9a1bc8eee37ae a8d047bf8c1af257f42b550932995e5083364a7e185a62de08976e2ca45d334231109eeaf7020301 0001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104 0500038201010085cf673c6dd1deb8648e0589573c0e55e286ba9f3ef23a3882fbe024a5c54aeef5 10e96f36291f0172deb8bcf2b8ce9e6517a143c658e8fb24c80a7936138c5e6f7dda3ca8b33e4600 a1cb92c2f079793304c0ddc296c4 EAP-Message = 0x015d6d73cdae8f32eea68667d9cf33a6ad8c5e38a0ffbda541b5b789ffd0cd2b4de23592384ee2 3e154ea629f1a3743fcba443f8e6d355411d310f787d6551c413af2eccfabc2b28e9e786fd78cb32 50a0ca2cd0adf11d8045d03ea0cca6b28d5c498c0965a238b05ccf7cadc3946ee0c42d65594ca337 8ecd205c74b42b5f9c060287639e4cf76f5003ec0d3723abd391f4693556553f5aaac2684a2bb808 e2a2cf16b425c9736e1c16030100861000008200803d7d38a765634fe46cd97911bbb0826fd6bb31 7dc04dbb7ca60c2d352f4a9be2f147f261ccf2d7c5e05b85783810260ddaed3c3772fcceab264dd8 daf8a4467e6a6729a7152dabe5a4 EAP-Message = 0x4c2375c148a15096de5c28842d80507318656b36edc71772326fd6fddbc6dbb9d5476332d561de 95d1a40b59779113ada15e6b466977eb16030101060f00010201003fcdbdf9a53a3f14ce87dbc345 68e1cc53d78b24457c12a7be38fc6e07932f6a253fc07cf73579bc7dbb98eeaf91076ba912ff6fe2 f6bfc1d2803974757922cd8fa5142f870aae126053adf7b4c7456bb431a174446775b7e9f78fcfb0 925edee9a12cf5a76fc6ef7fdf983adeb3ec234d89af9e7298602df31a4febaa1c9aa039c3142ec5 7416c3771b1ae8934b1444dda9e28b932ae8ff1a22aae98ceb9f2d7a9caac9efb16c01a4cd3dadda 86513428a3bd3a11b262eaa750dc EAP-Message = 0xd50749f461997927394171b785ff74c98d883674fc8035287993a279f1ffa72b9c4cbc6b96fcaa d6e5daaca7bd9aca988c6a8b3c487bd1e5cc73dd3c3c59f8ec39549ebeb614030100010116030100 30f1c1d6ee34104fca2869c989529493079d85690315b83299b5d9567823fea467b507af2267dd69 305c7d35d7809adf12 State = 0x2676735822737e1a69809cb3876d58ea Message-Authenticator = 0xcc6ace4662072c78666cb7d873d7a354 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0395], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 5 to 127.0.0.1 port 32770 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Waking up in 4.4 seconds. Cleaning up request 0 ID 0 with timestamp +4 Cleaning up request 1 ID 1 with timestamp +4 Cleaning up request 2 ID 2 with timestamp +4 Cleaning up request 3 ID 3 with timestamp +4 Waking up in 0.1 seconds. Cleaning up request 4 ID 4 with timestamp +4 Waking up in 0.2 seconds. Cleaning up request 5 ID 5 with timestamp +5 Ready to process requests. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ wpa_supplicant logs (copying only FAILURE logs seen at end) ++++++++++++++++++++++++++++++++++++++++++++++++++++++ EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=5 length=44 Attribute 79 (EAP-Message) length=6 Value: 04 05 00 04 Attribute 80 (Message-Authenticator) length=18 Value: 7a 61 25 5b 8e cd 44 3b 18 b1 af e3 82 fd 32 5d STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=5 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 2 FAILURE Regards, Gaurav Kansal

3 5

data volume
by mike 16 Oct '08

16 Oct '08

hi how can i reject a user if his datavolume is reached? (some attribute in radreplay?) all users are stored in mysql.

4 3

Dynamic Clients with FreeRADIUS
by jasoneswan 07 Oct '08

07 Oct '08

Has anyone gotten dynamic-clients working with freeradius yet? I'm trying to accept clients from ANY IP, then looks up the IP in sql 'nas' table to see if it exists -- View this message in context: http://www.nabble.com/Dynamic-Clients-with-FreeRADIUS-tp19384912p19384912.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 11

eap ttls certificate config
by Jehan PROCACCIA 02 Oct '08

02 Oct '08

hello, I try to configure my freeradius-2.0.3-3.el5 to read our certicate chain with no success :-( . neither CA_file or CA_path directives works as expected in eap.conf . here's my config: /etc/raddb/eap.conf tls { certdir = ${confdir}/certs cadir = ${confdir}/certs/CA private_key_password = secret private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem certificate_file = ${certdir}/radiux-pkiit-2008.pem CA_file = ${certdir}/pki-chain.pem #CA_path = ${cadir}/ pki-chain.pem contain the concatenation of our 3 level pki hierarchy ( cat itClass1.crt > pki-chain.pem ; cat itClass2.crt >> pki-chain.pem ; cat itClass3.crt >> pki-chain.pem ) itClass1.crt is self-signed, it signed class2 , then class2 signed class3 CA and finnaly class3 signed radiux-pkiit-2008.pem SSL server . Then, how can I tell freeradius to load that pki-chain.pem ? setting it in CA_file doesn't seem to work, as clients with itClass1.crt loaded cannot negociate TLS handshake with the freeradius server :-( Using the CA_path directive with a certs/CA directory containing the 3 classes certificate in PEM format + a hash on them , generate a segmentation fault on the start of radiusd :-( . is CA_path deprecated ? how should the certificate and hash in that CA_path should be presented ? I heard about C_rehash but cannot find it. Please let me know how to tell radiusd/eap to load my self signed 3 level hierarchy pki . Thanks.

4 9

Logging level
by Arrigo Savio 02 Oct '08

02 Oct '08

Hi everybody. I installed Freeradius 2.1.0 on a Fedora 9 server. I'm trying to understand if is it possible to set the logging level in radius.log log file. Where can I set up a "radius -X like" level also in radius.log file? Is it eventually possible to change this level "on the fly"? I mean without restarting the whole radius process.... Thanks,Arryxyz

2 6

MySQL tables for 2.1.1
by Karl Auer 02 Oct '08

02 Oct '08

Hi all. This is the third of my three questions. The second one solved itself (I read the docs - again). 2.1.1 is installed and running it as root, with the user "radius" and the group "radius" have been specified as the user and group in radiusd.conf. I've had to fix permissions on about ten files - various files in /usr/local/etc/raddb needed to be made readable by the "radius" group, and I had to set up and set permissions on the logging directory. That's just what I've found so far. Is this an indication that I did the install incorrectly? Or do most people run the server as root, so these problems do not arise? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 1

Please Remove
by Tyler Willson 30 Sep '08

30 Sep '08

Thanks! -----Original Message----- From: freeradius-users-bounces+tweetywill=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tweetywill=gmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Tuesday, September 30, 2008 2:31 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 41, Issue 141 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: freeradius compiled version (lastest) against active directory authentication (Alan DeKok) 2. Re: freeradius compiled version (lastest) against active directoryauthentication (tnt(a)kalik.net) 3. Missing field in accounting (Arrigo Savio) 4. R: R: Logging level (Arrigo Savio) 5. Re: R: R: Logging level (Alan DeKok) 6. Re: Missing field in accounting (Alan DeKok) 7. Re: problem with ip_pools (Marco C. Coelho) 8. Re: Where do I add the config stuff to route requests based on attributes in a request? (Arran Cudbard-Bell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Sep 2008 17:31:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: freeradius compiled version (lastest) against active directory authentication To: luis.azunet(a)yahoo.es, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E24667.7020006(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 luis a wrote: > i all ready read it and he does not work Nonsense. If you follow the instructions, it works. > check it out the output You've edited the configuration files, and broken them. Don't do that. Start off with the default configuration files. THEN follow the instructions. > that warning apered after i added the line to the user config file > DEFAULT Auth-Type = Local, Password == "stealme" The instructions on my web site DON'T say to do that. So you're not following the instructions. > and also when i remplace > DEFAULT Auth-Type = System Can you explain why you're making nearly random changes to the configuration files rather than following the instructions on the web site? Alan DeKok. ------------------------------ Message: 2 Date: Tue, 30 Sep 2008 16:47:30 +0100 From: <tnt(a)kalik.net> Subject: Re: freeradius compiled version (lastest) against active directoryauthentication To: freeradius-users(a)lists.freeradius.org Message-ID: <w7MzM4fw.1222789650.5079860.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 > Have you tried my web site (deployingradius.com) ? It has a >"howto" >for configuring authentication against Active Directory. > >i all ready read it and he does not work > > >check it out the output > >------------------------------------ > > >Listening on authentication address * port 1812 Listening on accounting >address * port 1813 Listening on proxy address * port 1814 Ready to >process requests. >rad_recv: Access-Request packet from host 127.0.0.1 port 49964, id=37, length=72 > User-Name = "luis" > User-Password = "x" > NAS-IP-Address = xx.xx.xx.x > NAS-Port = 0 This is a pap request. ntlm_auth is configured in mschap. Send an mschap request. Or configure ldap "bind as user" if you are going to have pap requests. > > > >------------------- >and also when i remplace >DEFAULT Auth-Type = System > >i get this message . > .. >Found Auth-Type = System >+- entering group authenticate {...} >[unix] invalid password "luis" >++[unix] returns reject >Failed to authenticate the user. That is OK. user "luis" was found but password was wrong. But it looks like (I still can't figure out what is it that you want to do) you don't actually want to authenticate against local users but AD. So what do you want to do: - authenticate against AD? - or against users of the local system? - or both? What type of requests are you going to recieve: - pap? - mschap (PEAP)? - both? Ivan Kalik Kalik Informatika ISP Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Tue, 30 Sep 2008 18:04:42 +0200 From: "Arrigo Savio" <a.savio(a)bascom.it> Subject: Missing field in accounting To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <F978D341FFB841D7837CAA87CFA6F62B(a)bascom.local> Content-Type: text/plain; charset="us-ascii" Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. I have the following problem: When the data flow passes from authentication to accounting, I miss the stripping of the username/realm. I mean: in first authentication step, I have correctly splitted the username (test) from the realm (realm.com) and infact the "INSERT INTO radpostauth" is correctly populated. The next query, that should write into accounting table, doesn't find %{Stripped-User-Name} and %{Realm} values, so that it put empty fields in the table. All other fields are correct. BTW, if I put in dialer.conf accounting query the field %{SQL-User-Name}, I find the field populated with the whole username (test(a)realm.com, in the example below). Can you help me, please? Arrigo [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' . ++[sql] returns ok Login OK: [prova(a)realm.com/realm] (from client C831 Test port 92) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] expand: %t -> Tue Sep 30 17:53:01 2008 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' [sql] expand: %{User-Password} -> realm [sql] expand: INSERT INTO radpostauth (username, realm, pass, reply, authdate) VALUES ( '%{Stripped-User-Name}', '%{Realm}', '%{%{User- ... ++[sql] returns ok +- entering group preacct {...} [acct_unique] Hashing 'NAS-Port = 92,Client-IP-Address = 10.0.1.224,NAS-IP-Address = 10.0.1.224,Acct-Session-Id = "000000D8",User-Name = "prova(a)realm.com"' [acct_unique] Acct-Unique-Session-ID = "1bdfdc3b2335277d". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] expand: %t -> Tue Sep 30 17:53:01 2008 ++[detail] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Stripped-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Arrigo ------------------------------ Message: 4 Date: Tue, 30 Sep 2008 18:07:32 +0200 From: "Arrigo Savio" <a.savio(a)bascom.it> Subject: R: R: Logging level To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <72251FE17275403EAF292FA4A42F8AAC(a)bascom.local> Content-Type: text/plain; charset="iso-8859-1" I read all comments, and tried to give some permission on the files, but I still receive the error pasted... I read in docs that: # If not set, then ANYONE can connect to the control socket, # and have complete control over the server. This is likely # not what you want. I tried to comment out the parameters, but it doesn't work anyway. Arrigo. -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it(a)lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di Alan DeKok Inviato: marted? 30 settembre 2008 8.43 A: FreeRadius users mailing list Oggetto: Re: R: Logging level Arrigo Savio wrote: > radmin> set > ERROR: You do not have write permission. > > Where can I specify this permission? Read the example configuration file in raddb/sites-available/control-socket. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 5 Date: Tue, 30 Sep 2008 18:15:39 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: R: R: Logging level To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E250AB.607(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arrigo Savio wrote: > I read all comments, and tried to give some permission on the files, > but I still receive the error pasted... > I read in docs that: > # If not set, then ANYONE can connect to the control socket, > # and have complete control over the server. This is likely > # not what you want. > I tried to comment out the parameters, but it doesn't work anyway. Did you see the "access_mode" parameter? Are you sure you're using 2.1.1? Are you sure you're looking at the configuration files that are included in 2.1.1? Alan DeKok. ------------------------------ Message: 6 Date: Tue, 30 Sep 2008 18:18:12 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Missing field in accounting To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E25144.2000209(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arrigo Savio wrote: > Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. > I have the following problem: > When the data flow passes from authentication to accounting, I miss > the stripping of the username/realm. You need to copy the *same* User-Name re-writing rules from the "authorize" section into the "preacct" section. I mean: in first authentication step, I > have correctly splitted the username (test) from the realm (realm.com) > and infact the "INSERT INTO radpostauth" is correctly populated. > The next query, There is no "next query". There is another packet, which is an *accounting* packet, and not an *authentication* packet. Alan DeKok. ------------------------------ Message: 7 Date: Tue, 30 Sep 2008 12:35:11 -0500 From: "Marco C. Coelho" <maillist1(a)argontech.net> Subject: Re: problem with ip_pools To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E2634F.7010602(a)argontech.net> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Please See Below: Alan DeKok wrote: > Marco C. Coelho wrote: > >> I ran out of IP space in my original IP_Pool, and since the next >> available addresses were non contiguous, I added a second pool. >> Here's the snippet of my radiusd.conf: >> > > Did you add "main_pool2" to the "post-auth" && accounting sections > where "main_pool" was referenced? > No. After I added it and corrected the operand to := it now issues the new addresses. Thanks! > Did you put "main_pool" and "main_pool" into a fail-over section, as > documented in "man unlang" ? > No, and I must be blind, because I have read the section and cannot find mention of it. > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

Where do I add the config stuff to route requests based on attributes in a request?
by Peter Eriksson 30 Sep '08

30 Sep '08

Setup: WLAN Access Points providing multiple SSIDs for access to different VLANs. They talk to RADIUS server that should forward the requests to different other RADIUS servers based on which WLAN the clients are connecting to. SSID 'eduroam' should forward requests to the EDUROAM RADIUS server. SSID 'IFM' should forward requests to our internal RADIUS server. I'd see that in the incoming RADIUS request from the access points there is a Called-Station-Id that I'd like to use for this purpose. Now the question is - what do I write and in which config files to use this? The attribute typically looks like this: Called-Station-Id = "00-17-9A-D3-9A-BA:IFM" or Called-Station-Id = "00-17-9A-D1-67-CE:eduroam" (Access Points ethernet address, colon, and then the SSID). - Peter

4 3