December 2009 - Freeradius-Users - lists.freeradius.org

rlm_sqlippool allocating duplicate IPs
by Phil Mayers 03 Dec '09

03 Dec '09

All, I've just become aware of a rather annoying problem with our PPTP VPN server. Sometimes, a client will connect, disconnect and reconnect in quick succession. In these circumstances, there seems to be a window which an IP can remain allocated to a live VPN session, but is marked as free in the SQL table, causing subsequent clients to connect, be allocated the IP, and fail to get any connectivity. Unfortunately at this time I don't have a debug trace or even detail logs of the accounting traffic for an instance of this, but I was wondering if anyone had seen something similar. We're running FreeRadius 2.1.4 on RHEL5 against a postgres 8.3 database. I am wondering if I've got a logic error in my sqlippool queries; however, they're the stock ones for postgres that come with the distribution with two additions: 1. Any time a row is updated, two extra columns are added to the update: updatedby = '%{localopts.server}', updatedat = now() 2. I've made the WHERE clause on the stop-clear and alive-update more specific, changing it from: WHERE nasipaddress = '%{NAS-IP-Address}' \ AND pool_key = '${pool-key}'" ...to: WHERE nasipaddress = '%{Nas-IP-Address}' \ AND pool_key = '${pool-key}' \ AND username = '%{SQL-User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" Obviously the stock queries will try to allocate the same IP to subsequent connections for the same username, which is good and desired for us, but in this case it seems to be somehow allocating the IP, allocating the *same* IP to the 2nd connection, then marking it as unused when the first, short-lived client dies (and the accounting stop presumably comes in late) I can't see how this is happening, since the postgres module has proper transaction support and rlm_sqlippool issues the "START TRANSACTION" queries around every allocate/update/free query, unless it's the postgres isolation level being wrong - in which case I'd expect others to see it. Yours, baffled...

2 5

Microsoft: Certificate Authentication
by Fernando Calvelo Vazquez 03 Dec '09

03 Dec '09

I'm a newbie, and I'm trying to configure a simple EAP-TLS autententication by using client certificates. I have follow different procedures that I have found on the web to do that, but no successful currently http://wiki.freeradius.org/WPA_HOWTO#HOWTO_Do_It:_An_Outline http://www.linuxjournal.com/node/8151/print1 I have 2 questions: - 1st... How I should read the output log? I see something like different attempts by using different methods, but I don't know if they are correlated between them. - 2nd... What is wrong in my configuration? I can not distinguish, at the moment, which is the entry at logs that I should focus. This is the full output log of my attempt. -------------------------------------------------- rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=243, length=164 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020200090175736572 Message-Authenticator = 0xfba02c8ac6cde8bd5e9cc9c8802e9b93 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 243 to 160.103.180.252 port 32769 EAP-Message = 0x01030016041079a3e325aa029e8ab2ff01846230544a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4846a7ba4845a389971edb0de589acf4 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=244, length=179 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x02030006030d State = 0x4846a7ba4845a389971edb0de589acf4 Message-Authenticator = 0x37a434abc65138138fd4796c6e762cc2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 244 to 160.103.180.252 port 32769 EAP-Message = 0x010400060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4846a7ba4942aa89971edb0de589acf4 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=245, length=288 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020400730d800000006916030100640100006003014b1670b85bd6ec60f746bf7a25503e108c5e77945815b72de35f874617cd6a63000018002f00350005000ac009c00ac013c01400320038001300040100001f00000009000700000475736572000a00080006001700180019000b00020100 State = 0x4846a7ba4942aa89971edb0de589acf4 Message-Authenticator = 0x59ee0b77dde94d67dcf75a8acfd955e9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 115 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 105 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0064], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 082d], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 009b], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 245 to 160.103.180.252 port 32769 EAP-Message = 0x010504000dc000000901160301002a0200002603014b1670b8b8cc1d715d848ee2743ba05da48da5fc7a1e2a8a80dba3c240f6d13300002f00160301082d0b0008290008260003933082038f30820277a003020102020105300d06092a864886f70d0101040500308189310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a1304455352463120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d303931323032 EAP-Message = 0x3133323134345a170d3130313230323133323134345a3073310b3009060355040613024652310e300c060355040813054973657265310d300b060355040a130445535246312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e4a3599d55dfed32bb2dd97edb7febd830ce39f41874d0e5f74b02585faf7ff9f45052dd354b8ef114ddb63b67f470f8192ede48e9c3c437f880bd3a5d089f57891e58e73acae452c5949dff5412b4f11e EAP-Message = 0x11c6d4b61a8104ee317e1fd4b1d241f76a6ecb1b26f0a1018bdadc4f176fdfc66dd1f5c4f56f8e48d11662f907db5ad6cceb705ad435fe7a3c3e70486c73430c4c193f6738250000b10de634552ff3f0d54207d4fd9f0192fec213ec4854bc46febdcad27abc72c72e45415d558fc8643a6a49c4b5aef0593cf62edb551cc9b1d53aca3694c3ffbf23659967eddb44828020893ffa2c06c38bbf598efb81c42456936e91e09c701c39b054be846e710203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100b66737e13bf16a7366c344dc8b550ebe9774944d5030c68b708ec435 EAP-Message = 0x5fff762e9d2a02348589178c7783f3678cc10fbc3635f8156166c4e26842e3c9513df9acff0088f53f84042dc05b12732a9f91fe4731e01a7bb115d918144fa642b1395d91cfc5a4249c911875ea199ddc5dc9fc51fa5852c158e9ac39c2b26bf332504c2e63aa147adaa2a9c5e064b5644ce279811c2324836c5bceef65a350a54d72338630fe8e3527680f7b726248efc0046e01b73e7f239ceed69d8745026dba7e2eb4928da67f793e20107051069e8f8490250a4e5e26fff78a0fbee04a323dd70ba6d2a70197c5a1be93f007f9701428dab8f3ddd0335317ad61379282335cdc0b00048d3082048930820371a003020102020900c029cc32e98c EAP-Message = 0x0217300d06092a864886f70d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4846a7ba4a43aa89971edb0de589acf4 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=246, length=179 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020500060d00 State = 0x4846a7ba4a43aa89971edb0de589acf4 Message-Authenticator = 0x5133bbfe13db2695294ac87d88e0dc90 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 246 to 160.103.180.252 port 32769 EAP-Message = 0x010604000dc0000009010101050500308189310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a1304455352463120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039313230323133323134345a170d3130313230323133323134345a308189310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246 EAP-Message = 0x3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c42d37329909ff866c2ddd7493ae65d1195619adc00afcf3df4c8487a1149b846ed5f7ca57c07e8de91342bd39871ab92136939454c6510cfdc7f33790c170be30a40c97c7137aa15520cf6d37ef5f6bca12f8a0ad15c8413fda300399fe55b98b03e15b278e9139e288e1c253fee049b2f874a782e7dc018d1da6ef9ac2b836f55803e60d494e9e64c9bef5e531a6d7280a EAP-Message = 0x8035abfcaa54882ec8ba886f0b1f66636dbde3450dd5c2454f82cca89dc164cbd6244e8ce57b99bdd6ce61d600724c945bddbeb1aae178c8435b44f09b11ce77eb11336e9fdba425d0f6f2afa0da1fecb8967a85bcd97d0913a34c345f9808b514885c7ed884c90b9da18f929fef0203010001a381f13081ee301d0603551d0e04160414915d8065ec5af3fb19079647ad4a44563f8936323081be0603551d230481b63081b38014915d8065ec5af3fb19079647ad4a44563f893632a1818fa4818c308189310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b06035504 EAP-Message = 0x0a1304455352463120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900c029cc32e98c0217300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100bd49d4ca86009b4fcb6a7a2b282ec2df2c749d166d356141b4c1b5720ebf955c7eaf1acd37e6b4a6226eaa9b603905b81f9ff8e0a8c6be4de629e77c50b1e6cee78bfe7ea8510c5fc3f4a4251e4f08a49da2c13a2c07dec815df4ed33c7a84801f7b4b9af5af2319269cb95354048763d7eb5f5e8ccb1db6f5a3cbb186ce8f EAP-Message = 0x84e025c2599b56ae3f98b749 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4846a7ba4b40aa89971edb0de589acf4 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=247, length=179 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020600060d00 State = 0x4846a7ba4b40aa89971edb0de589acf4 Message-Authenticator = 0x2ed77d6f8362c5cde55db3be96604946 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 247 to 160.103.180.252 port 32769 EAP-Message = 0x0107011f0d80000009010c98a5d5cb4f8686ffab6198d77af42723db6e94a6d16de1d592da88d99db195084d59eceff6109ddcbfee6b34f5d1770916ce2eb4841a7f326652c0b3e249a1b259bc817dcf4e3a8e0696084952b478fd9dc31b4af2a68d856af8b32c211f13e21305938b4d1125eaf352e4beacfb702c3fcfef57160301009b0d000093020102008e008c308189310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a1304455352463120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355040313 EAP-Message = 0x1d4578616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4846a7ba4c41aa89971edb0de589acf4 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 160.103.180.252 port 32769, id=248, length=1660 User-Name = "user" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020705c50d80000005bb160301057b0b00036b0003680003653082036130820249a003020102020106300d06092a864886f70d01010405003073310b3009060355040613024652310e300c060355040813054973657265310d300b060355040a130445535246312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d301e170d3039313230323133323335385a170d3130313230323133323335385a305c310b3009060355040613024652310e300c060355040813054973657265310d300b060355040a130445535246310d EAP-Message = 0x300b0603550403130475736572311f301d06092a864886f70d010901161075736572406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201010097d42e7efd9d6d3779c7e8332bf95412f7b3f899adbc9a82c23bc1a5b042eb94644e7b0d2687cce6d5614d4b026e69e08d8fe4d3c74c393311e6b9a781306be331b51a31cdd983d7bdf9eb42876f2f399a103bc527457830dc5f19ec094c43aaebef0a0a3a98acacd4eec724c1dc9a412a88f0b2a61a138a715e41c9f38b54ade7bbd45a447afff20d7d670f554495a3ef91a1d8b74ec9e8ced3820d735fe98865ec21660ccc19888cb9ec7c7a2f EAP-Message = 0xa5d93096a267ddf7c02d459ff973a0e5934180dae55573573e11feef218391dc2a63de3153d1fb0455c3639bf54292318164a9227db552c322338c6f62f089791adedc9c12c7abba5d291505e021430b3fb70203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d0101040500038201010052828c773deb6f47894b702ebcab180a57224ca1782f9c88c0dfb06f7960c76596b71e4cfc16db61a122160fb297a13135e84f615e886bbfc7f0b543a70f427cd8494b9509b9b1b30ebb45eeaea41f787a7a28d26bea6a25fd4c268e5d6719d21ff6a9742f6df9eb1e05489f68ad1974e2110a6a391cf4d6db EAP-Message = 0x2b2bbcdc4b7a7b199daa3a456d44d1b114c78636ce369a783713e502dc811d6ae6f11bc7bfe2ef08cbdda19bcabdf3d9676f6567e49332a90f1fe37b3b862d1adaf12bc2b97c3082103600bac2722531c3f20cf1fb0b92d5e6bffdfc881907116057822a51c6545efab63513e2a15d27a732ff6cd9c80cf414318fcb9ca6031afedaa8737f238c1000010201007100aa87914b3d5afcf8b203a91ff18361a257a8e68e9e6bf9b236982e7656f6c3da3ed8a18342e40c92156885d1194a93679ee4bf4f42074d51aaef8727711f26c2cb98dc14628eba9a36b23ddd7c43f2a96b826a34667cf0bcbf2be7c85ed29f72ba866ac985e465a81cc77f23e217 EAP-Message = 0xf4ebee899a796d8461d06621a80cf7efd815ca1a6efc57e26791f8eafb7392757d7ae8a5a1817c2f5fc28186102f1d301e15829c064b6812dd4edb73748ad35ee3354018de6c2c0dc73c8c956dcecd40ffc1341bbda72d477654596b9111bd49b4aaeecacc4f99651dc329ee6bf72c02e77d6e8561272aa62d553c7c944add2f7c504bba595f8bec2d90f0a75401b59f0f000102010056e9a7514c9bfa911b4a6d83d7130c0c24879e41a7c0ccde757404bec262a7557ace3546baa5f02898b091fad9088406da74645a09bd172aad189741756d8b1b23ed2c84d889ec28a68ee9fb2b7f47688d588cc35a97e7b2d5709e8a9870d3b2cd029a485b14c6 EAP-Message = 0xf3461ec7f6295ffdd05d5ca94c21d46e0d583f9dc5277ecf6a528be053c527b8fe02a0a84a98aa37d5753bf7291667c49503f0f22b4394dbba0857c80f6a9a023bf56a611a2ff952ef45e8a63ac3153665b66b2324fc85101685b49eb9ec76fb9096cde885df4da1fa2224b40943fb907b068115f2905c3af2cab52008a8d436497189290f3ac638cc4ded6f354248dddca15525478c24be5a14030100010116030100303a6cd161291c5ff4a3e3494d75d28b57382f8af5678c9dcc668c2ad222086bb540169e6c1b135e147be876d29bd03ea2 State = 0x4846a7ba4c41aa89971edb0de589acf4 Message-Authenticator = 0x8126ccaf88a0d4a9c279618a24fbf364 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 1467 [tls] Length Included [tls] eaptls_verify returned 11 [tls] <<< TLS 1.0 Handshake [length 036f], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 248 to 160.103.180.252 port 32769 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 243 with timestamp +7 Cleaning up request 1 ID 244 with timestamp +7 Cleaning up request 2 ID 245 with timestamp +7 Cleaning up request 3 ID 246 with timestamp +7 Cleaning up request 4 ID 247 with timestamp +7 Waking up in 1.0 seconds. Cleaning up request 5 ID 248 with timestamp +7 Ready to process requests. ------------------------------- Thanks a lot in advance for your help. Regards, Fernando.

2 2

Re: Logging From where?
by Alan Buxey 03 Dec '09

03 Dec '09

--- original message --- From: "Alan DeKok" <aland(a)deployingradius.com> Subject: Re: Logging From where? Date: 03rd December 2009 Time: 6:52:27 as alan has said, latest versions can have custom log - theres also line_log module - NAS-IP-Address is your friend .old version? Well, what your're after is/can be stored/found elsewhere . Eg detail logs alan freeradius(a)corwyn.net wrote: > Everything is all running well. Currently when a user logs in I get this > in the log: > > > Wed Dec 2 17:09:32 2009 : Auth: Login OK: [rsteeves] (from client Cisco > port 2 cli 10.20.31.17) > > Is it possible to also have freeradius log where I was logging into in > addition to where I logged in from? In 2.1.7 you can add custom messages to the logs. See the "log" section of radiusd.conf, "msg_*". Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Failure to get freeradius work with mysql
by Thai Pham Vinh 03 Dec '09

03 Dec '09

Hello all, I'm doing some investigation to set up a system to authenticate wireless clients using 802.1X. freeradius is my choice because it's free and robust. I followed the instructions in "Deploying FreeRadius with MySQL Cluster Database" to set it up. I used radtest to verify the account in both "users" file and "mysql" database successfully. However, when it came to working with the wireless client, only the account in "users" file worked. The users stored in "mysql" database didn't. I configured the laptop to use EAP-PEAP. I examined the debug and found that FR rejected the client request at the last steps (when using mysql database): rad_recv: Access-Request packet from host 10.100.0.152 port 1226, id=242, length=271 User-Name = "user1" NAS-IP-Address = 10.100.0.152 NAS-Identifier = "00:1f:41:54:c4:19" NAS-Port = 1 Called-Station-Id = "00-1F-41-54-C4-19:free-internet" Calling-Station-Id = "00-19-7E-75-8F-E5" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020700571900170301004c7a9ca4c1143f9e8369e9648842e42d52e47f32e377ddb7109dea0dff2a19a761b2344bf994690cdcc4929bbd725db2e151869d3c1673f6cb54cdfc8a9c366acb69ae7492cf63732a02a10a98 State = 0xfa24a8fafc23b1c9dd29d46684e60d05 Message-Authenticator = 0xe5772ca3d27eede908597d3ec363cdfe +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31f1d2adb1254069291e8790ea6b2abf8b0000000000000000c0da299a4d8e225d5eb3c29a799bdfd2e5f1fbb8b9ccf5c8007573657231 server { PEAP: Setting User-Name to user1 Sending tunneled request EAP-Message = 0x020700401a0207003b31f1d2adb1254069291e8790ea6b2abf8b0000000000000000c0da299a4d8e225d5eb3c29a799bdfd2e5f1fbb8b9ccf5c8007573657231 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user1" State = 0xb8773755b8702dae4ab169969e969276 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 242 to 10.100.0.152 port 1226 EAP-Message = 0x010800261900170301001bb01d04e6aa35394f3fb1a6ba4967e4d4d123c69434f2c2cf442703 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfa24a8fafd2cb1c9dd29d46684e60d05 Finished request 21. I'm still reading more to understand the technology. But I hope that someone could help me to fix the problem. Thanks, Thai.

2 2

Logging From where?
by freeradius＠corwyn.net 03 Dec '09

03 Dec '09

Everything is all running well. Currently when a user logs in I get this in the log: Wed Dec 2 17:09:32 2009 : Auth: Login OK: [rsteeves] (from client Cisco port 2 cli 10.20.31.17) Is it possible to also have freeradius log where I was logging into in addition to where I logged in from? Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 3

Re: FW: Free Radius & Cisco
by freeradius＠corwyn.net 02 Dec '09

02 Dec '09

DEFAULT Huntgroup-Name == Cisco_Huntgroup, Auth-Type:=ntlm_auth, Ldap-Group == "HelpDesk" Service-Type:=NAS-Prompt-User, cisco-avpair:="shell:priv-lvl=1", Reply-Message := "Authorized Users Only" is what I'm using. Change priv-lvl to 15 for enable Rick At 07:03 PM 12/2/2009, Johnston, Ian wrote: >Content-Class: urn:content-classes:message >Content-Type: multipart/alternative; > boundary="----_=_NextPart_001_01CA73AC.1AC44E3C" > >Hi, > >Thanks for Free Radius Im confident it will be just what we need. > >I have set it up on a Dell DL360 G5 running >CentOS 2.3 and created simple clients.conf, >raddb.conf and users files. Radtest and logins >from a couple of clients are working well. >However, when I try to move up from the absolute >basics, e.g. to give my user who telnets to a >Cisco switch an enabled priveledge leval it just >doesnt work: the user logons OK but is still at >the plain command prompt. Im sure its >something simple Ive missed and Id be grateful >if you could give me any pointers. > >Ive looked through the mailing-list archive, >and although one question is exactly the same >Freeradius and Cisco (cisco-avpair = >"shell:priv-lvl=15" doesn't work) I seem to have >everything they have suggested in the answers? > >Thanks in advance for your help. > > > >Regards, > >Ian > > > >Here are some cuts from various files: > >Switch Config > >aaa authentication login nocusers group radius > >aaa authorization exec nocusers group radius > >aaa session-id common > >radius-server host 10.210.27.4 auth-port 1645 acct-port 1646 > >radius-server source-ports 1645-1646 > >line vty 0 4 > > exec-timeout 60 0 > > login authentication nocusers > > > > > > > > > >users > >dan Cleartext-Password := "password" > > Reply-Message = "Hello, %{User-Name}", > > Service-Type = Administrative-user, > > cisco-avpair = "shell:priv-lvl=15" > > > >ipj Cleartext-Password := "password" > > Reply-Message = "Hello, %{User-Name}", > > Service-Type = NAS-Prompt-User, > > cisco-avpair = "shell:priv-lvl=15" > > > >I also tried: > >dan Cleartext-Password := "password", >Service-Type = Administrative-user, cisco-avpair = "shell:priv-lvl=15" > > Reply-Message = "Hello, %{User-Name}", > > Service-Type = Administrative-user, > > > >and > >dan Cleartext-Password := "password" > > Reply-Message = "Hello, %{User-Name}", > > Service-Type = > Administrative-user, # and > Shell-user, and login and a few other things !-( > > cisco-avpair = "shell:priv-lvl=15" > > > >the login failed with the first alternate and >logged on as a plain user on the second. > > > > > > > > > > > > > >Snips from radiusd X output > >Sending Access-Accept of id 42 to 10.210.27.2 port 1645 > > Reply-Message = "Hello, ipj" > > Service-Type = NAS-Prompt-User > > Cisco-AVPair = "shell:priv-lvl=15" > > > >Sending Access-Accept of id 43 to 10.210.27.2 port 1645 > > Reply-Message = "Hello, dan" > > Service-Type = Administrative-User > > Cisco-AVPair = "shell:priv-lvl=15" > > > > > > > > > > > >Output from radtest > >[root@radius1 raddb]# radtest dan password radius1:1645 0 testing123 > >Sending Access-Request of id 33 to 10.210.27.4 port 1645 > > User-Name = "dan" > > User-Password = "password" > > NAS-IP-Address = 10.210.27.4 > > NAS-Port = 0 > >rad_recv: Access-Request packet from host >10.210.27.4 port 32770, id=33, length=55 > > User-Name = "dan" > > User-Password = "password" > > NAS-IP-Address = 10.210.27.4 > > NAS-Port = 0 > >+- entering group authorize {...} > >++[preprocess] returns ok > >++[chap] returns noop > >++[mschap] returns noop > >[suffix] No '@' in User-Name = "dan", looking up realm NULL > >[suffix] No such realm "NULL" > >++[suffix] returns noop > >[eap] No EAP-Message, not doing EAP > >++[eap] returns noop > >++[unix] returns notfound > >[files] users: Matched entry dan at line 11 > >[files] expand: Hello, %{User-Name} -> Hello, dan > >++[files] returns ok > >++[expiration] returns noop > >++[logintime] returns noop > >++[pap] returns updated > >Found Auth-Type = PAP > >+- entering group PAP {...} > >[pap] login attempt with password "password" > >[pap] Using clear text password "password" > >[pap] User authenticated successfully > >++[pap] returns ok > >Login OK: [dan] (from client radius1 port 0) > >+- entering group post-auth {...} > >++[exec] returns noop > >Sending Access-Accept of id 33 to 10.210.27.4 port 32770 > > Service-Type = Administrative-User > > Cisco-AVPair = "shell:priv-lvl=15" > > Reply-Message = "Hello, dan" > >Finished request 2. > >Going to the next request > >rad_recv: Access-Accept packet from host >10.210.27.4 port 1645, id=33, length=63 > >Waking up in 4.9 seconds. > > Service-Type = Administrative-User > > Cisco-AVPair = "shell:priv-lvl=15" > > Reply-Message = "Hello, dan" > >[root@radius1 raddb]# Cleaning up request 2 ID 33 with timestamp +62 > >Ready to process requests. > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Help on TLS+Active Directory
by gera 02 Dec '09

02 Dec '09

Hi. Need some help to understand this combination. I'm trying to setup EAP-TLS + Active Directory Authentication on a wireless mobility controller. This mob con has this Portal Captive feature. To start testing, I configured freeradius as a ldap client for Active Directory, using the Administrator account to bind to it, and using commonname as a filter. Then I configured the portal captive from the mob-con to authenticate through the radius server, and it worked fine, even using the simultaneous-use attribute. Then, I tried to go ahead configuring EAP-TLS. At first I recompiled the source code to include support for ssl. Then I created the certs on freeradius using the Makefile which comes on the package. I signed up the client certificates using the CA ones, not the server ones. Next, I configured the corresponding sections on eap.conf and default (enabling eap) and started freeradius -X. After copying the certificates to the Windows Vista machines, I started the association. Everything was well, and the client authenticated without problems. Even trying to use the same certificate on another machine reached the simultaneous-use count and didn't allow the client to connect. BUT, we noted an interesting behaviour. If the client specify Windows to use another username to login, although freeradius complaints that the user doesn't exist on ldap, it seems it still accepts this user, as long as the certificate is fine. So, in this case, if the user isn't allowed to login because of simultaneous use, he still can change the username which he uses specifying another one (whichever, even if it doesn't exist) and voilá! He can now log in. I'm sure I'm missing something, but I'm not sure what. Any clue? Will supply log or conf files upon request (right now, I'm not sure what parts could be relevant to you).

3 5

Re: MS-CHAP2 Response is incorrect.
by tnt＠kalik.net 02 Dec '09

02 Dec '09

> I´m having a problem deploying a FreeRadius server to authenticate > Wireless users with an Active Directory. Have you followed the guide: http://deployingradius.com/documents/configuration/active_directory.html Has it worked for pap requests and exec ntlm_auth? Ivan Kalik

1 0

RE: Freeradius-Users Digest, Vol 56, Issue 18
by Peter Carlstedt 02 Dec '09

02 Dec '09

> Hi, > > Hello everyone. > > Im trying to understand how the certificates work in Freeradius. > > Last time I asked about why I need to install a root certificate on all the windows clients I got the answer that it is because PEAP works that way. But when I read about it on other sites it says that EAP-TTLS and PEAP was created so that you wont need client-side certificates? > > client-side certificate means a specific cert for the client..not the root CA. > > you need a root CA installed because thats that the RADIUS server has been signed with. > if you've used a CA to sign the RADIUS cert that is commonly in the client you wont need > to install the CA...but eg self-signed CA will need to be installed. > > > The PEAP0 I want to use is EAP-MSCHAPv2 since that one should not require client-side certificates if I have understood it correctly. > > RADIUS server signed by CA > CA needs to be on the client if you want to really trust/verify the cert > > alan Okay, so is there anyway for me to get the root CA installed without having to do it manually on the clients? Peter _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Freeradius AND Mysql ? or Freeradius-mysql package??? or both?
by C. Diego Raffaelli A. 02 Dec '09

02 Dec '09

Dear all: i have installed debian, mysql server 5.0 (by aptitude install) and freeradius-server-2.1.7 by wget and "untar -xvfz" , manually. i have no errors on freeradius run. i have a 3com RAS with PPP and PPPoE users, i would like to put my debian-freeradius as a Radius for them (AAA). Question is: it is necessary install freeradius-mysql package? if yes, then: must i install freeradius-mysql as a repository package (aptitude install freeradius-mysql) ? or it's not recommended this way? Its better do it by downloading and untar manually ? there is no problem if i "aptitude install freeradius-mysql" with my actual freeradius version? thanks sorry my poor english. Carlos

2 1