February 2009 - Freeradius-Users - lists.freeradius.org

Dialup_admin "New user" page is empty
by Michael Schwartzkopff 10 Feb '09

10 Feb '09

Hi, I am trying to get dialup_admin running. I have ldap directory and FR+LDAP works. I have the webserver running, see the start page and "Check Server" works. When I click "New User" I see a blank page. Nothing in the /var/log/apache2 files. Any help or hints? Thanks. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 1

FreeRadius support of EAP-AKA
by aaronlai＠gdnt.com.cn 10 Feb '09

10 Feb '09

Hi, Does anyone know if the FreeRadius supports EAP-AKA or not? I am using Version 2.1.3 and it seems that the EAP-AKA is not supported. Is there any plan to support that in the future releases? Thanks, Aaron Lai

2 1

DHCP in FreeRADIUS 2
by Andrew Rikhlivsky 10 Feb '09

10 Feb '09

Hi all. Where I can read information about using DHCP opt. 82 in FreeRADIUS 2 ?

3 2

802.1x with freeradius + PEAP + 3com Switch
by Laurent CARON 10 Feb '09

10 Feb '09

Hi, I managed to get authentication of users logged on Windows XP workstation to the network. The machine authentication (while booting) however fails thus preventing the users from retrieving their roaming profiles. Here is the relevant part of the log: Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: - authorize Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: performing user authorization for host/mycomputer Thu Feb 5 14:39:16 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name:None' Thu Feb 5 14:39:16 2009 : Debug: expand: (uid=%{mschap:User-Name:None}) -> (uid=mycomputer$) Thu Feb 5 14:39:16 2009 : Debug: expand: ou=People,dc=mycompany,dc=com -> ou=People,dc=mycompany,dc=com Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: attempting LDAP reconnection It seems freeradius "tries" to authenticate the computer from the ou=People,dc=mydomain,dc=com. In radiusd.conf I have the following: ldap { server = "192.168.0.3" identity = "uid=dot1x_read_user,ou=People,dc=mydomain,dc=com" password = ldapreadpasswd basedn = "ou=People,dc=mydomain,dc=com" filter = "(uid=%{mschap:User-Name:None})" I now need to instruct the ldap to search in ou=Computers,dc=mydomain,dc=com for the computers authentication. How do I do this while preserving the working users auth ? Thanks Laurent

3 10

Installation Problem
by Marcelo Freitas 09 Feb '09

09 Feb '09

Hello everybody, I searched the archive but I couldn't find any other topic similar. Can someone help me with the installation of FreeRadius 2.1.3 on my Slackware box ? I'm getting this output after running Make ---------------------------------------------- gmake[6]: Leaving directory `/home/other/freeradius-server-2.1.3/src/modules/rlm_dynamic_clients' gmake[5]: Leaving directory `/home/other/freeradius-server-2.1.3/src/modules' gmake[4]: Leaving directory `/home/other/freeradius-server-2.1.3/src/modules' Making all in main... gmake[4]: Entering directory `/home/other/freeradius-server-2.1.3/src/main' /home/other/freeradius-server-2.1.3/libtool --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo evaluate.lo vmps.lo detail.lo \ /home/other/freeradius-server-2.1.3/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt -lltdl -lcrypto -lssl -lcrypto rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o radiusd acct.o auth.o client.o conffile.o crypt.o exec.o files.o listen.o log.o mainconfig.o modules.o modcall.o radiusd.o stats.o session.o threads.o util.o valuepair.o version.o xlat.o event.o realms.o evaluate.o vmps.o detail.o -Wl,--export-dynamic /home/other/freeradius-server-2.1.3/src/lib/.libs/libfreeradius-radius.a -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto modules.o(.text+0x1104): In function `setup_modules': /home/other/freeradius-server-2.1.3/src/main/modules.c:1037: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/home/other/freeradius-server-2.1.3/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/other/freeradius-server-2.1.3/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/other/freeradius-server-2.1.3/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/other/freeradius-server-2.1.3' make: *** [all] Error 2 ---------------------------------------------- Thanks, Marcelo

3 4

RE: Problem with udpfromto in version 2.1.1 - please help
by Will D. Spann 09 Feb '09

09 Feb '09

Ivan Kalik, >>I should note that in my radiusd.conf file, I'm not including "eap.conf" nor "sites-enabled/", but other than that I have all default settings. >Well done! By removing /sites-enabled you have stopped the server from >processing all As from AAA (authentication, authorization and >accounting) in one masterfull stroke. Now put everything back as it was. Thanks for the reply. I didn't realize disabling sites-enabled would disable all AAA services. Running radiusd -X as root with default settings gives errors related to EAP and Diffie-Hellman. I'm running the x64 package from openSUSE 11.1 (FreeRADIUS 2.1.1). I have OpenSSL 0.9.8h installed. The radiusd -X output is listed below. Thanks for any comments on this. Will gcwifi-auth-vm:~ # radiusd -X FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Dec 3 2008 at 13:57:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ........+.........................................+...+ // etc. unable to write 'random state' dh: Permission denied make: *** [dh] Error 1 Exec-Program output: openssl dhparam -out dh 1024 Exec-Program-Wait: plaintext: openssl dhparam -out dh 1024 Exec-Program: returned: 2 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Errors initializing modules

2 4

PAP authentication and multiple LDAP userpassword attributes
by Christophe Saillard 09 Feb '09

09 Feb '09

Hi, I'm working on upgrading from FR 1.1.7 to FR 2.1.3. I use FR for EAP-TTLS/PAP authentication with LDAP. FR 1.1.7 successfully authenticates users with multiple LDAPuserpassword attributes which are stored with crypt and/or MD5 hash, the passwords are not the same (even it's better if the are) : ####################################################################### [...] rlm_ldap: performing user authorization for mylogin radius_xlat: '(&(uid=mylogin)(udsradiusProfileWifi=*))' radius_xlat: 'ou=people,o=annuaire' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=annuaire, with filter (&(uid=mylogin)(udsradiusProfileWifi=*)) rlm_ldap: performing search in uid=wifi-crc,ou=profilsWifi,o=annuaire, with filter (objectclass=radiusprofile) rlm_ldap: Added password {MD5}xxxxx in check items rlm_ldap: Added password {crypt}xxxxx in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user mylogin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "LDAP_OSIRIS" returns ok for request 29 modcall: leaving group LDAP_OSIRIS (returns ok) for request 29 rad_check_password: Found Auth-Type LDAP_OSIRIS auth: type "LDAP_OSIRIS" Processing the authenticate section of radiusd.conf modcall: entering group LDAP_OSIRIS for request 29 rlm_ldap: - authenticate rlm_ldap: login attempt by "saillard" with password "mycleartextpassword" rlm_ldap: user DN: uid=mylogin,ou=uds,ou=people,o=annuaire rlm_ldap: (re)connect to ldaps://ldapuds.u-strasbg.fr, authentication 1 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as uid=mylogin,ou=uds,ou=people,o=annuaire/polopackvih+ to ldaps://ldapuds.u-strasbg.fr rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mylogin authenticated succesfully [...] ####################################################################### Now with FR 2.1.3, it looks like only the first password attribute is used : ####################################################################### [...] [ldap] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(udsradiusProfileWifi=*)) -> (&(uid=mylogin)(udsradiusProfileWifi=*)) [ldap] expand: ou=people,o=annuaire -> ou=people,o=annuaire rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=annuaire, with filter (&(uid=mylogin)(udsradiusProfileWifi=*)) rlm_ldap: performing search in uid=wifi-crc,ou=profilsWifi,o=annuaire, with filter (objectclass=radiusprofile) [ldap] Added User-Password = {crypt}xxxxx in check items [ldap] Added User-Password = {MD5}xxxxx in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user mylogin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[pap] returns updated Found Auth-Type = PAP +- entering group authenticate {...} [pap] login attempt with password "mycleartextpassword" [pap] Using CRYPT encryption. [pap] Passwords don't match [...] ####################################################################### Is there a way to tell FR to try with others attributes ? My configuration is quite simple, here's my sites-enabled/proxy-inner-tunnel : server proxy-inner-tunnel { authorize { eap ldap pap } authenticate { eap pap } post-proxy { eap } } And the pap modules : pap { auto_header = yes } Any clue ? Thanks -- --------------------------- Christophe Saillard Université de Strasbourg Direction Informatique --------------------------- Tél : 03 90 24 03 17 Fax : 03 90 24 03 12 ---------------------------

2 1

Reading triplets from HLR
by bruno.faria＠indt.org.br 09 Feb '09

09 Feb '09

Hi Users of FreeRadius, I'm trying to use EAP-SIM authentication for interworking between WLAN/3G networks. We have a 2G/3G HLR wich operates both SS7 and SIGTRAN. I'm wondering if FreeRadius has any mechanism to fecth authentication vectors from the HLR. I've seen a topic this the same question but there was no answer. Is there any work regarding this issue? Thanks you, Bruno Faria Electrical Engineer INdT - Instituto Nokia de Tecnologia Network Technologies - Telecom LAB Manaus, AM - Brasil - 69048-660 Mobile: +55 92 9213 6310 Office: +55 92 2126 1118 www.indt.org.br bruno.faria(a)indt.org.br / ext-bruno.faria(a)nokia.com

2 1

sqlippool : undefined symbol: rlm_sql_query
by Sebastian Krieger 09 Feb '09

09 Feb '09

Hi, I want to get freeradius running with the sqlippool module and mysql backend on Ubuntu 8.04 LTS Server. Everything works so far, but it seems still impossible to enable the sqlippool on Debian based systems. At first I tried the freeradius 1.1.7-1build4 packages supplied by the distribution, but then I always received the following error: freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool.so: undefined symbol: sql_get_socket After that I gave the backport packages of version 2.1.0 a try, because I have read somewhere that this error should be solved since version 2.0.4. But unfortunately I had the same result with it. freeradius_2.1.0+dfsg-0ubuntu2~hardy1_i386.deb freeradius-common_2.1.0+dfsg-0ubuntu2~hardy1_all.deb freeradius-mysql_2.1.0+dfsg-0ubuntu2~hardy1_i386.deb freeradius-utils_2.1.0+dfsg-0ubuntu2~hardy1_i386.deb libfreeradius2_2.1.0+dfsg-0ubuntu2~hardy1_i386.deb Now I tried to compile freeradius version 2.1.3 on this server and to build a fresh deb package with success, but using sqlippool now results into a slightly different error message. freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool-2.1.3.so: undefined symbol: rlm_sql_query In this message a patch to this problem is mentioned. http://lists.cistron.nl/pipermail/freeradius-devel/2009-January/012736.html And here someone relinked rlmsqlippool to rlm_sql to get rid of this issue. http://www.nabble.com/sqlippool-symbol-error-td20331823.html What should I do to get sqlippool working? I don't know how to relink the it. Thanks a lot. Sebastian --- There seems to be a syntax error at line 24 in /usr/local/etc/raddb/sql/mysql/ippool.conf. At the end of the line "\" is missing. including configuration file /usr/local/etc/raddb/sql/mysql/ippool.conf /usr/local/etc/raddb/sql/mysql/ippool.conf[24]: Expecting section start brace '{' after "AND nasipaddress" Errors reading /usr/local/etc/raddb/radiusd.conf WHERE expiry_time <= NOW() - INTERVAL 1 SECOND \ AND nasipaddress = '%{Nas-IP-Address}'"

2 1

Re: Non Ldap Group members being rejected
by Godfrey Peart 08 Feb '09

08 Feb '09

[files] expand: %{User-Name} -> john [files] sql_set_user escaped user --> 'john' rlm_sql (sql): Reserving sql socket id: 1 [files] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup *WHERE username = 'john' ORDER BY priority [files] sql_groupcmp finished: User is a member of group Guests rlm_sql (sql): Released sql socket id: 1 [files] users: Matched entry DEFAULT at line 18* ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for john with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success Thanks, that worked a treat, users is now found in SQL-Group == Guests

1 0