December 2010 - Freeradius-Users - lists.freeradius.org

Issue installing FreeRadius with openSSL support on a CentOS Sever
by Hanavan, John (John) 06 Dec '10

06 Dec '10

Hi All, We have been trying to install FreeRadius with openSSL support on to a CentOS Sever without much success. The version of FreeRadius and CentOS are listed below. FreeRadius Version: 2.1.10 CentOs Version: CentOs release 5.3 The commands that we are using to start the installation are. ./configure --with-openssl --with-openssl-libraries=/usr/local/ssl/lib --with-openssl-includes=/usr/local/ssl/include --with-rlm-counter-lib-dir=/usr/lib The output that indicates installation failure of openSSL support are shown below (The full output is in the attached file). configure: skipping test for openssl/ssl.h === configuring in src/modules/rlm_dbm (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_dbm) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for ndbm.h... no checking for gdbm/ndbm.h... no checking for gdbm-ndbm.h... no checking for dbm in default lib... no checking for dbm_open in -lndbm... no checking for dbm_open in -lgdbm... no checking for dbm_open in -lgdbm_compat... no configure: creating ./config.status config.status: creating Makefile === configuring in ./types/rlm_eap_peap (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_peap) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in ./types/rlm_eap_ttls (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_ttls) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in ./types/rlm_eap_ikev2 (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_ikev2) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for ikev2_set_log_callback in -leap-ikev2... no checking EAPIKEv2/connector.h usability... no checking EAPIKEv2/connector.h presence... no checking for EAPIKEv2/connector.h... no configure: creating ./config.status config.status: creating Makefile We are just trying to get EAP-TLS support enabled on our FreeRadius Sever. It should be relatively straight forward, one would think, to successfully enable this feature requiring openSSL support. I hope someone can tell us what it is we are doing wrong. Regards, John Hanavan

2 1

Re: application to share resources with my mac users
by Gary Gatten 06 Dec '10

06 Dec '10

NFS? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Dec 06 15:37:01 2010 Subject: application to share resources with my mac users hello greetings to all such I have a question regarding the free radius, the situation is as follows: installed on my ubuntu computer operating system. then install and configure free radius and my mac users, as well as clients and the access point. and my question is: there is any application or through an interface selected files and folders you want to share my users that gave high above? Thanks in advance and have nice day. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

application to share resources with my mac users
by alejandra arceo estrada 06 Dec '10

06 Dec '10

hello greetings to all such I have a question regarding the free radius, the situation is as follows: installed on my ubuntu computer operating system. then install and configure free radius and my mac users, as well as clients and the access point. and my question is: there is any application or through an interface selected files and folders you want to share my users that gave high above? Thanks in advance and have nice day.

1 0

FreeRadius + FreeBSD + ipv6
by Johann Hugo 06 Dec '10

06 Dec '10

Hi I'm busy with a FreeRadius Eduroam setup, but it only works with ipv4 and not with ipv6. My Setup: wifi-client <--> my-FreeRadius-proxy <---> eduroam-proxy <---> remote-site My server: FreeBSD 8.1-STABLE with freeradius-2.1.10_1 that was build from the ports, with ipv6 enabled. Here is a list of things that I've noticed when I run radiusd -X Regards Johann ------------------------------------------------------------------------------------------------------------ 1) FreeRadius with only an ipv4 listen section in radiusd.conf. (no ipv6) #listen { # type = auth # ipv6addr = :: # port = 0 #} ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* FreeRadius tries to send Access-Request packets to the ipv6 address of edurom- proxy-server (eduroam0.sanren.ac.za) when I use it's dns name in proxy.conf. Sending Access-Request of id 172 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test(a)ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 It works fine if I use the ipv4 address (no dns) for eduroam0.sanren.ac.za. ------------------------------------------------------------------------------------------------------------ 2) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf. listen { type = auth ipv6addr = :: port = 0 } ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* freeradius radiusd 61076 6 udp6 *:1812 *:* Running radiusd -X I can see it tries to send out ipv6 requests. Sending Access-Request of id 229 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test(a)ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 But I don't see anyting with tcpdump. After a while I get the following message in radiusd: WARNING: Internal sanity check failed in event handler for request 13: Discarding the request! Ready to process requests. ------------------------------------------------------------------------------------------------------------ 3) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf, but with a specific ipv6 address configured. listen { type = auth ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } radiusd -X stops with the following error: Failed binding to authentication address 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 ----------------------------------------------------------------------------------------------------------------- ## radiusd.conf -- FreeRADIUS server configuration file. ###################################################################### prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/local/lib/freeradius-2.1.9 pidfile = ${run_dir}/${name}.pid user = freeradius group = freeradius max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } listen { type = acct ipaddr = * # ipv6addr = :: port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ######################################################################

4 11

Help, authentication problems!!
by miha- 06 Dec '10

06 Dec '10

Hello, I am having problems with authentication. I chacked secret on NAS and on Radius server. Bouth are some but the radius is keep telling to check the secret. What could be worng or I am missing ? Thanks!!! This is configuration on nas. ##----- Activate RADIUS connection setProperty com.centile.connectors.aaa.watchdog.enable false setProperty com.centile.connectors.aaa radius setProperty com.centile.connectors.aaa.localserv intraswitch setProperty com.centile.connectors.aaa.localpass b (secret) setProperty com.centile.connectors.aaa.remotserv 1.2.3.4 setProperty com.centile.connectors.aaa.remotport 1812 setProperty com.centile.connectors.aaa.calltype any -- This is in cliente.cong client 212.13.228.58 { secret = b shortname = intraswitch nastype = cisco 1. Sample If I typed wrong pass in sql for user authentication I see password from user connection (12345) but it is wrong (12 in sql). In sample 2 I put right pass in sql for user, but you can see that is the radius is showing me that is encrypted and saying me WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! . why? 1. Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "12345" [pap] Using clear text password "12" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file 2. ap] returns noop [sql] expand: %{User-Name} -> 081609000 [sql] sql_set_user escaped user --> '081609000' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '081609000' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '081609000' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '081609000' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'static' ORDER BY id [sql] User found in group static [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'static' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "þqL?%" [pap] Using clear text password "12345" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 081609000 attr_filter: Matched entry DEFAULT at line 11 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-authentication-problems-tp3293… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius web GUI
by Keith Beeby 06 Dec '10

06 Dec '10

Hi, Could anyone recommend the best web based management for FreeRADIUS 2.x? Is there a Webmin module? Thank you Keith

2 1

Fall-Back Group
by Jay Dorado 06 Dec '10

06 Dec '10

Hi, I am trying to work on something which is to provide a user 100Mb per month and if the user exceeds the quota before the month end I want it to be configure in such a way that the user can still access the internet with 2hrs of internet access daily. Has anyone come across such configuration? -- Regards, Jay

1 0

FR proxy to ACS and NPS with MS CHAP v2
by SagiBarOr 05 Dec '10

05 Dec '10

We are developing a security scheme in which we use EAP TTLS MS CHAP v2 with Proxy. The TTLS phase is done with the first AAA server, and the second step, with MS CHAP v2, is proxied to another AAA (which is an LDAP server). When the first AAA server is FR and the second one is also FV, then authentication is OK. When the second AAA server is ACS (Cisco) or NPS (MS), the MS CHAP v2 authentication fails. We preformed troubleshooting and elimination testing which indicate the issue is with the pwd. Not with the user name. For example it also fails with the local DB of the 2nd AAA server. Also the verbose error log shows the user account is found. Looks like something is wrong with the pwd hash. will most appreciate your expert opinion. Thnks Sagi -- View this message in context: http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 31

Meraki Access Points Login incorrect for SHA-Password
by danodemano 04 Dec '10

04 Dec '10

Alright, I'm going to try my best to explain what's going on here. I have a Meraki wireless access point I am trying to get configured to work with RADIUS. I have my freeradius server up and running with two other access points just fine. However, I cannot get it to work right with the Meraki one. It's set up to us MySQL for all the authentication and such and as I mentioned it works fine with the other two access points. However, when the Meraki access point tries to authenticate using SHA-Password credentials in the MySQL database I get a Login incorrect. Here is a bit from the radius log file: Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 cli 00-00-00-00-00-02) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 cli 00-00-00-00-00-02) Both users are in the MySQL database, the only difference is the 'testing' has a 'Cleartext-Password' while the 'test2' user has an 'SHA-Password' If I try to use the 'test2' user from command line with a radtest it works fine: Sat Dec 4 09:23:28 2010 : Auth: Login OK: [test2] (from client localhost port 10) It also works correctly with my Untangle box: Sat Dec 4 09:29:23 2010 : Auth: Login OK: [test2] (from client Untangle port 0) I contacted Meraki about it and among other things they said: "It may be failing because your RADIUS server policy is configured to use the EAP-TLS authentication method and our test simulates a supplicant using PEAP-MSCHAPv2." Honestly I know very little about freeradius. I have set it up using some how-to guides on the Internet and it seems to be functioning correctly for the other two access points. The record in the 'nas' table for the Meraki access point is identical to the records for the other access points other than the IP/shortname. I have made copies of (I think) all the used config files if that's helpful. You can find them all here: http://dbunyard.homeip.net/stuff/raddb/ http://dbunyard.homeip.net/stuff/raddb/ Any help in configuring this would be greatly appreciated! If you need any additional information or logs let me know. Thanks! -- Dan -- View this message in context: http://freeradius.1045715.n5.nabble.com/Meraki-Access-Points-Login-incorrec… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

PEAP/TTLS and Client certificates
by rdeboer 04 Dec '10

04 Dec '10

Hello, I want to set up a radius server which authenticates users only once they provide their username, password AND client certificate. Now, I've managed to get this to work, my only problem is that as TTLS and PEAP use TLS, the TLS module must be enabled and configured. By doing so, users can also log in with just a client certificate. My real question here is: Is it possible to somehow force everyone to use PEAP or TTLS with a client certificate, while rejecting users trying to connect purely through TLS with only a client certificate? Kind regards, Remy -- View this message in context: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4