December 2010 - Freeradius-Users - lists.freeradius.org

Problem with MS-CHAPV2 and Windows XP SP3
by Henrique Camolezi Pacheco 27 Dec '10

27 Dec '10

I'm trying to implement 802.1x and LDAP with freeradius, but am having problems with the certificate. When I try to authenticate, I get the following error message: Sending Access-Challenge of id 66 to 10.10.12.77 port 1825 Reply-Message = "Access-Accept " Idle-Timeout = 1 Session-Timeout = 1 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x232ca99e232eb03c24e354b343e4af25 Mon Dec 27 09:50:50 2010: Info: Finished request 4. Mon Dec 27 09:50:50 2010: Debug: Going to the next request Mon Dec 27 09:50:50 2010: Debug: Waking up in 4.9 seconds. Mon Dec 27 09:50:55 2010: Info: Cleaning up request 4 ID 66 with timestamp +1771 Mon Dec 27 09:50:55 2010: Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Dec 27 09:50:55 2010: Debug: WARNING:! EAP session state is 0x232ca99e232eb03c did not finish! Mon Dec 27 09:50:55 2010: Debug: WARNING:! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Dec 27 09:50:55 2010: Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Dec 27 09:50:55 2010: Info: Ready to process requests. I'm trying make 802.1x authentication, but I don't have sucessfull

2 1

about kick off oldest user
by Spacelee 27 Dec '10

27 Dec '10

Hi, everyone. I have set an attribute Simultaneous-Use := 1 to an account name Test, and when I use Test to double login, I will get the authentication failed the second time, what I want is when I login the second time, the server just kick off the first login of Test, is it possible? Do I need to change the source code if I need to implement this function? Thanks. -- *Space Lee*

4 3

Check in users file using a string attribute obtained from ldap
by Kostas Zorbadelos 24 Dec '10

24 Dec '10

Greetings to all, I am trying to accomplish the following setup: - have freeradius query an ldap server to get the usual user entry with one check and a few reply attributes - have after that a users file, that based on the check attribute obtained before by the ldap module make some processing (eg add a few common reply attributes) This is actually a "grouping" functionallity and I can accomplish what I want using the Ldap-Group attribute, BUT I want to avoid the extra ldap queries. So for example I have: LDAP ---------- # kzorba, people, company.gr dn: uid=kzorba1,ou=people,dc=company,dc=gr objectClass: XXX objectClass: YYY radiusProfile: FOO_STATIC Framed-IP-Address: 62.103.131.9 userPassword: XXXXXXX sn: ZORBADELOS uid: kzorba ... ldap.attrmap -------------- checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Ascend-Group radiusProfile replyItem Framed-IP-Address Framed-IP-Address replyItem Framed-Route Framed-Route replyItem Filter-Id Filter-Id And I want to have a users file that looks like this: DEFAULT Ascend-Group =~ "STATIC" Reply-Message = "Your account is Static." Having the following authorize section in default authorize { preprocess chap mschap ldap { notfound = reject } files pap } The checks fail. I looked at the source code and from what I understood the ldap module puts all check items in the so called control (or check list), while rlm_file makes checks in the request list So I figured that doing an unlang update request would solve the problem. authorize { preprocess chap mschap ldap { notfound = reject } update request { Group = "%{control:Ascend-Group}" } files pap } And in users file have a DEFAULT Group =~ "STATIC" Reply-Message = "Your account is Static." However this also did not work. Any help as to what am I missing here? Thanks, Kostas Zorbadelos

3 2

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 24 Dec '10

24 Dec '10

Estaré ausente de la oficina desde el 23/12/2010 y no volveré hasta el 03/01/2011. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2) o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ¡Felices fiestas y próspero año nuevo! ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

Perl bindings for libfreeradius-radius
by Alexandr Kovalenko 23 Dec '10

23 Dec '10

Hello! Anyone aware of any perl module, which provide libfreeradius-radius interface? Thanks in advance! -- Alexandr Kovalenko http://uafug.org.ua/

2 3

Windows Client
by McCann, Brian 23 Dec '10

23 Dec '10

Hi all. I'm sure some of you are right away thinking "not this again", since this is probably something very simple, but I cannot figure this out. I've got an XP SP3 client, a Windows 7 SP1 client, and an iPad all trying to sign in to a WPA2 wireless network, that I have setup to auth with FreeRadius. The iPad works 100% of the time. The Windows XP client & Windows 7 do not. The most obvious thing in the debug log (whole snippit below) is the "EAP session for the state 0x.... did not finish!". I've followed the directions to disable certificate checking on Windows, and this continues to happen. I've re-ran "make" in the certs directory, and checked that the openssl lines do infact include the "xpextensions" file. Is there something else I should be doing here? I've been following the directions @ http://deployingradius.com/documents/configuration/pap.html , along with the FAQs at http://wiki.freeradius.org/Certificate_Compatibility . Thanks, --Brian

3 3

rlm_radutmp Error
by Moayad Mohammad 22 Dec '10

22 Dec '10

Dears, I am using freeradius2-2.1.7-7.el5, I got the following error in radius.log file "Error: rlm_radutmp: Logout entry for NAS ASN port 5 has wrong ID" As I noticed, this error appears only when NAS send stop record to radius server. What's the problem? And how can I solve it? Regards, Moayad

2 1

Error: TLS Alert
by Moayad Mohammad 22 Dec '10

22 Dec '10

Dears, I am using freeradius2-2.1.7-7.el5 with mysql backend and openssl-0.9.8e-12.el5_5.7. And using EAP-TTLS, default_eap_type = mschapv2 I got the below error: Error: TLS Alert write:fatal:protocol version Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Error: TLS Alert write:fatal:bad record mac What's the problem? And how can I solve it? Regards, Moayad

2 1

Use Event-Timestamp for Accounting Start/Stop with MySQL
by Juri Glaß 22 Dec '10

22 Dec '10

Hi I would like to write the Event-Timestamp from Accounting Start/Stop messages to my MySQL database instead of the server side time. I tried to configure the dialup.conf, but it doesn't work properly. I replaced %S with %{Event-Timestamp}, the result is "0000-00-00 00:00:00" in the database, the log file says : expand: UPDATE radacct SET acctstoptime = '%{Event-Timestamp}', ** snip ** -> UPDATE radacct SET acctstoptime = 'Dec 21 2010 10:02:30 CET' ** snip ** When I use something like DATE_FORMAT(date,format) from MySQL, the format string is somehow expanded. FROM_UNIXTIME isn't working either. I understand that unix timestamps are printed as strings like 'Dec 21 2010 10:02:30 CET', but only for logging or for the sql statements too? Thank you for your help. Btw.: FreeRADIUS Version 2.0.4 Best Juri

4 6

Re: FreeRADIUS exiting with Signal 11 on FreeBSD
by ironrake＠yahoo.com 22 Dec '10

22 Dec '10

It started for me at FreeBSD 7.2 and has continued through 8.1 for both Freeradius 2 from the ports collection and from the official tar file source distribution. My server is lightly loaded and not really a production system so I've not run it under gdb. I use the standard kernel scheduler. The user I run freeradius as has a default login class. The parent process will always die with this message just after a successful authentication is logged. Sent from Verizon Wireless

1 0