August 2010 - Freeradius-Users - lists.freeradius.org

(no subject)
by Walter Goulet 06 Aug '10

06 Aug '10

Sssssseessss ee

1 0

Problem about simultaneous-use parameter and windows DC.
by 李程 06 Aug '10

06 Aug '10

Hello guys. We set up a freeradius server several months ago. We use postgresql database for Users and Clients databases, and all works fine. Then we want to use a windows domain controller to do the anthentication by calling ntlm_auth. After some tests, it works too. But now we have no idea how to enable the simultaneous-use parameter, because tables of Users database is actually empty, all user informations are in the windows DC. Is there any way to enable the simultaneous-use parameter? Thanks! Miles

2 4

Moving to Virtual Servers
by Cory Johnson 06 Aug '10

06 Aug '10

Greetings, I've been using the documentation here: http://wiki.freeradius.org/Virtual_server attempting to create 2 virtual servers on the same socket each associated with a client. I have already configured the ldap module, as well as added some lines to the users file. Before "virtualizing" I am able to authenticate my ldap users via radtest. Here's the config that works against LDAP, before trying to add to a virtual server: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 1812 } listen { ipaddr = * port = 1813 type = acct } client 192.168.1.0/24 { secret = testing123 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = no msg_goodpass = "Great Success!" msg_badpass = "I'm sorry but you appear to have entered a incorrect password or you may not be authorized to access this equipment" } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ...And the output from a test in debug mode (edited out passwords and password hashes): [ldap] Entering ldap_groupcmp() [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 rlm_ldap::ldap_groupcmp: User found in group NOC [ldap] ldap_release_conn: Release Id: 0 [ldap] performing user authorization for cjohnson [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [ldap] sambaLmPassword -> LM-Password == 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [ldap] looking for reply items in directory... [ldap] Setting Auth-Type = LDAP [ldap] user cjohnson authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 [ldap] login attempt by "cjohnson" with password "s3cret" [ldap] user DN: uid=cjohnson,ou=Users,dc=corp,dc=example,dc=com [ldap] (re)connect to 192.168.1.99:389, authentication 1 [ldap] bind as uid=cjohnson,ou=Users,dc=corp,dc=example,dc=com/s3cret to 192.168.1.99:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user cjohnson authenticated succesfully Login OK: [cjohnson] (from client 192.168.1.0/24 port 0) Great Success! Waking up in 4.0 seconds. Here's the changes I made to the config, attempting to add current setup to virtual server "server_one": ... listen { type = auth ipaddr = * port = 1812 } listen { ipaddr = * port = 1813 type = acct } client 192.168.1.0/24 { virtual_server = server_one secret = testing123 } server server_one { } ... The rest of the config is the same. The server will start, but now I can't see my LDAP users, heres the log entry: server server_one { Login incorrect: [cjohnson/s3cret] (from client 192.168.1.0/24 port 0) I'm sorry but you appear to have entered a incorrect password or you may not be authorized to access this equipment } # server server_one Is there something I need to put within server section? It's as if the ldap module and the users file aren't being referenced anymore. Any tips or references to complete examples where virtual servers are set up in this way? If someone could take a moment to point me in the right direction I would certainly appreciate it. Cory J

2 1

RE: suffix configuration
by Sallee, Stephen (Jake) 06 Aug '10

06 Aug '10

> Look at modules/realm > This is how you "split" off domain\user or user@domain. I did look at that file before I posted, but I don't know what I could change in it that would help me. It looks like the only think that is set in that file is the delimiter. The suffix delimiter is correct, but I still cannot get authenticated with the username@domain convention. I tried adding the following to my realms file but it does nothing -------------------------- realm umhb.edu { format = suffix delimiter = "@" } realm cru { format = suffix delimiter = "@" } -------------------------- Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221 -----Original Message----- From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.o rg] On Behalf Of Johan Meiring Sent: Thursday, August 05, 2010 2:03 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: suffix configuration On 2010/08/05 08:37 PM, Sallee, Stephen (Jake) wrote: >> realms > > ... thank you. Whilst I do appreciate brevity, a single monosyllabic > response seems as though it may be a bit too brief : ) > > Can you elaborate? I am not asking for anyone so solve my problem for > me but rather to be pointed in the correct direction. > Was hoping you had read all the files in /etc/radiusd (or /etc/freeradius) already. Look at modules/realm This is how you "split" off domain\user or user@domain. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RADIUS Certificate question
by Sallee, Stephen (Jake) 06 Aug '10

06 Aug '10

I am about to generate a CSR for my FreeRADIUS Server. The vast majority of my clients are Vista and Win 7 with a few MACs, with this in mind would I be better off going with a 1024 bit cert or would a 2048 bit cert be better? I know both are quite secure, but for platform interoperability and future proofing, does anyone have any thoughts on which one is better? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

mac-auth-bypass
by Brett A. Karns 05 Aug '10

05 Aug '10

Where can I find a good document on using freeRADIUS for mac-auth-bypass? ___________________________________________ Brett

2 1

suffix configuration
by Sallee, Stephen (Jake) 05 Aug '10

05 Aug '10

One last problem and I think I am ready for production, wohoo! When my users try to login with the convention username@domain the login fails because I do not think I have FreeRADIUS correctly configured to parse out the domain, however if they login with the convention domain\username it works fine. Where do I configure the behavior of suffix to act the same as prefix? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 4

freeradius sql modul faild to load
by ziko 05 Aug '10

05 Aug '10

Hello. I have freeradius 2.1.9 on Fedora 13. I also have mysql-server installed and freeradius-mysql package. I created database with Daloradius sql script and everything works, but when i uncomment "sql" in /raddb/sites-enabled/default file, freeradius gives error, failed to load sql modules. what can i do? please help me.

2 1

problems to buid freeRadius v2.1.9 on Solaris 10 (x86)
by maximatt 05 Aug '10

05 Aug '10

hi... :) I have some problems to build freeRadius v2.1.9 on Solaris (x86). I install libCap, GDBM, libTool, openLDAP and openSSL to resolve some dependences and i can generate "make" without problems. But, when i try to compile them (using "gmake") i have the following issue: # gmake : : feof 0x48d /usr/local/ssl/lib/libcrypto.a(bss_file.o) feof 0x323 /usr/local/ssl/lib/libcrypto.a(ui_openssl.o) fseek 0x49b /usr/local/ssl/lib/libcrypto.a(bss_file.o) __udivdi3 0xce /usr/local/ssl/lib/libcrypto.a(b_print.o) __udivdi3 0x4a6 /usr/local/ssl/lib/libcrypto.a(b_print.o) ld: fatal: relocations remain against allocatable but non-writable sections collect2: ld returned 1 exit status gmake[9]: *** [rlm_eap_tls.la] Error 1 gmake[9]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules/rlm_eap/types/rlm_eap_tls' gmake[8]: *** [rlm_eap_tls] Error 2 gmake[8]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules/rlm_eap/types' gmake[6]: *** [types] Error 2 gmake[6]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules/rlm_eap' gmake[5]: *** [rlm_eap] Error 2 gmake[5]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9' gmake: *** [all] Error 2 I try to fix them setting some parameters when i build make script , search in www but i can find nothing that help me fix them... :( Any idea? Thanks in advance! :) -- *Salu2 ;)*

2 4

Trouble migrating EAP TLS authentication from Free Radius 1.1.8 to 2.1.9
by SEELEMANN, Sven 05 Aug '10

05 Aug '10

Hi, I've been trying to migrate the FreeRadius server from 1.1.8 to the latest (stable) release (2.1.9 at the last try, 2.1.8 before that). I'm using EAP TLS to authenticate modem connection to our DSLAM (using 2 way authentication). The 1.1.8 server has no trouble performing the task, however, the 2.1.x server doesn't ever complete the authentication process. From what I can tell, once the 1.1.8 server gets the final TLS ACK it allows the connection, but the 2.1.x server is looking for something else. Is this a FreeRadius issue or a DSLAM problem? If DSLAM, where is the best place to start looking for description of what should be happening? I have openssl 1.0.0 installed on the sparc Solaris 10 server that is running FreeRadius. Using a single modem and debug mode, I've got the following log snippets (from the end of the session each): Version 1.1.8: Waking up in 5 seconds... rad_recv: Access-Request packet from host 138.120.206.110:10000, id=56, length=158 NAS-Identifier = "SSL-7330-3" NAS-IP-Address = 138.120.206.110 User-Name = "00:18:3F:5E:57:B0" NAS-Port = 136383488 NAS-Port-Type = xDSL Acct-Session-Id = "173:26:18::0075" NAS-Port-Id = "atm 1/1/04/13:0:32" Calling-Station-Id = "\000\030?^W\260" EAP-Message = 0x020700060d00 Message-Authenticator = 0x778fd2a832af2ac150c6df5119a51f88 State = 0x2638193a96b23d3b2ac39fe35dff53cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 49 modcall[authorize]: module "preprocess" returns ok for request 49 radius_xlat: '/usr/local/etc/raddb/var/log/radius/radacct/138.120.206.110/auth-detail-20100306' rlm_detail: /usr/local/etc/raddb/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/etc/raddb/var/log/radius/radacct/138.120.206.110/auth-detail-20100306 modcall[authorize]: module "auth_log" returns ok for request 49 modcall[authorize]: module "chap" returns noop for request 49 modcall[authorize]: module "mschap" returns noop for request 49 rlm_realm: No '@' in User-Name = "00:18:3F:5E:57:B0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 49 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 49 modcall[authorize]: module "files" returns notfound for request 49 modcall: group authorize returns updated for request 49 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 49 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 49 modcall: group authenticate returns ok for request 49 Sending Access-Accept of id 56 to 138.120.206.110:10000 MS-MPPE-Recv-Key = 0x7b94ecfc920b6cd85506aee431a4d876e4af891c3dc51c433af623302ace6490 MS-MPPE-Send-Key = 0x370e00c44f3145ad3eaa77720d9e48a102750fcefdb44f980156c67c2dc790ee EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:18:3F:5E:57:B0" Finished request 49 Going to the next request Waking up in 5 seconds... Version 2.1.9: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 138.120.206.113 port 10000, id=202, length=158 NAS-Identifier = "SSL-7330-4" NAS-IP-Address = 138.120.206.113 User-Name = "00:1B:5B:10:97:88" NAS-Port = 136392448 NAS-Port-Type = xDSL Acct-Session-Id = "157:52:37::0371" NAS-Port-Id = "atm 1/1/04/48:0:32" Calling-Station-Id = "\000\033[\020\227\210" EAP-Message = 0x020e00060d00 Message-Authenticator = 0xdffd259e9fa9cef084a12d640fb51073 State = 0x056b0543006508967ef0ed7dafcf0427 +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 14 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] No SSL info available. Waiting for more SSL data. [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 202 to 138.120.206.113 port 10000 EAP-Message = 0x010f000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x056b0543036408967ef0ed7dafcf0427 Finished request 13. Going to the next request Thanks for any assistance, Sven. -- Sven A. Seelemann, P. Eng. Alcatel-Lucent SIT Designer 600 March Road, PO Box 13600 Ottawa, Ontario, CANADA K2K 2E6 email: sven.seelemann(a)alcatel-lucent.com Phone: 613-784-3202 Fax: 613-599-3684

2 1