August 2010 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

FR 2.1.0 (ubuntu) proxying to NPS/IAS.
by Ville Leinonen 02 Feb '11

02 Feb '11

Hi, I try to use FR to forwarding access-request to NPS servers, but some reason FR/NPS gives "User password is incorrect" message. I have tripple check that password is correct. When i test IAS to NPS proxy it works. I have enable in NPS side MS-CHAP-v2, MS-CHAP, CHAP and PAP/SPAP methods. Any clue what is wrong? Here is some logs: rad_recv: Access-Request packet from host 192.168.21.150 port 1025, id=57, length=154 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "vle", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "vle" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user vle to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} ++[files] returns noop Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Proxying request 0 to home server 192.168.21.200 port 1812 Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.21.200 port 1812, id=118, length=52 Proxy-State = 0x3537 Reply-Message = "User password is incorrect" Br, Ville

6 11

rlm_python and dynload problem
by Aurélien Geron 07 Jan '11

07 Jan '11

Hi, I came across a bug when rlm_python executes python code that tries to load a dynamic (shared) module. This bug seems to have been discussed 2 or 3 times on this list, but no really satisfying solution appears to have been found so far (as far as I know), so I thought I might raise the subject again and perhaps try to contribute in finding a solution. In short, I think the solution to this problem is explained here, but I don't know how to implement it in freeRADIUS : http://docs.python.org/release/2.5.2/ext/link-reqs.html Here is my setup : - running a perfectly standard Debian Lenny (2.6.26-2-amd64) - installed the latest freeradius package from the lenny-backports (2.1.8+dfsg-1~bpo50+1) - the python debian package is the one installed with Debian Lenny (2.5.2-3) Here is my config: ---------------------------------------------- ####### # /etc/freeradius/modules/python ####### python python_test { mod_instantiate = radiusd_test func_instantiate = instantiate } ####### # /etc/freeradius/radiusd.conf ####### ... instantiate { python_test } ... ####### # /usr/lib/python2.5/site-packages/radiusd_test.py ####### def instantiate(p): radiusd.radlog(radiusd.L_DBG, "THIS WORKS") import random # this crashes radiusd.radlog(radiusd.L_DBG, "THIS IS NEVER REACHED !") ---------------------------------------------- Here is the output of "freeradius -X" : ---------------------------------------------- FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Apr 26 2010 at 21:49:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf ... Module: Linked to module rlm_python Module: Instantiating python_test python_init done python python_test { mod_instantiate = "radiusd_test" func_instantiate = "instantiate" } THIS WORKS rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/lib/python2.5/lib-dynload/math.so: undefined symbol: PyExc_ValueError /etc/freeradius/modules/python[24]: Instantiation failed for module "python_test" ---------------------------------------------- The module is properly loaded, the "instantiate" function gets called, and the first log message is output. In fact, any 100% pure python code works fine. The bug happens when a python module gets loaded dynamically : importing any module located in /usr/lib/python2.5/lib-dynload/*.so will crash. >From what I understand, here's what happens: 1) rlm_python was built against libpython2.5.a, but for optimization purposes, the linker stripped out all the symbols that were not used by rlm_python itself (including, for example, PyExc_ValueError). This behavior is platform-dependent, which probably explains why everything works fine on centos, for example. 2) when the radiusd_test module runs, it tries to import the "random" module, which itself tries to import the "math" module, which is in lib-dynload, and gets loaded dynamically. 3) unfortunately, python fails to load that module because it uses the PyExc_ValueError symbol and it does not know where it is defined (it is located in /usr/lib/libpython2.5.so.1, but unfortunately, the "math" module does not know that. As I said, I believe that the solution to this problem is clearly explained here: http://docs.python.org/release/2.5.2/ext/link-reqs.html As it's just a few paragraphs, I'll quote it here, for your convenience: ---------------------------------------------- While the configure script shipped with the Python sources will correctly build Python to export the symbols needed by dynamically linked extensions, this is not automatically inherited by applications which embed the Python library statically, at least on Unix. This is an issue when the application is linked to the static runtime library (libpython.a) and needs to load dynamic extensions (implemented as.so files). The problem is that some entry points are defined by the Python runtime solely for extension modules to use. If the embedding application does not use any of these entry points, some linkers will not include those entries in the symbol table of the finished executable. Some additional options are needed to inform the linker not to remove these symbols. Determining the right options to use for any given platform can be quite difficult, but fortunately the Python configuration already has those values. To retrieve them from an installed Python interpreter, start an interactive interpreter and have a short session like this: >>> import distutils.sysconfig >>> distutils.sysconfig.get_config_var('LINKFORSHARED') '-Xlinker -export-dynamic' The contents of the string presented will be the options that should be used. If the string is empty, there's no need to add any additional options. The LINKFORSHARED definition corresponds to the variable of the same name in Python's top-level Makefile. ---------------------------------------------- I think the short-term solution to this bug is to modify "src/modules/rlm_python/configure.in" and make it use the LINKFORSHARED linker options when linking rlm_python against libpython2.5.a., This could be done by adding a line such as: PY_OTHER_LDFLAGS=`sed -n -e 's/^LINKFORSHARED=$.*$/\1/p' $PY_MAKEFILE` just under this one: PY_OTHER_LIBS=`sed -n -e 's/^LIBS=$.*$/\1/p' $PY_MAKEFILE` and then using $PY_OTHER_LDFLAGS somewhere... the thing is, I have no idea where, because I am new to all these dynamic modules and embedded interpreters . I tried this though: python_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $PY_OTHER_LDFLAGS -lpython${PY_VERSION} -lm" and recompiled the debian package (dpkg-buildpackage), but the problem was not fixed. Can someone tell me where to add those options exactly ? I can try recompiling as many times as necessary. Apparently, at least one person complains about the fact that you have to link against the static python runtime library (libpython2.5.a) even when you plan to use dynamic modules, and he has opened a bug report here: http://bugs.python.org/issue4434 Basically, if I understand correctly, his idea is to have the python fellows declare the proper dependencies in every *.so file, so that the libpython2.5.so.1 file gets loaded automatically when the "math" module (or any other dynamic module) gets loaded. Maybe that's the ideal solution, I really don't know. But it seems to me that we should try to fix freeRADIUS so that it works around this bug before python dependencies are fixed (it make take a while or even never happen). So I thing the only short-medium-term solution is to use LINKFORSHARED linker options. Thanks for reading this huge message. I hope we can beat this bug. Aurelien Geron

3 8

Reals Based Upon Port
by Brian Carpio 17 Dec '10

17 Dec '10

Hi, Currently I am using freeradius2-2.1.8-2 to load balance radius traffic between two hosts, I have a single realm DEFAULT setup which proxies the radius traffic between the two servers and that works great, however now I have an unusual need to proxy auth/acct radius traffic to non standard ports and I'm unsure how (or even it's even possible) to setup a new realm which is based on destination port for instance. Default Server 1 - Auth/Acct - Port 1812,1813 Default Server 2 - Auth/Acct - Port 1812,1813 Pool Default - Default Server 1 - Default Server 2 Realm Default - Pool Default - NOTE: Traffic coming into freeradius on the standard 1812/1813 ports will be sent to this default realm (which I have working perfectly now) ---- Up to this point I have it all working ---- Alt Server 1 - Auth/Acct - Port 1815/1816 Alt Server 2 - Auth/Acct - Port 1815/1816 Pool Alt - Alt Server 1 - Alt Server 2 Realm Alt - Pool Alt - NOTE: Traffic coming into freeradius on 1815/1816 will be sent to this Alt realm... I am just wondering if this is possible. Or if I would need to setup another instance of freeradius with its own configuration to do this alternative ports setup. Thanks a lot! Brian Carpio Senior Systems Engineer Office: +1.303.962.7242 Mobile: +1.720.319.8617 Email: bcarpio(a)broadhop.com

2 9

FR proxy to ACS and NPS with MS CHAP v2
by SagiBarOr 05 Dec '10

05 Dec '10

We are developing a security scheme in which we use EAP TTLS MS CHAP v2 with Proxy. The TTLS phase is done with the first AAA server, and the second step, with MS CHAP v2, is proxied to another AAA (which is an LDAP server). When the first AAA server is FR and the second one is also FV, then authentication is OK. When the second AAA server is ACS (Cisco) or NPS (MS), the MS CHAP v2 authentication fails. We preformed troubleshooting and elimination testing which indicate the issue is with the pwd. Not with the user name. For example it also fails with the local DB of the 2nd AAA server. Also the verbose error log shows the user account is found. Looks like something is wrong with the pwd hash. will most appreciate your expert opinion. Thnks Sagi -- View this message in context: http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 31

Certificate-based client side authentication towards a website with freeradius
by Martin Schneider 01 Dec '10

01 Dec '10

Hello all, we're trying to setup a freeradius / apache installation that allows us to authenticate and authorize users with *certificates* towards a website. Is there a good tutorial out there somewhere? We did only finde partial information that seems to be quite old unfortunately. Or could somebody who is deep into this matter please give some advice or ideas how we can solve our task? Best regards M

5 10

RADIUS reading LDAP attributes
by Sigurd Foshaug 04 Sep '10

04 Sep '10

Hi all, I have a freeradius 2.1.3 running and I can successfully authenticate users. I would like to use a users LDAP attribute so I can provide them with different permissions on the proxy server. I have currently mapped a RADIUS attribute to the LDAP attribute and it successfully reads the attribute when a user is authenticating. >From radiusd -X: rlm_ldap: description -> My-Local-LDAP-Comment = "STAFF" So the user in question has STAFF as a comment in his ldap description attribute. I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this: ATTRIBUTE My-Local-LDAP-Comment 3000 string and in the raddb/ldap.attrmap I have added: replyItem My-Local-LDAP-Comment description Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS, so I can make rules depending on its contents? Any suggestions on what to do, or which documentation to read would be appreciated. Thanks, Sigurd

2 2

..::Huntgroup Issues::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi, I'm trying to use the huntgroup feature on the freeradius software with out luck. I think I'm missing something that's why I'm sending this email maybe you can help me. Right now I have the following files: huntgroups file at the end: squid NAS-IP-Address == 127.0.0.1 users file at the end: alfonso Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "squid" clients.conf at the end: client 127.0.0.1 { secret = xxxxxxxxxxx shortname = squid } When I try with the radtest to log in, I get an access-reject. Here's the client side response: [root@mscitum raddb]# radtest alfonso testing localhost 10 xxxxxxx Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 Here's the output of the debug, it seems that it doesn't find the config file. rad_recv: Access-Request packet from host 127.0.0.1:36858, id=134, length=59 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "alfonso", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 134 to 127.0.0.1 port 36858 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 134 with timestamp 4c7319f1 Nothing to do. Sleeping until we see a request. May be I'm missing to enable some feature, thanks in advance for your help. Regards Alfonso.

3 4

Failed (re-)authentification after some time...
by Jan Zacharias 02 Sep '10

02 Sep '10

Something strange is going on: we do re-authentification every ten seconds with one WinXP SP3 client hooked up to a Cisco 3560G Switch. The reauth interval is small to stress-test the setup. It works w/a problems for 1-2 Days, then we get: Sun Aug 15 10:00:51 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:00:51 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:05 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:05 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:39 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 157 due to unfinished request 125603 Sun Aug 15 10:01:44 2010 : Error: Child PID 30686 is taking too much time: forcing failure and killing child. Sun Aug 15 10:01:44 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:44 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) The last two entries are due to the crappy windows client. If auth fails once, it thinks, that the saved auth info is wrong and deletes it, querying the user to enter mschap(PEAP) login/pw again. The entry Sun Aug 15 10:01:39 2010 is interesting as no client was connected to port 1645 at that time and the two days before, however it seems as if this triggers the timeout initially. My question: can I somehow extend the timeout or do anything else to prevent this from happening?

2 9

CA_file vs. CA_path
by David Mitchell 31 Aug '10

31 Aug '10

I now have 2.1.10 compiled and running. It seems to work fine. I did have to make one change to my configuration. I had been using CA_path to refer to the certificates which can authenticate clients for EAP-TLS authentication in 2.1.8. In 2.1.10, that doesn't seem to work. If I specify a single file via CA_file that works fine. I can manage either way I think since the file referenced in CA_file can contain multiple certificates. I did verify that I had run 'c_rehash' in my CA_path directory. I'm not sure why CA_path doesn't work since the OpenSSL docs indicate that they are largely interchangable. Is it an intentional change? I didn't see anything in the ChangeLog about it. -David -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 3