October 2011 - Freeradius-Users - lists.freeradius.org

ntlm_auth fails @radius-debug
by Andreas Rudat 26 Oct '11

26 Oct '11

Hello, I work with this tutorial http://deployingradius.com/documents/configuration/active_directory.html all works fine, since I try to use ntlm_auth with radius directly I added a user tester / testen users: at the top DEFAULT Auth-Type := ntlm_auth tester Cleartext-Password := "testen" and added to inner-site ->authenticate ntlm_auth then, if if I try radtest tester testen localhost 0 testing123 I get this Found Auth-Type = ntlm_auth WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Thanks

1 1

Re: Unencrypted username in radacct/radpostauth for ttls tunnel authenticated user
by James T. Mugauri 26 Oct '11

26 Oct '11

On 10/26/2011 02:49 PM, freeradius-users-request(a)lists.freeradius.org wrote: > On Access-Accept, store the unencrypted User-Name in the DB, along > with a Class attribute. When you receive an accounting packet, look up > the Class attribute to find the unencrypted User-Name. Thanks I notice when running in debug mode, I have: [ttls] Got tunneled request User-Name = "testairspan(a)iconnect.zm" User-Password = "airspan" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "testairspan(a)iconnect.zm" User-Password = "airspan" FreeRADIUS-Proxied-To = 127.0.0.1 Calling-Station-Id = "00-1f-fb-20-7b-0e" Service-Type = Framed-User NAS-Port-Type = Wireless-802.16 WiMAX-Release = "1.0" ... ... ... [sql] expand: %{User-Name} -> testairspan(a)iconnect.zm [sql] sql_set_user escaped user --> 'testairspan(a)iconnect.zm' The user is then correctly authenticated and receives the relevant parameters What attribute contains the unencrypted username, and at which stage of the inner-tunnel session can I retrieve it? > > That's pretty much the only way with WiMAX. > > Alan DeKok

2 1

Unencrypted username in radacct/radpostauth for ttls tunnel authenticated user
by James T. Mugauri 26 Oct '11

26 Oct '11

Hi, I have managed to auth a Greenpacket WiMAX MS via an eap ttls tunnel. Thanks to Alan's direction earlier, I can also send the service flow definitions correctly. I have now found that subsequent db writes (and logging) associated with accounting and postauth functions are the encrypted values (available in the tunnel?). Is there a way to ensure that the plaintext values are used with all subsequent logging actions? Regards, JamesTM Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley

2 1

eap module change between 2.1.11 & 2.1.12 ?
by Fred 26 Oct '11

26 Oct '11

Hi all, I have a configuration with 2 wifi instances : * default & inner-tunnel for internal users * partners & partners.inner-eap for partners users. for internal user, I have an eap.conf for outer and inner.eap.conf for inner for partners, I have a partners.eap. with eap partners.eap {...virtual_server = partners.inner-tunnel} and so on. Actually, it only works if I only start one site and fails at loading second site ... All those eap configs shares the same parameters, the only difference are references to virtual servers : for partners, virtual_server points to partners ... This worked perfectly until 2.1.12. In 2.1.12, I got an SSL error message at eap module instantiation : rlm_eap: SSL error error:140DB111:SSL routines:SSL_CTX_set_session_id_context:ssl session id context too long rlm_eap_tls: Error reading certificate file /etc/raddb/certs/acs_cert.pem rlm_eap: Failed to initialize type tls /etc/raddb/partners/modules/partners.eap[1]: Instantiation failed for module "partners.eap" /etc/raddb/partners/default[41]: Failed to load module "partners.eap". /etc/raddb/partners/default[28]: Errors parsing authenticate section. Depending of the order of loading, the second eap declaration fails : If I start default and inner-tunnel first, parners eap fails. If I start parners-default and partners.inner-tunnel first, eap for internal user fails when loading default site ... I saw the new version of eap module doc on the wiki, where I can see it's not possible to have multiple instances of eap modules, which I did not saw before. How can I solve this problem which did not occured with 2.1.11 ? FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Sep 27 2011 at 11:59:05 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/radius-fr-ny-wifi.listen.conf including configuration file /etc/raddb/radius-fr-ny-wifi.proxy.conf including configuration file /etc/raddb/local.clients.conf including configuration file /etc/raddb/loadmodules including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/partners/modules/partners.preprocess including configuration file /etc/raddb/partners/modules/partners.files including configuration file /etc/raddb/partners/modules/partners.mschap including configuration file /etc/raddb/partners/modules/partners.eap including configuration file /etc/raddb/partners/modules/partners.inner-eap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/03-default including configuration file /etc/raddb/sites-enabled/02-partners including configuration file /etc/raddb/local.clients.conf including configuration file /etc/raddb/partners/radius-fr-ny-wifi.listen.conf including configuration file /etc/raddb/partners/default including configuration file /etc/raddb/sites-enabled/01-partners.inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 4 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm carrefour.com { nostrip authhost = 10.48.184.69:1812 accthost = 10.48.184.69:1813 secret = cisco } realm LOCAL { } home_server_pool my_auth_failover { type = fail-over home_server = localhost } radiusd: #### Loading Clients #### client 10.48.184.18 { ipaddr = 10.48.184.18 require_message_authenticator = yes secret = "radius" shortname = "neuilly-local-wifi-partners" } client 10.48.184.20 { ipaddr = 10.48.184.20 require_message_authenticator = yes secret = "radius" } client 10.49.64.18 { require_message_authenticator = yes secret = "radius" } client 10.49.64.20 { ipaddr = 10.49.64.20 require_message_authenticator = yes secret = "radius" shortname = "m2-local-wifi" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = LDAP Module: Creating Autz-Type = Status-Server Module: Creating Acct-Type = Status-Server Module: Creating Post-Proxy-Type = Fail Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "10.49.64.25" port = 389 password = "uVgDRrEJ" identity = "cn=syncuser,dc=carrefour,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=People,dc=corp,dc=carrefour,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(&(objectclass=radiusprofile)(!(pwdAccountLockedTime=000001010000Z)) )" password_attribute = "User-Password" auto_header = yes access_attr_used_for_allow = yes groupname_attribute = "radiusGroupName" groupmembership_filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=radiusProfile))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 10 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x2b1d9d963020 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/acs_privkey.pem" certificate_file = "/etc/raddb/certs/acs_cert.pem" CA_file = "/etc/raddb/certs/carrefourca.pem" private_key_password = "cisco" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = yes lifetime = 6 max_entries = 8192 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_challenge" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_challenge { attrsfile = "/etc/raddb/attrs.access_challenge" key = "%{User-Name}" relaxed = no } Module: Linked to module rlm_always Module: Instantiating module "handled" from file /etc/raddb/modules/always always handled { rcode = "handled" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t Virtual-Server : %{%{Virtual-Server}:-DEFAULT} Proxy:%{%{FreeRADIUS-proxied-To}:-NONE} " detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t %{%{Virtual-Server}:-DEFAULT}" detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking pre-proxy {...} for more modules to load Module: Instantiating module "pre_proxy_log" from file /etc/raddb/modules/detail.log detail pre_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" header = "%t Virtual-Server:%{%{control:Virtual-Server}:-DEFAULT} Proxy:%{%{control:FreeRADIUS-Proxied-To}:-NONE} %{%control:{Proxy-To-Realm}:-NoProxyToReal} " detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Instantiating module "post_proxy_log" from file /etc/raddb/modules/detail.log detail post_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" header = "%t Virtual-Server:%{%{Virtual-Server}:-DEFAULT} Proxy:%{%{FreeRADIUS-Proxied-To}:-NONE} %{%{Proxy-To-Realm}:-NoProxyToReal} " detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating module "fail" from file /etc/raddb/modules/always always fail { rcode = "fail" simulcount = 0 mpp = no } Module: Instantiating module "reply_log" from file /etc/raddb/modules/detail.log detail reply_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t Virtual-Server : %{%{Virtual-Server}:-DEFAULT} Proxy:%{%{FreeRADIUS-Proxied-To}:-NONE} " detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server partners { # from file /etc/raddb/sites-enabled/02-partners modules { Module: Creating Auth-Type = partners.eap Module: Checking authenticate {...} for more modules to load Module: Instantiating module "partners.eap" from file /etc/raddb/partners/modules/partners.eap eap partners.eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "Local" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/acs_privkey.pem" certificate_file = "/etc/raddb/certs/acs_cert.pem" CA_file = "/etc/raddb/certs/carrefourca.pem" private_key_password = "cisco" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = yes lifetime = 6 max_entries = 8192 } } rlm_eap: SSL error error:140DB111:SSL routines:SSL_CTX_set_session_id_context:ssl session id context too long rlm_eap_tls: Error reading certificate file /etc/raddb/certs/acs_cert.pem rlm_eap: Failed to initialize type tls /etc/raddb/partners/modules/partners.eap[1]: Instantiation failed for module "partners.eap" /etc/raddb/partners/default[41]: Failed to load module "partners.eap". /etc/raddb/partners/default[28]: Errors parsing authenticate section.

3 10

Re: FreeRadius Losing packets in Multi-Threads mode
by Pierre Rondou 26 Oct '11

26 Oct '11

Hello, On Tue, 25 Oct 2011 21:09:31 +0100, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > > however, as Alan said. in single thread mode, you only have one process > dealing with > requests.....so one single open connection to SQL, one single sesion to > LDAP etc etc > (whatever you use) - eg even a local file with PERL. > > with multithread mode, you have many threads - all of which can be hitting > your SQL or LDAP > at same time...or trying to write to the same file in a PERL module....so > you have to look > at the speed/ability of your backend....the jump from a single query ata > time to concurrent > queries may have tipped your balance > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Here is what I had thought about: FreeRadius correctly treats the requests (answer are always received), but there is a locking problem with the log files, meaning that basically, only one thread can write inside. Is there any solution about that? As stated before, there is no overloading problem on the server. Running in single thread could be a solution, but it's really slow compared to multi-thread ... Regards, Pierre

3 3

Re: Freeradius rlm_sql: Failed to create the pair: Invalid TLV specification (WiMAX MS)
by James T. Mugauri 26 Oct '11

26 Oct '11

Apologies for my incorrectly headed last response: On 10/26/2011 12:11 AM, freeradius-users-request(a)lists.freeradius.org wrote: > You just add the attributes, and the server will take care of > encapsulating them in TLVs. Is there any thing i must pay attention to with regard to either (or both of): 1. The order in which i define the attributes, especially when i am defining 2 QoS-Descriptors (for downlink and uplink e.g.) and 2 or more Packet-Flow-Descriptors (for controlling different types of traffic) 2. The operator I should use. When should I use '+=', or is ':=' alright in every instance? Regards, JamesTM

1 0

Re: Freeradius-Users Digest, Vol 78, Issue 111
by James T. Mugauri 26 Oct '11

26 Oct '11

On 10/26/2011 12:11 AM, freeradius-users-request(a)lists.freeradius.org wrote: > You just add the attributes, and the server will take care of > encapsulating them in TLVs. Is there any thing i must pay attention to with regard to either (or both of): 1. The order in which i define the attributes, especially when i am defining 2 QoS-Descriptors (for downlink and uplink e.g.) and 2 or more Packet-Flow-Descriptors (for controlling different types of traffic) 2. The operator I should use. When should I use '+=', or is ':=' alright in every instance? Regards, JamesTM

2 1

Fwd: Need help on "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user"
by Stephen Kwok 25 Oct '11

25 Oct '11

Hi, I am a newbie to FreeRADIUS and I have run into a problem during the setup. I have spent some time on researching for an answer online, but I got no luck. I have described the problem as below. Could anyone please let me know what went wrong? Thank you so much in advance. Stephen OS: Mac OSX 10.6.8 FreeRADIUS version: 2.1.12 Steps taken: 1. Downloaded freeradius from http://freeradius.org/download.html 2. Decompressed it 3. Copied the decompressed folder to /sw/freeradius-server-2.1.12 4. Added "testing Cleartext-Password := "password"" to the top of /sw/freeradius-server-2.1.12/raddb/users and saved the file 5. Opened a terminal console 6. Executed sudo - root 7. Cd to /sw/freeradius-server-2.1.12 8. Followed Building on MAC OSX on http://wiki.freeradius.org/Build: ./configure --enable-developer make sudo make install 9. Cd to /sw/freeradius-server-2.1.12/src/main 10. Executed radiusd -X 11. Open another terminal console 12. Executed sudo - root 13. Cd to /sw/freeradius-server-2.1.12/src/main 14. Executed radtest testing password 127.0.0.1 0 testing123 *Client Output* machine:~ root# radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 209 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 172.16.142.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=209, length=20 FreeRADIUS Debugging Output This colorized output was produced by an automated tool<http://networkradius.com/freeradius.html> from Network RADIUS <http://networkradius.com/> ------------------------------ FreeRADIUS Version 2.1.12, for host i386-apple-darwin10.8.0, built on Oct 25 2011 at 14:21:07 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes use_open_directory = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 63625 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. *Packet 0* ------------------------------ rad_recv: Access-Request packet from host 127.0.0.1 port 64417, id=253, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 172.16.142.1 NAS-Port = 0 Message-Authenticator = 0xac50d12cd56157895ad148d9eae1fab3 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 253 to 127.0.0.1 port 64417 Waking up in 4.9 seconds. Cleaning up request 0 ID 253 with timestamp +52 Ready to process requests.

3 2

Free Radius 2.1.10 ubuntu 10.10 Multiple RootCA
by Kris Armstrong 25 Oct '11

25 Oct '11

I am trying to configure free radius with multiple ROOT CA's. This is not a products environment it is purely a test environment. We need the ability to test out products against freeradius and other radius servers. using multiple different certificate sizes and ROOT CA's. I currently have the following in my EAP.conf file. Based on the way I read the eap.conf file this would be the correct way of doing it. Here is what happens. I can authenticate against the first ROOT CA no matter which one it is as long as its the first in the list. its like all other CA's are ignored. In the below as you can see I have commented out the first few ROOT CAs and the 1024ca.pem is the current first in the list. I am able to authenticate against this one but none past. if I comment out 1024 then I can authenticate against the next. Any help would be greatly appreciated. I had read on another forum that in order to support multiple ROOT CAs you just put them all in the same file. I tried this as well with just the certs as well as with the certs and the private keys neither seemed to work. I believe that was on a Radius 1.x server though so maybe Freeradius 2.1.10 Ubuntu 10.04 Thanks, #certdir = ${confdir}/certs #cadir = ${confdir}/certs #certdir = /etc/freeradius/certs20080204 #cadir = /etc/freeradius/certs20080204 certdir = /etc/freeradius/Certs11-20-2011/client/pem cadir = /etc/freeradius/Certs11-20-2011/CA/pem #private_key_password = whatever #private_key_file = ${certdir}/server.pem private_key_password = passphrase #private_key_file = ${certdir}/1010Client.pem private_key_file = ${certdir}/1024_1024client.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. #certificate_file = ${certdir}/server.pem #certificate_file = ${certdir}/1010Client.pem certificate_file = ${certdir}/1024_1024client.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #CA_file = ${cadir}/ca.pem #CA_file = ${cadir}/PV_10_CA.pem #CA_file = ${cadir}/CA/pem/1024ca.pem #CA_file = ${cadir}/512ca.pem #CA_file = ${cadir}/768ca.pem CA_file = ${cadir}/1024ca.pem CA_file = ${cadir}/1280ca.pem CA_file = ${cadir}/1536ca.pem CA_file = ${cadir}/1792ca.pem CA_file = ${cadir}/2048ca.pem CA_file = ${cadir}/4096ca.pem Thanks, Kris Armstrong CCNP, CCDP, MCSE, Security+, A+ Cell Ph:719.440.30.79 Google Voice: 719.357.5821 Fax Ph: 866.390.8416 E-Mail: kris.armstrong(a)me.com Skype: kris.armstrong(a)gmail.com FaceTime: kris.armstrong(a)me.com

2 1

FreeRadius Losing packets in Multi-Threads mode
by Pierre Rondou 25 Oct '11

25 Oct '11

Hello everybody, I'm currently running freeradius on a debian (squeeze) server # uname -a Linux test 2.6.32-5-amd64 #1 SMP Mon Oct 3 03:59:20 UTC 2011 x86_64 GNU/Linux # freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 The problem is that the server seems to lose accounting packets in Multithread mode Logging with module "detail" or "linelog" logs only a very little amount (0.5%) of the transmitted packets. The client receive all the answer, but my problem is that I rely on those logs for an other program. Example: # echo "Message-Authenticator = 0x00" | radclient 127.0.0.1 acct testing123 -c 2500000 > temp && wc -l temp && wc -l /var/log/freeradius/radacct/127.0.0.1/detail-20111025 2500000 temp 84224 /var/log/freeradius/radacct/127.0.0.1/detail-20111025 This only happen when using FreeRadius in Multithread mode, while using it in single-thread (freeradius -s), all the packets are logged correctly. Anyone has a hint on this problem? Regards, Pierre Rondou

5 8