October 2011 - Freeradius-Users - lists.freeradius.org

Freeradius rlm_sql: Failed to create the pair: Invalid TLV specification (WiMAX MS)
by James T. Mugauri 25 Oct '11

25 Oct '11

Hi, I am running 2.1.12 in an attempt to auth Wimax users. However I am having difficulty defining TLVs for WiMAX-QoS-Descriptor and associated WiMAX-Packet-Flow-Descriptor I used a post on the matter in the freeradius mailing list which suggested something to the effect of: INSERT INTO radgroupreply (groupname, attribute, op, value) VALUES ('WiMAX_Test3', 'WiMAX-QoS-Id', ':=', '101'), ('WiMAX_Test3', 'WiMAX-Service-Class-Name', ':=', 'DATA'), ('WiMAX_Test3', 'WiMAX-Schedule-Type', ':=', 'Best-Effort'), ('WiMAX_Test3', 'WiMAX-Traffic-Priority', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Maximum-Sustained-Traffic-Rate', ':=','512000'), ('WiMAX_Test3', 'WiMAX-Reduced-Resources-Code', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Packet-Data-Flow-Id', ':=', '21'), ('WiMAX_Test3', 'WiMAX-Service-Data-Flow-Id', ':=', '21'), ('WiMAX_Test3', 'WiMAX-Direction', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Activation-Trigger', ':=', '15'), ('WiMAX_Test3', 'WiMAX-Transport-Type', ':=', 'IPv4-CS'), ('WiMAX_Test3', 'WiMAX-Uplink-QOS-Id', ':=', '101'), ('WiMAX_Test3', 'WiMAX-Uplink-Classifier', ':=', 'permit in any src any dst any priority 1'), ...etc This did not work, as the greenpacket SM keeps on trying to connect as if it is not authenticated, despite the following attributes being returned in the Access-Accept packet: Sending Access-Accept of id 84 to 10.11.12.13 port 1812 Framed-IP-Address := XXX.XX.12.12 Framed-IP-Netmask := 255.255.255.224 WiMAX-DNS-Server := XXX.XX.12.65 Framed-Route := "XXX.XX.12.30" WiMAX-QoS-Id := 101 WiMAX-Service-Class-Name := "DATA" WiMAX-Schedule-Type := Best-Effort WiMAX-Traffic-Priority := 1 WiMAX-Maximum-Sustained-Traffic-Rate := 512000 WiMAX-Reduced-Resources-Code := 1 WiMAX-Packet-Data-Flow-Id := 22 WiMAX-Service-Data-Flow-Id := 22 WiMAX-Direction := Downlink WiMAX-Activation-Trigger := 15 WiMAX-Transport-Type := IPv4-CS WiMAX-Uplink-QOS-Id := 101 WiMAX-Uplink-Classifier := "permit in any src any dst any priority 1" WiMAX-QoS-Id += 102 WiMAX-Service-Class-Name += "DATA" WiMAX-Schedule-Type += Best-Effort WiMAX-Traffic-Priority += 1 WiMAX-Maximum-Sustained-Traffic-Rate += 400000 WiMAX-Reduced-Resources-Code += 1 WiMAX-Downlink-QOS-Id := 102 WiMAX-Downlink-Classifier := "permit in any src any dst any priority 1" MS-MPPE-Recv-Key = 0xdd5af25dadbfeba854cc0c6a5694abe0636104f1551530a9537855ecb6629d7e MS-MPPE-Send-Key = 0x93064994b3908d600cdab33f17742a4de175db703101a8cd5019b0384a885d98 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}00E6D4F0ED7C281D867BE1534026CDA8IC3513" Finished request 4. I thought i would add an attribute pair to be explicit that I am defining TLVs, by inserting the following rows in the database (at the appropriate rows by id): ('WiMAX_Test3', 'WiMAX-QoS-Descriptor', '=', '...'), ('WiMAX_Test3', 'WiMAX-Packet-Flow-Descriptor', '=', '...'), ...etc but i then get the error specified in the subject above. Can anyone shed light on how to correctly populate radgroupreply to ensure proper definition of WiMAX TLVs? Or perhaps I am doing something else wrong? Hopefully, JamesTM -- Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley

2 1

Free Radius 2.1.10 ubuntu 10.10 Multiple RootCA
by Kris Armstrong 25 Oct '11

25 Oct '11

I am trying to configure free radius with multiple ROOT CA's. This is not a products environment it is purely a test environment. We need the ability to test out products against freeradius and other radius servers. using multiple different certificate sizes and ROOT CA's. I currently have the following in my EAP.conf file. Based on the way I read the eap.conf file this would be the correct way of doing it. Here is what happens. I can authenticate against the first ROOT CA no matter which one it is as long as its the first in the list. its like all other CA's are ignored. In the below as you can see I have commented out the first few ROOT CAs and the 1024ca.pem is the current first in the list. I am able to authenticate against this one but none past. if I comment out 1024 then I can authenticate against the next. Any help would be greatly appreciated. I had read on another forum that in order to support multiple ROOT CAs you just put them all in the same file. I tried this as well with just the certs as well as with the certs and the private keys neither seemed to work. I believe that was on a Radius 1.x server though so maybe there is a change in the 2.x? Any thoughts or ideas that I might be missing would be greatly appreciated thanks in advance. Freeradius 2.1.10 Ubuntu 10.04 Thanks, #certdir = ${confdir}/certs #cadir = ${confdir}/certs #certdir = /etc/freeradius/certs20080204 #cadir = /etc/freeradius/certs20080204 certdir = /etc/freeradius/Certs11-20-2011/client/pem cadir = /etc/freeradius/Certs11-20-2011/CA/pem #private_key_password = whatever #private_key_file = ${certdir}/server.pem private_key_password = passphrase #private_key_file = ${certdir}/1010Client.pem private_key_file = ${certdir}/1024_1024client.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. #certificate_file = ${certdir}/server.pem #certificate_file = ${certdir}/1010Client.pem certificate_file = ${certdir}/1024_1024client.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #CA_file = ${cadir}/ca.pem #CA_file = ${cadir}/PV_10_CA.pem #CA_file = ${cadir}/CA/pem/1024ca.pem #CA_file = ${cadir}/512ca.pem #CA_file = ${cadir}/768ca.pem CA_file = ${cadir}/1024ca.pem CA_file = ${cadir}/1280ca.pem CA_file = ${cadir}/1536ca.pem CA_file = ${cadir}/1792ca.pem CA_file = ${cadir}/2048ca.pem CA_file = ${cadir}/4096ca.pem Thanks, Kris Armstrong

2 1

update RAD_REPLY with += in rlm_perl
by Energ 25 Oct '11

25 Oct '11

hi all! how do i update RAD_REPLY correctly with perl if i want to add addtiotional Cisco-AVPair in reply? lets say user profile has Cisco-AVPair="something1". I can have multiple of those by adding to user profile another pair like this Cisco-AVPair+="something1". But how to do the same while processing with rlm_perl? How to hablde hash update in this situation? thx! -- View this message in context: http://freeradius.1045715.n5.nabble.com/update-RAD-REPLY-with-in-rlm-perl-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Stop Logging in radpostauth table
by Det Det 25 Oct '11

25 Oct '11

Hi, How do I stop logging in radpostauth table? Is commenting out the query that inserts to radpostauth a correct way of doing that? thanks! det

2 2

Load FR on boot with Ubuntu?
by David Peterson 24 Oct '11

24 Oct '11

Can someone show me how to load FR on boot in Ubuntu? David

4 5

Installation docu
by Andrej 24 Oct '11

24 Oct '11

Hi, Not sure whether this is the right list to be writing to (the website suggests it is), and I'm not following the suggested method (patch documentation, and post it here if I don't want to use git), but I wouldn't really know which document to patch with my suggestion. I wanted to (and eventually managed to) install freeradius 2.1.12 with a PostgreSQL backend. The existing docu, and the output of ./configure --help give no clues as to what's required. A run of ./configure w/o any parameters didn't pick up my postgres install (which has its headers and libs in fairly commonplace locations). Only grepping for -ril postgres I found configure options in the redhat.spec file, and using those radius built against Postgres just fine ... can this info either be added into the configure script, or the INSTALL document? Cheers, Andrej

4 7

Workload in freeradius‏ platform
by siguillaume 24 Oct '11

24 Oct '11

Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp4… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 18

Re: Installation docu
by Alan Buxey 23 Oct '11

23 Oct '11

Guess it depends on your distro and setup? ./configure worked fine here for full postgresql support... alan -- Message may be brief as it has been sent from my mobile

1 0

radius + ldap + ntlm
by Andreas Rudat 23 Oct '11

23 Oct '11

Hello, I understand it correctly, that I can't use peap + mschapv2 with ldap? Im realy confused atm, what I can realy use, everytime I think its fine, I found another unsecure thing :/ Thanks

3 5

Re: SSL error after updating cert
by Eric Geier 21 Oct '11

21 Oct '11

Thanks for the reply! Yes, the clients are set with correct time/date. That command didn't work. Did you mean openssl verify command? I ran that and both the old cert (still valid for a few days) and the new cert (already valid) shows correct domain but then says: error 20 at 0 depth lookup:unable to get local issuer certificate This may not be the problem since I get it with both old and new certs. Any other ideas? On Fri Oct 21 14:56:33 CDT 2011, James J J Hooper <jjj.hooper(a)bristol.ac.uk> wrote: > On 21/10/2011 20:44, Eric Geier wrote: >> Hi, I?m trying to update my server?s cert, but getting errors >> after applying it: >> >> Fri Oct 21 12:26:45 2011 : Error: TLS Alert >> read:fatal:certificate >> expired >> Fri Oct 21 12:26:45 2011 : Error: TLS_accept:failed in SSLv3 >> read client certificate A >> Fri Oct 21 12:26:45 2011 : Error: rlm_eap: SSL error >> error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert >> certificate expired >> Fri Oct 21 12:26:45 2011 : Error: rlm_eap_tls: SSL_read failed >> inside of TLS (-1), TLS session fails. >> >> Says expired but I?m using the new cert, which is a renewal from >> a >> third-party CA and using the same private key. I apply it by >> inserting the text of the .crt file into the server-cert.pem file >> in the certs folder. I think that?s all I have to do and restart >> freeradius? >> > > 1) Check the date on the client system is correct > > 2) do: > openssl -in /path/to/your/raddb/server-cert.pem -noout -text > and verify the properties of the cert you have. > > -James > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1