February 2011 - Freeradius-Users - lists.freeradius.org

missing config items on reinstall
by Raymond Norton 15 Feb '11

15 Feb '11

I had installed openssl and freeradius (deb package) on Ubuntu 10.04, but had made a mess of things and decided to just purge everything and start over. Freeradius will not start now, because the symlinks and radiusd.conf file were not reproduced.: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file /etc/freeradius/certs/server.pem rlm_eap: Failed to initialize type tls I can copy over another .conf file and look at another server for the symlinks, but is there a way to fix this, without piecing things together, and preventing this from occurring in the future?

3 4

Re: Free radius + openldap specific group + cisco switch
by premsudhan 15 Feb '11

15 Feb '11

Help please. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Free-radius-openldap-specific-group… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

How to set Authentication method priority??
by vijay s sheelavantar 14 Feb '11

14 Feb '11

Hi, 1.     I have pam_radius_auth module configured to authenticate the login users. I have configured FreeRadius Server on a linux machine. I want to set the the priority for "local authentication" or "Radius authentication" for SSH. How can I do this? 2. I have created a user called "user" on client machine with passwd "123qwe" and I have created the same user on server with password "User_12", when authentication request reached the server it is sending "Access-Accept" message back to client, but user is not getting access to the machine(SSH). I have following configuration in my /etc/pam.d/ssh file auth       sufficient    pam_radius_auth.so debugauth       required     pam_nologin.soauth       required     pam_unix.soauth       required     pam_env.so # [1]auth       required     pam_tally.so deny=10 per_user account    required     pam_unix.so session    required     pam_unix.sosession    optional     pam_motd.so # [1]session    optional     pam_mail.so standard noenv # [1]session    required     pam_limits.so #password   required     pam_unix.so # Alternate strength checking for password. Note that this# requires the libpam-cracklib package to be installed.# You will need to comment out the password line above and# uncomment the next two in order to use this.## password required       pam_cracklib.so retry=3 minlen=6 difok=3# password required       pam_unix.so use_authtok nullok md5 password required       pam_cracklib.so retry=3 minlen=8 difok=3 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 password required       pam_unix.so use_authtok nullok md5 shadow remember=5 Please let me know If I am making any mistake here. and help me to set the priority. Thanx and RegardsVijay S.

1 0

Persistent MySQL connections to arbitrary databases
by Jonathan Gazeley 14 Feb '11

14 Feb '11

I am asking about MySQL connections to a database *other than* the usual radius database. For one of my wireless SSIDs, part of the authorization process invokes a perl script which opens a MySQL handle to a different database, does a query, destroys the handle, and returns the value to radiusd. There's a lot of overhead in this so I would like to make radiusd open a pool of handles to this database, as it does with its own database. What's the approved method for making radiusd open persistent connections to an arbitrary database, and then using these handles from a perl module? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team IT Services University of Bristol ----------------------------

11 47

Windows 7 EAP-TLS WIred Auth
by Christ Schlacta 14 Feb '11

14 Feb '11

I'm trying to authenticate a wired client (Switch supports radius) and I'm getting the following output (or similar): rad_recv: Access-Request packet from host 10.0.0.13 port 1024, id=161, length=136 User-Name = "izanami" Called-Station-Id = "30-46-9a-16-00-bc" Calling-Station-Id = "bc-ae-c5-91-67-a3" NAS-Identifier = "30-46-9a-16-00-ba" NAS-Port = 12 Framed-MTU = 1500 NAS-Port-Type = Ethernet EAP-Message = 0x0201000c01697a616e616d69 Message-Authenticator = 0xa794e968adbaf0f9398574107af8a2fb ? Evaluating (User-Name == bubbles) -> FALSE +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [files] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDN})) -> (&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (&(cn=WifiDisabled)(&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=izanami,ou=RadHosts,dc=aarcane,dc=info, with filter (objectclass=*) rlm_ldap::groupcmp: Group WifiDisabled not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for izanami [ldap] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] macAddress -> Calling-Station-Id == "bc-ae-c5-91-67-a3" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user izanami authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 rlm_checkval: Value Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 ++[checkval] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 161 to 10.0.0.13 port 1024 Service-Type = Administrative-User EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5f8b66d45f896b3ed367e3714d4f5e92 Finished request 114. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.13 port 1024, id=162, length=247 User-Name = "izanami" Called-Station-Id = "30-46-9a-16-00-bc" Calling-Station-Id = "bc-ae-c5-91-67-a3" NAS-Identifier = "30-46-9a-16-00-ba" NAS-Port = 12 Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5f8b66d45f896b3ed367e3714d4f5e92 EAP-Message = 0x020200690d800000005f160301005a0100005603014d585bc08003e569e30a71f5a39088d3d8a8ad4ac62ced01cd057f171fb48b59000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x5e953afa8c6d6fb70318d9ff899a5633 ? Evaluating (User-Name == bubbles) -> FALSE +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 2 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [files] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDN})) -> (&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (&(cn=WifiDisabled)(&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=izanami,ou=RadHosts,dc=aarcane,dc=info, with filter (objectclass=*) rlm_ldap::groupcmp: Group WifiDisabled not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for izanami [ldap] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] macAddress -> Calling-Station-Id == "bc-ae-c5-91-67-a3" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user izanami authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 rlm_checkval: Value Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 ++[checkval] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08e6], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0159], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 162 to 10.0.0.13 port 1024 Service-Type = Administrative-User EAP-Message = 0x010304000dc000000a7f16030100310200002d03014d585c00e6cff8b49f97e451a451dbfb05893664517f78d8d61b9df37d341f4a00002f000005ff0100010016030108e60b0008e20008df0003d9308203d5308202bda003020102020102300d06092a864886f70d010 10505003081a0310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f06035504071308416e74656c6f706531183016060355040a130f5363686c616374612046616d696c7931133011060355040b130a4b65795369676e696e67311630140603550403130d53 63686c6163746143657274323122302006092a864886f70d01090116 EAP-Message = 0x1361617263616e654061617263616e652e6f7267301e170d3130313030313036323234395a170d3230303932383036323234395a3081a1310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f06035504071308416e74656c6f7 06531183016060355040a130f5363686c616374612046616d696c79310f300d060355040b1306526164697573311b30190603550403131262697463682e61617263616e652e696e666f3122302006092a864886f70d010901161361617263616e654061617263616e652e6f726730820122300d06092a 864886f70d01010105000382010f003082010a0282010100d13f2aa5 EAP-Message = 0xdd8c7a38ec9f91d750c163b7da9723cdb2cfbced8c0a26e53e4ff735f081b7a82f818c7e1b50de1ff316775bd0367397e0587956bb4103dd630a3a6ea26f1839ee7ad53518c0ab515722da1ee20da3d25919566b545bd9fbdae681ff0322c5ff17f59f310cfce44aed048 af285360747fd71fe57085782efef97deefd1dc0d60d696f8effcd4f892a13d0dfb9e5d8f63dd66dca720183b53966e7d08da5e057c2b3d93bb221e9af86c492c6ab20df195061ed3de43e3a8c63aeddc73b73c46df84a36b32df4e0c87c353d17a0adac9afcab37bee40b7fb377bf75bc2e043d2f2fb 4fc05daddceb2873f2c437a89902aeed52bc27169903cbb874d37702 EAP-Message = 0x03010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010002865a9d48b16abe75747906794409983d703a267216dba22b69d3da0bd407de3580985b6c0f9dbe54f7e401e6ea9c7db74a11b50c70902eacd 9067dc197fbf99d8dc57404a262bf9ae266e4b8ebd18cf8c9803f8114f695a9e22f5699d6604835a2addf0e634110d290e4a92e7040fa0699750af78dcfaac3d6957dd31481d48f7179e9bae452f608bbcffab59e136d6fc32811b3110d42148d155673840419e7561fb926292b3b5de638ddde7bb79a 09cf2e266712dc87c25cd6f6a55a03f2a52c3b730ef5a0380f4d7da3 EAP-Message = 0xf356d5f85403d6b92d4e0de3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5f8b66d45e886b3ed367e3714d4f5e92 Finished request 115. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.13 port 1024, id=163, length=148 User-Name = "izanami" Called-Station-Id = "30-46-9a-16-00-bc" Calling-Station-Id = "bc-ae-c5-91-67-a3" NAS-Identifier = "30-46-9a-16-00-ba" NAS-Port = 12 Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5f8b66d45e886b3ed367e3714d4f5e92 EAP-Message = 0x020300060d00 Message-Authenticator = 0x7790a68d39849d52b1e1e59b31ecb08a ? Evaluating (User-Name == bubbles) -> FALSE +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [files] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDN})) -> (&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (&(cn=WifiDisabled)(&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=izanami,ou=RadHosts,dc=aarcane,dc=info, with filter (objectclass=*) rlm_ldap::groupcmp: Group WifiDisabled not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for izanami [ldap] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] macAddress -> Calling-Station-Id == "bc-ae-c5-91-67-a3" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user izanami authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 rlm_checkval: Value Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 ++[checkval] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 163 to 10.0.0.13 port 1024 Service-Type = Administrative-User EAP-Message = 0x010404000dc000000a7f38fc6ef9babf007ebc8baaecb8d24a949a66715812f29a52b2fe5bd28d8b461b80d90ae2196386cf000500308204fc308203e4a003020102020101300d06092a864886f70d01010505003081a0310b30090603550406130255533113301106035 50408130a43616c69666f726e69613111300f06035504071308416e74656c6f706531183016060355040a130f5363686c616374612046616d696c7931133011060355040b130a4b65795369676e696e67311630140603550403130d5363686c6163746143657274323122302006092a864886f70d0109 01161361617263616e654061617263616e652e6f7267301e170d3130 EAP-Message = 0x313030313036323031335a170d3230303932383036323031335a3081a0310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f06035504071308416e74656c6f706531183016060355040a130f5363686c616374612046616d696 c7931133011060355040b130a4b65795369676e696e67311630140603550403130d5363686c6163746143657274323122302006092a864886f70d010901161361617263616e654061617263616e652e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100b6d7b0 404f4a62f7e492dcf6eb1421622d43bdc1084f8743450ad979174001 EAP-Message = 0xac0b8c4fa1ff0389a3e6e9bcdc9665efc61ceaca24081db9d16c9b66885aac53ba5cc6d583bde3ad08ad2aafcaea00dcbe2ad554b02e73fe317f22358cf988e23a2e32ef20cbcd910fe949bb3105f6dd47349dc03593294f5d89e8296b7415abdc393fa5515789d7f0bb6 5353fdc62ee1eedf4cf909322f92cbc44fff472dddb5fab8e4d42bc7cd010e6d75f71cd791c93bbfa94d5ee8079596d818ab89017c676da5768d35847fa7ebc3840c25281a31b33d9ae84a88dfc0938c582197eace610b483bd72d5bbda623c7819b191e07957a97d931230e0e740ef9ab08cbbda5ed1 0203010001a382013d30820139301d0603551d0e04160414ee354cff EAP-Message = 0xfc743aa29a50944370d137d26c018d843081cd0603551d230481c53081c28014ee354cfffc743aa29a50944370d137d26c018d84a181a6a481a33081a0310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f060355040713084 16e74656c6f706531183016060355040a130f5363686c616374612046616d696c7931133011060355040b130a4b65795369676e696e67311630140603550403130d5363686c6163746143657274323122302006092a864886f70d010901161361617263616e654061617263616e652e6f726782010130 3a0603551d1f04333031302fa02da02b8629687474703a2f2f736368 EAP-Message = 0x6c6163746163657274322e61 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5f8b66d45d8f6b3ed367e3714d4f5e92 Finished request 116. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.13 port 1024, id=164, length=148 User-Name = "izanami" Called-Station-Id = "30-46-9a-16-00-bc" Calling-Station-Id = "bc-ae-c5-91-67-a3" NAS-Identifier = "30-46-9a-16-00-ba" NAS-Port = 12 Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5f8b66d45d8f6b3ed367e3714d4f5e92 EAP-Message = 0x020400060d00 Message-Authenticator = 0x9957fee5996873676a87b72783ac9256 ? Evaluating (User-Name == bubbles) -> FALSE +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 4 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [files] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDN})) -> (&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (&(cn=WifiDisabled)(&(objectClass=GroupOfNames)(member=cn\3dizanami\2cou\3dRadHosts\2cdc\3daarcane\2cdc\3dinfo))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=izanami,ou=RadHosts,dc=aarcane,dc=info, with filter (objectclass=*) rlm_ldap::groupcmp: Group WifiDisabled not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for izanami [ldap] expand: (cn=%{User-Name}) -> (cn=izanami) [ldap] expand: ou=RadHosts,dc=aarcane,dc=info -> ou=RadHosts,dc=aarcane,dc=info [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=RadHosts,dc=aarcane,dc=info, with filter (cn=izanami) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] macAddress -> Calling-Station-Id == "bc-ae-c5-91-67-a3" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user izanami authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 rlm_checkval: Value Name: Calling-Station-Id, Value: bc-ae-c5-91-67-a3 ++[checkval] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 164 to 10.0.0.13 port 1024 Service-Type = Administrative-User EAP-Message = 0x0105029d0d8000000a7f617263616e652e696e666f2f63726c2e70656d300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100900fcaecc95e2c10c787b1d65e13dd2f8bdb82ba7d2108bc570282fa2b3b10bdb5fd0200626f2341d484d080596c8004fa64645c74297f8be11406c814141950461a2baaf193f44e3fc243017d07c12293624aab58e7aa641577a36c222a01175c87a1e0c68d1d99e817de8f22cd302634b834023be1e3e50d7bad7de57cf36cb35fc066eb8163f9ebe21fd4b36600250b921643137415dc71ccdfb26318a645cc580e3ba35cd4f7082c1b6f7c520f9cac686881aa2cd4fba20d5039edc1 EAP-Message = 0xfec64b116281aad9b24191de543fe5ec9bfaa8e5d94874344b41c80a271a558a659d006d38c68b0bb12fb582c92f5dff5b8c19b76fb7833add0cd91d487a98cca9d616030101590d00015103010240014b00a43081a1310b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f06035504071308416e74656c6f706531183016060355040a130f5363686c616374612046616d696c79310f300d060355040b1306526164697573311b30190603550403131262697463682e61617263616e652e696e666f3122302006092a864886f70d010901161361617263616e654061617263616e652e6f726700a33081a031 EAP-Message = 0x0b3009060355040613025553311330110603550408130a43616c69666f726e69613111300f06035504071308416e74656c6f706531183016060355040a130f5363686c616374612046616d696c7931133011060355040b130a4b65795369676e696e67311630140603550403130d5363686c6163746143657274323122302006092a864886f70d010901161361617263616e654061617263616e652e6f72670e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5f8b66d45c8e6b3ed367e3714d4f5e92 Finished request 117. Going to the next request Waking up in 4.9 seconds. it seems to get to the same point (Finished request xxx.) and then repeats the entire process four times (the same number of times specified in my switch config) then fails to connect. I'm not sure if I'm missing something, or what.. but it should all be fine, as this is the same config I use for my wireless config. I'm certain I've missed something obvious, and if you can provide any additional information to point me in the right direction, I'd much appreciate it.

4 4

Freeradius on lenny doesn't permit mschap auth
by David Dumortier 14 Feb '11

14 Feb '11

Hi all, I had read and configure like http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO I have test ntlm_auth with success but radtest user passwd localhost 0 testing123 fail I attach my debug output Thanks -- David Dumortier

10 28

EAP transaction benchmark
by Waqas Toor 14 Feb '11

14 Feb '11

Hi community, I need to benchmark the eap transactions in the case of EAP-TLS auth. I mean how many transactions per second of eap a system can handle ( test bed is a multi core intel based system with 36 GB of ram ) also if there are any tools available the we can use to benchmark eap process ( some type of eap radclient ) so that we build some threaded process upon that tool to check these transactions for our environment. Also if there are any benchmarks that are already done by community/testers can be useful too. I am using 2 phase auth 1 is EAP-TLS and then MAC based auth. Thanks. Waqas Toor

2 1

freeradius +mpd
by Edgars 13 Feb '11

13 Feb '11

Hello, I'm running freebsd 8.1 with mpd 5.5, authenticating users against freeradius. After some seccon uptime pppoe link is dropped. In radius.log i see this Auth: Login OK: [test/test] (from client mpd port 2 cli 000c2906911e) Error: Received Accounting-Request packet from 10.10.10.2 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Found in forums about "options RADIX_MPATH" for kernel but that didn't give me any result. DEBUG: rad_recv: Access-Request packet from host 10.10.10.2 port 19490, id=151, length=183 NAS-Identifier = "mpd.mydomain.tld" NAS-IP-Address = 10.10.10.2 Message-Authenticator = 0xd52aa007f6772e3745cc6209e99aef8d Acct-Session-Id = "7596900-em1_0-2" NAS-Port = 2 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000c2906911e" Called-Station-Id = "z" NAS-Port-Id = "em1" Vendor-12341-Attr-12 = 0x656d315f302d32 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:0c:29:06:91:1e" User-Name = "test" User-Password = "test" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/10.10.10.2/auth-detail-20110213 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.10.10.2/auth-detail-20110213 [auth_log] expand: %t -> Sun Feb 13 10:00:27 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attri bute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attri bute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergr oup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok Login OK: [test/test] (from client mpd port 2 cli 000c2906911e) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 151 to 10.10.10.2 port 19490 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Finished request 23. Going to the next request Waking up in 0.5 seconds. rad_recv: Accounting-Request packet from host 10.10.10.2 port 26224, id=172, length=218 NAS-Identifier = "mpd.mydomain.tld" NAS-IP-Address = 10.10.10.2 Acct-Session-Id = "7596900-em1_0-2" NAS-Port = 2 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000c2906911e" Called-Station-Id = "z" NAS-Port-Id = "em1" Vendor-12341-Attr-12 = 0x656d315f302d32 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:0c:29:06:91:1e" Acct-Status-Type = Start Framed-IP-Address = 20.20.20.2 User-Name = "test" Acct-Multi-Session-Id = "7596900-B-1" Vendor-12341-Attr-13 = 0x422d31 Vendor-12341-Attr-14 = 0x6e6730 Vendor-12341-Attr-15 = 0x00000004 Acct-Link-Count = 1 Acct-Authentic = RADIUS +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = 10.10.10.2,NAS-IP-Address = 10.10.10.2,Acct-Session-Id = "7596900-em1_0-2",User-Name = "test"' [acct_unique] Acct-Unique-Session-ID = "026e7c5b94c4dd87". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/10.10.10.2/detail-20110213 [detail] /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.10.10.2/detail-20110213 [detail] expand: %t -> Sun Feb 13 10:00:27 2011 ++[detail] returns ok ++[unix] returns fail Finished request 24. Cleaning up request 24 ID 172 with timestamp +12 Going to the next request Waking up in 0.5 seconds.

2 1

help with proper responses?
by Christ Schlacta 13 Feb '11

13 Feb '11

so uh.. I locked myself out of my radius enabled switch (for some stupid reason the switch thinks it's a good idea to use radius for the admin user as well...) and now I can sign in to my switch, but can't change anything, because I don't know what radius responses to send. if anyone knows the right answer, it'd be a big help. I know this probably isn't the best place to ask, but it is currently the only.

2 1

Second SSH with Freeradius based authentication
by Jaikanth Krishnaswamy 12 Feb '11

12 Feb '11

Hi All, I am a newbie to freeradus. I am planning to run a second SSHD on a higher port on my server which will allow me to authenticate separately from my existing SSHD. Can somebody help me by telling me what are the steps I need to take to perform this . The Server I will be using is a RHEL5. Thanks in advance. JK

3 3