March 2013 - Freeradius-Users - lists.freeradius.org

Old message abou LDAP
by Andres Septer 11 Mar '13

11 Mar '13

When one searches google for freeradius and ldap groups there is a LOT of messages that all point to this message. Freeradius and LDAP groups how to make it work: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/ms… Unfortunately this old archive is unavailable. 404 Is there any other good howto about freeradius + LDAP + groups -- ho to make them wor together? Andres

3 4

troubles with eap-peap mschapv2
by Bertrand Poulet 11 Mar '13

11 Mar '13

Hi all , i try to migrate from FreeRADIUS 1.1.6 (Mandrake) to FreeRADIUS 2.2.0 (from source) on ubuntu12.04. The same supplicant and same AP with old FR is ok, but not with new FR 2.2.0. What i've done : I've installed with ./configure; make; make install root@myhost:/usr/local/etc/raddb/certs# make openssl dhparam -out dh 1024 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time .......................+.................+........................................................................+........................................+...............................................................+.................................+...............+.......+...........................++*++*++* openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ......................................................................+++ ..........................................................+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key .................................+++ .............................................................................................................+++ writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Mar 11 13:18:05 2013 GMT Not After : Mar 11 13:18:05 2014 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Mar 11 13:18:05 2014 GMT (365 days) Write out database with 1 new entries Data Base Updated openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` MAC verified OK openssl verify -CAfile ca.pem server.pem server.pem: OK openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der root@myhost:/usr/local/etc/raddb/certs# ll -tr total 116 drwxr-xr-x 8 root root 4096 mars 11 14:10 ../ -rwxr-x--- 1 root root 2693 mars 11 14:10 bootstrap* -rw-r----- 1 root root 4287 mars 11 14:10 Makefile -rw-r----- 1 root root 7847 mars 11 14:10 README -rw-r----- 1 root root 578 mars 11 14:10 xpextensions -rw-r----- 1 root root 1289 mars 11 14:10 ca.cnf -rw-r----- 1 root root 1124 mars 11 14:10 server.cnf -rw-r----- 1 root root 1102 mars 11 14:10 client.cnf -rw-r--r-- 1 root root 3 mars 11 14:18 serial.old -rw-r--r-- 1 root root 0 mars 11 14:18 index.txt.old -rw-r--r-- 1 root root 245 mars 11 14:18 dh -rw-r--r-- 1 root root 5120 mars 11 14:18 random -rw-r--r-- 1 root root 1834 mars 11 14:18 server.key -rw-r--r-- 1 root root 1062 mars 11 14:18 server.csr -rw-r--r-- 1 root root 1675 mars 11 14:18 ca.pem -rw-r--r-- 1 root root 1834 mars 11 14:18 ca.key -rw-r--r-- 1 root root 4212 mars 11 14:18 server.crt -rw-r--r-- 1 root root 3 mars 11 14:18 serial -rw-r--r-- 1 root root 21 mars 11 14:18 index.txt.attr -rw-r--r-- 1 root root 120 mars 11 14:18 index.txt -rw-r--r-- 1 root root 4212 mars 11 14:18 01.pem -rw-r--r-- 1 root root 2533 mars 11 14:18 server.p12 -rw-r--r-- 1 root root 3586 mars 11 14:18 server.pem -rw-r--r-- 1 root root 1195 mars 11 14:18 ca.der drwxr-x--- 2 root root 4096 mars 11 14:18 ./ i got this known problem of certificates (default). freeradius -XXX .... Mon Mar 11 16:35:47 2013 : Debug: Module: Instantiating eap-tls Mon Mar 11 16:35:47 2013 : Debug: tls { Mon Mar 11 16:35:47 2013 : Debug: rsa_key_exchange = no Mon Mar 11 16:35:47 2013 : Debug: dh_key_exchange = yes Mon Mar 11 16:35:47 2013 : Debug: rsa_key_length = 512 Mon Mar 11 16:35:47 2013 : Debug: dh_key_length = 512 Mon Mar 11 16:35:47 2013 : Debug: verify_depth = 0 Mon Mar 11 16:35:47 2013 : Debug: CA_path = "/usr/local/etc/raddb/certs" Mon Mar 11 16:35:47 2013 : Debug: pem_file_type = yes Mon Mar 11 16:35:47 2013 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Mon Mar 11 16:35:47 2013 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Mon Mar 11 16:35:47 2013 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Mon Mar 11 16:35:47 2013 : Debug: private_key_password = "whatever" Mon Mar 11 16:35:47 2013 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Mon Mar 11 16:35:47 2013 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Mon Mar 11 16:35:47 2013 : Debug: fragment_size = 1024 Mon Mar 11 16:35:47 2013 : Debug: include_length = yes Mon Mar 11 16:35:47 2013 : Debug: check_crl = no Mon Mar 11 16:35:47 2013 : Debug: cipher_list = "DEFAULT" Mon Mar 11 16:35:47 2013 : Debug: ecdh_curve = "prime256v1" .... Sending Access-Challenge of id 202 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ee5af279ee6b6b6ef02d416f50f62d3 Mon Mar 11 15:59:05 2013 : Info: Finished request 0. Mon Mar 11 15:59:05 2013 : Debug: Going to the next request Mon Mar 11 15:59:05 2013 : Debug: Waking up in 4.9 seconds. Mon Mar 11 15:59:10 2013 : Info: Cleaning up request 0 ID 202 with timestamp +8 Mon Mar 11 15:59:10 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Mar 11 15:59:10 2013 : Debug: WARNING: !! EAP session for state 0x9ee5af279ee6b6b6 did not finish! Mon Mar 11 15:59:10 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Mar 11 15:59:10 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Mar 11 15:59:10 2013 : Info: Ready to process requests. .... The supplicant :Windows 7, with no certifcates validated, with PEAP, EAP-MSCHAPV2 . What's wrong

3 2

Cannot access radius server from remote host
by Iftakhul Anwar 10 Mar '13

10 Mar '13

Hi All, I just try connect radius server remotely. i've try to radtest with command : radtest user1 meruvian localhost 1812 testing123 Sending Access-Request of id 133 to 127.0.0.1 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=133, length=20 ## i get accept response from radius server. But when i try with command bellow i got error message like a no respon from radius server: radtest user1 meruvian 192.168.2.3 1812 testing123 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 12 socket 3 Note:192.168.2.3 is ip of radius server. How i can try to connect radius server from another host ? i've try to disable my firewall. but still get no respon from server. Help me to solve this. Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 4

Redirecting Reject Request To Webpage
by Russell Mike 10 Mar '13

10 Mar '13

Hi FreeRadius List Members, Thanks for all the support ever. i am having difficulty to understand something, i need help. i am able to configure mac authentication base on the following logic. it Works !! username="<mac address>";attribute="Auth-Type";op=":=";value="Accept" username="<mac address>";attribute="Auth-Type";op=":=";value="Reject" *Question:* Redirecting Reject Request To Webpage For example, a customer would get reject from FR due to non payment. but at this stage customer do not know, what is happening. Why internet in down. We want the request to redirected to a web page that will display the cause of disconnection. Thanks RM --

3 4

Cannot disconnect radius user using radclient
by Iftakhul Anwar 10 Mar '13

10 Mar '13

Hi All, I've successfully install coovachili anda freeradius using mysql database. Now I've just try to disconnect coovachilli user online with radclient command: I try with command bellow to disconect user="alice" * echo "User-Name=alice" | radclient -x localhost:3779 disconnect testing123 * *Sending Disconnect-Request of id 126 to 127.0.0.1 port 3779* * User-Name = "alice"* *rad_recv: Disconnect-ACK packet from host 127.0.0.1 port 3779, id=126, length=20* And then, user alice be disconnect from coova. Then i try to give disconnect command using remote acces using command bellow : *echo "User-Name=alice" | radclient -x 192.168.2.3:3779 disconnect testing123* *Sending Disconnect-Request of id 78 to 192.168.2.3 port 3779* * User-Name = "alice"* *radclient: no response from server for ID 78 socket 3* * * Note: 192.168.2.3 is ip of radius server But no response from radius server. I've add on client.conf ip address which i use to radius client.But still have same problem. I try that command on my local machine using comand : *echo "User-Name=alice" | radclient -x 192.168.2.3:3779 disconnect testing123* * * Radius still no response. How i can execute this command both of on local and on remote machine ? Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 8

free time
by Jed Gainer 10 Mar '13

10 Mar '13

I would like to ignore bandwidth usage between 2 and 5 am. sqlcounter counterChilliSpotMaxTotalOctetsDaily { counter-name = ChilliSpot-Max-Total-Octets-Daily check-name = CS-Total-Octets-Daily counter-type = data reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '00:00:00')) AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime NOT BETWEEN UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '02:00:00')) AND UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '05:00:00'))" } Should I do it all in the SQL like that? or does someone have a better idea.

3 5

Simple Peap + PAP authentication
by Matthew Ceroni 09 Mar '13

09 Mar '13

Trying to setup 802.1x authentication on my home router (running OpenWRT). http://pastebin.com/fWtNZ8FD Above is the output of radiusd -X I am trying to connect via my Android phone. Shouldn't the request coming from the device include the ClearText password it is looking for? I am simply listing the user in the users file. No LDAP, AD, SQL database. Thanks

2 1

Release of Version 2.2.1
by Alan DeKok 08 Mar '13

08 Mar '13

It's been a while since Version 2.2 was released, so it's time for the next release. I'd like to fix the reported memory leak issue, and then release it later next week. The changes are minor, and mostly cleanups and bug fixes. Please let me know if there are any issues. Alan DeKok.

4 5

Re: Failed to load module "jradius" freeradius server
by David Bird 08 Mar '13

08 Mar '13

Hi Arran, Thanks for the note that support for rlm_jradius has been removed in FR 3.0. I'm slightly disappointed that it wasn't brought forward from 2.x, but can understand that it's not considered a standard module (even though it is included in some popular distributions). I haven't been following the changes in 3.0 very carefully, but if the demand is there, I will look into updating it for 3.0. Even though I do consider supporting and compiling freeradius modules 'on-topic' for freeradius mailing list, anyone is welcome to bring up the topic at jradius(a)coova.org instead. Cheers, David > Date: Thu, 7 Mar 2013 11:02:17 -0500 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Failed to load module "jradius" freeradius server > Message-ID: <C9EB7AE3-492A-4D59-BE04-1645044DC3E8(a)freeradius.org> > Content-Type: text/plain; charset=iso-8859-1 > > > On 7 Mar 2013, at 10:55, Iftakhul Anwar <anwar(a)meruvian.org> wrote: > > > Actually i install freeradius from apt-get , > > Right, so jradius won't have been built. > > jradius support is going away, it will *NOT* be in Version 3 unless someone contributes a new version of the module which works with the updated jradius protocol. > > -Arran > > >

2 1

hashed username in MySQL?
by Adam Moffett 08 Mar '13

08 Mar '13

I had a user set up in the users file and it was all working. Now I'm experimenting with MySQL and in the debug output I'm looking at the SQL queries and instead of the actual clear text username I'm getting this: AE576AA1F2CB984F6D07750C01C0EAF9 ...which I assume is the username hashed. Is there some simple option someone can't think of that would explain a clear text username being ok for the files module, but getting a hashed username in the SQL module? An unrelated comment: The last time I used RADIUS there was PAP and CHAP. MSCHAP was a new thing. The amount that has changed in the past 15 years is a little overwhelming.

2 1