May 2013 - Freeradius-Users - lists.freeradius.org

Problem with PAP autentification on freeradius-3.0.0
by BALSIANOK, Peter 16 May '13

16 May '13

Hi, I have problem with PAP autentification on freeradius-3.0.0, but on freeradius-2.2.1 everythink works correct. Could you please help me, thx. Debug output for freeradius-3.0.0: radiusd@tdrad1test:/storage/app/radius/raddb/auth-new$ /storage/app/radius/freeradius-3.0.0/sbin/radiusd -X -d /storage/app/radius/raddb/auth-new radiusd: FreeRADIUS Version 3.0.0, for host x86_64-unknown-linux-gnu, built on May 14 2013 at 16:22:54 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... ... Listening on proxy address * port 0 Listening on auth address * port 1812 as server default Listening on auth address * port 1645 as server default Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50633, id=15, length=115 NAS-Port-Type = Virtual Service-Type = Framed-User Calling-Station-Id = "421905012405" Called-Station-Id = "l2tp.vps" Framed-Protocol = PPP User-Name = "l2tp(a)radiustest.sk" User-Password = "l2tp" Connect-Info = "8640000" NAS-IP-Address = 213.151.234.114 (0) # Executing section authorize from file /storage/app/radius/raddb/auth-new/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [chap] = noop (0) suffix : Looking up realm "radiustest.sk" for User-Name = "l2tp(a)radiustest.sk" (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Stripped-User-Name = "l2tp" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Authentication realm is LOCAL. (0) [suffix] = ok rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = l2tp.vps rlm_perl: Added pair Calling-Station-Id = 421905012405 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = l2tp(a)radiustest.sk rlm_perl: Added pair User-Password = l2tp rlm_perl: Added pair Connect-Info = 8640000 rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair Stripped-User-Name = l2tp rlm_perl: Added pair NAS-IP-Address = 213.151.234.114 rlm_perl: Added pair Current-Time = 1368711260 rlm_perl: Added pair Password-With-Header = {SSHA}cAgh2LCe5649EzEAbc+nAfIOvOyOJSmU+sKiPA== rlm_perl: Added pair VPDN_SERVICE_ID = User-GPRS-L2TP (0) [perl] = ok (0) [pap] = updated (0) Found Auth-Type = PAP (0) # Executing group from file /storage/app/radius/raddb/auth-new/sites-enabled/default (0) group PAP { (0) - entering group PAP {...} (0) pap : login attempt with password "l2tp" (0) pap : Using SSHA encryption. (0) ERROR: pap : SSHA password check failed (0) pap : Passwords don't match (0) [pap] = reject (0) Failed to authenticate the user. (0) Login incorrect (pap: SSHA password check failed): [l2tp(a)radiustest.sk/l2tp] (from client localhost port 0 cli 421905012405) Debug output for freeradius-2.2.1: radiusd@tdrad1test:/storage/app/radius/raddb/auth$ /storage/app/radius/freeradius/sbin/radiusd -X -d /storage/app/radius/raddb/auth radiusd: FreeRADIUS Version 2.2.1, for host x86_64-unknown-linux-gnu, built on May 2 2013 at 09:22:02 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... ... Listening on authentication address * port 1812 Listening on authentication address * port 1645 Listening on proxy address * port 37677 Listening on command file ../../log/radius/radius_auth.sock Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 57436, id=196, length=115 NAS-Port-Type = Virtual Service-Type = Framed-User Calling-Station-Id = "421905012405" Called-Station-Id = "l2tp.vps" Framed-Protocol = PPP User-Name = "l2tp(a)radiustest.sk" User-Password = "l2tp" Connect-Info = "8640000" NAS-IP-Address = 213.151.234.114 # Executing section authorize from file /storage/app/radius/raddb/auth/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] Looking up realm "radiustest.sk" for User-Name = "l2tp(a)radiustest.sk" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "l2tp" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[files] returns noop rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = l2tp.vps rlm_perl: Added pair Calling-Station-Id = 421905012405 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = l2tp(a)radiustest.sk rlm_perl: Added pair User-Password = l2tp rlm_perl: Added pair Connect-Info = 8640000 rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair Stripped-User-Name = l2tp rlm_perl: Added pair NAS-IP-Address = 213.151.234.114 rlm_perl: Added pair Current-Time = 1368709398 rlm_perl: Added pair Password-With-Header = {SSHA}cAgh2LCe5649EzEAbc+nAfIOvOyOJSmU+sKiPA== rlm_perl: Added pair VPDN_SERVICE_ID = User-GPRS-L2TP ++[perl] returns ok [pap] Normalizing SSHA1-Password from base64 encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /storage/app/radius/raddb/auth/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "l2tp" [pap] Using SSHA encryption. [pap] User authenticated successfully ++[pap] returns ok Login OK: [l2tp(a)radiustest.sk/l2tp] (from client localhost port 0 cli 421905012405) Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 1

Basic question to authenticate switches and Linux boxes
by Roberto Carna 16 May '13

16 May '13

Dear, I'm new at Freeredius as an AAA sever in a Linux box and I need to authenticate Allied switches and Debian/Centos boxes. What package/module do I have to install in adition to freeradius ??? And what authentication procedure do I have ti use in order to let universal AAA ??? Thanks a lot, Roberto "the locu abierto"

4 5

Radius Change IP
by Sokphak TOUCH 16 May '13

16 May '13

Hello All, I have one radius server is on services. Because of network changed, I need to change IP address of this server. Could you please let me know after changing IP does radius will be working as normal? And what are the thing should I consider? Thanks everyone for your input Regards, Sokphak

2 3

accessing subtypes (tlv)
by Juan Pablo L. 15 May '13

15 May '13

Hi, i have downloaded and installed freeradius from git master FreeRADIUS Version 3.0.0 (git #7a9281c), i m developing a module to do some charging based on 3gpp2 standards for a cdma network, i have modified the dictionary to reflect a subtype in one of the attributes: ATTRIBUTE 3GPP2-Prepaid-acct-Capability 91 tlvATTRIBUTE 3GPP2-Prepaid-acct-Capability-AvailableInClient 91.1 integer but i m having trouble accesing 3GPP2-Prepaid-acct-Capability-AvailableInClient, basically i dont know how and i cant find an example in the code so far. when i do: ppac = pairfind(request->packet->vps,91.1,5535,TAG_ANY)orppac = pairfind(request->packet->vps,91,5535,TAG_ANY) they both return null. any hint will be appreciated as to how can i access the values in the subtypesof any tlv-type attribute. the other option is just put back the dictionary to octect type and access the values manuallybut i know this version of freeradius supports tlv so i would like to find a way to do it using freeradius capabilities. thanks!

2 2

Re: FreeRadius Ceritificate Migration
by John Dennis 15 May '13

15 May '13

Thank you for including the full debug. Here is the section from the rlm_eap_tls initialization. > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/usr/local/etc/raddb/certs/roots" > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/servercert.pem" > certificate_file = "/usr/local/etc/raddb/certs/servercert.pem" > private_key_password = "********" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > ecdh_curve = "prime256v1" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } A couple of things immediately jump out at me. This is not the default configuration. First of all there is no CA_file configured (only CA_path). You must have commented that out or deleted it. That means you can't use a bundled CA file. Secondly the CA_path is not the default either, you've got /usr/local/etc/raddb/certs/roots. Does that directory exist? But more importantly can radiusd execute the directory and read it's contents? These are file/directory permission issues. In radiusd.conf are user and group variables, these are the user and group respectively that radiusd runs as *after* it initializes. I'm not sure if OpenSSL reads the CA files before or after radiusd drops privileges from root to the user/group specified in radiusd.conf. But at the time OpenSSL reads the files it has to have permission to traverse into the directory (execute permission) and have read permission on the files to read their contents. If you're not sure if radiusd is reading the CA files or not it's easy to verify by running radiusd under strace (hint: use -o to direct the output to a file and then search for your CA_path) you should see the directory being opened and files being read. If there are permission problems you'll see error information in the strace output. HTH, John -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

Free radius as Proxy EAP-PEAP-GTC User-Password is never set
by Sankalp Dubey 15 May '13

15 May '13

Hi Is EAP-PEAP-GTC User-Password is set while using Free Radius as a proxy? We have a radius server which does not understand EAP. We want to authenticate the WiFi clients with this server. In order to achieve this we have configured the Free Radius as proxy (EAP-PEAP-GTC). But this does not seems to be working as at our server end we do not receive clear text password. Here is the radiusd debug output: main { name = "radiusd" prefix = "/home/freeradius" localstatedir = "/home/freeradius/var" sbindir = "/home/freeradius/sbin" logdir = "/home/freeradius/var/log/radius" run_dir = "/home/freeradius/var/run/radiusd" libdir = "/home/freeradius/lib" radacctdir = "/home/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/home/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/home/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DEVLAB { authhost = 10.141.148.91:1812 secret = testing123 } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client netmotion { ipaddr = 10.141.150.34 require_message_authenticator = no secret = "testing123" nastype = "other" } client wifi { ipaddr = 10.141.148.220 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /home/freeradius/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /home/freeradius/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /home/freeradius/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /home/freeradius/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /home/freeradius/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /home/freeradius/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /home/freeradius/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /home/freeradius/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /home/freeradius/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /home/freeradius/etc/raddb/modules/unix unix { radwtmp = "/home/freeradius/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /home/freeradius/etc/raddb/eap.conf eap { default_eap_type = "gtc" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/home/freeradius/etc/raddb/certs" pem_file_type = yes private_key_file = "/home/freeradius/etc/raddb/certs/server.pem" certificate_file = "/home/freeradius/etc/raddb/certs/server.pem" CA_file = "/home/freeradius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/home/freeradius/etc/raddb/certs/dh" random_file = "/home/freeradius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/home/freeradius/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /home/freeradius/etc/raddb/modules/preprocess preprocess { huntgroups = "/home/freeradius/etc/raddb/huntgroups" hints = "/home/freeradius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /home/freeradius/etc/raddb/huntgroups reading pairlist file /home/freeradius/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /home/freeradius/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /home/freeradius/etc/raddb/modules/files files { usersfile = "/home/freeradius/etc/raddb/users" acctusersfile = "/home/freeradius/etc/raddb/acct_users" preproxy_usersfile = "/home/freeradius/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /home/freeradius/etc/raddb/users reading pairlist file /home/freeradius/etc/raddb/acct_users reading pairlist file /home/freeradius/etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /home/freeradius/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /home/freeradius/etc/raddb/modules/detail detail { detailfile = "/home/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /home/freeradius/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/home/freeradius/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /home/freeradius/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /home/freeradius/etc/raddb/modules/radutmp radutmp { filename = "/home/freeradius/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /home/freeradius/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/home/freeradius/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /home/freeradius/etc/raddb/attrs.access_reject } # modules } # server server proxy-inner-tunnel { # from file /home/freeradius/etc/raddb/sites-enabled/proxy-inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server server inner-tunnel { # from file /home/freeradius/etc/raddb/sites-enabled/inner-tunnel modules { Module: Creating Auth-Type = inner-eap Module: Checking authenticate {...} for more modules to load Module: Instantiating module "inner-eap" from file /home/freeradius/etc/raddb/modules/inner-eap eap inner-eap { default_eap_type = "gtc" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Enter your Security Code innear-eap: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/home/freeradius/etc/raddb/certs/server.pem" certificate_file = "/home/freeradius/etc/raddb/certs/server.pem" CA_file = "/home/freeradius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/home/freeradius/etc/raddb/certs/dh" random_file = "/home/freeradius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/home/freeradius/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 51628 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /home/freeradius/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.141.150.34 port 50001, id=159, length=88 NAS-Identifier = "symc-2k8-150-34" User-Name = "user3" Calling-Station-Id = "0000005e5554" EAP-Message = 0x0200000a017573657233 Message-Authenticator = 0x2863faee4523a276cbac192585bb7c6c # Executing section authorize from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] returns handled Sending Access-Challenge of id 159 to 10.141.150.34 port 50001 EAP-Message = 0x0101000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f2467dc0f2561157cc843c3aeb740bb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.141.150.34 port 50001, id=160, length=103 NAS-Identifier = "symc-2k8-150-34" User-Name = "user3" Calling-Station-Id = "0000005e5554" EAP-Message = 0x0201000703190d Message-Authenticator = 0x9ca44cf06d9b92a8d8423fdfe6a12c71 State = 0x0f2467dc0f2561157cc843c3aeb740bb # Executing section authorize from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 7 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /home/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 160 to 10.141.150.34 port 50001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f2467dc0e267e157cc843c3aeb740bb Finished request 1. Going to the next request Waking up in 4.9 seconds.

2 8

Re: FreeRadius Ceritificate Migration
by John Dennis 14 May '13

14 May '13

On 05/14/2013 12:01 PM, Mitch Yackobeck wrote: > Good morning John, > > I appologize for making myself look like a moron. The original message > had actually been sent to someone who was helping me to potentially work > thru some issues that we were seeing and trying to work out. I > attempted to modify the message in haste and get some input from the > group and it appears that I severely bungled that one up. I've learned > my lesson in humility as I actually went back and read what I had done > and like yourself could not make true heads or tails of that first > paragraph. > > The ultimate goal we are trying to achieve here is this; we are > potentially going to be changing our certificate structure in our > classroom networks. We are looking to have a way to have clients that > have not been converted to the new certificate structure as well as > those that have been converted able to authenticate simultaneously using > the same wireless SSID and FreeRadius server. We use Novell eDir for > the backend services on the classroom side with FreeRadius > authenticating our wireless users at the root of the tree. For > authentication purposes we have moved from passing the username and > password via 802.1X on the Novell Client to an EAP-TLS user certificate > installed in the computer certificate store so that the system is > already authenticated to the network prior to a user attempting to login > and remains connected even after login. > > What I was trying to convey is that I've spent some time over the last > couple of weeks upgrading my test environment from an older version of > FreeRadius to the latest available. On that test server, I have both > its test certificates and our production server certificates loaded up > using a single file. Using the certs specific to the test server, > everything works as expected, when I attempt to use the certs from the > production server, thats when things go a little pear shaped. Initially > it appears that the server is able to read the client certificate enough > to recognize that the information is available, but when it requests > further details, it fails to find the CA applicaple to the client cert > and bombs out a reject. See below for a capture of the client > authentication attempt. > > I'm wondering if this type of setup is actually possible or if there is > some switch that someone knows of somewhere in the config that perhaps I > have missed. > > Any help would be appreciated. Thank you Mitch, this is much more lucid. I'll try to help as best I can but you're still making it difficult. We ask for the output of radiusd -X in plain text format for a reason (not edited snippets). Why? Well for starters it contains all sorts of essential information that you've deleted. At the very most basic level what FreeRADIUS version are you using? But it also tells us other things, such as how the server is configured, what files it's reading, etc. But in any event what you want to accomplish should work. Let me give you some basic information and things to look at. First of all I notice you're reading your configuration from /usr/local/etc/raddb, some people get confused because /etc/raddb is a common location and they edit the wrong files. Make sure you're editing the files the server is loading. Also, make sure the location of the cert directory in the config is what you expect and is where you've installed your CA root certs (had the full debug been posting we could have verified this). Cert verification may involve a chain of CA certs, each of which must validate, until a trusted root is reached. Every CA cert in the chain must be available, either because the client passes it or because you've installed it. Therefore it would be good to verify whether the client cert issuer is the only cert necessary or not and if not have you installed the intermediaries. But since you said you were able to manually verify the client cert via the openssl command line tool that's probably not the issue. But did you verify you've configured FreeRADIUS to use the same CA as the command line tool? OpenSSL has two basic ways it can access multiple CA certs, you either concatenate them in a "bundle" file and set the CA_file to that, or you set the CA_path and OpenSSL will look for certs in the directory. Sounds like you decided to populate the CA_path with individual certs. Do they have file extensions? Did you set the CA_path variable correctly? (the debug log would have helped answer this). It's a shame the cbtls_verify function in rlm_eap_tls.c does not print the certificate (via X509_print_ex()) when verification fails, being able to see the contents of the cert can be immensely helpful. Looking at your error messages my best guess is that OpenSSL cannot locate one or more of the issuer certs, the most likely cause of this is misconfiguration of either the CA_file or CA_path variable, or the contents found at those locations. See the man page for SSL_CTX_load_verify_locations for details on what OpenSSL expects and confirm your FreeRADIUS config matches it (also verify in the debug output the server is loading what you expect it to load and not something else). -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

radperf
by Bruce Bauman 14 May '13

14 May '13

We'd like to use radperf to test the performance impact of configuration changes to our FreeRadius server before putting the changes into production. Several recent posts have mentioned that radperf is not currently available for download. Alan DeKok had mentioned a few months back that he was going to release an improved version. Any update on this? Thanks. Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

1 0

Bug in CUI generation? Is this a known issue?
by stefan.paetow＠diamond.ac.uk 14 May '13

14 May '13

I'm playing around with CUI generation with FreeRADIUS 2.2.0 and discovered something odd. In policy.conf I've set cui_require_operator_name = 1 and cui_hash_key = "4c2982f2f3b1dc4804994cf386db8c0a34d4ab2a". As you can see it's a 32-character string and it looks like a hash. In radiusd -X output I get this: Ready to process requests. rad_recv: Access-Request packet from host 192.168.126.155 port 1814, id=17, length=113 User-Name = "steve(a)diamond.ac.uk" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x80a453196d15a8e68ba13642ba725b24 Proxy-State = 0x30 Operator-Name = "1camford.ac.uk" Chargeable-User-Identity = "" Proxy-State = 0x313630 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (!(User-Name =~ /@/)) ?? Evaluating (User-Name =~ /@/) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(User-Name =~ /@/)) -> FALSE ++? if (User-Name =~ /@$/) ? Evaluating (User-Name =~ /@$/) -> FALSE ++? if (User-Name =~ /@$/) -> FALSE ++? if (User-Name =~ /@.+?@/) ? Evaluating (User-Name =~ /@.+?@/) -> FALSE ++? if (User-Name =~ /@.+?@/) -> FALSE ++? if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) ? Evaluating (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE ++? if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE ++? if (User-Name =~ /(a)[\\.-]/) ? Evaluating (User-Name =~ /(a)[\\.-]/) -> FALSE ++? if (User-Name =~ /(a)[\\.-]/) -> FALSE ++? if (User-Name =~ /@.+?[\\.-]$/) ? Evaluating (User-Name =~ /@.+?[\\.-]$/) -> FALSE ++? if (User-Name =~ /@.+?[\\.-]$/) -> FALSE ++? if (User-Name =~ /(a)[^\\.]+$/) ? Evaluating (User-Name =~ /(a)[^\\.]+$/) -> FALSE ++? if (User-Name =~ /(a)[^\\.]+$/) -> FALSE ++? if (User-Name =~ /@.+?\\.\\./) ? Evaluating (User-Name =~ /@.+?\\.\\./) -> FALSE ++? if (User-Name =~ /@.+?\\.\\./) -> FALSE ++? if (User-Name =~ /(a)myabc\\.com$/i) ? Evaluating (User-Name =~ /(a)myabc\\.com$/i) -> FALSE ++? if (User-Name =~ /(a)myabc\\.com$/i) -> FALSE ++? if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) ? Evaluating (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE ++? if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE ++? if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /(a)\\.?ac\\.uk$/i) ? Evaluating (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE ++? if (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE ++? if (User-Name =~ /@.+?\\.ax\\.uk$/i) ? Evaluating (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE ++? if (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "diamond.ac.uk" for User-Name = "steve(a)diamond.ac.uk" [suffix] Found realm "diamond.ac.uk" [suffix] Adding Stripped-User-Name = "steve" [suffix] Adding Realm = "diamond.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++- entering policy cui_postauth {...} +++? if (FreeRadius-Proxied-To == 127.0.0.1) (Attribute FreeRadius-Proxied-To was not found) ? Evaluating (FreeRadius-Proxied-To == 127.0.0.1) -> FALSE +++? if (FreeRadius-Proxied-To == 127.0.0.1) -> FALSE +++- entering else else {...} ++++? if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity && !(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) expand: %{control:Proxy-To-Realm} -> ?? Evaluating ("%{control:Proxy-To-Realm}") -> FALSE ? Converting !FALSE -> TRUE ? Evaluating (Chargeable-User-Identity ) -> TRUE ?? Evaluating (reply:Chargeable-User-Identity) -> FALSE ? Converting !FALSE -> TRUE ?? Evaluating (Operator-Name ) -> TRUE ??? Skipping ("${policy.cui_require_operator_name}") ++++? if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) -> TRUE ++++- entering if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) {...} expand: %{md5:4c2982f2f3b1dc4804994cf386db8c0a34d4ab2a%{User-Name}%{%{Operator-Name}:-}} -> +++++[reply] returns noop ++++- if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity && !(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) returns noop +++- else else returns noop ++- policy cui_postauth returns noop As you can see, the expand: bit shows an empty value. Then I changed my cui_hash_key to "01234567890abcdef01234567890abcdef" and it did the same. However, when I set cui_hash_key to a hex string that was not 32 characters in length ("abcdef" as an example), or a non-hex string of any length, it works ok. So I'm guessing here that if the cui_hash_key happens to be a string that is a potentially valid MD5 hash, the md5 operator in the CUI generation statement does nothing or barfs. Working fragment: ++++- entering if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) {...} expand: %{Operator-Name} -> 1camford.ac.uk expand: abcdef%{User-Name}%{%{Operator-Name}:-} -> abcdefsteve(a)diamond.ac.uk1camford.ac.uk expand: %{md5:abcdef%{User-Name}%{%{Operator-Name}:-}} -> 330a6f12e7152cb8888ef6aaa30b1aed +++++[reply] returns noop If this is known already, then that's fine (because it means you'll probably fix it in the future). Just thought I'd flag this up. In the meanwhile I've changed my cui_hash_key to something non-hex to avoid this issue. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

5 7

FreeRadius Ceritificate Migration
by Mitch Yackobeck 13 May '13

13 May '13

3 2