January 2015 - Freeradius-Users - lists.freeradius.org

Local user and LDAP
by Manuel Izquierdo 05 Jan '15

05 Jan '15

Hi I am new using freeradius. I am trying to configure freeradius to authenticate with LDAP and it is working well. Also I want to use a local user in the users file to use from network manager server but this user must be authenticated in local and don´t go to the LDAP. This is my configuration: /etc/raddb/sites-available/default authorize { preprocess chap mschap digest files ldap } /etc/raddb/users admin Cleartext-Password := ¨setup¨ DEFAULT LDAP-GROUP == ¨Network-monitor” DEFAULT Auth-Type = Local Fall-Through = yes With this configuration always is working LDAP, if you do a debug using the local user I can see: - [ files ] returns ok - Now start again LDAP ?? …. WARNING: Auth-Type already set. Not setting to PAP Failed to authenticate the user I don’t know why it trying using LDAP. Please, would you mind the simplest way to have a local user and LDAP working. If it is the local user don´t use LDAP or if LDAP not found the user user local file. Regards Manuel Izquierdo Calvo Senior Technical Specialist Mail: mizq14(a)gmail.com <mailto:mizq14@gmail.com> Mob: + 61 431 452 049

3 4

Question about radcheck sql!
by Haviaras Kostas 05 Jan '15

05 Jan '15

Hello, here is my problem, I would like to display to user another username and i will use another username on the radcheck and I will have another table to make the matching between the usernames, my question is I have to change the "authorize_check_query" on the queries.conf, I have to modify other files ? Or my idea is completely wrong! Thanks for your attention and time!

1 0

Freeradius 2.1.10 EAP-MD5 problem
by Nabil Benbelgacem 05 Jan '15

05 Jan '15

Hi all of you. First, i wish you a happy new year ! :) Well, i have a little problem with freeradius. I have installed it on Ubuntu Server 12.04 LTS. Here is my project. I want to make a radius server where users can use an username and password to logon on access points. But nothing more and nothing less. I have configured the radius server for EAP-MD5 authentification but when i try to test the configuration with freeradius -XXX, i get this message at the end : Fri Jan 2 18:13:27 2015 : Info: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Feb 24 2014 at 15:16:51 Fri Jan 2 18:13:27 2015 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Fri Jan 2 18:13:27 2015 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Jan 2 18:13:27 2015 : Info: PARTICULAR PURPOSE. Fri Jan 2 18:13:27 2015 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Jan 2 18:13:27 2015 : Info: GNU General Public License v2. Fri Jan 2 18:13:27 2015 : Info: Starting - reading configuration files ... Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/radiusd.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/proxy.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/clients.conf Fri Jan 2 18:13:27 2015 : Debug: including files in directory /etc/freeradius/modules/ Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/linelog Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/radutmp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/otp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/realm Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/acct_unique Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/checkval Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/unix Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/logintime Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/expr Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/digest Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail.log Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/pam Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/files Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/attr_filter Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/inner-eap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/etc_group Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sradutmp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/exec Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/preprocess Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ippool Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/echo Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/counter Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/krb5 Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/perl Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/opendirectory Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mschap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/wimax Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/policy Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ldap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sql_log Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mac2ip Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/passwd Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/smsotp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/chap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/pap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/expiration Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/cui Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/dynamic_clients Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/always Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/eap.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql/mysql/dialup.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/policy.conf Fri Jan 2 18:13:27 2015 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql/mysql/dialup.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/control-socket Fri Jan 2 18:13:27 2015 : Debug: main { Fri Jan 2 18:13:27 2015 : Debug: user = "freerad" Fri Jan 2 18:13:27 2015 : Debug: group = "freerad" Fri Jan 2 18:13:27 2015 : Debug: allow_core_dumps = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: including dictionary file /etc/freeradius/dictionary Fri Jan 2 18:13:27 2015 : Debug: main { Fri Jan 2 18:13:27 2015 : Debug: prefix = "/usr" Fri Jan 2 18:13:27 2015 : Debug: localstatedir = "/var" Fri Jan 2 18:13:27 2015 : Debug: logdir = "/var/log/freeradius" Fri Jan 2 18:13:27 2015 : Debug: libdir = "/usr/lib/freeradius" Fri Jan 2 18:13:27 2015 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Jan 2 18:13:27 2015 : Debug: hostname_lookups = no Fri Jan 2 18:13:27 2015 : Debug: max_request_time = 30 Fri Jan 2 18:13:27 2015 : Debug: cleanup_delay = 5 Fri Jan 2 18:13:27 2015 : Debug: max_requests = 1024 Fri Jan 2 18:13:27 2015 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Jan 2 18:13:27 2015 : Debug: checkrad = "/usr/sbin/checkrad" Fri Jan 2 18:13:27 2015 : Debug: debug_level = 0 Fri Jan 2 18:13:27 2015 : Debug: proxy_requests = yes Fri Jan 2 18:13:27 2015 : Debug: log { Fri Jan 2 18:13:27 2015 : Debug: stripped_names = no Fri Jan 2 18:13:27 2015 : Debug: auth = no Fri Jan 2 18:13:27 2015 : Debug: auth_badpass = no Fri Jan 2 18:13:27 2015 : Debug: auth_goodpass = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: security { Fri Jan 2 18:13:27 2015 : Debug: max_attributes = 200 Fri Jan 2 18:13:27 2015 : Debug: reject_delay = 1 Fri Jan 2 18:13:27 2015 : Debug: status_server = yes Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Jan 2 18:13:27 2015 : Debug: proxy server { Fri Jan 2 18:13:27 2015 : Debug: retry_delay = 5 Fri Jan 2 18:13:27 2015 : Debug: retry_count = 3 Fri Jan 2 18:13:27 2015 : Debug: default_fallback = no Fri Jan 2 18:13:27 2015 : Debug: dead_time = 120 Fri Jan 2 18:13:27 2015 : Debug: wake_all_if_all_dead = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: home_server localhost { Fri Jan 2 18:13:27 2015 : Debug: ipaddr = 127.0.0.1 Fri Jan 2 18:13:27 2015 : Debug: port = 1812 Fri Jan 2 18:13:27 2015 : Debug: type = "auth" Fri Jan 2 18:13:27 2015 : Debug: secret = "testing123" Fri Jan 2 18:13:27 2015 : Debug: response_window = 20 Fri Jan 2 18:13:27 2015 : Debug: max_outstanding = 65536 Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = yes Fri Jan 2 18:13:27 2015 : Debug: zombie_period = 40 Fri Jan 2 18:13:27 2015 : Debug: status_check = "status-server" Fri Jan 2 18:13:27 2015 : Debug: ping_interval = 30 Fri Jan 2 18:13:27 2015 : Debug: check_interval = 30 Fri Jan 2 18:13:27 2015 : Debug: num_answers_to_alive = 3 Fri Jan 2 18:13:27 2015 : Debug: num_pings_to_alive = 3 Fri Jan 2 18:13:27 2015 : Debug: revive_interval = 120 Fri Jan 2 18:13:27 2015 : Debug: status_check_timeout = 4 Fri Jan 2 18:13:27 2015 : Debug: irt = 2 Fri Jan 2 18:13:27 2015 : Debug: mrt = 16 Fri Jan 2 18:13:27 2015 : Debug: mrc = 5 Fri Jan 2 18:13:27 2015 : Debug: mrd = 30 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: home_server_pool my_auth_failover { Fri Jan 2 18:13:27 2015 : Debug: type = fail-over Fri Jan 2 18:13:27 2015 : Debug: home_server = localhost Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: realm example.com { Fri Jan 2 18:13:27 2015 : Debug: auth_pool = my_auth_failover Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: realm LOCAL { Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Clients #### Fri Jan 2 18:13:27 2015 : Debug: client localhost { Fri Jan 2 18:13:27 2015 : Debug: ipaddr = 127.0.0.1 Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = no Fri Jan 2 18:13:27 2015 : Debug: secret = "cht1000" Fri Jan 2 18:13:27 2015 : Debug: nastype = "other" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: client 192.168.100.15 { Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = no Fri Jan 2 18:13:27 2015 : Debug: secret = "cht1000" Fri Jan 2 18:13:27 2015 : Debug: shortname = "TP-Link" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Instantiating modules #### Fri Jan 2 18:13:27 2015 : Debug: instantiate { Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_exec Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "exec" from file /etc/freeradius/modules/exec Fri Jan 2 18:13:27 2015 : Debug: exec { Fri Jan 2 18:13:27 2015 : Debug: wait = no Fri Jan 2 18:13:27 2015 : Debug: input_pairs = "request" Fri Jan 2 18:13:27 2015 : Debug: shell_escape = yes Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_expr Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_expiration Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration Fri Jan 2 18:13:27 2015 : Debug: expiration { Fri Jan 2 18:13:27 2015 : Debug: reply-message = "Password Has Expired " Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_logintime Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime Fri Jan 2 18:13:27 2015 : Debug: logintime { Fri Jan 2 18:13:27 2015 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Jan 2 18:13:27 2015 : Debug: minimum-timeout = 60 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Virtual Servers #### Fri Jan 2 18:13:27 2015 : Debug: server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel Fri Jan 2 18:13:27 2015 : Debug: modules { Fri Jan 2 18:13:27 2015 : Debug: Module: Checking authenticate {...} for more modules to load Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_pap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "pap" from file /etc/freeradius/modules/pap Fri Jan 2 18:13:27 2015 : Debug: pap { Fri Jan 2 18:13:27 2015 : Debug: encryption_scheme = "auto" Fri Jan 2 18:13:27 2015 : Debug: auto_header = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_chap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_mschap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap Fri Jan 2 18:13:27 2015 : Debug: mschap { Fri Jan 2 18:13:27 2015 : Debug: use_mppe = yes Fri Jan 2 18:13:27 2015 : Debug: require_encryption = no Fri Jan 2 18:13:27 2015 : Debug: require_strong = no Fri Jan 2 18:13:27 2015 : Debug: with_ntdomain_hack = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_unix Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "unix" from file /etc/freeradius/modules/unix Fri Jan 2 18:13:27 2015 : Debug: unix { Fri Jan 2 18:13:27 2015 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_eap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "eap" from file /etc/freeradius/eap.conf Fri Jan 2 18:13:27 2015 : Debug: eap { Fri Jan 2 18:13:27 2015 : Debug: default_eap_type = "md5" Fri Jan 2 18:13:27 2015 : Debug: timer_expire = 60 Fri Jan 2 18:13:27 2015 : Debug: ignore_unknown_eap_types = no Fri Jan 2 18:13:27 2015 : Debug: cisco_accounting_username_bug = no Fri Jan 2 18:13:27 2015 : Debug: max_sessions = 4096 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating eap-md5 Fri Jan 2 18:13:27 2015 : Error: rlm_eap: Unknown EAP type cache Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/sites-enabled/inner-tunnel[236]: Failed to load module "eap". Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/sites-enabled/inner-tunnel[189]: Errors parsing authenticate section. My configuration is the next : Freeradius Database : MySQL 2 NIC connected and configured. DHCP service ON and working for eth1. The access points are configured with WPA2 Enterprise security and i have given the radius server IP with the shared key. I have already tested the basic configuration of freeradius before testing with EAP-MD5 and it worked. If someone can help me about this... That'll help me a lot. Thanks in advance.

4 7

Radius Server and Radsecproxy Certificate problem
by Ankit Prajapati 04 Jan '15

04 Jan '15

I am trying to setup radsec using freeradius version 3.0.3. I have generated self-signed certificate on my freeradius server using openssl commands . I have generated CA ,client ,server. , and using same certificate for radsecProxy. 1) Running radsec on Access Point using following command: ./radsecproxy -f -c radsecproxy.conf 2) Running Radius sever on Ubuntu Machine using following command : radiusd -fxx -l stdout Now Radius Server and RadSec able to listen on port 2083 , but not able to make successful connection using TLS. Getting following error on Radsec: Jan 4 16:44:34 2015: tlsconnect: TLS: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Jan 4 16:44:36 2015: connecttcphostlist: trying to open TCP connection to 192.168.11.2 port 2083 Jan 4 16:44:36 2015: connecttcphostlist: TCP connection to 192.168.11.2 port 2083 up Jan 4 16:44:36 2015: verify error: num=19:self signed certificate in certificate chain:depth=1: Test Certificate Authority and on Radius Server getting following error: (0) Requiring client certificate (0) Initiate (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.0 Handshake [length 00de], ClientHello (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.0 Handshake [length 003e], ServerHello (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.0 Handshake [length 08dd], Certificate (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.0 Handshake [length 00a9], CertificateRequest (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (0) <<< TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: TLS Alert read:fatal:unknown CA (0) ERROR: TLS_accept: Failed in SSLv3 read client certificate A (0) ERROR: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 46788 Client has closed connection ... shutting down socket auth from client (192.168.11.1, 46788) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. How to resolve this ? -Regards Ankit

2 1

Publishing an EAP-TLS WPA2 Enterprise Setup Guide on the Wiki
by Jasvinder S. Bahra 03 Jan '15

03 Jan '15

Everyone, I've put together a step-by-step guide showing how to setup FreeRadius to provide a WPA2 Enterprise (EAP-TLS) secure wifi network. In addition, the guide shows how to get various clients onto the network (windows, android and apple devices). I would like to create a page on the official freeradius wiki for my guide, and place a link to it on the HOWTO (http://wiki.freeradius.org/guide/HOWTO) page. Does anyone know how I can gain permission to do so? (assuming permission is required) Or do I need to join the freeradius-developer list and ask there? If the guide would have to be vetted before hand - who would have to give the okay? (again, if required) If anyone can answer these questions, I would appreciate it. Regards, Jazz

5 5

Default Max-Daily-Session setting and per user setting
by Matej Žerovnik 02 Jan '15

02 Jan '15

Hello! I want to set up default Max-Daily-Session limit for all users to 1h and also have the ability to set up per-user Max-Daily-Session. How can I achieve that? I know I can set per-user limit in radcheck mysql table, but how can I set the default limit that will not overwrite per-user setting? Thanks, Matej -- --- Matej Zerovnik

3 4

Client derived CoA/DM home servers
by Arran Cudbard-Bell 02 Jan '15

02 Jan '15

In v3.0.x CoA/DM home servers may now be specified as part of a client definition. Previously a coa home_server could be associated with a client using the coa_server config pair to specify the name of a coa home_server or pool. This functionality is extended, so that if coa_server is specified as a config section a new coa home_server is created, and inherits pairs from the client definition. For example: client localhost { coa_server { port = 1700 zombie_period = 50 coa { irt = 10 } } ipaddr = 127.0.0.1 secret = testing123 } would add a home_server with the ipaddr 127.0.0.1 and the secret testing123 on port 1700, If no port is specified 3799 is used. An empty coa_server section may also be used if no values need to be altered. client localhost { coa_server { } ipaddr = 127.0.0.1 secret = testing123 } and values from the client definition can be overridden. client localhost { coa_server { secret = 123testing } ipaddr = 127.0.0.1 secret = testing123 } The coa_server section isn't restricted to clients.conf and should work fine with rlm_ldap and rlm_couchbase too. If there's demand for it a global knob can be added so that coa home_server definitions are added automatically for all clients. Client derived home_servers will conflict with home_servers defined in proxy.conf if two share the same type/port/ipaddr, but they won't conflict on name as they're unnamed. This also means they can't be referenced in pools. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

What exactly does it mean Socket Destructor failed
by Robert Graham 02 Jan '15

02 Jan '15

I have the proper access to log into the SQL server and I can remotely log into it through tsql and with the MS SQL linux instructions, and perform queries, but I cannot get freeradius for the life of me able to connect....it keeps erroring out with socket destructor called. rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to database "gensql" rlm_sql (sql): Initialising connection pool pool { start = 15 min = 10 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_unixodbc: Connection failed rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" [root@localhost raddb]# Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 3

PAP and NT-hashed password
by sb 02 Jan '15

02 Jan '15

Hello! I'm trying to authenticate users from LDAP with FreeRadius by PAP protocol. Passwords are stored in LDAP in NT-hash. It's not my idea, I just have to do it. When I do radtest -t pap .... I see from freeradius -X: [pap] login attempt with password "n*******W" [pap] Using clear text password "1D******************************9B" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [user/n***********W] (from client localhost port 0) Using Post-Auth-Type Reject So, FreeRadius compares my clear-text password with NT-hash taken from LDAP. Of course they are mismatched and I got a reject. If I'm using this hash as a password, it works. At same time if I use mschap, it works well: radtest -t mschap ... +- entering group MS-CHAP {...} [mschap] Found LM-Password [mschap] Found NT-Password [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok So the question is: how to force PAP to create NT-hash from the given password and compare hash and hash. but not the password and hash? Thank you!

4 14