- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 82, Issue 33
by Gilmour, Scott 13 Feb '12

13 Feb '12

Alan, I already have certificates created on my 2008 Server so I want to use those certificates on my Ubuntu Server without creating new ones. You mentioned my openssl configuration is wrong. Any suggestions on how I can fix the openssl configuration? Thanks Scott Message: 1 Date: Sun, 12 Feb 2012 10:26:44 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Cetificates to Use with Ubuntu Server To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4F3785D4.3020103(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Gilmour, Scott wrote: > I have Ubuntu Server installed and I have a Windows 2008 Server > Certificate Authority > > When I type the openssl command I keep on getting this error: CA > certificate and CA private key do not match Your OpenSSL configuration is wrong. > Ps. I was able to get Samba to work after loading the lates server > Ubuntu 11.10. Thanks for everyones help. That's good to hear. > root@FreeRadius:/etc/freeradius/certs# openssl ca -policy > policy_anything -out certificate.pem -passin pass:enterasys -key > enterasys -extensions xpserver_ext -extfile xpextensions -infiles > server.csr Don't do that. There's a lot of magic in OpenSSL. Instead, see raddb/certs/README. The process for creating certificates is automated, documented, and it *works*. Alan DeKok.

3 2

update replay
by Miha Zoubek 13 Feb '12

13 Feb '12

Hi, I have set in sql.conf multiple sql instance. I will also include further different dialup.conf for sql query. How can I configure default file in site-avalible as for one softswitch I do not need this variables to be replied: update reply { NAS-IP-Address = "%{NAS-IP-Address}" Acct-Multi-Session-Id = "%{Acct-Multi-Session-Id}" Acct-Session-Id = "%{Acct-Session-Id}" Event-Timestamp = "%{Event-Timestamp}" 3GPP2-Session-Termination-Capability = "%{3GPP2-Session-Termination-Capability}" 3GPP2-Prepaid-Acct-Quota = "%{3GPP2-Prepaid-Acct-Quota}" 3GPP2-Prepaid-acct-Capability = "%{3GPP2-Prepaid-acct-Capability}" # 3GPP2-Session-Termination-Capability = "{3GPP2-Session-Termination-Capability}" # Acct-Multi-Session-Id = %{request:Acct-Multi-Session-Id} # 3GPP2-Release-Indicator =%{request:3GPP2-Release-Indicator} } Thanks! Miha -- Best regards / Lep Pozdrav Miha Zoubek Softnet d.o.o.

3 7

Multi-domain AD and Users Who Aren't So Bright
by McNutt, Justin M. 13 Feb '12

13 Feb '12

So I'm working on a way to Improve the User Experience. I've gotten a LONG way, but now I'm stuck. Here's the short/long version (all details, without undue explanation or discussion of what I tried that doesn't work): WARNING: This may well be a case of doing it the hard way. If that's the case, feel free to tell me, but it's not for lack of trying to research this via Google, searching archives of this list, etc. Just tell me what I'm doing wrong. I can handle it. ;) Okay, here goes: 1) I created two custom attributes named "My-NT-Domain" and "My-User-Name" and added them to the dictionary file as 3003 and 3004, respectively. 2) I added sections to sites-enabled/my-virt-server in the "authorize {" like this: # Allow host-based authentication for computers in the domain. if ( User-Name =~ /host\/[^\.]+\.(.+)/ ) { update request { My-User-Name = "%{mschap:User-Name}" My-NT-Domain = "%{1}" } } # Fix the forward slash. elsif ( User-Name =~ /([^\/]+)\/(.+)/ ) { update request { My-User-Name = "%{2}" My-NT-Domain = "%{1}" } } # New student e-mail format. elsif ( User-Name =~ /([^@]+)@mail.missouri.edu/ ) { update request { My-User-Name = "%{1}" My-NT-Domain = "TIGERS" } } ... and so on. 3) I changed /etc/raddb/modules/mschap to call ntlm_auth like this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{My-User-Name}:-%{mschap:User-Name}} --domain=%{%{My-NT-Domain}:-%{mschap:NT-Domain}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" So at this point, if a user plugs in the correct "domain\username" stuff, none of the "cleanup" cases match, so my custom attributes are empty, and the usual %{mschap:xx} variables work fine. If fixes were necessary, the custom attributes take over. All that works fine. NOW we want to be able to have a user authenticate without specifying a domain. In theory, that's no big deal. If the users NEVER specify a domain at all, I can populate my custom attributes with this: if ( ! My-NT-Domain ) { update request { My-User-Name = "%{User-Name}" My-NT-Domain = `/etc/raddb/bin/GetDomain.pl %{User-Name}` } } The "GetDomain.pl" script does a command-line LDAP search (using "ldapsearch") against our AD for %{User-Name}, grabs the dn attribute, matches the AD domain, and returns the NT domain that corresponds. This also works. NOW, the problem is that if the user DOES specify "domain\username" correctly, then none of the "cleanup" cases match, so My-NT-Domain is empty. But since my custom attribute is empty, the Perl script is being called unnecessarily to run the LDAP search. Solution: I was still thinking about this as I wrote it, and I modified the "final check" clause (that looks for the total absence of domain hints) and I thought of a way to implicitly resolve the case where the user passes scary characters in the user ID (injection attack) AND the case where the user specified a valid domain\username set of creds at the same time: # Check special fix-it cases above. # These could probably be done as a single if statement. # It was simpler to keep them separate while testing. if ( ! My-NT-Domain ) { if ( User-Name =~ /^[a-zA-Z0-9]+$/ ) { update request { My-User-Name = "%{User-Name}" My-NT-Domain = `/etc/raddb/bin/GetDomain.pl %{User-Name}` } } } This appears to be working. Overall, I give this solution about a B+. PROS: Works in a single forest, multi-domain environment, regardless of any conformity to typical AD domain naming standards. Makes authentication SIMPLE for the users. The way I wrote the GetDomain script, it always returns DOMAIN or (null) after only a single LDAP query (efficient). Combined with judicious use of "radiusd -XC" provides a simple way to correct common typos. Permits computer-based authentication to work again in multi-domain or non-typical-naming cases (where mschap currently fails). Still reports the original creds as given by user (in case you still want to report on the cases that needed fixing and resolve the problem at the source, rather than making FR do all the work. Limited to this virtual server. CONS: In many cases - like translating "col.missouri.edu" to "UMC-USERS", the "fixes" are hard-coded. By comparison, changing the / to a \ works for any domain in a single check. Doubles (at least) the number of calls to AD in cases where everyone is lazy and leaves out the domain. I.e. an LDAP call to get the domain plus the authentication itself. Encourages user ignorance. (Judgement call.) Limited to this virtual server. Thoughts? Opinions? Better ways to accomplish any/all of this? --J

4 19

Freeradius rlm_pam
by Mark 12 Feb '12

12 Feb '12

Hello, While my eventual goal is GTC + PAM, I'm struggling to get the innner-tunnel request to successfully authenticate my user through PAM. I've made the following configuration changes from a clean installation of 2.1.12 on a Gentoo Linux system: 1. Added wap to the clients file 2. Put certs in eap.conf file 3. Uncommented pam in the sites-available/default file 4. changed copy_request_to_tunnel to yes 5. Uncommented Pam in sites-available/innner-tunnel In order to test the inner-tunnel configuration I used the following command: radtest markg goodpass 127.0.0.1:18120 0 testing123 The radiusd -X output is: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 11 2012 at 09:59:42 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.10 { require_message_authenticator = no secret = "cisc0" shortname = "ciscowap" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /etc/raddb/modules/pam pam { pam_auth = "radiusd" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/ssl/certs" pem_file_type = yes private_key_file = "/etc/raddb/newcerts/server.key" certificate_file = "/etc/raddb/newcerts/server.crt" CA_file = "/etc/ssl/certs/ca.pem" dh_file = "/etc/raddb/newcerts/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/newcerts/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 34881 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50096, id=72, length=75 User-Name = "markg" User-Password = "goodpass" NAS-IP-Address = 192.68.1.2 NAS-Port = 0 Message-Authenticator = 0xa2fa31a820c472d36f71c0d16a4bb0c5 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "markg", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [markg] (from client localhost port 0) } # server inner-tunnel Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> markg attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 72 to 127.0.0.1 port 50096 Waking up in 4.9 seconds. Cleaning up request 0 ID 72 with timestamp +10 Ready to process requests. ======================================================================== Reading the Wiki and previous help responses on this list, I see that Auth-Type shouldn't have to be forced. I'd be grateful for any assistance as to what changes I need to make so that the inner-tunnel request from rad-test would successfully authenticate via PAM. Thanks in advance for your help! Mark

3 4

Re: Freeradius rlm_pam
by Alan Buxey 12 Feb '12

12 Feb '12

Hi, Your server is configured with md5 as the default EAP type. The client NAKs that and then goes on to do PEAP. Can your clients do EAP-GTC? another confusion occurs in inner tunnel due to having 2 auth-type entries. Perhaps define a new file/users instance for the inner-tunnel with DEFAULT Auth-Type = pam defined. Pap module might then pick this up alan

1 0

RE: Cetificates to Use with Ubuntu Server
by Gilmour, Scott 12 Feb '12

12 Feb '12

Hi, I have Ubuntu Server installed and I have a Windows 2008 Server Certificate Authority When I type the openssl command I keep on getting this error: CA certificate and CA private key do not match Any help or suggestions would be appreciated. Thanks Scott Ps. I was able to get Samba to work after loading the lates server Ubuntu 11.10. Thanks for everyones help. root@FreeRadius:/etc/freeradius/certs# openssl ca -policy policy_anything -out certificate.pem -passin pass:enterasys -key enterasys -extensions xpserver_ext -extfile xpextensions -infiles server.csr Using configuration from /usr/lib/ssl/openssl.cnf CA certificate and CA private key do not match 3074058392:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:318: root@FreeRadius:/etc/freeradius/certs# root@FreeRadius:/etc/freeradius/certs# openssl req -new -nodes -keyout mykey.pem -out server.csrGenerating a 1024 bit RSA private key .......++++++ ........++++++ writing new private key to 'mykey.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:MA Locality Name (eg, city) []:Andover Organization Name (eg, company) [Internet Widgits Pty Ltd]:Enterasys.com Organizational Unit Name (eg, section) []:SQA Common Name (eg, YOUR name) []:Scott Email Address []:SQA@enterasys.com Please enter the following 'extra' attributes to be sent with your certificate request enterasys []:enterasys An optional company name []:Enterasys root@FreeRadius:/etc/freeradius/certs# root@FreeRadius:/etc/freeradius/certs# openssl pkcs12 -in "SQA 2008 System Certificate.p12" -out ca.pem Enter Import Password: MAC verified OK Enter PEM pass phrase: Verifying - Enter PEM pass phrase: root@FreeRadius:/etc/freeradius/certs# openssl ca -policy policy_anything -out certificate.pem -passin pass:enterasys -key enterasys -extensions xpserver_ext -extfile xpextensions -infiles server.csr Using configuration from /usr/lib/ssl/openssl.cnf CA certificate and CA private key do not match 3074058392:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:318: root@FreeRadius:/etc/freeradius/certs# OpenSSL.cnf file: # OpenSSL example configuration file. # This is mostly being used for generation of certificate requests. # # This definition stops the following lines choking if HOME isn't # defined. HOME = . RANDFILE = $ENV::HOME/.rnd # Extra OBJECT IDENTIFIER info: #oid_file = $ENV::HOME/.oid oid_section = new_oids # To use this configuration file with the "-extfile" option of the # "openssl x509" utility, name here the section containing the # X.509v3 extensions to use: # extensions = # (Alternatively, use a configuration file that has only # X.509v3 extensions in its main [= default] section.) [ new_oids ] # We can add new OIDs in here for use by 'ca', 'req' and 'ts'. # Add a simple OID like this: # testoid1=1.2.3.4 # Or use config file substitution like this: # testoid2=${testoid1}.5.6 # Policies used by the TSA examples. tsa_policy1 = 1.2.3.4.1 tsa_policy2 = 1.2.3.4.5.6 tsa_policy3 = 1.2.3.4.5.7 #################################################################### [ ca ] default_ca = CA_default # The default ca section #################################################################### [ CA_default ] dir = /etc/freeradius # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are keptcd .. database = $dir/index.txt # database index file. #unique_subject = no # Set to 'no' to allow creation of # several ctificates with same subject. new_certs_dir = $dir/certs # default place for new certs. certificate = $certs/ca.pem # The CA certificate serial = $dir/serial # The current serial number crlnumber = $dir/crlnumber # the current crl number # must be commented out to leave a V1 CRL crl = $dir/crl.pem # The current CRL private_key = $certs/mykey.pem # The private key RANDFILE = $certs/random # private random number file x509_extensions = usr_cert # The extentions to add to the cert Directions I am Using: The second way of doing this, which is not very neat, is as follows: >From the computer where your freeradius is, you generate a request and a private key by: shell:~ # openssl req -new -nodes -keyout mykey.pem -out server.csr The challenge password is important because it'll be used in the freeradius configuration The file mykey.pem is the private key. Copy this file to /usr/local/etc/raddb/certs shell:~ # cp mykey.pem /usr/local/etc/raddb/certs Then, from the computer where your CA authority is, open a Command prompt window and type: C:\>certutil -backup directory It will prompt you for the password for your private key and will generate a backup of your CA private and public key inside the directory "directory". Let's say that your password is "password". Then, go to "directory" C:\>cd directory And copy the file "Certification Authority.p12" to the computer where your FreeRadius is. This file contains both your CA's private and public keys. Then, from your freeradius computer, you need to convert this file to a format more "manageable". shell:~ # openssl pkcs12 -in "Certification Authority.p12" -out ca.pem Then, you need to modify your /etc/ssl/openssl.cnf file. Locate the section [ CA_default ] and modify the lines certificate and private_key, so they point to the file you generated in the last step. Those lines should look like: certificate = /root/ca.pem private_key = /root/ca.pem Once you have finished doing these changes, then create a file called xpextensions with the following contents: [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 This is required to add the extension needed for your certificate. Then shell:~ # openssl ca -policy policy_anything -out certificate.pem -passin pass:password -key password -extensions xpserver_ext -extfile xpextensions -infiles server.csr Delete the file server.csr shell:~ # rm server.csr And copy the files ca.pem and certificate.pem to /usr/local/etc/raddb/certs shell:~ # cp ca.pem certificate.pem /usr/local/etc/raddb/certs It is preferable to delete all info about the private key from the file ca.pem, but it is up to you. Now edit your eap.conf file and you are done. A sample eap.conf is at the end of this guide. Configure your clients to use PEAP, check the checkbox "Validate server certificate" and select your Trusted Root Certification Authority from the list. SAMPLE EAP.CONF eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = #The challenge password you have chosen when you generated your private key private_key_file = ${raddbdir}/certs/mykey.pem certificate_file = ${raddbdir}/certs/certificate.pem CA_file = ${raddbdir}/certs/ca.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 } mschapv2 { } }

2 1

Re: how to disable a particular EAP type in freeradius2 for a particular ESSID ?
by Alan Buxey 11 Feb '12

11 Feb '12

Yes. Perfectly possible...just need to make copies of the 'files' module file, then give it is name (as per docs), then out a different users file in the second copy. In the virtual server you can then call the copy of the files module that uses that different file. Personally I'd just use one small bit of unlang eg if(%{Called-Station-Id} ~= /:ssid$/i && EAP-Type = EAP-TLS) { access-reject } (example quick code!)...this assumes the request coming from the AP/controller has the SSID embedded in it..... alan

4 3

LDAP Binding
by NdK 11 Feb '12

11 Feb '12

Hello all. Is it possible to bind to AD's LDAP using the Kerberos ticket obtained at join time? That would allow to search for group membership without spawning more processes... Tks, Diego.

4 6

Optimizing ldap queries to AD using users file on freeradius 2.1.12
by Luis Písco 11 Feb '12

11 Feb '12

Hello, Im trying to minimize ldap queries to Active directory do to heavy load on DC. -------------------------------------------- 1º - Change query on LDAP module to not search group of group Accomplish using on ldap: filter = "(samaccountname=%{Stripped-User-Name})" dictionary_mapping = ${raddbdir}/ldap.attrmap groupname_attribute = cn groupmembership_filter = "(objectClass=Group)(member=%{check:Ldap-UserDn})" -------------------------------------------- 2º - Do only one LDAP query for every type I have several campus and several vlan assignment on each campus. So I have for example this check items on users file: DEFAULT Huntgroup-Name == "gambelas",ldapnaodocentes-Ldap-Group =="Nao Docentes" Tunnel-Private-Group-ID := 302, DEFAULT Huntgroup-Name == "gambelas",ldapnaodocentes-Ldap-Group == "e-U-InternoComoExterno" Tunnel-Private-Group-ID := 304, DEFAULT Huntgroup-Name == "Penha",ldapnaodocentes-Ldap-Group =="Nao Docentes" Tunnel-Private-Group-ID := 602, And so on. If the user is on last campus, it will query the AD several times for the same group query because even if Huntgroup-Name dont match, it will run the ldap query of the same check line. So I tried this with no success: DEFAULT ldapnaodocentes-Ldap-Group =="Nao Docentes" Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", My-Group:=2, Fall-Through = Yes DEFAULT Huntgroup-Name == "gambelas", My-Group==2 Tunnel-Private-Group-ID := 302, Reply-Message = " eduroam Gambelas Nao Docente Vlan 302!", DEFAULT Huntgroup-Name == "penha", My-Group==2 Tunnel-Private-Group-ID := 602, Reply-Message = " eduroam Penha Nao Docente Vlan 602!", But the My-Group==2 is not evaluated. It is not possible to assign a value to an item and use it later on the users file? -------------------------------------------- 3º - Several group have the same vlan so i can create a group of groups on AD and do the search by that group. The problem is that it search if every group the user belong. If the user have 20 group on AD and have to check for 10 group is users file, it will do 200 search. The field tokenGroups on user AD have all the group and group of group for the user, but have a list of SID and not the DN of the group. It is possible get the SID of the group instead of the DN to use to search on tokenGroups field of the user AD? -------------------------------------------- Tanks Pisco

2 1

Re: Another LDAP/MSCHAPv2 problem
by Alan Buxey 11 Feb '12

11 Feb '12

Hmmm. Don't update user-name. Set or update stripped-user-name instead and use that in the mschap auth actually I'm sure by default the system understands these user names so as long as you use %{mschap:user-name} you'll be using the correct value in that place.... we do machine auth to multiple AD backends with none of this hassle....which is why we use FR. alan

2 1