- Freeradius-Users - lists.freeradius.org

add field in radcheck table
by gary 01 Nov '11

01 Nov '11

2 8

Client hostname in clients.conf instead of IP address
by tohaikmeng 01 Nov '11

01 Nov '11

Hello, Can anyone help me with this question? I have added the following configuration to raddb/modules/attr_rewrite, which allows me to get Client IP address. attr_rewrite addclientip { attribute = Client-IP-Address searchin = packet searchfor = "^$" replacewith = "%{Client-IP-Address}" maxmatches = 1 new_attribute = yes } Is there anyway for me to retrieve the Client hostname as configured in raddb/clients.conf shown in the example below. client www.abc.com { secret = password } Any help will be greatly appreciated. Thanks :) Alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/Client-hostname-in-clients-conf-ins… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 31 Oct '11

31 Oct '11

add that in (actually tried that before as well), still does not work, but the logging looks a little different now: ***** [ldap] performing user authorization for marguin2 [ldap] expand: (uid=%u) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... rlm_ldap: userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... rlm_ldap: radiusFilterId -> Filter-Id = "wireless" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ***** so now the password is not clear text in the log as it was before but still seeing that no good password error....but then there is that line towards the bottom that sasys user authorized to use remote access... do i need to configure Filter-Id or something in the sites-enabled/default or innertunnel or something like that? -m On 10/31/2011 12:19 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: cisco WAP/FreeRadius/OpenLDAP (Phil Mayers) > 2. RE: IPv6 ready? (Sergio NNX) > 3. Re: IPv6 ready? (Phil Mayers) > 4. RE: IPv6 ready? (Sergio NNX) > 5. Re: IPv6 ready? (Phil Mayers) > 6. Re: IPv6 ready? (Johan Meiring) > 7. RE: IPv6 ready? (Sergio NNX) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 31 Oct 2011 14:53:02 +0000 > From: Phil Mayers<p.mayers(a)imperial.ac.uk> > Subject: Re: cisco WAP/FreeRadius/OpenLDAP > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4EAEB64E.5080300(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 31/10/11 14:03, Matthew Arguin wrote: >> Phil, >> I just confirmed that it is tagged with the {CRYPT} or {SHA} (i have >> tried both). also, i changed the user that is binding to be the manager >> CN which has full access to the ldap for mod etc to rule that out. > Ah. I've just seen that you are running 2.1.7 from your original email. > > The default LDAP attribute mappings were updated after that version to > include this line in "ldap.attrmap": > > checkitem Password-With-Header userPassword > > ...you should: > > a. Add that line to your "ldap.attrmap", see if it makes any difference > b. Plan an upgrade to 2.1.12 > > > ------------------------------ > > Message: 2 > Date: Mon, 31 Oct 2011 15:32:07 +0000 > From: Sergio NNX<sfhacker(a)hotmail.com> > Subject: RE: IPv6 ready? > To:<freeradius-users(a)lists.freeradius.org> > Message-ID:<BAY147-W5460081D972A7B951D126CCD60(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes : > > ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log > > but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so??? > > Thanks again for your help. > > Sergio. > >> Date: Mon, 31 Oct 2011 08:52:46 +0000 >> From: A.L.M.Buxey(a)lboro.ac.uk >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: IPv6 ready? >> >> Hi, >> >>> Just wondering if FR supports IPv6 addresses since I'm unable to start the >>> server when using IPv6. >> yes. we use it fine with IPv6 - both receiving and sending RADIUS packets. >> >>> Another question is: are you aware of any (client) tool for testing FR >>> when using IPv6 addresses? eapol_test doesn't seem to know anything about >>> :: or ::1 >> eapol_test - use hostnames (eg in /etc/hosts ?) ? >> >>> Do the below lines from radiusd.conf require any change when IPv6? >>> >>> ... >>> ... >>> detail { >>> detailfile = >>> ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log >> yes, Client-IP-Address doesnt exist in IPv6 world - you can use one of the source >> address attributes instead >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

2 1

AD integration
by Whitlow, Michael 31 Oct '11

31 Oct '11

Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow

8 20

Assert Failed on Proxing
by andreapepa 31 Oct '11

31 Oct '11

Hi all, As you can see from the attached log, i was tring to do some proxy test, the server crashed attempting to proxy against a not running freeradius proxy.... ( i was only testing proxy action not authentication on other FR servers) is it normal? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa(a)newradius.it" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy auth_by_SSID {...} +++? if (Called-Station-Id != /:WiNET-TR5G/ && User-Name =~ /cpe/ ) ? Evaluating (Called-Station-Id != /:WiNET-TR5G/ ) -> TRUE ? Evaluating (User-Name =~ /cpe/) -> FALSE +++? if (Called-Station-Id != /:WiNET-TR5G/ && User-Name =~ /cpe/ ) -> FALSE ++- policy auth_by_SSID returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/172.25.18.123/auth-detail-20111021 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.25.18.123/auth-detail-20111021 [auth_log] expand: %t -> Fri Oct 21 11:57:05 2011 ++[auth_log] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "newradius.it" for User-Name = "apepa(a)newradius.it" [suffix] Found realm "newradius.it" [suffix] Adding Stripped-User-Name = "apepa" [suffix] Adding Realm = "newradius.it" [suffix] Proxying request from user apepa to realm newradius.it [suffix] Preparing to proxy authentication request to realm "newradius.it" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{Stripped-User-Name} -> apepa [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-none}} -> apepa [sql] sql_set_user escaped user --> 'apepa' rlm_sql (sql): Reserving sql socket id: 43 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='apepa' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='apepa' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in group TNNET [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 7 , fields = 5 rlm_sql (sql): Released sql socket id: 43 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Proxying request 0 to home server 172.25.200.161 port 1812 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 Sending duplicate proxied request to home server 172.25.200.161 port 1812 - ID: 123 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Waking up in 16.9 seconds. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 Sending duplicate proxied request to home server 172.25.200.161 port 1812 - ID: 123 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Waking up in 13.9 seconds. ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL Abortito -- View this message in context: http://freeradius.1045715.n5.nabble.com/Assert-Failed-on-Proxing-tp4924319p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 14

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 31 Oct '11

31 Oct '11

Phil, I just confirmed that it is tagged with the {CRYPT} or {SHA} (i have tried both). also, i changed the user that is binding to be the manager CN which has full access to the ldap for mod etc to rule that out. [ldap] performing user authorization for marguin2 [ldap] expand: (uid=%u) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: radiusFilterId -> Filter-Id = "wireless" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 at this point i am wondering if i have not done something with that radiusFilterId value... meaning do something to permit that that filter is permitted to auth etc. -m On 10/28/2011 10:40 AM, freeradius-users-request(a)lists.freeradius.org wrote: > On 28/10/11 13:46, Matthew Arguin wrote: >> > right now, the user that i am testing with has a password that is CRYPT. > Ok. But does it look like this: > > userPassword: xxyyeeyeetwe > > or this: > > userPassword: {crypt}xxyyeqetew > > This matters. > > > ------------------------------ -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

2 1

Quota based on time with squid
by senthil kumar 31 Oct '11

31 Oct '11

Hello Team, I am a newbie to radius server. I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server. I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius? I am using only linux machine with proxy server. whether NAS is needed? If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth. Thanks, Senthil

4 6

Custom MySQL Queries
by JennyBlunt 29 Oct '11

29 Oct '11

Hello What's the best approach regarding custom mysql queries? I'd like to check if a user is blocked whilst authorising.. Have tried to add something like this to my dictionary file: ATTRIBUTE User-Disabled-Attr 3002 integer And then putting a 1 / 0 in to radcheck against the user. What's the best way to do this kind of request? Is it better to write a lookup somewhere else? Thanks J -- View this message in context: http://freeradius.1045715.n5.nabble.com/Custom-MySQL-Queries-tp4943692p4943… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

RADIUS certificate compatibility warning
by Martin Ubank 29 Oct '11

29 Oct '11

I've upgraded FreeRadius to 2.1.10 and Samba to 3.5.6. I've got right through (again) to the final "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP" stage but the command 'eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123' fails. The 'radiusd -X' output finishes with : WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x89fe3c9f81f72525 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! http://wiki.freeradius.org/Certificate_Compatibility refers to a problem when the client is a Windows machine, but I'm running the 'eapol_test' command on the FreeRadius server which is Linux (CentOS). The following lines from the output of the 'eapol_test' command seem to indicate a problem with the root certificate.: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:00000000:lib(0):func(0):reason(0) OpenSSL: tls_connection_ca_cert - loaded DER format CA certificate I created the certificates using the method decsribed in http://deployingradius.com/documents/configuration/certificates.html I can supply the full output from the 'eapol_test' command and from 'radiusd -X' but they're too big to include in this email. Can anyone tell me what I'm doing wrong? Thanks Martin. ================================================================ Here are the errors/warnings section from the output of the 'eapol_test' command and from 'radiusd -X', and the full contents of peap-mschapv2-cert-ntlm_auth.conf, the ca.cnf, server.cnf & client.cnf files & eap.conf: 'eapol_test' errors/warnings ============================ : RADIUS packet matching with station decapsulated EAP packet (code=1 id=2 len=6) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=2 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 EAP: Initialize selected EAP method: vendor 0 method 25 (PEAP) TLS: Phase2 EAP types - hexdump(len=40): 00 00 00 00 04 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 11 00 00 00 TLS: using phase1 config options OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:00000000:lib(0):func(0):reason(0) OpenSSL: tls_connection_ca_cert - loaded DER format CA certificate CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-PEAP: Start (server ver=0, own ver=1) EAP-PEAP: Using PEAP version 0 SSL: (where=0x10 ret=0x1) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:before/connect initialization SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client hello A SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server hello A SSL: SSL_connect - want more data SSL: 112 bytes pending from ssl_out SSL: 112 bytes left to be sent out (of total 112 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=122) : 'radiusd -X' errors/warnings ============================ : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: USERNAME [mschap] Told to do MS-CHAPv2 for USERNAME with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USERNAME [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-CAMPUS} -> --domain=CAMPUS [mschap] mschap2: 8a [mschap] Creating challenge hash with username: USERNAME [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ee9182b1015b8ded [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=69c37f86d6f44237a66d979b71072d9b874e0fd822ad f858 Exec-Program output: NT_KEY: 4600A59AAB67436A4D937233DEED28B7 Exec-Program-Wait: plaintext: NT_KEY: 4600A59AAB67436A4D937233DEED28B7 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d4343373038393531333746344638333338433834463437303836313636424637413735344643333 0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9197308e909e2a67190d1c1ddd88b035 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d4343373038393531333746344638333338433834463437303836313636424637413735344643333 0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9197308e909e2a67190d1c1ddd88b035 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 127.0.0.1 port 50462 EAP-Message = 0x0109005b19001703010050ad7b5774ef100e1dd3a5c7a83b174202511c51378dc9f1932cf39dc92db9b588fa9f336d1aeb825 807e62e2cc34dd162d02aa28c9104381f52a86933e2b9e0f65927f00c2fb64b78a078cc5e8e79457b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x20754327287c5ad31b57225dabc8b87e Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +76 Cleaning up request 1 ID 1 with timestamp +76 Cleaning up request 2 ID 2 with timestamp +76 Cleaning up request 3 ID 3 with timestamp +76 Cleaning up request 4 ID 4 with timestamp +76 Cleaning up request 5 ID 5 with timestamp +76 Cleaning up request 6 ID 6 with timestamp +76 Cleaning up request 7 ID 7 with timestamp +76 Cleaning up request 8 ID 8 with timestamp +76 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x20754327287c5ad3 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. peap-mschapv2-cert-ntlm_auth.conf ================================= # # eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123 # # eapol_version=1 # fast_reauth=0 network={ key_mgmt=WPA-EAP eap=PEAP identity="USERNAME" password="PASSWORD" phase2="autheap=MSCHAPV2" # priority=10 ca_cert="/etc/raddb/certs/ca.der" } ca.cnf ====== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/ca.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/ca.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 3650 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = inpass output_password = outpass x509_extensions = v3_ca [certificate_authority] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Certificate Authority" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true ================================================================ server.cnf ========== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 730 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = inpass output_password = outpass [server] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Server Certificate" ================================================================ client.cnf ========== [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 730 default_crl_days = 30 default_md = sha1 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = client default_bits = 2048 input_password = inpass output_password = outpass [client] countryName = UK stateOrProvinceName = United Kingdom localityName = Bristol organizationName = UWE emailAddress = email(a)uwe.ac.uk commonName = "UWE Client Certificate" eap.conf ======== eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = outpass private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" cache { enable = no max_entries = 255 } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } }

7 13

CUI in TLS
by Panagiotis Georgopoulos 28 Oct '11

28 Oct '11

Hello all, I am trying to implement CUI in EAP-TLS and I would like to get a handle on the CN of the client's certificate in my default. Basically I need to use the CN of the certificate, since there is no User-Name attribute in EAP-TLS. What module handles the TLS certificates' authentication? How can I get the CN in my post_auth and accounting stanzas in my default? On a similar note, why do we set the lastaccounting='0000-00-00 00:00:00',in the post_authquery in the cui.conf? Incidentally, if we need full IPv6 support the clientipaddress field in the cui table and the equivalent fields in radacct should be of length 39 and not 15. Cheers, Panos

2 3