- Freeradius-Users - lists.freeradius.org

Workload in freeradius‏ platform
by siguillaume 24 Oct '11

24 Oct '11

Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp4… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 18

Re: Installation docu
by Alan Buxey 23 Oct '11

23 Oct '11

Guess it depends on your distro and setup? ./configure worked fine here for full postgresql support... alan -- Message may be brief as it has been sent from my mobile

1 0

radius + ldap + ntlm
by Andreas Rudat 23 Oct '11

23 Oct '11

Hello, I understand it correctly, that I can't use peap + mschapv2 with ldap? Im realy confused atm, what I can realy use, everytime I think its fine, I found another unsecure thing :/ Thanks

3 5

Re: SSL error after updating cert
by Eric Geier 21 Oct '11

21 Oct '11

Thanks for the reply! Yes, the clients are set with correct time/date. That command didn't work. Did you mean openssl verify command? I ran that and both the old cert (still valid for a few days) and the new cert (already valid) shows correct domain but then says: error 20 at 0 depth lookup:unable to get local issuer certificate This may not be the problem since I get it with both old and new certs. Any other ideas? On Fri Oct 21 14:56:33 CDT 2011, James J J Hooper <jjj.hooper(a)bristol.ac.uk> wrote: > On 21/10/2011 20:44, Eric Geier wrote: >> Hi, I?m trying to update my server?s cert, but getting errors >> after applying it: >> >> Fri Oct 21 12:26:45 2011 : Error: TLS Alert >> read:fatal:certificate >> expired >> Fri Oct 21 12:26:45 2011 : Error: TLS_accept:failed in SSLv3 >> read client certificate A >> Fri Oct 21 12:26:45 2011 : Error: rlm_eap: SSL error >> error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert >> certificate expired >> Fri Oct 21 12:26:45 2011 : Error: rlm_eap_tls: SSL_read failed >> inside of TLS (-1), TLS session fails. >> >> Says expired but I?m using the new cert, which is a renewal from >> a >> third-party CA and using the same private key. I apply it by >> inserting the text of the .crt file into the server-cert.pem file >> in the certs folder. I think that?s all I have to do and restart >> freeradius? >> > > 1) Check the date on the client system is correct > > 2) do: > openssl -in /path/to/your/raddb/server-cert.pem -noout -text > and verify the properties of the cert you have. > > -James > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

SSL error after updating cert
by Eric Geier 21 Oct '11

21 Oct '11

Hi, I�m trying to update my server�s cert, but getting errors after applying it: Fri Oct 21 12:26:45 2011 : Error: TLS Alert read:fatal:certificate expired Fri Oct 21 12:26:45 2011 : Error: TLS_accept:failed in SSLv3 read client certificate A Fri Oct 21 12:26:45 2011 : Error: rlm_eap: SSL error error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired Fri Oct 21 12:26:45 2011 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Says expired but I�m using the new cert, which is a renewal from a third-party CA and using the same private key. I apply it by inserting the text of the .crt file into the server-cert.pem file in the certs folder. I think that�s all I have to do and restart freeradius? Any ideas? Thanks for your help!

2 1

Allow EAP-TLS based authentications only
by Panagiotis Georgopoulos 21 Oct '11

21 Oct '11

Hello all, I want to get my FR configuration to allow only EAP-TLS based authentications. Am I right in thinking that if I leave enabled only the EAP-TLS, the EAP-TTLS and PEAP parts in my eap.conf file, I would basically achieve what I want? In order words, essentially disable md5, leap, gtc, mschapv2 in the eap.conf. There should not be any need for me to touch the inner-tunnel or inner-eap, right? Thanks a lot, Panos

2 3

Radius + SAMBA PDC + LDAP
by Andreas Rudat 21 Oct '11

21 Oct '11

Hi, I'm using samba as pdc and ldap as user database. That all works fine. Now I want to use the ldap database for user auth. for radius. But when I'm looking here http://deployingradius.com/documents/configuration/active_directory.html and some other sources, I read everywhere the same. "Konfiguration of Kerberos" but why? I think it should also with ntlm only? And does this paper is the correct for me? Caus if I understand it correctly in that scenario they are using a MS AD? Thanks Andreas

2 2

Problems with radrelay
by tonimanel 21 Oct '11

21 Oct '11

Hi everybody, I had configured freeradius with mysql and writting in a second detail. This second file was readed by radrelay and accounting data was replicated between both servers. All worked fine. Now when I have tried to configure a second radrelay on the second server (that only recieved account data from the other server), first radrelay from the first server not works and all the system not works fine. The first server only writes in detail file if it is not launch with -n radrelay option. I think that it's very rare. Is it possible that radrelay works between two servers but only in one sense? What is happening? Regards, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-radrelay-tp4918721p49… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Configuring FreeRADIUS to use ntlm_auth for MS-CHAP
by Martin Ubank 21 Oct '11

21 Oct '11

I've been following the FreeRadius Deployment guide http://deployingradius.com/documents/configuration/active_directory.html The following software is installed on a Centos 6 VM: - Samba 3.5.4, Freeradius 2.1.9, wpa_supplicant-0.7.3, gcc v4.4.4-13, openssl, winbind. I successfully performed basic configuration tests with the 'eapol_test' command for: - PAP, EAP, EAP-TLS, EAP-TTLS, EAP-MD5 & EAP-MSCHAPv5. I've created production certificates & successfully tested for the above protocols. Installed Kerberos 1.8.2 & tested that successfully. I started to configure FreeRadius with AD and successfully tested it to use ntlm_auth. I've got to the final stage "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP" in the deployment process. This stage says: 1) "... delete the testing entry used above from the users file, ...", which I've done. 2) "... fine (sic) the mschap module in raddb/modules/mschap file, and look for the line containing ntlm_auth = . It ... should be uncommented, ...", which I've done. 3) "Start the server ..." I ran 'radiusd -X'. 4) "... and use a test client to send an MS-CHAP authentication request." I've used the command 'eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123'. I can see from the 'radiusd -X' output that FreeRadius is not using MS-CHAP correctly: <snip> [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for USERNAME with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject <snip> The 'eapol_test' output reflects this: <snip> EAP-PEAP: Selected Phase 2 EAP vendor 0 method 26 EAP-MSCHAPV2: RX identifier 8 mschapv2_id 8 EAP-MSCHAPV2: Received challenge EAP-MSCHAPV2: Authentication Servername - hexdump_ascii(len=11): 65 64 75 72 6f 61 6d 74 65 73 74 USERNAME EAP-MSCHAPV2: Generating Challenge Response MSCHAPV2: Identity - hexdump_ascii(len=11): 65 64 75 72 6f 61 6d 74 65 73 74 USERNAME MSCHAPV2: Username - hexdump_ascii(len=11): 65 64 75 72 6f 61 6d 74 65 73 74 USERNAME MSCHAPV2: auth_challenge - hexdump(len=16): a5 e6 9e fa 6e 1f ec 2f 0b b6 a3 96 ef 45 15 32 MSCHAPV2: peer_challenge - hexdump(len=16): 44 31 43 ff 2f 12 5b 25 b5 eb fb 59 6f 8d 2a a9 MSCHAPV2: username - hexdump_ascii(len=11): 65 64 75 72 6f 61 6d 74 65 73 74 USERNAME MSCHAPV2: password - hexdump_ascii(len=20): 77 6f 72 6b 6d 61 6e 20 74 6f 64 61 79 20 61 72 PASSWORD 6e 69 63 61 MSCHAPV2: NT Response - hexdump(len=24): 66 67 95 3d 56 d6 ab b4 ab ba 64 bf 6c db 8b 51 77 ad 3e bc 96 26 7c 7a MSCHAPV2: Auth Response - hexdump(len=20): f0 95 4d 86 ee 82 8f c0 12 84 cc a7 d0 72 fb e6 95 b3 ef d1 MSCHAPV2: Master Key - hexdump(len=16): 31 8d ae c0 3d e1 42 0f ae 05 bc f0 72 da 98 72 EAP-MSCHAPV2: TX identifier 8 mschapv2_id 8 (response) EAP-PEAP: Encrypting Phase 2 data - hexdump(len=70): 02 08 00 46 1a 02 08 00 41 31 44 31 43 ff 2f 12 5b 25 b5 eb fb 59 6f 8d 2a a9 00 00 00 00 00 00 00 00 66 67 95 3d 56 d6 ab b4 ab ba 64 bf 6c db 8b 51 77 ad 3e bc 96 26 7c 7a 00 65 64 75 72 6f 61 6d 74 65 73 74 <snip> RADIUS packet matching with station decapsulated EAP packet (code=4 id=9 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 EAPOL: EAP key not available EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 1 FAILURE The peap-mschapv2-cert-ntlm_auth.conf file contains: # # eapol_test -c peap-mschapv2-cert-ntlm_auth.conf -s testing123 # eapol_version=1 fast_reauth=0 network={ key_mgmt=WPA-EAP eap=PEAP identity="USERNAME" # anonymous_identity="anonymous" password="PASSWORD" phase2="auth=MSCHAPV2" priority=10 # # Uncomment the following to perform server certificate validation. ca_cert="/etc/raddb/certs/ca.der" } The file /etc/raddb/modules/mschap contains: # -*- text -*- # # $Id$ # Microsoft CHAP authentication # # This module supports MS-CHAP and MS-CHAPv2 authentication. # It also enforces the SMB-Account-Ctrl attribute. # mschap { #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-CAMPUS} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } /etc/raddb/users contains (commented lines removed for clarity): # DEFAULT Auth-Type = ntlm_auth # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP /etc/raddb/sites-enabled/default, a link to ../sites-available/default, contains (most commented lines removed): authorize { preprocess chap mschap # digest # wimax # IPASS suffix # ntdomain eap { ok = return } unix files # sql # etc_smbpasswd # ldap # daily # checkval expiration logintime pap # Autz-Type Status-Server { # # } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } # digest # pam unix # Auth-Type LDAP { # ldap # } eap # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } ntlm_auth } preacct { preprocess # update request { # FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}" # } acct_unique # # IPASS suffix # ntdomain files } accounting { detail # daily unix radutmp # sradutmp # main_pool # sql # if (noop) { # ok # } # sql_log # pgsql-voip attr_filter.accounting_response # Acct-Type Status-Server { # # } } session { radutmp # sql } post-auth { # main_pool # reply_log # sql # sql_log # ldap exec # wimax Post-Auth-Type REJECT { # sql attr_filter.access_reject } } pre-proxy { # attr_rewrite # files # attr_filter.pre-proxy # pre_proxy_log } post-proxy { # post_proxy_log # attr_rewrite # attr_filter.post-proxy eap # Post-Proxy-Type Fail { # detail # } } /etc/raddb/sites-enabled/inner-tunnel, a link to ../sites-available/inner-tunnel, contains (commented lines removed): server inner-tunnel { #listen { # ipaddr = 127.0.0.1 # port = 18120 # type = auth #} authorize { chap mschap unix # IPASS suffix # ntdomain update control { Proxy-To-Realm := LOCAL } eap { ok = return } files # sql # etc_smbpasswd # ldap # daily # checkval expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } # pam unix # Auth-Type LDAP { # ldap # } eap ntlm_auth } session { radutmp # sql } post-auth { # reply_log # sql # sql_log # ldap Post-Auth-Type REJECT { # sql attr_filter.access_reject } } pre-proxy { # attr_rewrite # files # attr_filter.pre-proxy # pre_proxy_log } post-proxy { # post_proxy_log # attr_rewrite # attr_filter.post-proxy eap # Post-Proxy-Type Fail { # detail # } } } # inner-tunnel server block However, it's not clear to me where the problem lies. I've attached various files to illustrate the problem. Can anyone point me in the direction of a solution? I've not included full versions of the output due to the mailing list's message size limit. Please let me know if I've not included sufficient information to diagnose the problem. Cheers Martin. P.S. I've hidden the actual username & password used.

6 10

Debug: rlm_sqlcounter: No integer found in string ""
by JennyBlunt 20 Oct '11

20 Oct '11

I'm having issues getting my dailycounter, hourlycounter etc. to work properly. Max-All-Session is ok but there seems to be something wrong with the others. The error in debug is: Info: [dailycounter] expand: %{sql:SELECT SUM(AcctSessionTime - GREATEST((1319068800 -UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='full' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1319068800'} -> Debug: rlm_sqlcounter: No integer found in string "" Info: ++[dailycounter] returns noop Debug: rlm_sqlcounter: Entering module authorize code Debug: rlm_sqlcounter: Could not find Check item value pair If run in mysql, I get value = NULL If I remove Unix_timestamp, I get a value but this is incorrect and obviously can't use. Can anyone suggest what I need to do to fix this?? Am using meraki hardware to test but have coovachilli around to test if required. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Debug-rlm-sqlcounter-No-integer-fou… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0