- Freeradius-Users - lists.freeradius.org

How to configure freeradius client?
by Meyer Jerome 06 May '11

06 May '11

Hi, We use freeradius to authenticate some Network Equipment, wie Router, Switches, usw.. and all run well! # radiusd -v radiusd: FreeRADIUS Version 2.1.8, for host x86_64-suse-linux-gnu, built on Sep 2 2010 at 13:07:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Now, I'm using "nagios" to check servers and network and I want to check up the freeradius server. So, I've install freeradius on a Linux machine and try to connect to the freeradius Server but It doesn't run : # radtest nagios nagios 10.28.8.133:1812 1812 outrider Sending Access-Request of id 120 to 10.28.x.133 port 1812 User-Name = "nagios" User-Password = "nagios" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 Sending Access-Request of id 120 to 10.28.x.133 port 1812 User-Name = "nagios" User-Password = "nagios" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 Sending Access-Request of id 120 to 10.28.x.133 port 1812 User-Name = "nagios" User-Password = "nagios" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 radclient: no response from server for ID 120 socket 3 1) I don't know what's the NAS-IP-Address? 2) I don't find any right document about "how to configure the client"? 3) How should I configure the client? Should some deamon to be start? Any help would be appreciated and thanks in advance, Best regards Freundliche Grüsse _________________ Jérôme M. Meyer Network Engineer IWB Telekom, Margarethenstrasse 40, 4002 Basel Telefon 061 275 52 66 Fax 061 275 59 40 E-Mail jerome.meyer(a)iwbtelekom.ch <mailto:vorname.name@iwbtelekom.ch> www.iwbtelekom.ch <http://www.iwbtelekom.ch/> Partner von Swisspower www.swisspower.ch <http://www.swisspower.ch/> (Bitte bedenken Sie die Folgen für die Umwelt, bevor Sie diese E-Mail ausdrucken.)

4 9

FR 2.1.x git + SoH: ASSERT FAILED xlat.c[1048]: outlen > 0
by James J J Hooper 06 May '11

06 May '11

Hi All, Sorry for the sketchy details.... We got an ASSERT FAILED xlat.c[1048]: outlen > 0 with a PEAP user. The bit of the -X I have is as below, and the soh virtual server config is attached. I have no further details at the moment because the client has gone away (and I've disabled SoH in the EAP module config in case they come back and knock it over again while I'm away). The same set-up has been fine with many other SoH clients previously. Can anyone point me in the right direction? ....The only think that came to mind was the packet getting a bit big with all those attributes? Thanks, James ++++[updated] returns updated +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated +++ ... skipping else for request 750: Preceding "if" was taken ++- policy create.uob-stripped-mac returns updated SoH-Supported = yes SoH-MS-Machine-OS-vendor = Microsoft SoH-MS-Machine-OS-version = 6 SoH-MS-Machine-OS-release = 0 SoH-MS-Machine-OS-build = 6000 SoH-MS-Machine-SP-version = 0 SoH-MS-Machine-SP-release = 0 SoH-MS-Machine-Processor = x86 SoH-MS-Machine-Name = "AlexanderPC" SoH-MS-Correlation-Id = 0x81aa82cd69f946f2bae142fd0fbfcc3e01cc09847027078c SoH-MS-Machine-Role = client SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=0 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=0 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=0 enabled=1" SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=0 enabled=0" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=0 enabled=1" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "auto-updates ok action=install by-policy=1" SoH-MS-Windows-Health-Status = "security-updates error no-wsus-srv" FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "abcdef(a)bris.ac.uk" Calling-Station-Id = "00:1b:77:xx:xx:xx" Called-Station-Id = "00:3a:98:9d:17:30:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.107.207 NAS-Identifier = "wism7" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "448" ASSERT FAILED xlat.c[1048]: outlen > 0 -- James J J Hooper Network Specialist, University of Bristol http://www.wireless.bristol.ac.uk -- Config bits: server eduroamlocal-soh { authorize { if (SoH-Supported == no) { update config { Auth-Type = Accept } } else { detail-bsql update config { Auth-Type = Accept } detail detail-bsql { detailfile = ${radacctdir}/%{%{Virtual-Server}:-UNKNOWN}-bsql/detail-bsql.log detailperm = 0600 header = "%t" }

3 7

NAS-Port ID
by Lars Witter 06 May '11

06 May '11

hi, i've a question about the database fileds "NASPortId" and "NASPortType" for radius in radacct. what's the meaning oder those fields? NASPortType is always filled with "Async" ... NASPortId is filled with different Integers. I've read the sources of ppp, but i didn't found out anything. :-( Thx.

2 1

Help Compiling ikev2, EVP_sha256 and tncs: Freeradius 3.0
by akinpelu emmanuel 06 May '11

06 May '11

Hi All, Please I am having challange building ikev2 and tncs library into the freeradius 3.0.0. Though I have installed the latest version of ikev2_0.2 and libtnc this is the error message I keep getting, moreover could I be helped on how to indicate the tncs library path in the configure line. ./configure --prefix=/home/fradius/install/radius --with-mysql-dir=/home/fradius/install --with-eap-ikev2-includes=/home/fradius/install/net/include/ --with-eap-ikev2-libraries=/home/fradius/install/net/lib/ |grep warn configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-include-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. Thank you Strenght and Honour! Akinpelu Emmanuel 08054711181 ok

3 5

Problem with LDAP and ntlm_auth
by Robert Mc Cready 06 May '11

06 May '11

We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain. The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together? We use PEAP. Working user authentication with LDAP debug (ntlm_auth not configured): http://www.cspi.qc.ca/sinfrmc/ldap_only.htm Working Windows computer account authentication: http://www.cspi.qc.ca/sinfrmc/mschap_only.htm User account getting rejected debug (with ntlm_auth configured): http://www.cspi.qc.ca/sinfrmc/mschap_and_ldap.htm Thanks, Robert.

3 3

Is ECC supported in freeradius?
by re est 06 May '11

06 May '11

Hello, We have compiled openssl 1.0.0d and freeradius 2.1.10 hoping to use ECC ciphers in TLS. Is ECC supported in freeradius? - re -- View this message in context: http://freeradius.1045715.n5.nabble.com/Is-ECC-supported-in-freeradius-tp43… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Adding Vendor Specific Attribute to the Access-Accept
by normal ozone 06 May '11

06 May '11

Hello, I want to be able to receive the Vendor Specific Attribute that I set in a user. For example I added the following attribute to my user using daloradius: Vendor: dictionary.freeradius.internal Attribute: User-Category Value: MyCategory In the Oreilly Manual it mentions that Access-Accept can send Optional attributes. Is there a way to setup freeradius so that this attribute can be included in the Access-Accept message? By the way I'm using the installer version of freeradius for my radius server. And my radius client is also a pc (I use a java library named TinyRadius) Thanks. Ishmael

4 6

[EAP-PEAP] PEAP Authentication failed
by Khalid Staili 05 May '11

05 May '11

I am using freeradius in a wired network. Th authentication protocol I'm using is PEAP. I have configured the server like described in many different sites, but I have a problem. This is the debug output I have : rad_recv: Access-Request packet from host 192.168.0.1 port 1024, id=192, length=204 Framed-MTU = 1480 NAS-IP-Address = 192.168.0.1 NAS-Identifier = "kskhaled" User-Name = "kskhaled" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-1f-fe-02-58-80" Calling-Station-Id = "00-26-55-b7-7c-bf" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02a0000d016b736b68616c6564 Message-Authenticator = 0x74cb8a1036cbc1836786bc29d6d0f75e +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 160 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry kskhaled at line 86 ++[files] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.0.1 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "22" EAP-Message = 0x01a100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a2fd5015a8ecc31b9ba37ff7858d5ab Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 1024, id=193, length=314 Framed-MTU = 1480 NAS-IP-Address = 192.168.0.1 NAS-Identifier = "kskhaled" User-Name = "kskhaled" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-1f-fe-02-58-80" Calling-Station-Id = "00-26-55-b7-7c-bf" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x5a2fd5015a8ecc31b9ba37ff7858d5ab EAP-Message = 0x02a1006919800000005f160301005a0100005603014dc19e9f979a3af96e33b19d0c62732513034307abf20b2a001cf13bda8125ab00002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000 Message-Authenticator = 0x27bfd0a5516047d0700ade8abfb74e62 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 161 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry kskhaled at line 86 ++[files] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0035], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0615], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.0.1 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "22" EAP-Message = 0x01a2040019c00000076f16030100350200003103014dc19e9fcc1c052070b54096a0918e33a7adb2f7d48503cf2305061f12f94cb5000039010009ff010001000023000016030106150b00061100060e00025f3082025b308201c4020101300d06092a864886f70d0101040500308194310e300c060355040a1305454e5349423111300f060355040b13084e6574776f726b733129302706092a864886f70d010901161a6672656572616469757340656e73692d626f75726765732e66723110300e06035504071307426f75726765733110300e06035504081307426f7572676573310b3009060355040613024652311330110603550403130a667265 EAP-Message = 0x65726164697573301e170d3131303530323230343135385a170d3132303530313230343135385a3057310b30090603550406130246523110300e06035504081307426f7572676573310e300c060355040a1305454e5349423111300f060355040b13084e6574776f726b73311330110603550403130a6672656572616469757330819f300d06092a864886f70d010101050003818d0030818902818100e5911c94b2f80950c32d2b576d999b66c0737868415f229afd8111ba61210d3d392bcd57e564cdcf9846effdd74acb6cae84df6d184dde37eb7d8e4acca51049b37b45e988b243776a892989f1b07ae6993c3ed726c8c5abc610232b9f11509c EAP-Message = 0xdfa85d229441058d31a8d529bd55e87ab4a3a8b93d0e08f3a6843de62b5d192d0203010001300d06092a864886f70d01010405000381810086ccd85809f82b506c45ae8a9b6114e3abb876c544cd3288f0e9451f4b52ec9e7ed0dd29383e09452570d711fc7b59bdd632a29ad007932602c743920eeb7e53022fc4eaea70699b49094fd4d56b62074ac3b760d907c19f6f2cf3b4c86fd124d89ba0c458629ad634f5ea139bb88e8cc13b2b0e4323b5e7c03aeb33aa05f2a00003a9308203a53082030ea003020102020900df846a35de47bd40300d06092a864886f70d0101040500308194310e300c060355040a1305454e5349423111300f06035504 EAP-Message = 0x0b13084e6574776f726b733129302706092a864886f70d010901161a6672656572616469757340656e73692d626f75726765732e66723110300e06035504071307426f75726765733110300e06035504081307426f7572676573310b3009060355040613024652311330110603550403130a66726565726164697573301e170d3131303530323230333630305a170d3133303432313230333630305a308194310e300c060355040a1305454e5349423111300f060355040b13084e6574776f726b733129302706092a864886f70d010901161a6672656572616469757340656e73692d626f75726765732e66723110300e06035504071307426f757267 EAP-Message = 0x65733110300e060355040813 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a2fd5015b8dcc31b9ba37ff7858d5ab Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 1024, id=194, length=215 Framed-MTU = 1480 NAS-IP-Address = 192.168.0.1 NAS-Identifier = "kskhaled" User-Name = "kskhaled" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-1f-fe-02-58-80" Calling-Station-Id = "00-26-55-b7-7c-bf" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x5a2fd5015b8dcc31b9ba37ff7858d5ab EAP-Message = 0x02a200061900 Message-Authenticator = 0x49f78f5e3bcb0dfb4ad97a2400e8c816 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 162 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry kskhaled at line 86 ++[files] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.0.1 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "22" EAP-Message = 0x01a3037f190007426f7572676573310b3009060355040613024652311330110603550403130a6672656572616469757330819f300d06092a864886f70d010101050003818d0030818902818100d545774be4fa25bc43f80ffa33007a504bbbad54eb34d3c46b6424e31f1d4295f1c166d2ab252547c700d5a8e006c15b7171454cf076adb5a019b167b076e2bc5da0e46ad9b9618a4b7503287dd1d3604999dc404d14d84f007bc5daa8004cc79c438ad49f268ce97f023492d6c222d1caab71f695daf2246fd281c39ddf910b0203010001a381fc3081f9300c0603551d13040530030101ff301d0603551d0e04160414f309a1552b739845194d0353 EAP-Message = 0xa9404fd9c4edd8e53081c90603551d230481c13081be8014f309a1552b739845194d0353a9404fd9c4edd8e5a1819aa48197308194310e300c060355040a1305454e5349423111300f060355040b13084e6574776f726b733129302706092a864886f70d010901161a6672656572616469757340656e73692d626f75726765732e66723110300e06035504071307426f75726765733110300e06035504081307426f7572676573310b3009060355040613024652311330110603550403130a66726565726164697573820900df846a35de47bd40300d06092a864886f70d010104050003818100567ea66dc5be2f09acc9e6c37f57ef0b7f3caa070f5c EAP-Message = 0x46853f11daa418e21402ff832134d925eac2e2bba50c8a67d7c75ac0ec45c0fac45db3a691715260eee5bfa005658e088f53cf7070b7e79781f0d863efbc1a6943f92f43c0dd97d090e5d9f1d234a30484842a95b0d35450025e2041c296e390c2df7b71bb1132a2b87c160301010d0c00010900408859401f8896730ccee6a57588a6124a20e3fd421942e87b0edc4d4232503f8a038f9d7e8d8b4347aefed2b208ace134ff1e2bcce7a1fe844b42e1fff9c60e1300010500403c17cdd4387305ca4f4a13564b99221c914d7de42c0b26c90d6a344e41527afab631e3f93613266d590f72ae81c533a344e0cb05d2cf9de8a446fb971f429e970080c0 EAP-Message = 0x8fb9a0e2db1ab56253f2aa1b44674272aecd2c701d755d5162d100f849318f4deadd39f5693e9afb377f17d49de9b475fe56522f96f86aadf78a79683c1e9a13eef5959409b2a299ac0cf23f535b96e57a65a64fa9d53e135a8a21db4d0481e9d58754bdfe8928a7bf5481d2a0dfac2ee3d76551d2c596aa5ba7548e08d99116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a2fd501588ccc31b9ba37ff7858d5ab Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.1 port 1024, id=195, length=226 Framed-MTU = 1480 NAS-IP-Address = 192.168.0.1 NAS-Identifier = "kskhaled" User-Name = "kskhaled" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-1f-fe-02-58-80" Calling-Station-Id = "00-26-55-b7-7c-bf" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x5a2fd501588ccc31b9ba37ff7858d5ab EAP-Message = 0x02a3001119800000000715030100020233 Message-Authenticator = 0x11829099870303de8e36ce50cee21288 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 163 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry kskhaled at line 86 ++[files] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> kskhaled attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 195 to 192.168.0.1 port 1024 EAP-Message = 0x04a30004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 192 with timestamp +32 Cleaning up request 1 ID 193 with timestamp +32 Cleaning up request 2 ID 194 with timestamp +32 Waking up in 1.0 seconds. Cleaning up request 3 ID 195 with timestamp +32 Ready to process requests.

3 6

about FreeRadius+radiusmanager+mirkotik
by Tanjil Ahmed 05 May '11

05 May '11

Dear All im really need help bout those issues some of my user trying to login Mikrotik but they cant first time.. Radius Server Reject thier query after fewmins they can able to login anybody can pls email with best configure of radiusd.conf of freeradius-server-2.1.8-dmamod-2 Note:im using Radius manager for billing ,Free Radius 2.1.8,mikrotik pppoe server thanks in advance

4 4

Multiple ldaps (SSL) backends and only the first queried works. Possible bug?
by Daniele Albrizio 04 May '11

04 May '11

I've two ldaps backends instantiated like: authorize { ... Autz-Type OPENLDAP { openldap } Autz-Type ADLDAP { adldap } ... } authenticate { ... Auth-Type OPENLDAP { openldap } Auth-Type ADLDAP { adldap } ... } The two modules are configured as follows using DIFFERENT issuing CAs... ldap adldap { server = "ldaps://myAD.ds.units.it" identity = ... password = ... basedn = ... filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /usr/local/etc/raddb/.../certs/ad_root_ca.pem require_cert = "demand" } ... } ldap openldap { server = "ldaps://myopenldap.units.it" identity = ... password = ... basedn = ... filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 5 timelimit = 5 net_timeout = 10 tls { start_tls = no cacertfile = /etc/ssl/certs/AddTrust_External_Root.pem require_cert = "demand" } ... } Now, the problem is that once I started freeradius, the first connection to an ldap server goes straight, while the second (to the other one) says: ldap_create ldap_url_parse_ext(ldaps://myAD.ds.units.it) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myAD.ds.units.it:636 ldap_new_socket: 32 ldap_prepare_socket: 32 ldap_connect_to_host: Trying yyy.yyy.yyy.yyy:636 ldap_pvt_connect: fd: 32 tm: 1 async: 0 ldap_ndelay_on: 32 ldap_int_poll: fd: 32 tm: 1 ldap_is_sock_ready: 32 ldap_ndelay_off: 32 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string ...and letting the first request to be to the myAD server (soon after a restart): ldap_create ldap_url_parse_ext(ldaps://myopenldap.units.it) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myopenldap.units.it:636 ldap_new_socket: 33 ldap_prepare_socket: 33 ldap_connect_to_host: Trying xxx.xxx.xxx.xxx:636 ldap_pvt_connect: fd: 33 tm: 10 async: 0 ldap_ndelay_on: 33 ldap_int_poll: fd: 33 tm: 10 ldap_is_sock_ready: 33 ldap_ndelay_off: 33 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string I suspect the "cacertfile" attribute is not correctly re-instantiated and only the value of the first request is used to check against when instantiating a new ldaps connection. Any suggestions? -- Daniele ALBRIZIO - albrizio(a)univ.trieste.it

4 6