- Freeradius-Users - lists.freeradius.org

EAP-TLS with Ldap
by Usuário do Sistema 12 Mar '11

12 Mar '11

Hello, I'm new at the Freeradius and I'm deploying it with EAP-TLS to authenticate my Wireless users which will be authenticated against a OpenLDAP base. I'm using freeradius2 and when I make a test from other linux machine with command "radtest joao.vero jango123 128.2.100.131 2 meleca" it's working as follow out Sending Access-Request of id 45 to 128.2.100.131 port 1645 User-Name = "joao.vero" User-Password = "jango123" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 128.2.100.131:1645, id=45, length=20 But, when I'm going to authenticate wireless users from Win7 ( with EAP-TLS, I'm using the test certificate from /etc/raddb/certs/..) It isn't working. it's appear in log: TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation What I did until at the moment in ralation EAP-TLS: I've configured the eap.conf file to read the certificates from /etc/raddb/certs/... I've create the user certificate ( as shows README in /etc/raddb/certs ) I've copied and installed two certificates to user machine: cliente.p12 and ca.der. the first as personal and the last as Trusted Root Certification Authorities I wish to use LDAP for authenticate my users but seems that User-Password must be Clear text. there is possible reach EAP-TLS with LDAP?? What I have do ?? any help is welcome Thank!

2 2

Failover for SQL lookup expansions?
by Brian Candler 12 Mar '11

12 Mar '11

With freeradius 2.1.10 I can configure failover for SQL lookups like this: # in policy.conf sql_foo { redundant { sql_foo_local sql_foo_remote } } # in sites-available/foo authorize { sql_foo } However, it looks like I can't use this redundant module inside a string expansion: authorize { update request { Huntgroup-Name = "%{sql_foo:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } --- Error logged: WARNING: Unknown module "sql_foo" in string expansion "%" How could I get the same level of redundancy for string expansions? Could I do the expansion multiple times inside a redundant section? I am thinking of perhaps: huntgroup_local { update request { Huntgroup-Name = "%{sql_foo_local:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } huntgroup_remote { update request { Huntgroup-Name = "%{sql_foo_remote:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } ... authorize { redundant { huntgroup_local huntgroup_remote } } However, I'm just not sure whether the ok/notfound/fail status would propagate through a string expansion in this case. The examples in configurable_failover.rst talk only about normal modules. Thanks, Brian.

2 2

Help migrating from 1.1.7 to 2.1.10 - clear text password being lost
by John Hayward 11 Mar '11

11 Mar '11

Hi Radius Fans, I am trying to move our current environment from 1.1.7 to 2.1.10 and are having a problem getting things to work. We have a Novell NDSLdap server which provides clear text passwords for Novell users. We are using peap-mschapv2. In looking at the logs and Eap-Messages we see: response 01 identity (username) -> server The server looks up the user in ndsldap and: Info: [ldap] Added the eDirectory password (password removed) in check items as Cleartext-Password Then the server sends a request 02 to use EAP-TLS There are a series of responses (mostly appear to be ack) and requests to get the tunnel setup which succeeds. Near the end the client sends a response (ID=8) which is a response to the mschap2 challenge. When the server is processing this response it reports: Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. I put in some additional debugging and found that address of the request->config_item has changed from when the ldap module put the cleartext password in as a pair and when the mschap module attempts to remove it. The ldap module is called in authorize and the mschap is called in authenticate. What might be causing the request->config to be at a different location between when the clear text password is stored and when it is needed to authenticate? johnh...

3 2

CHAP-Challenge Question
by Jeremiah 11 Mar '11

11 Mar '11

We are using freeradius 2.1.10. We are using a Mikrotik as a nas and trying to use CHAP for hotspot access. I have a test user setup and can use ntradping to Access-Accept back. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 174.57.91.24 port 1026, id=7, length=52 User-Name = "testwifi" CHAP-Password = 0xe89981fe6bf05bf6af662769cbb1a084f8 # Executing section authorize from file /opt/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testwifi [sql] sql_set_user escaped user --> 'testwifi' [sql] User found in radcheck table ++[sql] returns ok ++[mschap] returns noop Found Auth-Type = CHAP # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testwifi" with CHAP password [chap] Using clear text password "testblah" for user testwifi authentication. [chap] chap user testwifi authenticated succesfully ++[chap] returns ok Login OK: [testwifi] (from client mikrotik port 0) # Executing section post-auth from file /opt/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 174.57.91.24 port 1026 Mikrotik-Rate-Limit := "256k/512k" Session-Timeout += 120 Finished request 1. Going to the next request When a request comes in from the Tik , it adds a CHAP challenge and the Chap password obviously is differejt and the request fails. rad_recv: Access-Request packet from host 203.45.185.115 port 33303, id=6, length=246 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:12:AB:36:3E:0C" Called-Station-Id = "server1" NAS-Port-Id = "bridge1" User-Name = "testwifi" MS-CHAP-Domain = "wifi.net" NAS-Port = 2157969420 Acct-Session-Id = "80a0000c" Framed-IP-Address = 192.168.10.246 Mikrotik-Host-IP = 192.168.10.246 CHAP-Challenge = 0xf3663a1617d0a1d2537c157ee4ef1e77 CHAP-Password = 0xedcbec473f0529359a785e47ada0e0b23e Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 203.45.185.115 Mikrotik-Realm = "wifi.net" # Executing section authorize from file /opt/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testwifi [sql] sql_set_user escaped user --> 'testwifi' [sql] User found in radcheck table ++[sql] returns ok ++[mschap] returns noop Found Auth-Type = CHAP # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testwifi" with CHAP password [chap] Using clear text password "testblah" for user testwifi authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Login incorrect (rlm_chap: Wrong user password): [testwifi/<CHAP-Password>] (from client mikrotik port 2157969420 cli 00:12:AB:36:3E:0C) Using Post-Auth-Type Reject # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testwifi attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 22 for 1 seconds Going to the next request Waking up in 0.3 seconds. What basic element am I failing to understand? If the chap challenge string is sent in, should freeradius be able to use that with the chap-password to accept the user? Thanks Jeremiah

2 2

Proxy Request to Virtual Server using EAP
by joaocdc＠gmail.com 11 Mar '11

11 Mar '11

Hello Guys I need a help to use proxy request to virtual_server using EAP-TTLS and EAP-PEAP I have the following scenario: I have a Radius Sever (version 2.1.10), this server on a Linux Debian 6 This server must authenticate users of my wireless network. But my network is interconnected with several educational institutions, and users of these institutions are in my network. For users who are in my company, I want to authenticate them in my radius server, for users who are from other institutions to do routing or proxy server. I already have configured the authentication of my users using LDAP as a backend. My users will be divided into groups, each group has its own realm, each realm and forwards the authentication to a virtual server. If my users try to authenticate without entering the realm, it works OK. If users try to authenticate other institutions stating the realm of the institution, my radius is usually the proxy, and it works OK. if my users try to authenticate informing realm, I see in debug mode the virtual server is invoked, but the authentication does not happen, he accuses the following error: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Multiple levels of TLS nesting is invalid. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel Apparently he often wraps the request with TLS, and can no longer decapsulation. If you do a test without using EAP authentication (via radtest) authentication with realm works. Apparently he often wraps the request with TLS, and can no longer decapsulation. Enough already researched on the internet but have not found a solution. I need to make a proxy for virtual_server using EAP. If any can help me thank you. Sincerely John

1 0

FR 2.1.7 Exits for no reason
by McNutt, Justin M. 11 Mar '11

11 Mar '11

Hey all, So the host-based auth stuff is working well now, but we've discovered another problem. We have four FR 2.1.7 servers running on RHEL 5 (fully patched). Every now and then, for no apparent reason, radiusd just stops. It exits with "Exiting normally." to syslog. They don't all exit at the same time. Since there are four of them behind a load balancer, it usually doesn't result in a service outage, and we've been lucky so far that only a couple of them have been down at once. But it's still disconcerting. The servers tend to all be started within a minute of each other, since I make changes to Server #1, and then use an rsync script to replicate /etc/raddb to the other servers and restart them. So they all start within seconds of one another. This week, Server #3 stopped within about 8 hours of being started (went from 1130 to 1930). Server #1 failed last week at 2330. Server #4 hasn't failed yet. It's very odd. Any ideas on how I can troubleshoot this? Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

5 7

linelog and rlm_eap
by Kolbjørn Barmen 11 Mar '11

11 Mar '11

Is it possible to use the linelog to provide a "debug light" for rlm_eap and submodules? What I'm looking for is some way to tell why an authentication has failed for a given login attempt, without resorting to full debugging. If it is possible, example configuration is most welcome. Thanks! -- Kolbjørn Barmen UNINETT Driftsenter

4 6

Virtual Server
by Rob Yamry 11 Mar '11

11 Mar '11

Im running FreeRadius 2.1.8 to allow wireless access and that is working great. I now want to have the vpn auth against the freeradius server for access, but checking for a different ldap attribute on the user. I read the virtual servers wiki and it says that all modules are global across virtual servers. Do I need to set up another install of freeradius so I can check for the other ldap attribute or is there a better way to get this accomplished? Thanks for your help.

2 2

Customizing Reply-Messages for failed auths on 1.x
by Lorenzo Milesi 11 Mar '11

11 Mar '11

Hi. I've done several searches, but couldn't find a way... I'd like to customize the Reply-Message returned to client upon failed auth, like "User expired" or "Usage limit reached"... I'm running 1.1.7. How can I do that? Thanks. -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/ Via Carlo Torri Tarelli 19 - 23900 Lecco - ITALY - Tel 0341 220 205 - Fax 178 6070 222 GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it -------- D.Lgs. 196/2003 -------- Si avverte che tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario. Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile. Grazie.

2 1

same username with different password mysql chap
by Brent Wilkinson 11 Mar '11

11 Mar '11

I am in the process of setting up freeradius with mysql. I pretty much have everything working correctly except a issue that has come up. I am not sure if I did something wrong or this cannot be done. Here is my radcheck database +-----+----------+-----------+----+--------+-------+------------+ | id | username | attribute | op | value | PID | expires | +-----+----------+-----------+----+--------+-------+------------+ | 462 | 10295 | password | == | 912547 | 10295 | 2011-03-21 | | 463 | 10295 | password | == | 659320 | 10295 | 2011-03-21 | | 464 | 10295 | password | == | 322438 | 10295 | 2011-03-28 | | 465 | 10295 | password | == | 339410 | 10295 | 2011-04-04 | | 466 | 10295 | password | == | 987255 | 10295 | 2011-04-11 | | 467 | 10295 | password | == | 990160 | 10295 | 2011-04-18 | | 468 | 10295 | password | == | 373359 | 10295 | 2011-04-25 | | 469 | 10295 | password | == | 974781 | 10295 | 2011-05-02 | | 470 | 10295 | password | == | 121431 | 10295 | 2011-05-09 | | 471 | 10295 | password | == | 566703 | 10295 | 2011-05-16 | | 472 | 10295 | password | == | 430339 | 10295 | 2011-05-23 | +-----+----------+-----------+----+--------+-------+------------+ Here is the debug I get from radius -X using username 10295 and password 912547 Ready to process requests. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:13:E8:17:C9:09" Called-Station-Id = "test1" NAS-Port-Id = "ether2" User-Name = "10295" MS-CHAP-Domain = "test" NAS-Port = 2153775123 Acct-Session-Id = "80600013" Framed-IP-Address = 10.0.100.251 Mikrotik-Host-IP = 10.0.100.251 CHAP-Challenge = 0x9a7dde24641b743604ed531068ad4662 CHAP-Password = 0x1ac903f936a5ccd7efdf337e94bd4ba958 Service-Type = Login-User WISPr-Logoff-URL = "http://10.0.100.1/logout" NAS-Identifier = "Air2Data" NAS-IP-Address = 192.168.99.175 Mikrotik-Realm = "test" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "10295", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 10295 [sql] sql_set_user escaped user --> '10295' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '10295' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '10295' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '10295' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "10295" with CHAP password [chap] Using clear text password "912547" for user 10295 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 10295 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 Waiting to send Access-Reject to client hotspot port 48655 - ID: 43 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 Waiting to send Access-Reject to client hotspot port 48655 - ID: 43 Waking up in 0.3 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 43 to 192.168.99.175 port 48655 Waking up in 4.9 seconds. Cleaning up request 0 ID 43 with timestamp +2 Ready to process requests. What am I missing in that the chap is failing the password even though it is in the mysql database? Thanks Brent

3 3