- Freeradius-Users - lists.freeradius.org

Using Vendor Attributes
by Paul Varvel 02 Apr '10

02 Apr '10

Hi everybody, I'm beginner with FreeRadius and I'd like to know where can I use a vendor specific attribute for my Redback router (in which configuration file). The dictionary is in /usr/share/freeradius/dictionary.redback and loaded when FreeRadius starts. When is try to use Context-Name = "local" (a specific redback attribute) in my user configuration file. I obtain a Syntax error message. You'll find an example of Access Request from the router : Packet number 1 has just been sniffed From: 10.192.5.80:1812 To: 10.192.5.89:1812 Type: Access-Request User-Name = "00:0c:29:0e:79:dd" User-Password = "\002\251\374-f\211\204\232\232C\350\t%\362S\233" Service-Type = Dialout-Framed-User NAS-Identifier = "SE800" NAS-Port = 235077632 NAS-Real-Port = 3808428132 NAS-Port-Type = Virtual NAS-Port-Id = "" Medium-Type = DSL Mac-Addr = "00-0c-29-0e-79-dd" Platform-Type = SmartEdge-800 OS-Version = "6.2.1.2" Agent-Circuit-Id = "01" Vendor-Specific = 0x00000de901144f4e542d31332d312d313a313530303a3031 Redback-Attr-202 = 0x3d3d0701000c290e79dd Redback-Attr-202 = 0x0c0c0466747468 Redback-Attr-125 = 0x4d53465420352e30 In one word, we'd like to know where include VSAs and how to use it. Many thanks for your help. Regards

3 4

NAS-IP vs srcIP
by Marlon Duksa 01 Apr '10

01 Apr '10

Hi everyone - Can anyone think of a reason why the NAS-IP and the scr-IP of the access-req packet should not be the same? If the NAS-IP is configurable in the NAS, then the NAS-IP can be set to the IP address other than the src-ip of the NAS that is used in reqular FreeRadius accounting/authorization packets. The source IP address of the NAS is normally the native interface address from which access-req was sent (but it can be configurable). The NAS-IP would be used to address NAS in CoA requests sent from the FreeRadius. We need this behavior to address certain deployment requirements. for example: IP prot: srcIP: 1.1.1.1 dstIP: 2.2.2.2 Radius prot: code: access-request (1) AVPs: NAS-IP-Address: 3.3.3.3 scrIP != NAS-IP-Address Thanks, Marlon

6 5

Freeradius + PEAP.. stuck on validating identity..
by Bruno Kremel 01 Apr '10

01 Apr '10

Hi, I have freeradius for WPA2 Enterprise authentification in small network in library, it is stable version (2.0.4) on Debian Lenny compiled from sources with OpenSSL support.. Everything seems to be OK, but when I try to connect to AP from laptop with Windows XP after I enter name and password I am stuck on Validating identity, same on Ubuntu machine... My configuration is pretty much default except of enabling MySQL and setting paths and passwords to certificates (generated with make script in /etc/freeradius/certs, so they should be OK) and addresses of clients. This is what freeradius -X gives me when I try to connect to AP: Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.1 port 1291, id=0, length=123 User-Name = "pokus" NAS-IP-Address = 192.168.3.1 Called-Station-Id = "00259c523046" Calling-Station-Id = "001e650eb532" NAS-Identifier = "00259c523046" NAS-Port = 9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a01706f6b7573 Message-Authenticator = 0x634f3b088572fda3a12eca56ed6035b9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pokus", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> pokus rlm_sql (sql): sql_set_user escaped user --> 'pokus' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pokus' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'pokus' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'pokus' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pokus/<via Auth-Type = Accept>] (from client router port 9 cli 001e650eb532) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.3.1 port 1291 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +59 Ready to process requests. To me it seems that name/password was accepted so I have no clue where is the problem.. Thank you in advance for any help..

3 11

WPA2 802.1X PEAPv0/EAP-MSCHAPv2
by Ryan A. Krenzischek 01 Apr '10

01 Apr '10

Greetings! I am at a road block here. I know setting up WPA2 Enterprise PEAPv0/EAP-MSCHAPv2 / 802.1X should be simple. It just isn't working! Perhaps I am suffering from green screen syndrome :) I have followed directions from: http://tldp.org/HOWTO/html_single/8021X-HOWTO/ Aside from mschap being in the <etcdir>/raddb/modules directory and needing to enable mppe, the instructions are fairly straight forward. The certificates are generated from our certificate store. I'm trying a less complicated set up before moving on to OpenLDAP/Kerberos. During the build process, I made sure that OpenSSL was available. LDD shows that it is linked: # ldd /usr/local/sbin/radiusd /usr/local/sbin/radiusd: libfreeradius-radius-2.1.8.so => /usr/local/lib/freeradius-2.1.8/libfreeradius-radius-2.1.8.so (0x280b3000) libcrypt.so.2 => /lib/libcrypt.so.2 (0x280d5000) libltdl.so.7 => /usr/local/lib/libltdl.so.7 (0x280ed000) libssl.so.5 => /usr/local/lib/libssl.so.5 (0x280f7000) libcrypto.so.5 => /usr/local/lib/libcrypto.so.5 (0x2813e000) libpthread.so.1 => /usr/lib/libpthread.so.1 (0x282af000) libc.so.5 => /lib/libc.so.5 (0x282d3000) libz.so.2 => /lib/libz.so.2 (0x283ad000) The client computers are laptops running OpenSUSE 11.2 x86_64. Knetworkmanager is being used to configure the wireless security. the settings are: Security: WPA/WPA2 Enterprise Authentication: Protected EAP (PEAP) Anonymous Identity: <blank> CA Certificate: /etc/ssl/certs/ca.pem PEAP Version: Version 0 Inner Authentication: MSCHAPv2 Username: billgates Password: 98502 The "users" file contains: billgates User-Password := "98502" What I get on the test laptop in wpa_supplicant: Associated with 00:00:00:c0:ff:ee CTRL-EVENT-EAP-STARTED EAP Authentication started OpenSSL: tls_connection_ca_cert - Failed to parse ca_cert_blob error:0D0680A8:ASN1 encoding routines: ASN1_CHECK_TLEN:wrong tag openSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error TLS: Failed to set TLS connection parameters EAP-PEAP: Failed to initialize SSL. EAP: Failed to initialize EAP method: vendor 0 method 25 (PEAP) CTRL-EVENT-DISCONNECTED - Disconnect Event - Remove keys (this is repeated in the log several times) Debug Output: FreeRADIUS Version 2.1.8 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.8" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/CA/private/radius.pem" certificate_file = "/usr/local/etc/CA/certs/radius.pem" CA_file = "/usr/local/etc/CA/cacert.pem" private_key_password = "1337" dh_file = "/usr/local/etc/CA/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/CA/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 clients = "per_socket_clients" client 1.2.3.4 { require_message_authenticator = no secret = "n0t4u2c" shortname = "WLAN" } } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host 1.2.3.4 port 1812, id=156, length=86 User-Name = "billgates" NAS-IP-Address = 1.2.3.4 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "01-23-45-67-89-AB" EAP-Message = 0x02770009017279616e Message-Authenticator = 0x124bad1be78335e5345ac1235dd5a0f2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "billgates", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 119 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry billgates at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 156 to 1.2.3.4 port 1812 EAP-Message = 0x017800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80109fb1806886dec5fe36c0b7659309 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 1.2.3.4 port 1812, id=157, length=101 User-Name = "billgates" NAS-IP-Address = 1.2.3.4 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "01-23-45-67-89-AB" State = 0x80109fb1806886dec5fe36c0b7659309 EAP-Message = 0x027800060300 Message-Authenticator = 0x5acdbbd8d404e0ff100969933c8254b3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "billgates", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 120 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry billgates at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for bad type 0 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> billgates attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 157 to 1.2.3.4 port 1812 EAP-Message = 0x04780004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 2 ID 156 with timestamp +74 Waking up in 0.9 seconds. Cleaning up request 3 ID 157 with timestamp +74 Ready to process requests. TIA, Ryan

2 1

Freeradius Isn't Listening
by Randall Degges 31 Mar '10

31 Mar '10

Hi everyone, Firstly, I'm new to this list, but I've searched for an answer to my problems for quite a while, and haven't been able to find a solution. Please excuse me if this has already been asked. *USAGE* I'm using Freeradius to log call statistics from my Cisco AS5400 call gateway to a MySQL database. We use this for accounting ( to keep track of how many minutes callers use ). *VERSION* I'm using FreeRADIUS Version 2.1.0, for host x86_64-pc-linux-gnu, built on Sep 17 2009 at 17:46:37 on ubuntu-server. *PROBLEM* The problem I'm having is that when I run Freeradius (in production or debug mode), my Cisco AS5400 is unable to connect to the freeradius server. When I do a netstat -a on my freeradius server, I see no connections listening on ports 1812 and 1813 (which freeradius should be listening on). I believe that once this problem has been resolved, my setup will work correctly: 1. Call comes into my Cisco AS5400. 2. Cisco AS5400 sends accounting requests to my freeradius server. 3. Freeradius server performs a MySQL query to my MySQL database. 4. Caller hangs up. 5. Cisco AS5400 sends an accounting request to my freeradius server. 6. Freeradius server performs a MySQL update to my MySQL database, thus ending the transaction. *FREERADIUS DEBUG* Here is the output of: freeradius -X root@RAD01:~# freeradius -X FreeRADIUS Version 2.1.0, for host x86_64-pc-linux-gnu, built on Sep 17 2009 at 17:46:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 9600 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client xx.xx.xx.xx { ipaddr = xx.xx.xx.xx require_message_authenticator = no secret = "password" shortname = "AA" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking session {...} for more modules to load Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "xx.xx.xx.xx" port = "" login = "radius" password = "password" radius_db = "accounting" read_groups = yes sqltrace = yes sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 25 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT INTO dids (sessionid, did, caller, start) VALUES ('%{NAS-Identifier}%{Acct-Session-Id}', '%{Called-Station-Id}', '%{Calling-Station-Id}', NOW())" accounting_start_query_alt = "" accounting_stop_query = "UPDATE dids SET stop=NOW(), duration=%{Acct-Session-Time}, termination_cause='%{Acct-Terminate-Cause}' WHERE sessionid='%{NAS-Identifier}%{Acct-Session-Id}' LIMIT 1" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@xx.xx.xx.xx:/accounting rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 } } modules { Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking session {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. *DEBUG LISTENING PORTS* As you can see in the previous section, my freeradius debug seems to execute perfectly. Note how it says it is listening on 1812 and 1813. When I do a netstat -a command, I get: root@RAD01:~# netstat -a Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:ssh *:* LISTEN tcp 0 0 RAD01:37518 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37534 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37528 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37513 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37523 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37533 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37517 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37531 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37512 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37529 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:ssh cpe-xx.xx.xx.xx.:42502 ESTABLISHED tcp 0 0 RAD01:37519 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37530 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:ssh xx.xx.xx.xx.s:45758 ESTABLISHED tcp 0 0 RAD01:37516 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37515 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37514 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37511 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37510 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37522 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37526 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37521 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37525 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37524 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37520 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37527 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37532 xx.xx.xx.xx.s:mysql ESTABLISHED tcp6 0 0 [::]:ssh [::]:* LISTEN udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 4 [ ] DGRAM 3587 /dev/log unix 2 [ ACC ] STREAM LISTENING 2363 @/com/ubuntu/upstart unix 2 [ ] DGRAM 2429 @/org/kernel/udev/udevd unix 2 [ ] DGRAM 3868 unix 2 [ ] DGRAM 3813 unix 3 [ ] DGRAM 2432 unix 3 [ ] DGRAM 2431 unix 3 [ ] STREAM CONNECTED 2415 @/com/ubuntu/upstart unix 3 [ ] STREAM CONNECTED 2414 Note how it appears that ports 1812 and 1813 do not have anything listening... *DEBUG NETWORK* Now, after seeing this, I thought maybe I have a firewall active or something. But upon further investigation, I found that iptables has no rules: root@RAD01:~# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination And that my server is on a public IP (our radius server is hosted in the rackspace cloud, no firewall or anything as far as I know). *CONFIG FILES* Here are my freeradius configuration files. I've put them on a pastebin because I didn't want to make this email immensely long. Please have a look at them if you have any questions. http://pastie.org/893100 *CISCO SETUP* As I mentioned earlier, my freeradius *client* in this setup is my Cisco AS5400. When I have radius debugging turned on, on my cisco, here is some debugging output from a call. As you can see, it says that the server is not online. When I make calls, I see no activity in my freeradius debug window. So it seems that the packets aren't getting to freeradius from my cisco. *Jan 2 08:47:02.895: AAA/BIND(00000190): Bind i/f Serial7/0:15:23 *Jan 2 08:47:02.899: AAA/BIND(00000191): Bind i/f *Jan 2 08:47:02.903: RADIUS/ENCODE(00000191):Orig. component type = VOICE *Jan 2 08:47:02.903: RADIUS(00000191): Config NAS IP: 0.0.0.0 *Jan 2 08:47:02.903: RADIUS(00000191): sending *Jan 2 08:47:02.903: RADIUS/ENCODE: Best Local IP-Address 10.0.2.1 for Radius-Server xx.xx.xx.xx *Jan 2 08:47:02.907: RADIUS(00000191): Send Accounting-Request to xx.xx.xx.xx:1813 id 1646/154, len 128 *Jan 2 08:47:02.907: RADIUS: authenticator 5A 66 34 6D 47 00 B7 9E - BD 76 22 42 14 B6 A1 59 *Jan 2 08:47:02.907: RADIUS: Acct-Session-Id [44] 18 "0200000000000253" *Jan 2 08:47:02.907: RADIUS: Calling-Station-Id [31] 12 "8182179228" *Jan 2 08:47:02.907: RADIUS: Called-Station-Id [30] 12 "2172386245" *Jan 2 08:47:02.907: RADIUS: User-Name [1] 12 "8182179228" *Jan 2 08:47:02.907: RADIUS: Acct-Status-Type [40] 6 Start [1] *Jan 2 08:47:02.907: RADIUS: NAS-Port-Type [61] 6 Async [0] *Jan 2 08:47:02.907: RADIUS: NAS-Port [5] 6 0 *Jan 2 08:47:02.907: RADIUS: NAS-Port-Id [87] 18 "ISDN 7/7:15:D:24" *Jan 2 08:47:02.907: RADIUS: Service-Type [6] 6 Login [1] *Jan 2 08:47:02.907: RADIUS: NAS-IP-Address [4] 6 10.0.2.1 *Jan 2 08:47:02.907: RADIUS: Acct-Delay-Time [41] 6 0 *Jan 2 08:47:07.655: RADIUS: acct-timeout for 4012ECE4 now 5, acct-jitter 4294967295, acct-delay-time (at 4012ED5E) now 4 *Jan 2 08:47:07.655: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:07.655: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/155 *Jan 2 08:47:12.687: RADIUS: acct-timeout for 4012ECE4 now 9, acct-jitter 0, acct-delay-time (at 4012ED5E) now 9 *Jan 2 08:47:12.687: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:12.687: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/156 *Jan 2 08:47:14.947: RADIUS/ENCODE(00000191):Orig. component type = VOICE *Jan 2 08:47:14.947: RADIUS(00000191): Config NAS IP: 0.0.0.0 *Jan 2 08:47:14.947: RADIUS(00000191): sending *Jan 2 08:47:14.951: RADIUS/ENCODE: Best Local IP-Address xx.xx.xx.xx for Radius-Server xx.xx.xx.xx *Jan 2 08:47:14.951: RADIUS(00000191): Send Accounting-Request to xx.xx.xx.xx:1813 id 1646/157, len 158 *Jan 2 08:47:14.951: RADIUS: authenticator 6F 5D 1E 4E CC 63 E0 A1 - 64 3B 75 46 FF 42 65 55 *Jan 2 08:47:14.951: RADIUS: Acct-Session-Id [44] 18 "0200000000000253" *Jan 2 08:47:14.951: RADIUS: Calling-Station-Id [31] 12 "8182179228" *Jan 2 08:47:14.951: RADIUS: Called-Station-Id [30] 12 "2172386245" *Jan 2 08:47:14.951: RADIUS: Acct-Input-Octets [42] 6 94880 *Jan 2 08:47:14.951: RADIUS: Acct-Output-Octets [43] 6 95520 *Jan 2 08:47:14.951: RADIUS: Acct-Input-Packets [47] 6 593 *Jan 2 08:47:14.951: RADIUS: Acct-Output-Packets [48] 6 597 *Jan 2 08:47:14.951: RADIUS: Acct-Session-Time [46] 6 12 *Jan 2 08:47:14.951: RADIUS: User-Name [1] 12 "8182179228" *Jan 2 08:47:14.951: RADIUS: Acct-Status-Type [40] 6 Stop [2] *Jan 2 08:47:14.951: RADIUS: NAS-Port-Type [61] 6 Async [0] *Jan 2 08:47:14.951: RADIUS: NAS-Port [5] 6 0 *Jan 2 08:47:14.951: RADIUS: NAS-Port-Id [87] 18 "ISDN 7/7:15:D:24" *Jan 2 08:47:14.951: RADIUS: Service-Type [6] 6 Login [1] *Jan 2 08:47:14.951: RADIUS: NAS-IP-Address [4] 6 10.0.2.1 *Jan 2 08:47:14.951: RADIUS: Acct-Delay-Time [41] 6 0 *Jan 2 08:47:17.559: RADIUS: acct-timeout for 4012ECE4 now 14, acct-jitter 0, acct-delay-time (at 4012ED5E) now 14 *Jan 2 08:47:17.559: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:17.559: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/158 *Jan 2 08:47:19.871: RADIUS: acct-timeout for 4013486C now 5, acct-jitter 4294967295, acct-delay-time (at 40134904) now 4 *Jan 2 08:47:19.871: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:19.871: %RADIUS-4-RADIUS_DEAD: RADIUS server xx.xx.xx.xx:1812,1813 is not responding. *Jan 2 08:47:19.871: %RADIUS-4-RADIUS_ALIVE: RADIUS server xx.xx.xx.xx:1812,1813 has returned. *Jan 2 08:47:19.871: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/159 *Jan 2 08:47:22.527: RADIUS: acct-timeout for 4012ECE4 now 19, acct-jitter 0, acct-delay-time (at 4012ED5E) now 19 *Jan 2 08:47:22.527: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:22.527: RADIUS: No response from (xx.xx.xx.xx:1812,1813) for id 1646/158 *Jan 2 08:47:22.527: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Jan 2 08:47:22.527: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL *Jan 2 08:47:24.903: RADIUS: acct-timeout for 4013486C now 9, acct-jitter 0, acct-delay-time (at 40134904) now 9 *Jan 2 08:47:24.903: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:24.903: RADIUS: Retransmit to (173.203.117.112:1812,1813) for id 1646/161 *Jan 2 08:47:29.415: RADIUS: acct-timeout for 4013486C now 14, acct-jitter 0, acct-delay-time (at 40134904) now 14 *Jan 2 08:47:29.415: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:29.415: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/162 *Jan 2 08:47:34.415: RADIUS: acct-timeout for 4013486C now 19, acct-jitter 0, acct-delay-time (at 40134904) now 19 *Jan 2 08:47:34.415: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:34.415: RADIUS: No response from (xx.xx.xx.xx:1812,1813) for id 1646/162 *Jan 2 08:47:34.415: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Jan 2 08:47:34.415: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL *HELP!* OK, so sorry for this terribly long email, but I hope that this has provided enough information for you guys to help me debug what the heck is going wrong here. I've spent tons of hours trying to resolve this to no avail. I'm out of ideas. Thanks so much for all of your help, this has been a really irritating and frustrating experience. I'm hoping that if anyone else has the same problem, this thread may help them later on. Thanks! -Randall

5 7

Handling dynamic IPs for clients
by Fahd Kasri 31 Mar '10

31 Mar '10

Hi all, I have several clients connected to my freeradius server, but these clients have dynamic IPs. I have setup scripts on the clients for sending their IPs to the server and scripts on the server to restart freeradius when an IP address has changed. The problem is that there is always someone that won't be able to be authenticated because the client's IP hasn't been refreshed on the server. Is anybody in a similar situation? If so, do you have a better solution? Thanks. -- Fahd

2 1

problem with PEAP/MSCHAPv2
by Christian Pinedo Zamalloa 31 Mar '10

31 Mar '10

hello, I have found some errors in my freeradius server logs. It seems that some clients are having problems to authenticate againts them. I'm using PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. I have debuged the servers and when this error appears there are differences in the TLS negotiation of PEAP: example of succesful negotiation: ------------------------------------------------ [peap] processing EAP-TLS TLS Length 102 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED example of unsuccesful negotiation: ---------------------------------------------------- [peap] processing EAP-TLS TLS Length 109 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello C [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] >>> Unknown TLS version [length 0002] TLS Alert write:fatal:protocol version [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version num ber SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS I will look if something is bad configured in the user's wifi profile, but does anybody have this problem previously? Thanks, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80

3 2

Somewhat OT: Windows VIsta annoyance: sends local login credentials
by Sergio Belkin 31 Mar '10

31 Mar '10

2010/3/30 Julien Savoie <julien.savoie(a)usainteanne.ca>: > Check if you have this enabled in radiusd.conf > > mschap { > with_ntdomain_hack = yes > } > > realm ntdomain { > format = prefix > delimiter = "\\" > ignore_default = no > ignore_null = no > } > > and proxy.conf > > realm DEFAULT { > strip > } > > If you only have one domain this will work. If you have different domains > you'll need to setup the individual realms. Sounds like in your case you > don't though. > > Hi Julien, file /etc/raddb/modules/mschap is as original one. I use no domain, only user+password. Sorry, but I forget the subject before. Thanks in advance! > Sergio Belkin wrote: > > There are a few log entries like as as follows > Auth: Login incorrect (rlm_ldap: User not found): > [QSARGENTINA\\amumenthaler] (from client UP-PVIII-VIII-Bis port 0 via > TLS tunnel) > > Please could you help me to find a fix? > > - -- -- Open Kairos http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 3

Dan Schaffer is not in the office
by Dan Schaffer 31 Mar '10

31 Mar '10

I will be out of the office starting Wed 03/31/2010 and will not return until Thu 04/01/2010. I will have limited email and voicemail access during the week at the Phoenix Contact Kickoff meetings. If this is an urgent issue, please contact our Tech Support group at 800-586-5525. Thanks, Dan

1 0

Multiple LDAP searches
by Rob Brickhouse 31 Mar '10

31 Mar '10

I am setting up freeradius 2.1.6 and seem to be stuck on how do I go about setting up my ldap module to search multiple basedn if the user is not found in the first? I have four that I need to search in my LDAP tree but cannot figure out the correct way to make it search more than one. I feel like this is probably something simple I'm missing but can't seem to see it atm. Thanks Rob

3 2