- Freeradius-Users - lists.freeradius.org

PAP / ntlm_auth fails unless "DEFAULT Auth-Type = ntlm_auth" in users.
by Gary Gatten 15 Oct '09

15 Oct '09

I've been jacking around trying to fix this for several hours - but no go. I've RTFM several times, and read several docs such as: http://wiki.freeradius.org/Combining_authentication_of_AD_accounts_%28nt lm_auth%29_with_accounts_stored_elsewhere When I say "fix" - it's always been "broken" - it's never worked without the DEFAULT entry in users. Most all my accounts are in AD so the DEFAULT works for me, but I'm using this issue as a learning opportunity, but instead it's just a frustration opportunity. I'll post all my confs (2.1.6) and -X output if needed, but just looking for some hints to help determine why when the process fails through to PAP, it won't use ntlm_auth - it will only use "files" Thanks! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

acct_users WARNING in 2.1.7
by Craig Campbell 15 Oct '09

15 Oct '09

I've upgraded from 2.1.6 to 2.1.7 and the following error is now appearing in my debug output. [/usr/local/etc/raddb/acct_users]:36 WARNING! Check item "Tmp-String-0" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items acct_users contains the following, (Line 36 is the line beginning with DEFAULT) #CEC Exec-Program = "%{exec:/usr/local/sbin/acctstop.sh}", DEFAULT Acct-Status-Type == Stop Tmp-String-0 = "%{exec:/usr/local/sbin/acctstop.sh}", Fall-Through = no What have I done wrong? It seems to be ok, and be doing what I desire..... but I want the config to be CLEAN. All I really want is to run a script when an accounting STOP record is received. Am I doing it wrong? Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4509 (20091015) __________ The message was checked by ESET Smart Security. http://www.eset.com

2 1

3GPP string Attributes, containing encapsulated information...
by Stefan A. 15 Oct '09

15 Oct '09

Hi there, Is there a way to get Information out of the 3GPP-GPRS-Negotiated-QoS-profile? The Attribute is defined in the dictionary as: ATTRIBUTE 3GPP-GPRS-Negotiated-QoS-profile 5 string The Value of a String might be: 99-0B811F7396878774010000 To get the encapsulated "Traffic Class", I will need the most left 3 bits of the first '7' of the string. It would be 7 --> 0111 --> 011 --> 3 Is there a function available, to do this? Following the complete Attribute: AVP: l=33 v=3GPP(10415) t=3GPP-GPRS-Negotiated-QoS-profile(5): UMTS GTP QoS Profile Length: 25 UMTS GTP QoS Profile Version: 99 Hyphen separator: - 00.. .... = Spare: 0 ..00 1... = QoS delay: Delay class 1 (1) .... .011 = QoS reliability: Unack GTP/LLC, Ack RLC, Protected data (3) 1000 .... = QoS peak: Up to 128 000 oct/s (8) .... 0... = Spare: 0 .... .001 = QoS precedence: High priority (1) 000. .... = Spare: 0 ...1 1111 = QoS mean: Best effort (31) 011. .... = Traffic class: Interactive class (3) ...1 0... = Delivery order: Without delivery order ('no') (2) .... .011 = Delivery of erroneous SDU: Erroneous SDUs are not delivered ('no') (3) Maximum SDU size : 1500 octets Maximum bit rate for uplink : 1024 kbps Maximum bit rate for downlink : 1024 kbps 0111 .... = Residual BER: 1/100 000 = 1x10^-5 (7) .... 0100 = SDU Error ratio: 1/10 000 = 1x10^-4 (4) 0000 00.. = Transfer delay: Subscribed Transfer Delay (in MS to network direction) (0) .... ..01 = Traffic handling priority: Priority level 1 (1) Guaranteed bit rate for uplink: Subscribed guaranteed bit rate for uplink (in MS to network direction) (0) Guaranteed bit rate for downlink: Subscribed guaranteed bit rate for downlink (in MS to network direction) (0) Thank You. Stefan

1 0

wpa/wpa2 on logs
by Sergio Belkin 15 Oct '09

15 Oct '09

Hi, Is there a way to log if a supplicant is using either wpa or wpa2? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

4 8

Question regarding retrying of requests in detail-combined file
by Patric 15 Oct '09

15 Oct '09

Hi all :) FreeRADIUS 2.1.7 CentOS 5.2 I am not too sure where to start here so I will describe the symptoms first: I have 2 freeradius servers that both receive accounting requests, and proxy these requests to each other, as well as log these requests to a detail file. I have noticed now that while server A is processing the detail-combined file and proxying the requests to server B, server B will fail to get a lock on its detail file, and the request will fail. When this happens it is not passing anything back to server A, and server A does not seem to be timing out the request, so it stops processing the detail-combined file and just sits there. A bit more in depth, server B is still running FR 1.1.6. I am in the process of updating to 2.1.7 but am being delayed due to outdated OS, so am moving this lot to a new server. The lock fail is occurring when server B tries to get a lock on the detail-combined file, so it is very likely that I have had the proxying setup incorrectly here all along, but since it is 1.1.6 I do not expect help here... What I would like to try figure out is how to get server A (2.1.7) to time out a proxy request and retry it... Any pointers to sections/docs would be great as always, Thanks a mill! Patric

3 4

Problems with bootstrapping certificates
by Petr Uzel 15 Oct '09

15 Oct '09

Hi list, I have a question regarding bootstrapping default certificates using bootstrap script in raddb/certs directory. From the README: ------ $ radiusd -X That will cause the EAP-TLS module to run the "bootstrap" script in this directory. The script will be executed only once, the first time the server has been installed on a particular machine. This bootstrap script SHOULD be run on installation of any pre-built binary package for your OS. In any case, the script will ensure that it is not run twice, and that it does not over-write any existing certificates. ------ If I understand that right, it means that when I run the script twice, then generated certificates should not be changed (provided the *.cnf files did not change. But I observe something different: =======> cd raddb/certs/ =======> ./bootstrap openssl dhparam -out dh 1024 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time <SNIP> MAC verified OK openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Everything OK so far =======> touch *.cnf =======> ./bootstrap openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key <SNIP> writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key <SNIP> writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Oct 14 15:10:57 2009 GMT Not After : Oct 14 15:10:57 2010 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Oct 14 15:10:57 2010 GMT (365 days) failed to update database TXT_DB error number 2 make: *** [server.crt] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time <SNIP> Generating a 2048 bit RSA private key ................................................+++ .....+++ writing new private key to 'server.key' ----- Generating a 2048 bit RSA private key .............................................................+++ .........................+++ writing new private key to 'ca.key' ----- Generating a 2048 bit RSA private key ........................+++ ...............+++ writing new private key to 'ca.key' ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok ERROR:Serial number 01 has already been issued, check the database/serial_file for corruption The matching entry has the following details Type :Valid Expires on :101014151025Z Serial Number :01 File name :unknown Subject Name :/C=FR/ST=Radius/O=Example Inc./CN=Example Server Certificate/emailAddress=admin(a)example.com Please notice that generating server.crt failed with "TXT_DB error number 2". Thus after issuing the ./bootstrap command for the second time, the server.crt file is empty. If I change unique_subject=yes to unique_subject=no in index.txt.attr before issuing second ./bootstrap, then the script finishes without errors, but I'm not sure the resulting files are correct. I have to admit that my knowledge of openssl is very limited, but as far as I understand that, this behavior is a bug, or at least it does not conform to the documentation. I would expect that the bootstrap/Makefile would simply do nothing if the required certificates are already present, no matter what are the timestamps of *.cnf files. The testing was done with current git master branch. -- Best regards / s pozdravem Petr Uzel, openSUSE Boosters Team ----------------------------------------------------------------- SUSE LINUX, s.r.o. e-mail: puzel(a)suse.cz Lihovarská 1060/12 http://www.suse.cz 190 00 Prague 9, CR

3 3

Default Proxy and Domain
by Andreas M. 15 Oct '09

15 Oct '09

Hello, i have a working setup but following question: In my proxy.conf i have one entry with our company nt domain (for wlan auth) realm ZB { type = radius authhost = LOCAL accthost = LOCAL strip } Why does it not work, if i configure the same with "realm DEFAULT", does the DEFAULT realm not match all realms, known or unknown ? regards, Andreas M. -- g, Andreas M.

2 1

Small suggestion for FreeRadius debug output
by Patric 15 Oct '09

15 Oct '09

Hi again, Alan I have a very small suggestion, if I may - what about adding a timestamp to the debug output? I am not familiar with C, so dont know how difficult it would be to implement though... I have been going through debug output for the last couple of days now attempting to resolve various configuration problems, and while not essential, it would be nice to see how much time has elapsed between a request and response for example... Something like this: [2009-10-15 10:00:00] Sending Accounting-Response of id 0 to xxx.xxx.xxx.xxx port 59807 Proxy-State = 0x323138 [2009-10-15 10:00:00] Finished request 701. [2009-10-15 10:00:01] Cleaning up request 701 ID 0 with timestamp +1286 [2009-10-15 10:00:01] Going to the next request [2009-10-15 10:00:02] Waking up in 0.3 seconds. Just a thought :) Thanks for everything! Patric

2 2

EAP-TLS failing after enabling crl_check
by Kyle O'Malley 14 Oct '09

14 Oct '09

Hi All, I've been very successful at getting EAP-TLS functional, up to the point of actually getting the CRL check to work. A little background on my setup: EAP-TLS Functional WITHOUT check_crl CRL downloaded via http interface (windows2k) which is by default DER format. This is converted to PEM. CRL can be verified with" openssl crl -in crlfile.pem -text" -- This shows up perfectly, as expected, including the serial#s of certs that are revoked. I can verify every cert, view with openssl -text etc. All of the certs are legit and work fine for non-crl auth so I don't think there is anything wrong with my certs. I've converted the private/public/cacerts into .pfx and extracted individual certs, just the cacerts, tried various bundles, everything is smooth, but makes no difference. The CA is running on win2k3, openssl isn't used on the freeradius box as a CA. I run a perl script c_rehash to create the symbolic links as hashed names to the PEM certs (c_rehash even seems to 'know' the CRL file is a crl by making it whatever.r0) Also verified permissions (freeradius will fail anyways if permissions to the certs don't work). In short, I've tried everything I can think of and no matter what, once I enable crl_check, clients are rejected. Full error msg below, however, this is the initial error: [tls] <<< TLS 1.0 Handshake [length 1076], Certificate --> verify error:num=3:unable to get certificate CRL See my config below; Running radiusd -X -f Here is my config: certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = "blah" private_key_file = ${certdir}/ca/freeradius-priv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/ca/freeradius-pub.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. CA_file = ${cadir}/ca/ca.pem # # For DH cipher suites to work, you have to # run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 1024 # dh_file = ${certdir}/dh random_file = ${certdir}/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd check_crl = yes crl_path = "/etc/raddb/certs/ca/crl.pem" CA_path = "/etc/raddb/certs/ca/" #pem_file_type = yes Here is the error: [tls] <<< TLS 1.0 Handshake [length 1076], Certificate --> verify error:num=3:unable to get certificate CRL [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [apophxw88397hpyjx.apollogrp.edu] (from client wireless_access_point1 port 12289 cli 00-26-B0-61-FD-32) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Here is the CApath directory: lrwxrwxrwx 1 root root 18 Oct 14 16:40 7a1f8db1.0 -> freeradius-pub.pem lrwxrwxrwx 1 root root 6 Oct 14 16:40 a7454e50.0 -> ca.pem lrwxrwxrwx 1 root root 7 Oct 14 16:40 a7454e50.r0 -> crl.pem -r--r----- 1 root radiusd 1760 Oct 14 16:18 ca.pem -rw-rw-r-- 1 root radiusd 1877 Oct 14 16:40 crl.pem -r--r----- 1 root radiusd 1751 Oct 14 16:40 freeradius-priv.pem -r--r----- 1 root radiusd 2268 Oct 14 16:40 freeradius-pub.pem I can post a more lengthy failure log if someone wants it - my question is, has anyone got this working without running the openssl CA right on the same box as freeradius? What am I missing? Thank you for any assistance.

1 0

typo in configure script version 2.17
by Andrew Stone 14 Oct '09

14 Oct '09

When I do a "./configure --help" I see the following: --with-system-libtldl Use the libtltdl installed in your system (default=use our own) I believe this should be: --with-system-libltdl Use the libltdl installed in your system (default=use our own) Hope this helps. -Andrew

1 0