- Freeradius-Users - lists.freeradius.org

Question about outer identity
by Martin Pauly 31 Jul '09

31 Jul '09

Hi all, I have 2.1.6 and things basically work. But I just came across a question about the processing of outer/inner identity: As I understand it, in case of a non-EAP RADIUS request (eg from my old modem servers), there is no tunnel and hence no inner identity. ==> Autz and Auth are done by the default virtual server and governed by the settings in radiusd.conf and sites-available/default -- right? In case of an EAP request (we do EAP-TTLS and PEAP-MSCHAPv2), the outer identity is simply used as a dummy during Tunnel setup (Our EAP Clients use anonymous(a)uni-marburg.de as outer identity). Nonetheless, freeradius does an LDAP request during Authorization which, of course, fails with 'notfound'. freeradius then happily proceeds to do the real authentication with inner-tunnel. Now I wonder how to avoid that extra LDAP query. Here's my config (ldap123 refers to a virtual module doing redundant-load-balance with 3 LDAP servers): default: authorize { preprocess chap mschap suffix eap { ok = return } unix files ldap123 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap Auth-Type LDAP { ldap123 } } inner-tunnel: authorize { chap mschap unix suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files ldap123 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap123 } eap } And here is the (hopefully) relevant part of the output of freeradius -X: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.75.246 port 1645, id=68, length=166 User-Name = "anonymous(a)uni-marburg.de" Framed-MTU = 1400 Called-Station-Id = "0013.8011.a1e0" Calling-Station-Id = "001b.7720.e19d" Service-Type = Login-User Message-Authenticator = 0xc8c71b2e61687810d83b54a62fbc0150 EAP-Message = 0x0202001d01616e6f6e796d6f757340756e692d6d6172627572672e6465 NAS-Port-Type = Wireless-802.11 NAS-Port = 14662 NAS-IP-Address = 192.168.75.246 NAS-Identifier = "warz004" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "uni-marburg.de" for User-Name = "anonymous(a)uni-marburg.de" [suffix] Found realm "uni-marburg.de" [suffix] Adding Stripped-User-Name = "anonymous" [suffix] Adding Realm = "uni-marburg.de" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 29 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 30 [files] expand: %{User-Name} -> anonymous(a)uni-marburg.de ++[files] returns ok ++- entering policy ldap123 {...} +++- entering redundant-load-balance group redundant-load-balance {...} [ldap3] performing user authorization for anonymous [ldap3] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap3] expand: (&(uid:caseExactMatch:=%{Stripped-User-Name:-%{User-Name}}) (!(UniMrDarfRadius=0))) -> (&(uid:caseExactMatch:=anony mous) (!(UniMrDarfRadius=0))) [ldap3] expand: ou=people,ou=Students,ou=Accounts,o=Universitaet Marburg,c=DE -> ou=people,ou=Students,ou=Accounts,o=Universitaet M arburg,c=DE rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to auth3.students.uni-marburg.de:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/ssl/certs/deutsche-telekom-root-ca-2.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as uid=radius,ou=Proxy,o=Universitaet Marburg,c=DE/JhkG0iH to auth3.students.uni-marburg.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,ou=Students,ou=Accounts,o=Universitaet Marburg,c=DE, with filter (&(uid:caseExactMatch:=anonymous) (!(UniMrDarfRadius=0))) rlm_ldap: object not found [ldap3] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++++[ldap3] returns notfound +++- redundant-load-balance group redundant-load-balance returns notfound ++- policy ldap123 returns notfound ++[expiration] returns noop ++[logintime] returns noop Thanks for any help Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 3

Decoupled accounting
by Kanwar Ranbir Sandhu 31 Jul '09

31 Jul '09

Hi All, I'm using freeradius 2.1.6 and want to move to decoupled accounting. I understand the example configs, but one question I still have is this: do I have to have preacct and accounting sections in my "virtual.blah.com" file (very similar to the default file) which is in the sites-enabled dir, even though I will have preacct and accounting sections in the decoupled-accounting file? Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.25-170.2.72.fc10.x86_64 x86_64 GNU/Linux 13:16:02 up 5 days, 4:42, 5 users, load average: 1.43, 1.36, 1.26

4 11

bootstrap problem
by shivashankar 31 Jul '09

31 Jul '09

hi, i am using Freeradius2.1.6 bash-3.00# /usr/local/etc/raddb/certs/bootstrap sh: test: argument expected *** Error code 1 The following command caused the error: if [ -e /dev/urandom ] ; then \ dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \ else \ date > ./random; \ fi make: Fatal error: Command failed for target `random' Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time .................................................................... .................................................................... ............................................+....................... .................................................................... ..........................+......................................... ....................................................+.........+..... .........+.........................+.............................+.. -- View this message in context: http://www.nabble.com/bootstrap-problem-tp24752354p24752354.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: Freeradius-Users Digest, Vol 51, Issue 137
by Gilbert Lo 31 Jul '09

31 Jul '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

coa functionality in server question
by Anton G. 31 Jul '09

31 Jul '09

Hello, Running FR 2.1.6 on freebs7.1 I`m trying to implement CoA origination by server. read sites-available/originate-coa and added home_server home_server coa1 { type = coa ipaddr = 10.1.3.5 port = 1700 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } and "coa_server" to client client test1 { ipaddr = 10.1.3.5 netmask = 32 secret = testing321 nastype = other coa_server = coa1 } radiusd -X says ... radiusd: #### Loading Clients #### client test1 { ipaddr = 81.200.3.4 netmask = 32 require_message_authenticator = no secret = "testing321" nastype = "other" coa_server = "coa1" } /usr/local/etc/raddb/clients.conf[7]: No such home_server or home_server_pool "coa1" It seems that i didn`t understand "sites-available/originate-coa" right and miss something in my conf Could You please clarify it for me? ---------------- Anton G.K.

2 2

WPA Authentiction
by Devinder Singh 31 Jul '09

31 Jul '09

Hello 2009/7/31 Devinder Singh <devinbhullar(a)gmail.com>: > Hi > > I am using Free Radius version 2.0.1 and have set up the Root Server > and Client Certificates > > When i run Radiusd - X i get > > > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/wireless-auth/linux-7v1x.pem" > certificate_file = "/etc/wireless-auth/linux-7v1x.pem" > CA_file = "/etc/wireless-auth/root.pem" > private_key_password = "/etc/raddb/certs/pass/linux-7v1x.pass" > dh_file = "/etc/wireless-auth/DH" > random_file = "/etc/wireless-auth/random" > fragment_size = 1024 > include_length = yes > check_crl = no > } > rlm_eap: SSL error error:06065064:digital envelope > routines:EVP_DecryptFinal_ex:bad decrypt > rlm_eap_tls: Error reading private key file /etc/wireless-auth/linux-7v1x.pem > rlm_eap: Failed to initialize type tls > /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /etc/raddb/sites-enabled/default[280]: Failed to find module "eap". > /etc/raddb/sites-enabled/default[227]: Errors parsing authenticate section. > } > > > -- > Devinder > -- Devinder -- Devinder

1 0

DB Handles & Rejects
by Dean Smith 30 Jul '09

30 Jul '09

During a recent network incident we had some very high churn in PPP clients. Our NASes (Multiple Cisco 7200 as VPDN LNS) didn't appear to be able to authenticate as quickly as they needed to. In the Radius packet logs we see quite a few Rejects for requests that should have been OK - indeed the identical requests were repeated and answered correctly seconds afterwards. In the radius log itself we have quite a few of these:- Mon Jul 27 22:51:24 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jul 27 22:51:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jul 27 22:51:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 >From the archives the usual reason for the above would seem to be the MySQL database not answering quickly enough. The relevant freeradius configs are at the defaults - but the box(s) themselves don't appear to have struggled with CPU. Would getting that error in the logs result in valid authentication requests being rejected ? Unfortunately I'm not very experienced in MySQL to be able to tune it. Would increasing the number of "num_sql_socks" within the sql.conf from the default 5 be a good starting point ? Are there other FreeRadius configs I can adjust before moving onto the MySQL database itself ? Thanks Dean

2 1

Anyone familiar with configuring RADIUS for Nokia IP290 or firewalls
by Edwin Isada 30 Jul '09

30 Jul '09

All, Can anyone guide me or provide some examples on how to implement RADIUS on Nokia firewalls using their Windows LDAP credentials? I am currently using version 2.1.5. I would like to test accessing the appliance via HTTPS or SSH using our Windows Credentials. Anyone familiar with this implementation? Thanks, Edwin

2 2

rlm_ldap not found
by RANDRIAMAMPIONONA José Johnny 30 Jul '09

30 Jul '09

Hi everyone, I have a problem concerning my configuration and I am wondering if somebody can help me. ------------------------------ ----------------------------------------------------------------------------------------------------- *freeradius-server-2.1.6* is installed without warning on* CentOS v5.3*...configured on localhost and tested. Everything's OK. For the authentication I d like to use openldap which is already ready. I tested it and it work(on *ldap.uae.ac.ma*: you can check it). I installed my freeradius in /usr/local/freeradius-server-2.1.6...So I edit the following files: *ldap* in */usr/local/freeradius-server.2.16/etc/raddb/modules/ldap* *raidusd.conf* in */usr/local/freeradius-server-2.1.6/etc/radiusd.conf* *default* in * /usr/local/freeradius-server-2.1.6/etc/raddb/sites-enabled/default* to have the appropriate configuration ... When I execute /usr/local/freeradius-server-2.1.6/sbin/radiusd -XXX to start(in debug mode) the server it gives the following error: *failed to link to module 'rlm_ldap':rlm_ldap.so:cannot open shared object file :No such file or directory* there are another errors after it but, if this one is solved so ...everything ll be ok. I am bored and I don't know what to do: I found in another topic that I'll have to rebuild and re-install my server ...Is that true?Is there another solution? thx. -- JJohnny R. vasiana09(a)gmail.com

4 3

wrt54g and freeradius
by Gustavo Marcello 30 Jul '09

30 Jul '09

Hello everyone. I need to contact someone who knows how to do or able to use a lynksys WRT54G to authenticate users against a freeradius server, I am having trouble implementing it. I already have the freeradius to work well with a mysql database and try radtest works fine. But wanting to do this through the WRT54G does not work. I need someone who can help me. (I have the default configuration files.) I think it is important to stress that I want the users not authenticate can not access the network, ie, I do not want to use a hotspot system ... I want to deny access to the router if you do not have username and password. I already have a wifidog work well with freeradius and LDAP, but I do not like the solution because users access the network before authenticating. Moreover, to implement this workaround, I could not use the WRT54G because it has little memory and does not enter the open-wrt. I had to use WRT54GL, which are very difficult to find in Argentina. Thanks! Gustavo.

2 2