- Freeradius-Users - lists.freeradius.org

SAML support for freeRadius
by krishna Mohan 02 Mar '09

02 Mar '09

Hi, I have been looking for freeradius with SAML authentication; but found nothing quite informative on this. Is there any plugin or pam module that supports communication between freeRadius and SAML protocol, like freeRadius with sql or ldap. Pls share any useful information on this. Appreciate your help. Thanks, Sri

2 1

rlm_python import error undefinde symbol
by Alexander Yu. Solodukhin 01 Mar '09

01 Mar '09

Hi all. I try to use rlm_python and got import error on importing any module that relevant on shared object. Here an rlm_python configuration: ## cut python { mod_instantiate = account func_instantiate = instantiate mod_authorize = account func_authorize = authorize mod_accounting = account func_accounting = accounting mod_preproxy = account func_preproxy = preproxy mod_postproxy = account func_postproxy = postproxy mod_postauth = account func_postauth = postauth mod_detach = account func_detach = detach } ## end cut account.py is radiusd_test.py from src/modules/rlm_python with one line added on top of file: import time 'time' is not plain python module, it is shared object found at /usr/lib/python2.5/lib-dynload/time.so After starting radius i got this error: rlm_python:python_load_function: module 'account' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/lib/python2.5/lib-dynload/time.so: undefined symbol: PyExc_ValueError I was examine rlm_python code, and example 'C' code from python documentation on how to embedd python into 'C', and don't found major differences. This code works fine: #include <Python.h> int main(int argc, char *argv[]) { PyObject *pName, *pModule, *pDict, *pFunc; PyObject *pArgs, *pValue; int i; if (argc < 3) { fprintf(stderr,"Usage: call pythonfile funcname [args]\n"); return 1; } Py_Initialize(); pName = PyString_FromString(argv[1]); /* Error checking of pName left out */ Py_INCREF(pName); pModule = PyImport_Import(pName); Py_DECREF(pName); if (pModule != NULL) { pFunc = PyObject_GetAttrString(pModule, argv[2]); /* pFunc is a new reference */ if (pFunc && PyCallable_Check(pFunc)) { pArgs = PyTuple_New(argc - 3); for (i = 0; i < argc - 3; ++i) { pValue = PyInt_FromLong(atoi(argv[i + 3])); if (!pValue) { Py_DECREF(pArgs); Py_DECREF(pModule); fprintf(stderr, "Cannot convert argument\n"); return 1; } /* pValue reference stolen here: */ PyTuple_SetItem(pArgs, i, pValue); } pValue = PyObject_CallObject(pFunc, pArgs); Py_DECREF(pArgs); if (pValue != NULL) { printf("Result of call: %ld\n", PyInt_AsLong(pValue)); Py_DECREF(pValue); } else { Py_DECREF(pFunc); Py_DECREF(pModule); PyErr_Print(); fprintf(stderr,"Call failed\n"); return 1; } } else { if (PyErr_Occurred()) PyErr_Print(); fprintf(stderr, "Cannot find function \"%s\"\n", argv[2]); } Py_XDECREF(pFunc); Py_DECREF(pModule); } else { PyErr_Print(); fprintf(stderr, "Failed to load \"%s\"\n", argv[1]); return 1; } Py_Finalize(); return 0; } Compiled with: gcc call.c -o call -I/usr/include/python2.5 -L/usr/lib/python2.5/config -lpython2.5 Why this code does not through 'undefined symbol' error and rlm_python does? PS: I read mailing list before posting this question and saw that this problem was found in 2007. I try newst freeradius 2.1.3 and problem still exists. Any feedback will be great. -- ISP CrIS, Softwarium

1 1

EAP, Called-Station-Id and users file
by Cristiano Cumer 01 Mar '09

01 Mar '09

Dear list, I'm trying to configure a radius 1.14 (radiusd: FreeRADIUS Version 1.1.4, with security changes through 1.1.7 OSX Leopard Server) in such way that it doesn't authenticate users from a certain access point.. I have this entry in my users file DEFAULT Called-Station-Id =~ ".*MMP" Auth-Type := Reject from the logs I see it's being matched: users: Matched entry DEFAULT at line 220 but it has no effect on the authentication as I think (I'm a radius newbie) that EAP module is processed before the users file and the EAP module authenticates the user. I think I must process the DEFAULT Called-Station-Id =~ ".*MMP" Auth-Type := Reject before the EAP module, how can I do that ? In the hints file maybe? Thanks Cristiano rad_recv: Access-Request packet from host 192.168.2.31:2061, id=177, length=143 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00- n-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000801637269 Message-Authenticator = 0x5dbfc4d69e5f14b4a172f47575fdf842 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 0 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 177 to 192.168.2.31 port 2061 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x34c3e8f850f0bf36972e1df2a90487cd Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=178, length=297 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202009015800000008616030100810100007d030149a73723c89a6f08732f2687e4129ea4b5d0a774c90978664b86eeb2a05bbbc0202288bff5a023a17326bcbd7c54fffb96e226e27bd8b1ee5cb4c9e935bcaab9800036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x34c3e8f850f0bf36972e1df2a90487cd Message-Authenticator = 0x34083894e97ffcc560a45722a9ea0f75 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 1 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0081], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 035c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 178 to 192.168.2.31 port 2061 EAP-Message = 0x010303c31580000003b9160301004a02000046030149a737233be77c3ca105b42a8a0d7b2484e366cecdfecd5b5aba727e1eec017120f63150f5cc916f5fd22442664f584e05f26b983b1b347a94cc3e39c2a9a921c1002f00160301035c0b0003580003550003523082034e308202b7a003020102020120300d06092a864886f70d01010405003068310b3009060355040613024954310b300906035504081302425a3110300e06035504071307426f6c7a616e6f310c300a060355040a13034d4d50310b3009060355040313026361311f301d06092a864886f70d0109011610637269737469616e6f406d6d702e6974301e170d3038303632333139 EAP-Message = 0x323232345a170d3138303632313139323232345a3063310b3009060355040613024954310b300906035504081302425a310c300a060355040a13034d4d50311d301b06035504031314787365727665312e7a656c696766696c6d2e6974311a301806092a864886f70d010901160b74656368406d6d702e697430819f300d06092a864886f70d010101050003818d0030818902818100ca15a262ecb6bbe89411dd24ea3700c03a5deb0057ce8be3dae436c049a1c3b524e60c78d1314d0c25e4bf460802e7cf2ba842b3d3d178cc94d8029e6cfe618864a97f5edb92546aea0560a4bc30009a77ef968c9a23059a66d9b242baf80c8b584e8420ba488d EAP-Message = 0x0347e112305903f10e0fe10d470a72cb9f37723c48c417cf9f0203010001a382010b3082010730090603551d1304023000301106096086480186f8420101040403020640303306096086480186f842010d042616244f70656e53534c2047656e65726174656420536572766572204365727469666963617465301d0603551d0e041604145558696c681a63dccb9f188428b4f134f9905cd63081920603551d2304818a30818780140fe9c37a309830caa1d3160ce4761381a140f07fa16ca46a3068310b3009060355040613024954310b300906035504081302425a3110300e06035504071307426f6c7a616e6f310c300a060355040a13034d4d5031 EAP-Message = 0x0b3009060355040313026361311f301d06092a864886f70d0109011610637269737469616e6f406d6d702e6974820100300d06092a864886f70d0101040500038181007cb6d0a86535805629183fe530940e285969afbd2870835982185152f6a951144a8bcaf1928e681325cf5a3804da48c60450022b059750cef706298a063a27c2991501930ca18ed9acffbde1e2872dcf7c306dda5b0d38ca752865bd9998e108128a8686d0dc55060c22029870a68755ea08fe82fa47deaff69373c5565605d716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x939aa97763146ddbdd239e658360f03e Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=179, length=361 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300d01580000000c6160301008610000082008084ee2c3608616ce6eba4d00c29044351d16e12f685ae7f3b681c6dab7d82305beee402988ed382fa4bd470c168bdc0a965a109d5c77248ac0ed4a80132dd2137ec4e6f465e3b87b652840a9a159b955a1b1295071845a7d8eb644d23035913d6d14a4e3129c2b34ae491a56023a4945687c73590065cab6655c6751556d3ce1014030100010116030100301e3574dc99e3fb202d0cab8eef90cb10d573d7cd1bf7f2293f6f60c82dacd3a7a6859bb080b5c2afc066f4f6e671b8da State = 0x939aa97763146ddbdd239e658360f03e Message-Authenticator = 0xc745a0eba4da1470bc9051537c608ae5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 2 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 179 to 192.168.2.31 port 2061 EAP-Message = 0x0104004515800000003b1403010001011603010030724efe5892209f79ab0be929e2bcbf8e8b59a64d8dcbea3802424703b09caafead87b56b4e73d613a0cbe8630d9ecf3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9bb6f2bd09a30769727417518278b1c6 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=180, length=296 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204008f15800000008517030100800d661d7c92bd96e81b9d59d94e07128c9f7819bcf142363d1effff4c19ff685b0325afdf5ee8982c3ac3c83fc773e6405afeacb014e655072689bf86e5e81c8caf19449932f280d02c8ee99c6f454a017c9058efcb2edb73704d287d03d419f3fb411d316618c3909096fbacdd2731a2f930c9c07d9347ff468940280e0d3a50 State = 0x9bb6f2bd09a30769727417518278b1c6 Message-Authenticator = 0x9d4d0299131dca34d8fcec115e162981 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 143 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "cri" MS-CHAP-Challenge = 0xaac5cd367c8c6514065b78a2565af005 MS-CHAP2-Response = 0x4b006a5d287a775c2f4ec2dc8d5ee478803400000000000000003785e19f894564ea925070dd285bb53c762f75138e04eef0 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "cri" MS-CHAP-Challenge = 0xaac5cd367c8c6514065b78a2565af005 MS-CHAP2-Response = 0x4b006a5d287a775c2f4ec2dc8d5ee478803400000000000000003785e19f894564ea925070dd285bb53c762f75138e04eef0 FreeRADIUS-Proxied-To = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 3 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 3 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for cri with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. ?rlm_mschap:username_string = cri, shortUserName=cristianoc (length = 10) ?rlm_mschap: stepbuf server challenge:? aac5cd367c8c6514065b78a2565af005 ?rlm_mschap: stepbuf peer challenge:?? 6a5d287a775c2f4ec2dc8d5ee4788034 ?rlm_mschap stepbuf p24:?? 3785e19f894564ea925070dd285bb53c762f75138e04eef0 rlm_mschap: dsDoDirNodeAuth returns stepbuff: S=94B97D6D9ECB538F5BC19670191AA6C539961B90?<?W ??M????? (len=40) modcall[authenticate]: module "mschap" returns ok for request 3 modcall: leaving group MS-CHAP (returns ok) for request 3 Login OK: [cri/<no User-Password attribute>] (from client localhost port 0) TTLS: Got tunneled reply RADIUS code 2 MS-CHAP2-Success = 0x4b533d39344239374436443945434235333846354243313936373031393141413643353339393631423930 TTLS: Got tunneled Access-Accept TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge. modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 180 to 192.168.2.31 port 2061 EAP-Message = 0x0105005f15800000005517030100503d6bd35427103f31bd94fa61ded8e896daedf6fe82701d2d835ce1a0877797591fe2eefb0a839ac3e8a7b5dfcc9be6f361f002c0e30308cac5867f397e5ba6aaf5920ad41e2a0bd17a3198b773a66086 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xadaf96b5d3dfb8d5cbfb414029557575 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=181, length=159 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061500 State = 0xadaf96b5d3dfb8d5cbfb414029557575 Message-Authenticator = 0x4511af0f520283314c0820b2448124b4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 4 modcall: leaving group authenticate (returns ok) for request 4 Login OK: [cri/<no User-Password attribute>] (from client ap1 port 0 cli 00-19-E3-00-55-4F) Sending Access-Accept of id 181 to 192.168.2.31 port 2061 MS-MPPE-Recv-Key = 0xebfef0baec2d46597caf6ca28d858fe6f5817944f42b00e9716049bad5ed0bd5 MS-MPPE-Send-Key = 0xd23487bdcbe1da395589674f0733646244d69600d3733ff8b6e4e816334d11e5 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "cri" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... -

3 3

EAP-PEAP GTC auth_type
by Fajar A. Nugraha 28 Feb '09

28 Feb '09

Hi, I'm trying to setup freeradius 2.1.3 as a radius for wifi security. The setup is as follows : - AP is running dd-wrt, Wireless Security set Security Mode=radius - Client (Ubuntu Hardy) is setup using network-manager, connect to the wireless network using settings : Wireless Security=WPA2 Enterprise, EAP Method=PEAP, Key Type=Dynamic WEP, Phase2 Type=GTC - on freeradius the relevant eap.conf section follows #============================================== eap { default_eap_type = peap gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" cache { enable = no max_entries = 255 } } peap { default_eap_type = gtc copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } } #============================================== I have ldap (lda.conf) and pam sections (on radiusd.conf) correctly setup so that I can authenticate (tested with radtest) using system users (with pam) or LDAP user. Obviously EAP is not involved here yet. The comments on eap.conf says # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. There's also this comment on LDAP.conf # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). Now I'm assuming what happens when I use PEAP-GTC with system user is that : - eap calls peap - peap calls gtc - gtc calls PAP - PAP calls pam in which case GTC should receive the password in clear text (which is also visible from radiusd -X autput). Now the question: Can I set GTC to authenticate against LDAP? Using SYSTEM user with auth_type = PAP in gtc section works, tested with wireless client. #============================================== Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group PAP {...} [pap] login attempt with password "<My system password here>" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok rlm_eap_gtc: Everything is OK. [eap] Freeing handler ++[eap] returns ok Login OK: [<My system user here>] (from client <My client name here> port 0 via TLS tunnel) #============================================== but using LDAP user with auth_type = PAP in gtc section does not work #============================================== Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group PAP {...} [pap] login attempt with password "<My LDAP password here>" [pap] No password configured for the user. Cannot do authentication ++[pap] returns fail [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [<My LDAP user here>] (from client <My client name here> port 0 via TLS tunnel) #============================================== ... and setting auth_type = LDAP in gtc section (obviously) does not work #============================================== rlm_eap_gtc: Unknown Auth-Type LDAP rlm_eap: Failed to initialize type gtc /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. #============================================== Is there any way I can get this to work? i.e. having eap -> peap -> gtc -> PAP -> LDAP Regards, Fajar

3 13

OT: 802.1x CPE device with _wired_ supplicant support
by Vegard Svanberg 28 Feb '09

28 Feb '09

Sorry for the OT. My alibi is that the device will authenticate through a switch and Freeradius. :-) I'm looking for a cheap 802.1x CPE device ("broadband router" like, you know, with a 4-port embedded switch, wan-port and wireless support) which can be an 802.1x supplicant on the wired WAN port. It's seems such devices are hard to find, and I'm surprised as to why the usual broadband router manufacturers don't implement this. Any suggestions on where to find / what devices to use? Thanks in advance. -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 1

AUTO: Freitag, Thoralf is out of the office. (returning 05.03.2009)
by Thoralf Freitag 28 Feb '09

28 Feb '09

I am out of the office until 05.03.2009. In urgent cases contact HSS via eMail admin(a)ews.biotronik.de, or via telephone -4616. Note: This is an automated response to your message "Re: Conversion to Version 2" sent on 2/28/09 0:05:11. This is the only notification you will receive while this person is away.

1 0

Error: WARNING: Unresponsive child for request in module sql component accounting
by magicboiz 27 Feb '09

27 Feb '09

Hello all!! I facing this problem with my Freeradius 2.1.3, and I don't know how to solve it :( My NAS is sending only accounting registers to my freeradius server. My freeradius server, is configured to store these registers into a MySQL server. I have configured "max_request_time = 120", in the case of MySQL slow performance, but the problem perssits. My questions are: - how can I solve this issue? - When a child is unresponsive, the register is lost, or another child stores it into the database? Thx in advance. Regards RADIUSD.CONF: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 120 cleanup_delay = 1 max_requests = 10240 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 50 max_servers = 100 min_spare_servers = 10 max_spare_servers = 30 max_requests_per_server = 5 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/

4 8

SQL-Accounting
by Tim Stone 27 Feb '09

27 Feb '09

Hello, is it possible to call only a simple "Stored Procedure" (SP) on the MySQL-Server to do the Accounting Job, like the sql-log module (rlm_sql_log(5)), but do not log in file, instead of this, call the SP: I can't find more Information for such configuration. Thanx for help, Tim

2 5

Re: SQLCounter configuration
by alt_ 26 Feb '09

26 Feb '09

tnt-4 wrote: > >>3) Currently I receive something like Reply-Message = "Your maximum >>never usage time has been reached" when the counter reaches its limit - >>even when what was counted as not time but data volume. Can Reply-Message >>for sqlcounter be configured as in the expiration module? >> > > No. But you can sort out the reply with unlang. > > Can you show some examples please? I try to do like this: noresetBytecounter if (reject) { update reply { Reply-Message := "Traffic limit exceeded." } } but if noresetBytecounter return reject freeradius immediatly return reject to user and do not process 'if' clause -- View this message in context: http://www.nabble.com/SQLCounter-configuration-tp21384983p22219985.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 10

Question about authenticating CHAP clients using an external program - A different case
by Ali Majdzadeh 26 Feb '09

26 Feb '09

Hello All, I am using freeradius-1.1.7. In order to authenticate users using an external program, I have created an instance of the rlm_exec module which contains the properties of the external program. In the radiusd.conf, I have called the instance in the authentication section. Now, as I want to authenticate CHAP clients, I need to pass their clear text passwords to the rlm_chap module. The passwords are stored in the database (MySQL) and are fetched in the external program. In the external program, I have simply output User-Password = ### as the user's clear text password, but the rlm_chap module says: "Could not find clear text password for user ...". What is wrong? Any ideas? Kind Regards Ali Majdzadeh Kohbanani

2 16