- Freeradius-Users - lists.freeradius.org

Which version?
by Just E. Mail 11 Dec '08

11 Dec '08

OK.. I am ready to install freeRADIUS!. I have setup a LINUX server with: CentOS 5.2 mySQL-server-5.0.25-7 I noticed that 2.1.3 is the latest freeRADIUS version. Does it work with the above OS & mySQL versions or I need to fall back to a previous version of freeRADIUS? I am pretty new and this is my first freeRADIUS installation! Sam

2 1

Does FreeRADIUS support PEAPv0/EAP-TLS?
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

I'm attempting to setup PEAPv0/EAP-TLS which uses EAP-TLS as the inner authentication method within PEAP. Unlike EAP-TLS, PEAPv0/EAP-TLS sends the client certificate within the secure SSL tunnel, thus protecting the user's identity. While RFC-5216 suggests that EAP-TLS can optionally support a privacy mode in which the client certificate is pushed through the SSL tunnel, I've not found any way to enable this option. I have no particual interest in using PEAPv0/EAP-TLS other than the fact that I know it does what I want to accomplish. I would be perfectly happy to use EAP-TLS in Privacy mode, or PEAPv0/MSCHAPv2 with a required client certificate. However, both these modes pass the client certificate in the clear. Here's what my testing has shown: EAP-TLS: Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2- Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2 + Requierd Client Certificate- Works with Juniper Odyssey Access Client 4.8 (XP Supplicant doesn't support MSCHAPv2 + Certificate) PEAPv0/EAP-TLS- Fails on both supplicants I don't think my TLS settings are improper, as both EAP-TLS and PEAPv0/MS-CHAPv2 + Client Certifciate work fine. The debug logs shows the client certificate verified properly. I've tried pretty much every combination of PEAP options, and after each permutation I forced a reauthentication so that I could analyze the packets in Wireshark. No combination of settings forced the client certificate through the SSL tunnel. I thought " use_tunneled_reply = yes" might help, but it did not. I have pasted the relevant configuration settings below as well as a full log of the failure when I attempt to use PEAPv0/EAP-TLS. The relevant settings: Other than "default_eap_type = "tls" my settings are identical for PEAPv0/EAP-MSCHAPv2 which works fine. The failure log seems to suggest that "tls" is not a supported authentication mode within PEAP. [files] users: Matched entry DEFAULT at line 200 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} *rlm_eap: No EAP session matching the State variable.* *[eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request* [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE *PEAPv0/EAP-TLS Failure Log: *http://pastebin.com/m900e269 *PEAPv0/MSCHAPv2 Success Log:* http://pastebin.com/m16114697 *PEAPv.0/MSCHAPv2+Cert Success Log: *http://pastebin.com/m429d9c12 *EAP-TLS Success Log:* http://pastebin.com/m2b1c62f4 Relevant Settings: eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 3072 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server_key.pem" certificate_file = "/etc/freeradius/certs/server_cert.pem" CA_file = "/etc/freeradius/certs/cacert.pem" dh_file = "/etc/freeradius/certs/dh3072.pem" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "HIGH" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no peap { default_eap_type = "tls" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no modules mschap: Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Users: "DEFAULT" Cleartext-Password := "**************************************", EAP-TLS-Require-Client-Cert := Yes Note: (*'s represent a 32 character randomly generated password) Thanks in advance, Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 5

Programatically provision users to server.
by Matthew Carriere 10 Dec '08

10 Dec '08

Hi everyone, I am thinking of adding a FreeRadius server to an existing infrastructure in order to provision users through an application. I am currently running a WLAN controller connecting several access points. Currently users are added manually through the WLAN controller interface. Could I add a FreeRadius server and be able to programatically add users to it? I need to be able to do this through a Ruby on Rails application. I am thinking I would have to either: 1. Use some sort of API 2. Run a script that uses a command line interface Your thoughts and suggestions on this architecture would be appreciated. Thanks Matthew.

5 16

Accounting Software
by Just E. Mail 10 Dec '08

10 Dec '08

Hello: My first try on freeRADIUS. I am going to setup a test freeRADIUS server with CentOS 5.2 & mySQL for learning about RADIUS server. Questions: 1. Is there a GUI application to setup freeRADIUS? 2. Is there a free accounting package (must interface with mySQL) I can use? Thanks. Sam

2 1

ldap question
by Craig White 10 Dec '08

10 Dec '08

still a few issues so I upgraded to 2.1.1 and in debug mode (and I have enabled ldap), I see this... [ldap] checking if remote access for $SOME_USER is allowed by uid [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x... rlm_ldap: sambaLmPassword -> LM-Password == 0x... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user $SOME_USER authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP should I just disable pap? (I can't think of anything that I need to use it for) OR... considering that the LDAP 'userPassword' is essentially the same password that is contained in sambaNTPassword and sambaLMPassword, do I just somehow enable # password_attribute = "userPassword" as it talks about in rlm_ldap doc file? Craig

1 0

RE: No log destination specified.
by Marcel Grandemange 10 Dec '08

10 Dec '08

|->>I have a problem where I upgraded v1 to v2 of freeradius and now I can only |->start it with mode radius -X , if I try use script is simply does following. |-> |-> |-> |->>/usr/local/etc/rc.d]# ./rc.radiusd start |->>Starting FreeRADIUS:radiusd: Error: No log destination specified. |->>Radius |-> |-> |->>Any advise? |-> |->FYI - I have now made a startup script to the following. |-> |->/usr/local/sbin/radiusd -X & > /dev/null 2>&1 |-> |->To Run Freeradius as this is a production machine. >It is complaining that you have not specified a place to write a log file. >====== >logdir = /var/log ># ># The logging messages for the server are appended to the ># tail of this file. ># >log_file = ${logdir}/radius.log >====== >This is from my radiusd.conf file. Radius writes log file messages (few >and far between) to /var/log/radius.log >Fix that and you wont have to use the redirect to /dev/null, which I would >not use anyway as you want log files to know if something is going wrong. This is the beginning of my radius.conf, it seems the entry is indeed there and valid as it's same as old installation. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log >HTH, >Keith

3 2

EAP-SIM
by Leigh Martell 10 Dec '08

10 Dec '08

Hey, This may be a stupid question, but if I don't have access to a carriers HLR. Can I still do EAP-SIM if I have a sim reader. Sorry for this question I am just having trouble finding a definitive answer. Thanks, Leigh

1 0

version 2.1.3 available for Fedora 10 and Fedora 9
by John Dennis 10 Dec '08

10 Dec '08

The new version of FreeRADIUS, 2.1.3, is available in the testing repositories for Fedora 10 and Fedora 9. Please note they are in the testing repositories and have not been pushed to stable yet. If you have questions or issues please consult the FreeRadius Red Hat FAQ (http://wiki.freeradius.org/Red_Hat_FAQ) first. If you have success with it I would appreciate knowing that because that will be the key for me to push it to stable and a wider audience. Comments to this effect can be added to the package release on Bohdi, the Fedora Update System (https://admin.fedoraproject.org/updates) -- John Dennis <jdennis(a)redhat.com>

1 0

python error in complie freeradius-2.1.3
by henry1412 10 Dec '08

10 Dec '08

I install freeradius-2.1.3 on redhat9, the python version is 2.2. When I make the freeradius, it reports many error in rlm_python.c file. I paste the error information below rlm_python.c: In function `python_error': rlm_python.c:163: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:163: (Each undeclared identifier is reported only once rlm_python.c:163: for each function it appears in.) rlm_python.c:163: parse error before "__gstate" rlm_python.c:181: warning: implicit declaration of function `PyGILState_Release' rlm_python.c:181: `__gstate' undeclared (first use in this function) rlm_python.c: In function `python_init': rlm_python.c:201: warning: passing arg 2 of `PyModule_AddIntConstant' discards qualifiers from pointer target type rlm_python.c: In function `python_function': rlm_python.c:338: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:338: parse error before "gstate" rlm_python.c:361: `gstate' undeclared (first use in this function) rlm_python.c:361: warning: implicit declaration of function `PyGILState_Ensure' rlm_python.c: In function `python_load_function': rlm_python.c:470: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:470: parse error before "gstate" rlm_python.c:472: `gstate' undeclared (first use in this function) rlm_python.c: In function `python_objclear': rlm_python.c:508: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:508: parse error before "__gstate" Is my python version too old ?

3 2

fr group howto
by Hegedus Gabor 10 Dec '08

10 Dec '08

Hi all! I have 802.1x authentication, which works. I want use dynamic vlan assignment: The radius authenticate the user (use ntlm_auth) and after this, it use ldap to get user indormation form database (username=samaccount name). ldap.attrmap changes the attributes and send to the switch, it is okay. It is not so confortable, I wanna try something else: 1. I create groups: vlan21, vlan333, and so on. expand the vlan schema with 3 attrib (you know VLAN, IEEE-802, and VLANID). I put users and computers to the groups. How can I get users vlan info, I can't create ldap query, cos : - i have samaccount name what is not the cn, and the "member", "member of" attribs are contains cn. i don't know how can i do a good query, the good attrib is in vlanXY group. - get vlan? ok but i have just samaccount name, no cn - get user? ok but the good attribs is in the vlan group how? 2. I don't expand the vlanXY schema, I get user info(by samaccname) contains "member of" attr, and in the freeradius user file I create group. If group in the users file equals "member of" attrib send back the vlan info to the switch: (i know it is not good yet) DEFAULT Ldap-Group == "cn=vlan10,ou=vlans,dc=test,dc=hu" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10, Reply-Message = "You are in vlan 10" ldap modul: groupname_attribute = cn groupmembership_filter = "(&(memberof=cn=vlan10,ou=vlans,dc=test,dc=hu)(samaccountname=%{mschap:user-name}))" ## i know it is bad, but what is the good do you understand what i want? I test both prospect, pls help Thx Gabor

2 2