- Freeradius-Users - lists.freeradius.org

RE: (err=2)! (Shared secret is incorrect.)
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

The shared secret is the password that clients use to connect to the RADIUS server. It's located in the "client.conf" file in your freeradius configuration directory. Note, that this shared secret is used to secure RADIUS traffic. User names and passwords of users which are authenticating via EAP are stored in the "users" file. -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

4 3

rad_recv: Access-Reject
by Ilya 10 Dec '08

10 Dec '08

hello! debugging freeRADIUS i met the problem like this: At the beginning I thought that the problem was in the users file but in radiusd.log I saw the message: rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/raddb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique what's wrong? could anybody help me plz? radiusd -X log , users file and cliens.conf is attached. have a good day, ilya ________________________________ ilya vishnyov billing department baykalwestcom 68, 2-zheleznodorozhnaya str., irkutsk, 664005, russia gsm: +7 9025 113 992 e-mail: ilya(a)bwc.ru icq #: 988-0-229 ________________________________

1 0

Re: EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

Under my freeradius and ap current configuration, I can be success authenticated by windows xp client, but failed by linux client of wpa_supplicant-0.4.8. What's wrong with my setting? Is my wpa_supplicant version too old or my wpa_supplicant config file has some problem?

2 1

EAP-AKA
by Fernando 10 Dec '08

10 Dec '08

Hi all, I'm trying to configure EAP-AKA using EAP2, where do I insert the quintets?.. in the same way as EAP-SIM? Thanks, Fernando.

1 0

Re:EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

>>I want to build a IEEE 802.1x authentication environoment and >>I have installed freeradius-1.0.2, > Why? It's outdated and has serious security flaws in EAP. I just do some testing with old version who had more documents. It seem the old version also can run well, but I cann't config them running. Can you give me some suggestion at these old version.

2 1

domain security problem
by Hegedus Gabor 10 Dec '08

10 Dec '08

hi, my configuration: radius 2.X , win 2003 AD, domain: TEST, 802.1x I have a problem: If the pc is in the domain(TEST) it can authenticate good. If it is not in domain it can't auth, it is good, BUT when i set the computer name to TEST and it is not in the domain(simple workgroup) it CAN authenticate. I use ntml_auth for the authentigation. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" How can I fix this risk? What are the solutions?

2 2

(err=2)! (Shared secret is incorrect.)
by Ilya 10 Dec '08

10 Dec '08

i've read FAQ Hello i've got Linux 2.6.9-22 and freeRADIUS server v.2.1.1. I have the following problem - when i start radius in debuging mode it returns me the next message: "rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=195, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) [root@sasocl1 ~]#" i tried to solve this problem by reading FAQ but without any success Because i can not find something like "Login failed [user/password] ." in log file (attached). Please can anyone help me? Great thanks in advance! have a good day, ilya ________________________________ ilya vishnyov billing department baykalwestcom 68, 2-zheleznodorozhnaya str., irkutsk, 664005, russia gsm: +7 9025 113 992 e-mail: ilya(a)bwc.ru icq #: 988-0-229 ________________________________

1 0

Regarding Dynamiv Vlan Association Via Radius Server
by duraivelanc Chockalingam 10 Dec '08

10 Dec '08

Hi This is Durai Velan C, from India. I would like to know about the Free Radius Version that supports, "Dynamic VLAN Association" for an User that is getting authenticated from Radius Server. Here by, I would require the Free Radius Server Configurations document to aid the Same. Requirements. 1.) My Radius Server IP auth = 172.21.185.142, acct = 172.21.185.142 2.) User = alcatel , Domain = adilab.com 3.) User password = alcatel 4.) Authentication: 8021.X , through MD5-Challenge. If possible, kindly provide me the Radius Server COnfiguration for the above mentioned, details Your help on the same would be great Regards Durai velan C

2 1

EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

EAP/TLS TLS_accept error Hi: I want to build a IEEE 802.1x authentication environoment and I have installed freeradius-1.0.2, openssl-0.9.8i, hostpad-0.4.8, wpa_supplicant-0.4.8. The authentication server is built in redhat9 , the database is mysql5 and client is build in linux. I can use EAP/MD5 authentication type and it runs well. When I config EAP/TLS-MD5 type, the client cann't be authenticated. I have referenced many similar ways to resolve it, but I am failed. I list my configuration files and the debug information below. Who can give me some suggestion, Thank your very much for your help ! A. IN FREERADIUS: 1. Using CA.all to generate certificats: /CA.all Get those new files: cert-clt.der cert-clt.p12 cert-clt.pem cert-srv.p12 cert-srv.pem newcert.pem newreq.pem root.der root.p12 root.pem The default protect password is whaterver 2. Generate Diffie-Hellman key named dh and random key named random openssl dhparam -check -text -5 512 -out dh dd if=/dev/urandom of=random count=2 3. eap.conf default_eap_type = tls tls { private_key_password = whatever private_key_file = /etc/mycerts/cert-srv.pem certificate_file = /etc/mycerts/cert-srv.pem CA_file = /etc/mycerts/root.pem dh_file = /etc/mycerts/dh random_file = /etc/mycerts/random fragment_size = 1024 include_length = yes } 4. radius.conf authorize { preprocess suffix eap files sql } authenticate { eap } 5. users DEFAULT Auth-Type = EAP Fall-Through = 1 6. part of debug information modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0822], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0071], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A 6533:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:1052:SSL alert number 42 6533:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails B. IN HOSTAPD 1. some debug information RADIUS packet matching with station 00:13:d7:20:00:90 IEEE 802.1X: 00:13:d7:20:00:90 BE_AUTH entering state FAIL IEEE 802.1X: Sending EAP Packet to 00:13:d7:20:00:90 (identifier 4) IEEE 802.1X: 00:13:d7:20:00:90 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:13:d7:20:00:90 AUTH_PAE entering state HELD br0: STA 00:13:d7:20:00:90 IEEE 802.1X: authentication failed IEEE 802.1X: 00:13:d7:20:00:90 BE_AUTH entering state IDLE C. IN WPA_SUPPLICANT 1. wired.conf # IEEE 802.1X with EAP-TLS ctrl_interface=/var/run/wpa_supplicant ap_scan=0 eapol_version=1 network={ ssid="" key_mgmt=IEEE8021X eap=TLS identity="test" ca_cert="/root/root.pem" client_cert="/root/cert-clt.pem" private_key="/root/cert-clt.pem" private_key_passwd="whatever" eapol_flags=0 priority=2 } 2. some debug information SSL: SSL_connect:SSLv3 read server hello A TLS: Certificate verification failed, error 9 (certificate is not yet valid) depth 1 SSL: (where=0x4008 ret=0x22a) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad certificate SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server certificate B OpenSSL: tls_connection_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed SSL: 7 bytes pending from ssl_out SSL: Failed - tls_out available to report error

3 2

rlm_python:python_load_function: module 'freeradius-cdrtool' is not found
by john li 10 Dec '08

10 Dec '08

i am trying to install freeradius-cdrtool with freeradius-server-2.1.3 and get the following the error: rlm_python:python_load_function: module 'freeradius-cdrtool' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/lib/python2.5/lib-dynload/_socket.so: undefined symbol: PyExc_ValueError rlm_python:python_load_function: failed to import python function 'freeradius-cdrtool.instantiate' //etc/raddb/radiusd.conf[540]: Instantiation failed for module "python" //etc/raddb/radiusd.conf[2007]: Failed to find module "python". //etc/raddb/radiusd.conf[2005]: Errors parsing accounting section. } Errors initializing modules i have google the error and installed the freeradius-1.1.6 with freeradius-cdrtool successfully,but i still want to install freeradius-server-2.1.3 with freeradius-cdrtool, how to fix it? thanks a lot! -- Regards John

1 0