- Freeradius-Users - lists.freeradius.org

RSASecurid and PEAP
by Paul TAVERNIER 26 Nov '08

26 Nov '08

Hi i would like to know if this thing (scenario) is possible... 1) i want to authorize/authenticate a user with a couple username/OTPpassword (RSASecurid) through a Freeradius server (i proxy the acces-request to a RSARadius-Securid server). It's ok. 2) (then, if i get an Access-Accept) (in a post-proxy section?) i want to initiate an EAP Challenge between my XP-Wireless-supplicant client and FREERADIUS (not the RSA radius)... Can i configure something like that authorize { ... suffix ... } post-proxy { (if access-accept...) eap } Hope this mail is not too obfuscated...and then is able to be decoded... Regards Paul

2 1

ip pool
by sugiarto tjahyono 26 Nov '08

26 Nov '08

Dear all, I have a few problem. i use ip pool and it's works fine if i define ip pool in mysql. 779084,"test","password","=","test123" 779085,"test","Pool-Name",":=","main_pool1" 779086,"test","Called-Station-Id","=","hostpot1" The problem happened if i have 2 access point in the same area and IP the different is only at called-station-id. what should i set in radius if any user can go to AP 1 with Called-Station-Id 1 or AP 2 with Called-Station-Id 2. if user logged in AP1 they will get main_pool1 and if user logged in AP2 they will get main_pool2 sorry for my bad language:)

2 1

radmin SIGABRTs freeradius 2.1.1
by Norbert Wegener 26 Nov '08

26 Nov '08

I have an input file for radmin with the following content: debug file /var/log/radius/nw2.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' When those commands have been executed and some debugging shows up int the logfile, I want to switch to another log. changing the radmin input file to debug file /var/log/radius/nw3.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' and executing the commands, freeradius in the actual 2.1.1 version dies. This is, what gdb show up: Loaded symbols for /usr/lib64/freeradius/rlm_sql_log.so 0x00002b091e323562 in ?? () from /lib64/libc.so.6 (gdb) cont Continuing. Program received signal SIGABRT, Aborted. [Switching to Thread 47318162851936 (LWP 2820)] 0x00002b091e299b95 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00002b091e299b95 in raise () from /lib64/libc.so.6 #1 0x00002b091e29af90 in abort () from /lib64/libc.so.6 #2 0x00002b091e2d035b in __libc_message () from /lib64/libc.so.6 #3 0x00002b091e2d534e in malloc_printerr () from /lib64/libc.so.6 #4 0x00002b091e2d695c in free () from /lib64/libc.so.6 #5 0x000000000040e748 in command_debug_condition (listener=<value optimized out>, argc=2820, argv=0x6) at command.c:718 #6 0x000000000040ee01 in command_domain_recv (listener=0x726dc0, pfun=<value optimized out>, prequest=<value optimized out>) at command.c:1680 #7 0x000000000041ef10 in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=<value optimized out>) at event.c:2666 #8 0x00002b091d7169c0 in fr_event_loop (el=0x70e980) at event.c:400 #9 0x0000000000418bb1 in main (argc=<value optimized out>, argv=0xe) at radiusd.c:394 Norbert Wegener

4 6

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by hsuan 26 Nov '08

26 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius The server shown the message : [ldap] performing user authorization for ldapuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) expand: dc=mydomain,dc=com -> dc=mydomain,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=com/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 33059 What's the problem ? how can I to fix the error ? Please help me! Regards, Vicky

4 10

Dan Schaffer is out of the office.
by Dan Schaffer 26 Nov '08

26 Nov '08

I will be out of the office starting 11/26/2008 and will not return until 12/01/2008. Thank you and have a nice day, Dan

1 0

Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo Zavala 26 Nov '08

26 Nov '08

Hello, I in our network we have two data services: 1.- MMSC (Multimedia Message Service Center) 2.- EVDO (Evolution-Data Optimized) I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. Are there more people who figured out how to make possible this configuration-like? Thanks in advance Aldo

2 1

Login incorrect (rlm_ldap: User not found)
by hsuan 26 Nov '08

26 Nov '08

Dear all: I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. And I have add a new ldap user "hoyo" and set the user password But when I using "radius -X" to start the radius The server shown the message : ..... [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect (rlm_ldap: User not found): [hoyo/hoyo] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> hoyo attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated ..... .. ... I have set the user "hoyo " password by "ldappasswd -S -x -W -D "cn=Manager,dc=mydomain,dc=com" "cn=hoyo,dc=mydomain,dc=com"" and response as follows : "New password: Re-enter new password: Enter LDAP Password: Result: Success (0)" But why still have error ? how can I to solve the problem ? Regards, Vicky

2 2

pam_radius_auth v1.3.17 missing a define???
by David Ly 25 Nov '08

25 Nov '08

Hi, I've been looking into the source code of pam radius, due to authentication failure without a entry in the local /etc/passwd file, and i've noticed that; /|'PAM_SM_ACCOUNT|/ must be *#define*'d prior to including |<security/pam_modules.h>|.' isn't being done. Was this done on purpose? Could this possibly be factor in my problem. I would test it out, however I am unable to build the library on my machine. A fresh downloaded make gives me Nov 21 15:20:52 wisdur sshd[21221]: PAM unable to dlopen(/lib/security/pam_radius_auth.so): /lib/security/pam_radius_auth.so: undefined symbol: __stack_chk_fail_local Nov 21 15:20:52 wisdur sshd[21221]: PAM adding faulty module: /lib/security/pam_radius_auth.so Thanks in advance -David Ly (Just a side note, Does anyone knows why I get these errors when trying to build.) ggc -v ---> "gcc version 4.1.1" pam_radius_auth.c: In function ‘talk_radius’: pam_radius_auth.c:887: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness pam_radius_auth.c: In function ‘pam_sm_authenticate’: pam_radius_auth.c:1103: warning: assignment from incompatible pointer type

2 2

last hurdle...windows clients
by Craig White 25 Nov '08

25 Nov '08

freeradius-1.1.3-1.2.el5 I am authenticating Windows RRAS connections, Macintosh wifi, iPhone wifi all with LDAP and mschapv2 (using sambaNTPassword hashes in OpenLDAP) My users basically consists of... DEFAULT Auth-Type = LDAP eap.conf default_eap_type = mschapv2 and of course my certificates and LDAP setup which works for all the above authentications. My problem is Windows XP laptops (updated to SP3) and I have generated certificates for them. I have loaded both the CA and p12 certificates on a Windows client, set for WPA, TKIP, PEAP but it never asks me for a user name and password and thus always tries to authenticate as anonymous (log below)...even if I check the box to 'Automatically use my Windows name and password' - it still comes in as 'anonymous' Is there some thing else I need to add so that Windows also uses name/password or do I have something else in Auth-Type to just allow those with the certificates? How do I do this? I don't understand the message about unknown_ca in the log below either because I am acting as my own CA and this same cacert.pem seems to be happy on the Windows system I imported it on and I've been using it for a bunch of other daemons. Craig rad_recv: Access-Request packet from host 192.168.1.251:2050, id=112, length=172 User-Name = "anonymous" NAS-IP-Address = 192.168.1.251 NAS-Port = 0 Called-Station-Id = "00-21-29-E3-D1-8A" Calling-Station-Id = "00-04-23-62-BD-3D" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0288001119800000000715030100020230 State = 0xce80cf1b72bd9479de376550dc6d9052 Message-Authenticator = 0x90183570c2ef1940d04e9e5dc579a1bd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 59 modcall[authorize]: module "preprocess" returns ok for request 59 modcall[authorize]: module "chap" returns noop for request 59 modcall[authorize]: module "mschap" returns noop for request 59 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 59 rlm_eap: EAP packet type response id 136 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 59 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 59 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(uid=anonymous)' radius_xlat: 'ou=People,ou=Accounts,o=MyOrg' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=Accounts,o=MyOrg, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 59 modcall: leaving group authorize (returns updated) for request 59 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 59 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 59 modcall: leaving group authenticate (returns reject) for request 59 auth: Failed to validate the user.

3 8

Re: failure to compile 2.1.1 on Redhat ES3
by thoralf.freitag＠biotronik.com 25 Nov '08

25 Nov '08

>A.L.M.Buxey at lboro.ac.uk wrote: >> just tried to compile FR 2.1.1 on a more vintage system >> than what I normally find myself on - RedHat ES 3 >> >> Theres a compile issue with Python module which didnt >> exist on the same platform with 2.0.5 - but I'll ignore >> that one for now - the important part is the base daemon >> itself: >> >> /usr/src/freeradius-server-2.1.1/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall >-D_GNU_SOURCE -DNDEBUG -I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" >-DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 -c listen.c >> gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG >-I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 >-c listen.c -fPIC -DPIC -o .libs/listen.o >> listen.c:99:1: directives may not be used inside a macro argument > > Yuck. That assert can simply be deleted. > > Alan DeKok. Hi Alan, pls. give me a little hint, what exact can be deleted ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

2 2