- Freeradius-Users - lists.freeradius.org

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by hsuan 26 Nov '08

26 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius The server shown the message : [ldap] performing user authorization for ldapuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) expand: dc=mydomain,dc=com -> dc=mydomain,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=com/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 33059 What's the problem ? how can I to fix the error ? Please help me! Regards, Vicky

4 10

Dan Schaffer is out of the office.
by Dan Schaffer 26 Nov '08

26 Nov '08

I will be out of the office starting 11/26/2008 and will not return until 12/01/2008. Thank you and have a nice day, Dan

1 0

Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo Zavala 26 Nov '08

26 Nov '08

Hello, I in our network we have two data services: 1.- MMSC (Multimedia Message Service Center) 2.- EVDO (Evolution-Data Optimized) I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. Are there more people who figured out how to make possible this configuration-like? Thanks in advance Aldo

2 1

Login incorrect (rlm_ldap: User not found)
by hsuan 26 Nov '08

26 Nov '08

Dear all: I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. And I have add a new ldap user "hoyo" and set the user password But when I using "radius -X" to start the radius The server shown the message : ..... [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect (rlm_ldap: User not found): [hoyo/hoyo] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> hoyo attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated ..... .. ... I have set the user "hoyo " password by "ldappasswd -S -x -W -D "cn=Manager,dc=mydomain,dc=com" "cn=hoyo,dc=mydomain,dc=com"" and response as follows : "New password: Re-enter new password: Enter LDAP Password: Result: Success (0)" But why still have error ? how can I to solve the problem ? Regards, Vicky

2 2

pam_radius_auth v1.3.17 missing a define???
by David Ly 25 Nov '08

25 Nov '08

Hi, I've been looking into the source code of pam radius, due to authentication failure without a entry in the local /etc/passwd file, and i've noticed that; /|'PAM_SM_ACCOUNT|/ must be *#define*'d prior to including |<security/pam_modules.h>|.' isn't being done. Was this done on purpose? Could this possibly be factor in my problem. I would test it out, however I am unable to build the library on my machine. A fresh downloaded make gives me Nov 21 15:20:52 wisdur sshd[21221]: PAM unable to dlopen(/lib/security/pam_radius_auth.so): /lib/security/pam_radius_auth.so: undefined symbol: __stack_chk_fail_local Nov 21 15:20:52 wisdur sshd[21221]: PAM adding faulty module: /lib/security/pam_radius_auth.so Thanks in advance -David Ly (Just a side note, Does anyone knows why I get these errors when trying to build.) ggc -v ---> "gcc version 4.1.1" pam_radius_auth.c: In function ‘talk_radius’: pam_radius_auth.c:887: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness pam_radius_auth.c: In function ‘pam_sm_authenticate’: pam_radius_auth.c:1103: warning: assignment from incompatible pointer type

2 2

last hurdle...windows clients
by Craig White 25 Nov '08

25 Nov '08

freeradius-1.1.3-1.2.el5 I am authenticating Windows RRAS connections, Macintosh wifi, iPhone wifi all with LDAP and mschapv2 (using sambaNTPassword hashes in OpenLDAP) My users basically consists of... DEFAULT Auth-Type = LDAP eap.conf default_eap_type = mschapv2 and of course my certificates and LDAP setup which works for all the above authentications. My problem is Windows XP laptops (updated to SP3) and I have generated certificates for them. I have loaded both the CA and p12 certificates on a Windows client, set for WPA, TKIP, PEAP but it never asks me for a user name and password and thus always tries to authenticate as anonymous (log below)...even if I check the box to 'Automatically use my Windows name and password' - it still comes in as 'anonymous' Is there some thing else I need to add so that Windows also uses name/password or do I have something else in Auth-Type to just allow those with the certificates? How do I do this? I don't understand the message about unknown_ca in the log below either because I am acting as my own CA and this same cacert.pem seems to be happy on the Windows system I imported it on and I've been using it for a bunch of other daemons. Craig rad_recv: Access-Request packet from host 192.168.1.251:2050, id=112, length=172 User-Name = "anonymous" NAS-IP-Address = 192.168.1.251 NAS-Port = 0 Called-Station-Id = "00-21-29-E3-D1-8A" Calling-Station-Id = "00-04-23-62-BD-3D" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0288001119800000000715030100020230 State = 0xce80cf1b72bd9479de376550dc6d9052 Message-Authenticator = 0x90183570c2ef1940d04e9e5dc579a1bd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 59 modcall[authorize]: module "preprocess" returns ok for request 59 modcall[authorize]: module "chap" returns noop for request 59 modcall[authorize]: module "mschap" returns noop for request 59 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 59 rlm_eap: EAP packet type response id 136 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 59 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 59 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(uid=anonymous)' radius_xlat: 'ou=People,ou=Accounts,o=MyOrg' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=Accounts,o=MyOrg, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 59 modcall: leaving group authorize (returns updated) for request 59 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 59 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 59 modcall: leaving group authenticate (returns reject) for request 59 auth: Failed to validate the user.

3 8

Re: failure to compile 2.1.1 on Redhat ES3
by thoralf.freitag＠biotronik.com 25 Nov '08

25 Nov '08

>A.L.M.Buxey at lboro.ac.uk wrote: >> just tried to compile FR 2.1.1 on a more vintage system >> than what I normally find myself on - RedHat ES 3 >> >> Theres a compile issue with Python module which didnt >> exist on the same platform with 2.0.5 - but I'll ignore >> that one for now - the important part is the base daemon >> itself: >> >> /usr/src/freeradius-server-2.1.1/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall >-D_GNU_SOURCE -DNDEBUG -I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" >-DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 -c listen.c >> gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG >-I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 >-c listen.c -fPIC -DPIC -o .libs/listen.o >> listen.c:99:1: directives may not be used inside a macro argument > > Yuck. That assert can simply be deleted. > > Alan DeKok. Hi Alan, pls. give me a little hint, what exact can be deleted ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

2 2

Linksys WAP54G
by M.K. tenNapel 25 Nov '08

25 Nov '08

Hi, I have setup a FreeRadius-server and try to get it operational with a Linksys WAP54G AccessPoint. This seems to work highly unreliable. I posted a question about this on the Linksys support forums, but no luck so far: http://forums.linksys.com/linksys/board/message?board.id=Access_Points&thre… Googeling this problem, I found more complaints about this issue. I was wondering if more FreeRadius users are familiar with this problem. Maybe someone came up with a solution? I hate to throw out 3 AP's... Thanks! Mariourk

5 11

certificates confusion
by Craig White 25 Nov '08

25 Nov '08

please excuse me if this isn't entirely related to freeradius but it's all about getting WindowsXP laptops to my wireless network with freeradius and 8021.x I see that there is certificate failures and am thinking that I need to clean this up up until now, server2 is my ca and I have used that to generate and sign certificates. my radius server though is running on server1 and I think that my failure is related to the fact that I'm generating the certificates and signing them with server2. So my questions... 1. Do I set up server1 to be its own CA or do I still use server2 as the CA? 2. If server2 is the CA, do I then generate the request on server1, copy it to server2 and then sign it on server2? 3. Does anyone see any problems with these methods of generating certificates ? (openssl on Linux) # Generate server certificate signing request openssl req -new -nodes -keyout $SSL/radius_server_key.pem \ -out $SSL/radius_server_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign server certificate openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out radius_server_cert.pem \ -extensions xpserver_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_server_req.pem # Edit out text information in radius_server_cert.pem and then run # cat $SSL/radius_server_key.pem \ # $SSL/radius_server_cert.pem > \ # $SSL/radius_server_keycert.pem # Generate client certificates # openssl req -new -keyout $SSL/radius_client_key.pem \ -out $SSL/radius_client_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign client certificates openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out $SSL/radius_client_cert.pem \ -extensions xpclient_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_client_req.pem # cat $SSL/radius_client_key.pem $SSL/radius_client_cert.pem > $SSL/radius_client_keycert.pem Thanks Craig

5 7

Unlang / Username modification
by Nemec Christopher 25 Nov '08

25 Nov '08

Hello list; our freeradius is used to authenticate MAC-addresses (locally) and "humans" (against the windows AD). Therefor I would to like use unlang to seperate MAC-addresses from humans as they need to be treated differentely; the MAC-address authentication works fine; so does the proxying to the realm called "office". However I am stuck with these two tasks: a) Append the "office" prefix to the username (since we are lazy and do not want to type in the domain name when we log on to one of our switches) b) proxy the request to the AD I have placed the following lines of code in the radiusd.conf file: if (User-Name="nemec") { %{User-Name}:=office\nemec Proxy-To-Realm := "office" } However they are not being executed. Do they need to be at the top of the file? Is the syntax correct? radiusd -X runs with no errors and correctly processes all other requests, but does not proxy to the "office" realm. Christopher Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706

2 1