- Freeradius-Users - lists.freeradius.org

EAP and server certificate
by Damjan 17 Nov '08

17 Nov '08

Just to be sure, all EAP types require the radius server to have a certificate right? and this certificate, i.e. it's parent needs to be installed in the supplicants, right? -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

4 3

PEAP-MD5 WPA auth failure freeradius-2.1.1
by Prasad Parab 17 Nov '08

17 Nov '08

Dear All, I am trying to authenticate using PEAP-MD5 for WPA using a wireless device as follows: Wifi client ----------------> AP --------------------> freeradius-2.1.1 (PEAP-EAP-MD5 , WPA ) <-------------- Authenticator <------------------- /usr/local/radius/etc/raddb/users file entry Windows-XP Service pack 2 user: client "client" Cleartext-Password := "test123" Password:test123 Reply-Message = "Hello, client" Attached are 2 wireshark captures One between wifi-client & authenticator Other between authenticator and radius server. It shows auth failure. Can u elaborate as to why this is happenning as user name and password are both correct??? Regards Prasad

1 0

Framed-User?
by Sergio Belkin 16 Nov '08

16 Nov '08

Sorry for the stupid question, what does "Framed-User" stand for? I hope not to be stoned to death because of such a question :) -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

ldap and unix return different results
by Craig White 16 Nov '08

16 Nov '08

I am trying to use mschap and the following is logged suggesting that ldap authorize succeeds but unix authorize fails but the passwords are the same (aside from the fact that samba hashes the password). I can ssh into the radius server with the user name and password... # getent passwd|grep craigwhite craigwhite:x:1013:1000:Craig White:/home/users/craigwhite:/bin/sh # radtest craigwhite MY_PASSWORD MY_RADIUS_SERVER 0 whatever and on the radius server running 'radiusd -X -f' Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.7:60829, id=45, length=62 User-Name = "craigwhite" User-Password = "MY_PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "craigwhite", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for craigwhite radius_xlat: '(uid=craigwhite)' radius_xlat: 'ou=People,ou=Accounts,o=MY_ORG,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=admin,o=Mullen,c=US/riod to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,ou=Accounts,o=MY_ORG,c=US, with filter (uid=craigwhite) rlm_ldap: checking if remote access for craigwhite is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [UX ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value HASHED_PASSWORD & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value HASHED_PASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user craigwhite authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [craigwhite]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Obviously this is something to do with the 'users' file configuration which is still at it's default and apparently this is the problem here... DEFAULT Auth-Type = System Fall-Through = 1 What nugget am I missing? Craig

1 1

Unknown module eap
by Craig White 16 Nov '08

16 Nov '08

freeradius newbie here...not sure where I went wrong and someone probably can figure this out in a second. New installation, following guide @ tldp and another ldap guide but I don't think the ldap is the problem here. Not knowing what is significant, I'll just give the whole output. CentOS 5 (freeradius-1.1.3-1.2.el5) still using default certificates so as not to complicate things too much yet. # radiusd -X -f Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 rlm_eap: No such sub-type for default EAP type peap radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. Can someone toss me a bone here? Craig

3 3

FreeRADIUS client + PAM integration
by Vinay 16 Nov '08

16 Nov '08

hi there, We are planning to use FreeRadius Client with PAM. Could you please give me the document/Links/FAQ explaining the integration of FreeRADIUS client with PAM? Thanks Vinay

2 1

FreeRADIUS + OpenLDAP + MSCHAPv2
by Tim Gustafson 16 Nov '08

16 Nov '08

Hello, I'm running FreeRADIUS on a shiny-new CentOS 5.2 machine. I'm trying to figure out how to configure FreeRADIUS to authenticate against an OpenLDAP server using MSCHAPv2. I Googled a lot of different phrases, and came up with some things that were mildly helpful. Right now, I have FreeRADIUS authenticating against the LDAP server without using MSCHAPv2, but I'm not understanding how to now activate the MSCHAPv2 part. Can anyone point me towards some information about activating MSCHAPv2 in this kind of setup? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 4

Referencing a redundant-load-balance set within users file
by Tod A. Sandman 15 Nov '08

15 Nov '08

Version: freeradius-2.1.1 I cannot get a redundant-load-balance set to work within a variable expansion in the users file. I added this to the bottom of the instantiate section of radiusd.conf: redundant-load-balance redundant_ldap { ldap1 ldap2 ldap3 } and this to the authorize section of sites-enabled/default: redundant_ldap and I defined the 3 ldap instances in modules/ldap, and this part works fine. But I cannot figure out how to reference redundant_ldap from within the users file. I tried Connect-Info = "%{redundant_ldap:ldap:///dc=rice,dc=edu?riceClass?sub?uid=%u}" but the debug output shows: WARNING: Unknown module "redundant_ldap" in string expansion "%{redundant_ldap:ldap:///dc=rice,dc=edu?riceClass?sub?uid=%u}" I attached the start of the debug output. The whole output was over the 100k limit. Tod Sandman Sr. Systems Administrator Middleware Development & Integration Rice University Voice: 713.348.5816

2 4

LEAP auth failure using hostapd-0.5.9 and freeradius-2.1.1
by Prasad Parab 15 Nov '08

15 Nov '08

Dear All, I trying to authenticate a wireless client using LEAP auth type and have configured the AP to use hostapd-0.5.9 as authenticator.as follows: wireless client <--------------> hostapd-0.5.9 <---------------> freeradius-2.1.1 windows-XP based authenticator Red Hat Fedora-9 user created is as follows in freeradius-2.1.1 "client" Cleartext-Password := "test123" Reply-Message = "Hello, client" Leap is enabled in eap.cnf. Also can see auth success in wireshark captures. Atttached is wireshark capture. Am i doing something wrong in configuring freeradius-2.1.1???? Regards Prasad

2 1

Re: Re: rlm_counter: Failed to open file /etc/raddb/db.daily:, Permission denied
by Romain Mercier 14 Nov '08

14 Nov '08

Hi, I got the same issue and I solved it modifying the file : /usr/local/etc/raddb/radiusd.conf I replaced the line : db_dir = $(raddbdir) By : db_dir = ${raddbdir} I use freeRadius 2.0.5 on a freeBSD 6.3 freeradius-users-request(a)lists.freeradius.org a écrit : > Message: 2 > Date: Thu, 13 Nov 2008 18:21:17 -0500 > From: Ted Lum <freeradius.org(a)tedworld.com> > Subject: Re: rlm_counter: Failed to open file /etc/raddb/db.daily: > Permission denied > To: Alan DeKok <aland(a)deployingradius.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <491CB66D.2080809(a)tedworld.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > The default user and group have not been modified. > The server DOES NOT run as root. It always starts as root, but changes > its self. > > ...from radiusd.conf > # We STRONGLY recommend that you run the server with as few permissions > # as possible. That is, if you're not using shadow passwords, the > # user and group items below should be set to radius'. > > They are: > > user = radiusd > group = radiusd > > In fact, the db.daily file was created by the application and this is > the sole reason for the file's ownership being what it is. > > In addition I have moved the location to /tmp where everyone has > permission and it still fails. > > This is a ps after "service start radiusd": > UID PID PPID C STIME TTY TIME CMD > radiusd 6909 1 0 Nov12 ? 00:00:00 /usr/sbin/radiusd > > This is a ps after "/usr/sbin/radiusd -X": > UID PID PPID C STIME TTY TIME CMD > radiusd 6998 6933 5 15:48 pts/0 00:00:00 /usr/sbin/radiusd -X > > This is a ps after "strace /usr/sbin/radiusd": > UID PID PPID C STIME TTY TIME CMD > radiusd 7004 1 0 15:50 ? 00:00:00 /usr/sbin/radiusd > > In all cases its running as radiusd. > > So, any more ideas on how to fix this? > > -Ted- > > Alan DeKok wrote: > >> Ted Lum wrote: >> >> >>> Any idea how to fix this? >>> >>> >> Don't edit the default configuration files to break them. >> >> The default configuration files have the server running as root. >> You've changed that to a user who does NOT have permission to read the >> configuration files. >> >> >> >>> Wed Nov 12 21:29:16 2008 : Error: rlm_counter: Failed to open file >>> /etc/raddb/db.daily: Permission denied >>> >>> >> ... >> >> >>> /etc/raddb >>> -rw------- 1 radiusd radiusd 12312 Nov 12 21:29 db.daily >>> >>> >> The server isn't running as user "radiusd/radiusd". Fix that. >> >> >> >>> This works: >>> # /usr/sbin/radiusd -X >>> >>> >> Becuse you're running it as root. >> >> >> >>> This works: >>> # strace /usr/sbin/radiusd >>> >>> >> Because you're running it as root. >> >> >> >>> This does not work: >>> # service radiusd start >>> Starting RADIUS server: [FAILED] >>> >>> >> Because it changes UID's, and does not run as root. >> >> Alan DeKok. >> >> >> > > > -- Romain Mercier Université d'Angers - Direction des Systèmes d'Infrormation Service Systèmes et Réseaux Tel/Fax : 02-41-22-67-62/51 @ : romain.mercier(a)univ-angers.fr

2 2