- Freeradius-Users - lists.freeradius.org

Username Rewrites based on Hint / Realm
by Javier Fox 16 Oct '08

16 Oct '08

Hi folks, I have a bit of a conundrum trying to implement FreeRadius for a system where users from multiple ISP names must all authenticate in the same place, and I'm hoping a more experienced user can shed some light. In a nutshell, I need to do the following: -Check the 'called-station-id' of an incoming RADIUS request -If the id is A, B, or C, set a hint/realm flag to "alpha" -If the id is D, E, or F, set a hint/realm flag to "beta" -If the id is anything else, set a hint/realm flag to "gamma" -Based on the value of the hint/realm flag, rewrite the username before attempting authentication (by adding '@ispname1', '@ispname2', etc.) -Conversely, if the username already looks like 'user@ispname', leave it alone For completeness' sake, I'm performing the authentication against a Postgres database. In its current state, the system is able to happily authenticate users as long as the username is provided in the format "username@ispname"; otherwise they are rejected. Our old RADIUS system (using Radiator) appears to call a perl script to perform this username rewriting, but that just seems like a nasty hack that I'd prefer to avoid. Any advice on this would be immeasurably appreciated. Thanks, J. Fox

4 11

Error in the negotiations certificates
by Martin Silvero 16 Oct '08

16 Oct '08

I know, but what he does not understand is how to referee when you talk about "cabundle" because what I have in / cert are the certificates that I made in the steps of README, which I did not serve for windows, that the back to delete? when I run the command openssl x509-inform PEM-in-outform DER ca.pem-out ca.der, nothing changes, run and I created a "ca.der," what amount to the notebook and again gives me the same error. log: Sending Access-Challenge of id 190 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b44160301004a02000046030148f7681908289a36972e0c3b15b0d971036bbe355b9d493d5a4fced4e392e7792010d59ced27c0ac19921ee9205fcc168bbcd8e2e324c80acc31fd8076d8ecc48000390016030108390b000835000832000396308203923082027aa003020102020101300d06092a864886f70d010104050030818c310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c060355 EAP-Message = 0x04031315436572746966696361746520417574686f72697479301e170d3038313031303134353031385a170d3039313031303134353031385a3073310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100bacfd3d0fa48b30002182ca8ac9a31672b4ad7dcd6b45d7df598774e7af3c4d6cd46447144260ae3daac561a93e7 EAP-Message = 0xd97d8a9889591b5cd3cf6924d4dc5aaa78a8013bde946b633e51abb4b6150fbe66a8743dd34a887f5c731a685c811c5660ba3d68abd028679464d28af4171dea0a3e99a80ba7b75c10d3c5480a319ea9b9ca6a9d14536b6524eb6f559b10f8f326d612836e88d2b28e03a574ede8b7a7bfdde0a7846543a713bb279c81bb681e50609c10ca2b2f5b6b4b2c1683c9a60ae8c7121ce2a81fc124189d4f356dee804a45b49f71547f788006bc247c65a98e81c2359cc537ef1c65d8137aa6cf6b2aff605d4da97c7a5abad17885608d027ddc370203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104 EAP-Message = 0x050003820101008c4607f2629625d8c81fce1a7e3afddd78428b75078cd3d8e56f27c48c18af5aa4bd56bc0cb18b750abdaf2d2c275f280a10f96b7768982115fde0abe0f0efa32fc684ce1d15512346aae7e8bef802a06b2f4b5013614208f5d32916532e9ba00b2a24da3cf20fdd7137b6792b80a508b0ccd5781446eed07f2afe8b132818d4e82c94200f8561b80f55550f9eb8db6cdb5ad6efa0588cfd3bcfbdfd329ce85ccf598ffdc95d5b06a4b7e2ef5b77fb895acf66969780419bdc0c8c0ecfe9d3978ffafcde51868b257f8c14cf2669cce1d7a6c4b0a3868e9bfff3408d694f2250ff3b9e730ceed97d84e6f21e80062326d63c771a946d EAP-Message = 0x4d7692a192d9ca4b95110004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfec434f0fcc03929b80b395aebf61421 Thu Oct 16 13:13:13 2008 : Debug: Finished request 142. Thu Oct 16 13:13:13 2008 : Debug: Going to the next request Thu Oct 16 13:13:13 2008 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=191, length=151 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xa1b889b6c699680d2ff044a1cc9a3ba6 EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 1194 State = 0xfec434f0fcc03929b80b395aebf61421 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" Thu Oct 16 13:13:13 2008 : Debug: +- entering group authorize Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[preprocess] returns ok Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[chap] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[mschap] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_realm: No '@' in User-Name = "cert", looking up realm NULL Thu Oct 16 13:13:13 2008 : Debug: rlm_realm: No such realm "NULL" Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[suffix] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: EAP packet type response id 4 length 6 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[eap] returns updated Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling unix (rlm_unix) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from unix (rlm_unix) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[unix] returns notfound Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 143 Thu Oct 16 13:13:13 2008 : Debug: users: Matched entry cert at line 76 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[files] returns ok Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[expiration] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[logintime] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[pap] returns noop Thu Oct 16 13:13:13 2008 : Debug: rad_check_password: Found Auth-Type EAP Thu Oct 16 13:13:13 2008 : Debug: auth: type "EAP" Thu Oct 16 13:13:13 2008 : Debug: +- entering group authenticate Thu Oct 16 13:13:13 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: Request found, released from the list Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: EAP/tls Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: processing type tls Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: Authenticate Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: processing TLS Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: ack handshake fragment handler Thu Oct 16 13:13:13 2008 : Debug: eaptls_verify returned 1 Thu Oct 16 13:13:13 2008 : Debug: eaptls_process returned 13 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[eap] returns handled

2 1

CERT Question
by Charles Plater 16 Oct '08

16 Oct '08

I have freeradius 2.0.5 successfully authenticating 802.1x via MSChapV2. I am trying to use a signed SSL certificate, that is signed by a CA w/ a chained CA certificate (from ipsca.com) I assumed that using a CA signed cert would do away w/ the errors on connection from WPA2 / 802.1x client, but it seems I'm wrong, or I have requested the cert with the incorrect CN. Are there any instructions on using a valid SSL cert so that users are not prompted to verify the cert on first connection? I have looked at the README in the certs directory, and I tried a self signed cert, which gave the same error. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189(a)wayne.edu

2 3

Error in the negotiations certificates
by Martin Silvero 16 Oct '08

16 Oct '08

Do you referred to this line? ca.der: ca.pem openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der

2 1

Help on Users file, Group name and Pool-Name
by Xiaochen Jing 16 Oct '08

16 Oct '08

Hello all, I encountered a strange problem while editing "users" file. I have Freeradius 2.0.5 and MS SQL working together. When a request coming in, Freeradius forwards it to MS SQL for authentication of username and password, and Freeradius reads Group Name attribute saved in MS SQL. My goal is to have each username associated to a Group Name. Then based on Group Name, Freeradius decides what IP pool to use, and choose the proper Pool-Name attribute. So in "users" file, I created the following: DEFAULT Group := "doctor", Pool-Name := "julienne"-----------------line133 Group := "dentist", Pool-Name := "netplus"-----------------line134 Group := "staff", Pool-Name := "staffnet"-------------------line135 When I execute Freeradius, I got the following error: /usr/local/etc/raddb/users[135]: Syntax error: Previous line is missing a trailing comma for entry DEFAULT root@Server1:/usr/local/etc/raddb# Errors reading /usr/local/etc/raddb/users /usr/local/etc/raddb/radiusd.conf[1085]: Instantiation failed for module "files" /usr/local/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } Errors initializing modules It seems we need a comma at the end of the line which is not right for check items. So instead of doing that, I changed the sentenses to the following, in "users" file: DEFAULT Group := "doctor", Pool-Name := "julienne" DEFAULT Group := "dentist", Pool-Name := "netplus" Group := "staff", Pool-Name := "staffnet" This time everything works just fine. I successfully execute Freeradius, and for every user in either of the three groups, Freeradius uses proper Pool-Name to fine IP pool, and user gets a proper IP address falling into that pool. So can anyone shed some lights on this? Why it returns two results after I do that change? Seems DEFAULT can only have two lines? Thanks in advance XJ

2 1

Error in the negotiations certificates
by Martin Silvero 16 Oct '08

16 Oct '08

Good day, I was watching the file cert/Makefile to be able to solve my problem but the truth is that according to what I saw I could not understand must be done to achieve conversion certificates, is it a script? tell me if I am wrong: XP does not rely on the certificate then we must convert, following the information / Makefile, once you have the import licenses ed to the user. Are these certificates are with the .der and .p12 ?

2 1

data volume
by mike 16 Oct '08

16 Oct '08

hi how can i reject a user if his datavolume is reached? (some attribute in radreplay?) all users are stored in mysql.

4 3

GCC
by Casartello, Thomas 16 Oct '08

16 Oct '08

Are there any known issues with Free RADIUS and GCC 4.3.0+? I've never been able to get freeradius working quite right in Fedora 9 and I was wondering if it's because of the new GCC version. Thomas E. Casartello, Jr. Wireless Network Technician Linux Specialist Information Technology Westfield State College Westfield, MA 01086 (413) 572-8245

3 3

errors on starting deamon
by Noel Rwamatsika 16 Oct '08

16 Oct '08

hi there, i have the following error when i try to start the free radius daemon: roke-billing:/home/noel # rcfreeradius start Starting RADIUS daemon radiusd: Error: No log destination specified. startproc: exit status of parent of /usr/sbin/radiusd: 1 failed I have specified the log destination in the radius.conf file as /var/log/radius when i check the log, this is what i see Fri Oct 17 00:48:57 2008 : Error: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory Fri Oct 17 00:48:57 2008 : Error: rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem Fri Oct 17 00:48:57 2008 : Error: rlm_eap: Failed to initialize type tls Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Fri Oct 17 00:48:57 2008 : Error: Errors initializing modules looking forward to your help regards, Noel

2 3

dynamic dns in radius?
by Karl Auer 16 Oct '08

16 Oct '08

Hi all. We have a very broken NAS - it basically only half-understands realms. If I log in with "john@ream", it will send "john@realm" off to the RADIUS server, which authenticates just fine, but the NAS will then try to register "johnrealm" via dynamic DNS. So this is not a RADIUS issue, it's an issue with how this NAS handles dynamic DNS updates. There is no way to make the NAS behave differently, though enhancement requests and bug reports have been lodged in hopes of better behaviour in a future release of the NAS OS. So I was wondering whether there is any practical way to get the RADIUS server to do the dynamic DNS instead. I found this from 2002: http://marc.info/?l=freeradius-users&m=106947389429225&w=2 And this thread from 2004: http://lists.cistron.nl/pipermail/freeradius-devel/2004-July/007357.html ... but I see no mention of a DDNS module in the current distribution, nor in the docs (though I admit I may well have missed it, there are a lot of docs). Is there such a module? Or has anyone already implemented DDNS from within FreeRADIUS, perhaps by writing an executable script such as suggested by Alan in 2002? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 5