- Freeradius-Users - lists.freeradius.org

Create EAP TLS with Windows CA
by JasonBrown＠ferris.edu 18 Sep '08

18 Sep '08

Has anyone created certificates for EAP through a Windows CA? Thanks Jason Brown Systems Administrator Enterprise Technology Services Ferris State University (231) 591-2687

3 2

Fedora 9 EAP issue
by Casartello, Thomas 18 Sep '08

18 Sep '08

I have two servers with identical configuration and identical versions of freeradius, one running Fedora 8, one running Fedora 9. The Fedora 8 one works issueless, however with Fedora 9 I simply cannot get PEAP authentication to work with it. I am constantly getting this debug output: rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 User-Name = "tcasartello" Calling-Station-Id = "00-13-02-08-C8-B2" Called-Station-Id = "00-1F-9D-DB-94-40:s-wsc" NAS-Port = 29 NAS-IP-Address = 172.20.5.252 NAS-Identifier = "Chaplin_Controller_A" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "191" EAP-Message = 0x020100100174636173617274656c6c6f Message-Authenticator = 0x4079116973b9e650df19cf63def7d564 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tcasartello", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "tcasartello", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb276c10db274d82ffb970fb6bdf4b058 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 Sending duplicate reply to client chaplin-wism-a.wsc.ma.edu port 32769 - ID: 4 Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 172.20.5.252 port 32769, id=4, length=194 Sending duplicate reply to client chaplin-wism-a.wsc.ma.edu port 32769 - ID: 4 Sending Access-Challenge of id 4 to 172.20.5.252 port 32769 Waking up in 0.9 seconds. Cleaning up request 9 ID 4 with timestamp +377 Ready to process requests. Any suggestions on what I can do to try to debug this further? This happens on every version of FreeRADIUS I try so I have a feeling it's not directly a problem with freeradius perhaps some library broken or missing in Fedora 9. As I said in my fedora 8 box I have an identical configuration that works flawlessly. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

5 11

Download/use luser error
by Alex Moen 18 Sep '08

18 Sep '08

Hey all, I am having a problem connecting to a Cisco 10k. Here's the user: user(a)wherever.com Password == "ctdn" Service-Type = Framed-User, Framed-Protocol = PPP, Context-Name = "wherever.com", Cisco-Account-Info = "Andtc_512", Cisco-AVPair = "ip:addr-pool=wherever", Cisco-AVPair = "ip:vrf-id=WHEREVER", Cisco-AVPair = "ip:ip-unnumbered=loopback 1", Cisco-AVPair = "subscriber:sg-service-type=primary" When I test this, I get the following: radtest user(a)wherever.com ctdn 127.0.0.1:1812 10 testing123 Sending Access-Request of id 183 to 127.0.0.1:1812 User-Name = "user(a)wherever.com" User-Password = "ctdn" NAS-IP-Address = server NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=183, length=92 Service-Type = Framed-User Framed-Protocol = PPP Context-Name = "wherever.com" Cisco-Account-Info = "Andtc_512" Cisco-AVPair = "ip:addr-pool=wherever" Note that I don't get the last 3 "Cisco-AVPair" options. OK, I am running Version 0.9.3... Big deal! It's been working great for years until the network guy decided to change to the Cisco 10k. Anticipating a flood of "Upgrade, stupid!" e-mails, I decided to upgrade, just to see if that would help. So I downloaded the latest and greatest, gunzipped it (even tried the bunzip version), but when I try to untar the file, I get "tar: directory checksum error"... The 10k guy says that he can use this user config in his Steel Belted Radius server (actually kinda funny, he's a 10k guy using Juniper software)... Am I just using the wrong syntax that SBR fixes automagically? Any ideas? TIA, Alex

3 2

Unknown AVPs
by Jeffrey Sewell 18 Sep '08

18 Sep '08

I've got a FreeRADIUS server that takes in Accounting data that is proxied to it from another server. In the Accounting packets I see AVPs that are tagged "Unknown-Attribute." I assume that's because either the originating server or the FreeRADIUS server is missing a dictionary file/entry to identify the Attribute. First question: is that assumption correct? If so, who sets that Attribute, the originator or the target? And more generally: as these are written to the MySQL DB I see that they are pulled off the packet and stored as variables that are accessible in the sql.conf file for example: AcctSessionTime = '%{Acct-Session-Time}' Is that variable pulled directly from the packet? So that whatever attribute is in the packet, it will be named %{whatever} ? I've got other data coming in that I need to store in the SQL DB and suppose that I'll need to modify the sql.conf and the radacct table in order to get them in there. Any insights/thoughts/direction would be appreciated. Jeff

2 9

XP windows Validating identity blues
by scott woodard 18 Sep '08

18 Sep '08

Hi Everyone, I just followed the steps @ http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on… This is the output of radiusd -X -z [root@wifi ~]# radiusd -X -z Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "windose" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.0.201:2048, id=0, length=123 User-Name = "scott" NAS-IP-Address = 10.10.0.201 Called-Station-Id = "001d7e2fa43c" Calling-Station-Id = "0014a4439321" NAS-Identifier = "001d7e2fa43c" NAS-Port = 49 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173636f7474 Message-Authenticator = 0xc091f4c08c545d39e360712a422185d2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "scott" rlm_realm: Proxying request from user scott to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.0.201 port 2048 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 48d17a05 Nothing to do. Sleeping until we see a request. The windows box requests credentials for connection to the network. I am using scott passwd scott as listed in the users in radius directory. What I am missing ? Thanks in advance. Scott

2 3

redundant ippools using rlm_ippool in v1.1.3
by Matthias Witte 18 Sep '08

18 Sep '08

I am stuck with v1.1.3 in this case, otherwise I would use rlm_sqlippool. I need to assign IP addresses depending on the NAS the user comes in: 'huntgroups' contains lns0x NAS-IP-Address == a.b.c.x lns0y NAS-IP-Address == a.b.c.y In 'users' I set 'Post-Auth-Type' depending on 'Huntgroup-Name' (Userdata are in a MySQL database): DEFAULT Huntgroup-Name == "lns0x", Post-Auth-Type := LNS0X Fall-Through = Yes DEFAULT Huntgroup-Name == "lns0y", Post-Auth-Type := LNS0Y Fall-Through = Yes The modules section in radiusd.conf has the ippool definitions like # subnets on lns0x ippool lns0x-00 { range-start = 192.168.111.1 range-stop = 192.168.111.6 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0x_00 ip-index = /var/cache/freeradius/db.index_lns0x_00 override = yes maximum-timeout = 0 } ippool lns0x-01 { range-start = 192.168.111.9 range-stop = 192.168.111.14 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0x_01 ip-index = /var/cache/freeradius/db.index_lns0x_01 override = yes maximum-timeout = 0 } # subnets on lns0y ippool lns0x-00 { range-start = 192.168.112.1 range-stop = 192.168.112.6 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0y_00 ip-index = /var/cache/freeradius/db.index_lns0y_00 override = yes maximum-timeout = 0 } ippool lns0x-01 { range-start = 192.168.112.9 range-stop = 192.168.112.14 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0y_01 ip-index = /var/cache/freeradius/db.index_lns0y_01 override = yes maximum-timeout = 0 } My first attempt on the post-auth Section looked like Post-Auth-Type LNS0X { redundant { lns0x-00 lns0x-01 } } Post-Auth-Type LNS0Y { redundant { lns0y-00 lns0y-01 } } This does not work because the 'Pool-Name' check attribute is missing in users. If I set Pool-Name in users, addresses are only returned from the matching poolname module until it is depleted, the alternative pool module is not called. Is it possible to achieve the intended setup with rlm_ippool or is this only possible with rlm_sqlippool? Mit freundlichem Gru�, -- Matthias Witte - witte(a)netzquadrat.de Telefon: +49 (0)211-30 20 33-18 Telefax: +49 (0)211-30 20 33-22 [netzquadrat] GmbH - Gladbacher Str. 74 - 40219 D�sseldorf HRB D�sseldorf 36121 - Gesch�ftsf�hrer: Thilo Salmon, Tim Mois Steuernummer: 106/5719/1836, Umsatzsteuer-ID: DE246863050 billiger-telefonieren.de - billiger-surfen.de - stromseite.de - sms.de

2 3

Debugging access point behaviour
by Giovanni Lovato 18 Sep '08

18 Sep '08

First of all, this is not a FR problem. I use FR 2.1.0 and it works very well! BTW, I'm trying to configure an access point to authenticate against FR, but the process fails. Maybe someone here can tell me where is the issue, so I attach the log of FR... Some details: OS: Debian Lenny FR version: 2.1.0 Authentication backend: LDAP Authentication method: WPA2-EAP TLS Note: authentication works well with other access points. Thank you! -- Giovanni Lovato <giovanni.lovato(a)aldu.net>

1 0

Re: Re: No authenticate method (Auth-Type) configuration found
by Jason 18 Sep '08

18 Sep '08

>>This is a pap request. >>preprocess, chap, mschap, suffix, eap - no pap listed in authorize section. List it last. >>Ivan Kalik >>Kalik Informatika ISP Yes, There are pap section in the configure file. but have error, too. Now, I use another version of freeradius,1.1.7, and test, every thing is OK now！ Thanks!

1 0

No authenticate method (Auth-Type) configuration found
by browan.jason 18 Sep '08

18 Sep '08

Hi all, I have got some problems when use freeradius. freeradius version: FreeRADIUS Version 1.0.5, for host , built on Sep 9 2008 at 11:11:51 My system: Fedora core 4 Kernel version: 2.6.11-1.1369_FC4 When i test the radius server, I have add something into /usr/local/etc/raddb/users like this: test1 Auth-Type := Local, User-Password == "123456" User-Password =="123456", Service-Type=Framed-User, Framed-Protocol=PPP, Framed-IP-Address=192.168.121.99, Framed-IP-Netmask=255.255.252.0 Add this into clients.conf: client 192.168.121.43{ secret = mmmmmm shortname = remote nastype = other } Then start the freeradius server and use radtest to check this server: radtest test1 123456 192.168.121.49 0 mmmmmm 192.168.121.49 is my server's IP, My local machine IP address is 192.168.121.43. But, It always failed! Following is the client's information: Sending Access-Request of id 161 to 192.168.121.49:1812 User-Name = "test1" User-Password = "123456" NAS-IP-Address = freepp NAS-Port = 0 rad_recv: Access-Reject packet from host 192.168.121.49:1812, id=161, length=20 And radius server's debuf information: rad_recv: Access-Request packet from host 192.168.121.43:32768, id=161, length=57 User-Name = "test1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 161 to 192.168.121.43:32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 161 with timestamp 48d1f126 Nothing to do. Sleeping until we see a request. As you see, every time he told me "No authenticate method(Auth-Type) configuration found for the request......", I don't konw why? Could you please give me some help? Many Thanks! 2008-09-18 Jason Zhang

5 5

Authentication flow
by Sudarshan Soma 18 Sep '08

18 Sep '08

I have three authentication modules -- pam_radius_auth.so (for remote authentication) -- pam_unix ( unix local authentication) -- pam_opie (challenge/response) and other accounting modules such as pam_abl, which does user lockout/iplocking. I would like to choose a better authentication for access to my service: These are my requirements/clarifications: -- An intruder should not know how his authentication has failed(due to user locking or IP address locking or wrong passwd for remote authenticaon or for local authenticaion ), but only SecurityAdmin can see them in logs. Intruder just gets error as LOGIN failed. -- While logging to the service, should i allow user to specify authentication type such as challenge-response or local, if Radius servers are not reachable. Will this cause any kind of break in secure authentication process or does ti contrast with above. I am thinking of this to help legitimate users to get logged into the service I am kind of lost here, Can anyone please advise the better approach her. Many Thanks

2 1