- Freeradius-Users - lists.freeradius.org

minor prefix problem with 2.1.1 git
by Greg Woods 09 Sep '08

09 Sep '08

I tried to use a non-default prefix, and it craps out on "make install" because one of the sql-related files refuses to install in a directory name that didn't end with /usr/local/lib . I was able to work around this by using a --prefix like "/local/freeradius-git/usr/local" instead of just "/local/freeradius-git". A minor annoyance but I thought others might want to hear about it. At least the error message was clear enough that coming up with the workaround was easy. --Greg

2 1

Problems with the authentication TLS
by Martin Silvero 09 Sep '08

09 Sep '08

and install the new version and the probe, probe with radtest and I get this: Sending Access-Request of id 236 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "testing123" NAS-IP-Address = 10.30.1.104 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=236, length=20 its ok but... radiusd -X run and I get this:: FreeRADIUS Version 2.0.5, for host x86_64-unknown-linux-gnu, built on Sep 3 2008 at 17:32:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client 10.0.6.29 { require_message_authenticator = no secret = "testing123" shortname = "ap" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Generating a 2048 bit RSA private key ........................................................................................................................................................................................................................................................................................................+++ .....+++ unable to write 'random state' writing new private key to 'ca.key' ----- Generating a 2048 bit RSA private key .......+++ ..................................+++ unable to write 'random state' writing new private key to 'server.key' ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Sep 3 20:51:16 2008 GMT Not After : Sep 3 20:51:16 2009 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Sep 3 20:51:16 2009 GMT (365 days) Write out database with 1 new entries Data Base Updated unable to write 'random state' unable to write 'random state' MAC verified OK Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time *****************************+*************************+****************************** ... unable to write 'random state' Exec-Program output: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program-Wait: plaintext: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program: returned: 0 Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: cannot bind socket: Address already in use /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 0.0.0.0port 1812 Why is this wrong? I triyin with user root -- -- Silvero Martin

2 1

Two radius server on same machine
by Nataniel Klug 09 Sep '08

09 Sep '08

Hello all, I am trying to find some info about running two freeradius servers (on different ports) in the same machine. Can someone help me? I couldn't find any info... -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

5 5

Accounting Reporting Tools
by Sturgis, Grant 08 Sep '08

08 Sep '08

Greetings List, I am curious what people have done to report on the RADIUS accounting files. Are there packages out there that read and report on radacct files? Connections, denies attempts, etc? Thanks in advance, Grant -------------- Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

Unknown value specified for Post-Auth-Type
by Nataniel Klug 08 Sep '08

08 Sep '08

Hello all, I am running new 2.0.5 freeradius with mysql... This is running fine. I am trying to configure virtual servers but this is another question. I am testing this new version and I found this log (using radiusd -X): auth: Failed to validate the user. Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 138 to 127.0.0.1 port 44881 Mikrotik-Rate-Limit = "100k/200k 200k/400k 80k/160k 180/180 8 60k/120k" This only occurs when my client tries to authenticate using wrong password. The Mikrotik-Rate-Limit should only be sent when a client uses right calling-station-id, username and password. Anyone know how to make this option do not be sent when there is an error in client password? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

2 3

Re: Freeradius Usage
by Jesse Stone 08 Sep '08

08 Sep '08

Would Freeradius be the correct technology for this? For example, Currently, for me to allow someone access to my OpenVPN server and Samba I have to first add them as a standard user with the useradd script. Then I have use smbpasswd -e to enable their account for Samba. If I wanted that user to also be able to SSH into another server I would have to repeat this process. After about 3 users I forgot who has access to what. This is the process I want to simply. I want 1 place/script that prompts for every app/server that I want to restrict access to: Samba, SSH, Shell access, X, ect. I want this infromation stored in a standard SQL type database though so I can easilly manipulate users once they've been created on the fly. Perferrably within 1 table like a provided in my last email for an example simple user management style. What do large companies that have many users/linux machines use to handle user administration? -Jesse On Fri, Sep 5, 2008 at 5:30 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at>wrote: > It is a tricky concept, but it can be done with a lot of effort. Probably > not for all applications ( since it doesn't make any sense for some of them > ). Maybe you should consider making a real network DMZ. The concept of DMZ > allows you to define and allow/disallow access to services from the Internet > and those from the local LAN. You DO NOT make things or services available > "to the DMZ" ! > > > > Start simple ! > > > > Regards, > > E:S > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:50 > *To:* FreeRadius users mailing list > *Subject:* Re: Freeradius Usage > > > > Thank you for the quick response. I may not have mentioned this previously > but I am by no means a linux/networking expert. The company I work for is > pro-MS. Recently, I got the urge to get back into Linux and here I am. > > > > My thinking (in regards to network structure) was that I wanted > applications intended to the public as far away from my local lan as > posible. The local lan requires the app server though- OpenVPN, Samba (as > a PDC), misc other things so I wanted it available to the local lan but not > to the DMZ. > > > > My main questions though are with Freeradius. My setup is for "hobby" > purposes only and already I would have difficulty telling you exactly which > users have access to what. > > > > I want to using a technology like Freeradius or LDAP create 1 central place > on the app server that EVERYTHING would authenication to. In a perfect > world, the end result would be that I could type something like this: > > > > select %user% from permissionsDB > > > > and be returned something like this: > > > > SSH: NO, OpenVPN: YES, Samba: %Specific group% (which indicates shares > available), Shell Access: No, ect > > > > Basically, I want a setup where I can easilly scale upwards without having > to "teach" each new application how to use a DB. Freeradious also can > authenicate my wireless users when would also be great as for all I know, > half my bandwidth is being used by my neighbors. > > > > -Jesse > > On Fri, Sep 5, 2008 at 4:34 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at> > wrote: > > Hi, > > > > excuse me for asking, but why dont you set up the AppServer in your DMZ ? > you could have ( what I call ) the T – structure > > > > >< --- INTERNET --> GATEWAY ( server1 ) <---> LOCAL LAN > > I > > I DMZ > > I > > SERVER2 + APPServer > > > > It depends how your users use the gateway and how are they suppose to > connect to the Internet. > > > > Regards, > > E:S > > > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:25 > *To:* FreeRadius users mailing list > *Subject:* Freeradius Usage > > > > Hi All, > > > > I am new to this mailing list and am about to ask a probably very silly > question. Please feel free to direct me to resources that'll help me answer > them. > > > > I want to setup the following: > > > > Gateway [server1] > > - nic1 = Internet > > - nic2 = DMZ [server2] > > - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS > SERVER HERE) -> Local Lan > > > > I read a lot about both Freeradius and LDAP and cannot determine if either > can accomplish my goals. > > > > What I want is: > > > > 1) 1 central place where all user authenication takes place: SSH, Shell > Access, Samba, OpenVPN, Mumble, Any other app that requires user > administration. > > 2) This information stored in a SQL type database so that I can build my > own custom apps to report on user usage, performance ect. > > 3) My router has wireless and I have enabled the security features. I > would still like authenication to take place before a wireless user is > allowed on the network. > > > > For example, > > > > Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local > Lan > > > > I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan > > > > Is Freeradius the best approach for my needs? Do I need anything else? > > > > -Jesse > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 6

Can´t compile version 2.1.0 !
by Jose Franco Jr 08 Sep '08

08 Sep '08

Hi, I downloaded the new version 2.1.0 but I cannot compile it. ./configure runs fine but when I run make I got the following error: gmake[4]: Entering directory `/usr/local/src/freeradius-server-2.1.0/src/main' /usr/local/src/freeradius-server-2.1.0/libtool --mode=link gcc -o radmin radmin.lo gcc -o radmin .libs/radmin.o .libs/radmin.o: In function `main': /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:117: undefined reference to `using_history' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_insert' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_bind_key' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:176: undefined reference to `readline' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:185: undefined reference to `add_history' collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-server-2.1.0' make: *** [all] Error 2 I´m using Linux Slackware 12.1. On this same machine I have version 2.0.5 working and compiling fine. I already try to compile in another machine and have the same error.

2 1

Freeradius not always denying invalid users
by Chris Moss 08 Sep '08

08 Sep '08

We've been running Freeradius for a long time without any issues. We typically turn a customer off by changing the password in the passwd file. We use the passwd file for authentication. The issue is intermittent the customer is DSL so they will try to log in for a couple of hours constantly before being allowed to connect. Once the connect reseting their dsl connection forces them to login again. It will fail at this point, like it's supposed to. First before I get into posting any configs or that detail, has anyone else had similar problems? Also, the logs sometimes show invalid shell with part of the passwd file. Not necessarily the actual shell portion though. It may show the home directory, or the shell, or even part of one of those such as "/bin/fal" -- Chris Moss

3 11

Re : CA certificates
by Jehan PROCACCIA 08 Sep '08

08 Sep '08

Eshun Benjamin a écrit : > Could please send your log message when the user with the > it-master-class1 in it's CA list tries to authenticate > > ================================================== > > Benjamin K. Eshun OK here are the logs in order to further investigate. first the radiusd start in debug mode: $ /usr/sbin/radiusd -X FreeRADIUS Version 2.0.3, for host i686-redhat-linux-gnu, built on Jun 3 2008 at 19:30:19 radiusd: #### Loading Virtual Servers #### ... server { ... Module: Instantiating eap eap { default_eap_type = "ttls" ... Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radiux-pkiit-2008.key.pass.pem" certificate_file = "/etc/raddb/certs/radiux-pkiit-2008.pem" CA_file = "/etc/raddb/certs/ca-chain-institut-telecom_long.crt" private_key_password = "secret" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = "%{Stripped-User-Name:-%{User-Name}:-none}" cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes } ... } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Then, when a windows secureW2 users which checks certificates (cf .jpg attached) try to authenticate without success rad_recv: Access-Request packet from host 157.159.27.100 port 32768, id=225, length=209 User-Name = "anonymous(a)it-sudparis.eu" Calling-Station-Id = "00-1F-3C-59-5E-52" Called-Station-Id = "00-1F-9D-22-72-E0:eduroam" ... rlm_realm: Adding Realm = "it-sudparis.eu" rlm_realm: Authentication realm is LOCAL. ... ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 50 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fc], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 226 to 157.159.27.100 port 32768 EAP-Message = 0x0104040015c000000759160301004a02000046030148c4d73e9a1754c3d2321f1820840f38a8e62c3e4ca0ef122375dc1f94f28bf92005603c95ef0eb1d835531cea0ffd11b033d8e8ff7ba7227a45460aed42b7e54b000a0016030106fc0b0006f80006f50006f2308206ee308204d6a00302010202014d300d06092a864886f70d01010505003081a2314330410603550403143a54454c45434f4d2026204d616e6167656d656e7420537564506172697320636c6173733320436572746966696361746520417574686f7269747931263024060355040b141d54454c45434f4d2026204d616e6167656d656e74205375645061726973312630240603 EAP-Message = 0x55040a141d54454c45434f4d2026204d616e6167656d656e74205375645061726973310b3009060355040613026672301e170d3038303532373135323931335a170d3039303532373135323931335a308186310b30090603550406130266723110300e060355040813074573736f6e6e65310d300b060355040713044576727931273025060355040a131e54656c65636f6d206574204d616e6167656d656e74205375645061726973310d300b060355040b130473326961311e301c060355040313157261646975782e69742d73756470617269732e657530819f300d06092a864886f70d010101050003818d0030818902818100c01f06db2f842d54 EAP-Message = 0x78a307eae5f0796e31384a4e9162a81923f9958d3dd20364727bae95f6f5edf404b2c767836906a705a409fe65d95826134c8f90d479939e51059634a503cc5b942c6df13a8e378c2979573b9e19d000e3d0ff37e3cc9621d3a08507d0c1e5b156ab2b0ec7f18641ccd15886b2571ed5d84d7005f835959b0203010001a38202cb308202c7301106096086480186f8420101040403020640300b0603551d0f0404030205e030130603551d25040c300a06082b06010505070301303e06096086480186f84201040431162f687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f63726c2d76312e63726c301d06 EAP-Message = 0x03551d0e04160414e5b49fb229de0a48baf59832e0fbeecdba10a6ce3081a50603551d2304819d30819a8014c060d15966db10cb580bfc55a60cb9323c6be3a1a17fa47d307b313630340603550403132d496e7374697475742054454c45434f4d20636c6173733220436572746966696361746520417574686f7269747931193017060355040b1310496e7374697475742054454c45434f4d31193017060355040a1310496e7374697475742054454c45434f4d310b3009060355040613026672820101304906082b06010505070101043d303b303906082b06010505073002862d687474703a2f2f63612e69742d73756470617269732e65752f706b EAP-Message = 0x692f544d53505f43412f6974 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93e1b6b492e5a31188c469ba2a413593 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 157.159.27.100 port 32768, id=227, length=204 User-Name = "anonymous(a)it-sudparis.eu" Calling-Station-Id = "00-1F-3C-59-5E-52" Called-Station-Id = "00-1F-9D-22-72-E0:eduroam" ... ... 2nd time !?, the same treatment I presume ? ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 227 to 157.159.27.100 port 32768 EAP-Message = 0x0105036d15800000075963612e63727430400603551d1f043930373035a033a031862f687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f63726c2d76322e63726c30819c0603551d2004819430819130818e060429010101308185303406082b060105050702011628687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f435053304d06082b0601050507020230411a3f4c696d69746564204c696162696c6974792c2073656520687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f435055303d0603551d120436303481 EAP-Message = 0x1761646d696e706b694069742d73756470617269732e65758619687474703a2f2f7777772e69742d73756470617269732e6575301e0603551d11041730158113733269612d69737240696e742d6564752e6575300d06092a864886f70d010105050003820201009face565aceeac5212003ac162156be138cd6db700d4faa3113d50d0ea3f55e476817b9aaae953d8f832e1819f8469a9a5561f886f1aab1ffc9d48ffd39875546b3f59c7ccde6c165d454b190c439c89ee7e4ab5cdc5b1c138bb321428fa001e0fbb1a5a05f4ebba8300ff65ae797efa9f3b52a90a2b41b37243183a27d2ad8f0cb90f37e01cd3e4f4ac56e440b1a53cf73930d7ccc4 EAP-Message = 0x68822683b7c1f799223295c1c90ae1e9b993b7d30c9c53ae70bd64cd6d199f0da5c5ea995300bc53cf3f356650e79d304a59e32253e8e8ca93e284d8ae36e4976ed2db03ae165c9e01d850fff552a942f4391d05bb706279bcb1273e6d0e4355a50623e636403993f399fb758cb2bf5eb475e09dfc2a037b26a14514e714aab53398099386cb60a20b101eac27c82fe95b1cd4ab6426aaac13c1bbf0c3775d418e15c5996c8131831f30a0e1f3753ea7723ae15daaa17b20163a548a6adff64b77f5df43ca602bf2e0757736eb0641d483345f8fc0cdaecf0430f75eaf0f14708d692572f7f50da4c68bdd0215510601c7f9fed39a98995a6821a4be3e EAP-Message = 0x6896ec0b08a33450a6c348bbef00fcbd4d99de83b82cc4bdcd8e911d9e93591cac98600aff37f04ed6608d239a46f5b2ea7be3faaaec1448839e201c4c1b1a45fcc54e753ec11ff1c3f2399348cfb9b2a78afcc29604d0543cb496bd74c67e81ab8c20c2c3d58001cb0f801ec816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93e1b6b491e4a31188c469ba2a413593 Finished request 8. Going to the next request Waking up in 4.9 seconds. ... Cleaning up request 6 ID 225 with timestamp +534 Cleaning up request 7 ID 226 with timestamp +534 Cleaning up request 8 ID 227 with timestamp +534 Ready to process requests. The client receives the second .jpg attached "received an invalide server certificate" . Again, I wonder on my eap.conf directives: certificate_file point to our radius SSL-server certificate => CN=radius.it-sudparis.eu but what the CA_file should point to in our case ? the it-master-class1 CA root certificate ? the it-ca-class3 CA which signed our radius server ? a bundle of the 3 CA (as it is now !) ? , in which order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA files (by these I mean only what is between --BEGIN CERTIFICATE-- and --END CERTIFICATE-- or plus the "blabla" above ) ?. Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could be used, but in that case radiux-pkiit-2008.pem should contain the radius server certificate + a bundle of the 3 CA, in which order ? short or long ? ... thanks for your help. > > > ----- Message d'origine ---- > De : jehan procaccia <jehan.procaccia(a)it-sudparis.eu> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Vendredi, 5 Septembre 2008, 17h49mn 32s > Objet : CA certificates > > hello, > > we are running our own PKI with a 3 level hierarchy: > it-master-class1(self-signed) -> it-ca-class2 -> it-ca-class3. > > it-ca-class3 signed our radius server (radiux-pkiit-2008.pem) > In eap.conf file in the tls section I have > tls { > private_key_password = secret > private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem > certificate_file = ${certdir}/radiux-pkiit-2008.pem > CA_file = ${certdir}/ca-chain-institut-telecom_long.crt > } > unfortunaltly, securew2 windows clients configure to check certificates > and having it-master-class1 in it's CA list don't accept our TLS > security :-( . It tells that it received a bad certificate from the > server !?. > > I wonder if I didn't made a misconfiguration in radiusd/eap/tls section > above . > certificate_file point to our radius SSL-server certificate > CN=radius.it-sudparis.eu > but what the CA_file should point what in our case ? the > it-master-class1 CA root certificate ? the it-ca-class3 CA which signed > our radius server ? a bundle of the 3 CA (as it is now !) ? , in which > order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA > files (by these I mean only what is between --BEGIN CERTIFICATE-- and > --END CERTIFICATE-- or plus the "blabla" above ) ?. > Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could > be used, but in that case radiux-pkiit-2008.pem should contain the > radius server certificate + a bundle of the 3 CA, in which order ? short > or long ? ... > > You see I have lots of possibilities and interogation !. > > I'am much more used to configure SSL in apache ssl.conf, to me it is > clear as the directive are self explained : > SSLCertificateFile /etc/pki/tls/certs/server-2008.pem > SSLCertificateKeyFile /etc/pki/tls/private/server-2008.key > SSLCertificateChainFile /etc/pki/tls/certs/ca-chain-institut-telecom.crt > SSLCACertificateFile /etc/pki/tls/certs/itrootca-class1.crt > in eap.conf I don't see any distinction between the httpd equivalents : > SSLCertificateChainFile and SSLCACertificateFile > I also use openssl s-client to test my servers certs setting > openssl s_client -host mutuel.it-sudparis.eu -port 443 > But I cannot do the same for radius ? openssl s_client -host > radius.it-sudparis.eu -port 1812 => socket: Connection refused :-( . > > Thanks for your help . > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FR 2.1.0 rpmbuild error on SLES10SP1
by Graham Marsh 08 Sep '08

08 Sep '08

Hi, I understand an update to 2.1.0 will be out this week, but just letting you know that when running rpmbuild on the above platform, get the error as follows: Installed (but unpackaged) file(s) found: /usr/sbin/radmin Going by previous experience, I am guessing a tweak needs to be applied to the .spec file in the suse folder but I'd prefer to leave it to the experts as to exactly what. Regards GM

1 0