- Freeradius-Users - lists.freeradius.org

Invalid EAP Type with Catalyst 2960G IOS 12.2
by nf-vale 29 Jul '08

29 Jul '08

Hi all, I'm having a little trouble configuring a Cisco Switch - Catalyst 2960G IOS 12.2 to work properly with EAP-PEAP clients. I've tested the same radius configuration (freeradius 2.0.2) with an HP Procurve 2626 Swicth and all worked just fine. Windows XP clients can authenticate with PEAP successfully. The same clients connected to the Cisco Swicth that it's authenticating in the same freeradius server can not authenticate because freeradius is trying EAP-TLS instead of EAP-PEAP: Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1 port 1645, id=1, length=129 User-Name = "al00005" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1E-BD-62-B9-81" Calling-Station-Id = "00-1B-38-92-39-A0" EAP-Message = 0x0206000c01616c3030303035 Message-Authenticator = 0xb8fb13899c9df58f7770efaeeeb9eb1a NAS-Port-Type = Ethernet NAS-Port = 50001 NAS-IP-Address = 192.168.2.1 +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "al00005", skipping NULL due to config. ++[suffix] returns noop rlm_realm: No '\' in User-Name = "al00005", skipping NULL due to config. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 6 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[mschap] returns noop expand: %{Stripped-User-Name} -> expand: %{User-Name} -> al00005 expand: %{%{User-Name}:-none} -> al00005 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-none}} -> al00005 rlm_sql (sql): sql_set_user escaped user --> 'al00005' rlm_sql (sql): Reserving sql socket id: 0 expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'al00005' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'al00005' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='al00005' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'Alunos' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): User found in group Alunos expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'Alunos' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[files] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.1 port 1645 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x010700061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12f8640712ff7d8ac69a15b3712e899e Finished request 3. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 3 ID 1 with timestamp +501 Ready to process requests. Does anybody have a clue on how to solve this problem? Is it a IOS (version 12.2) problem? Thx, Nelson Vale

3 5

Seek through several RADIUS severs without realms
by Ronen Kfir 29 Jul '08

29 Jul '08

My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

freeradius crashing issue - malloc failures?
by Ryan Pugatch 28 Jul '08

28 Jul '08

Hi everyone, I seem to be having a problem with FreeRADIUS crashing. This time, it crashed on Saturday. I noticed it was down this morning and was able to bring it back up. This time difference allowed me to go through the log and see what happened when it crashed on Saturday. Here's the snippet from the log.. I'd appreciate any assistance in debugging this issue. Sat Jul 26 09:13:15 2008 : Error: TLS_accept:error in SSLv3 read client hello C Sat Jul 26 09:13:15 2008 : Error: rlm_eap: SSL error error:140A1041:SSL routines:SSL_BYTES_TO_CIPHER_LIST:malloc failure Sat Jul 26 09:13:15 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:13:15 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:14:20 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:16:55 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:19:30 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:20:05 2008 : Error: TLS_accept:error in SSLv3 read client hello C Sat Jul 26 09:20:05 2008 : Error: rlm_eap: SSL error error:140A1041:SSL routines:SSL_BYTES_TO_CIPHER_LIST:malloc failure Sat Jul 26 09:20:05 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:20:05 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:22:10 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:22:10 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:22:10 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:22:45 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:22:45 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:22:45 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:23:50 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:24:25 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:24:25 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:24:25 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:26:36 2008 : Error: Discarding duplicate request from client aruba:32794 - ID: 243 due to unfinished request 991655 Thanks, Ryan

3 5

realm question
by Jeff Crowe 28 Jul '08

28 Jul '08

Hi there, I have a question about prefix realms and stripping them. I have a provider that allows roaming dialup for our customers. They require the username to be in a format of idm/something/username. I get the whole idm/something/username delivered to me as the authentication. I have tried using the IPASS prefix to remove the idm/something, but it just returns the realm of idm and I am still left with stripped-user-name of something/username, I have also tried just adding a realm of "idm/something" to the proxy.conf and it didn't work. I am currently running freeradius 2.0.5 with a SQL (mysql) back end. Can I strip the "idm/something/" somehow? Thanks, Jeff.

2 2

clients.conf - identifying a "client" - sql/ldap
by Johan Meiring 28 Jul '08

28 Jul '08

Hi, I have the following setup. Various clients (chillispot) behind broadband (read: dynamic IP) connections. Basically I am selling AAA services. I would like to authotize a nas to use my services in the first place by using the NAS-Identifier and the radius secret. Both the NAS SQL table and the clients.conf file seem to identify the client by IP address. As my clients can be from ANY address, it seems that the only way is to create an entry in clients.conf is as follows: client 0.0.0.0/0 { shortname = myclient secret = abcde } This now implies again that all clients have to have the same secret. I am using the perl modules, but according to another post you cannot use perl as replacement for clients.conf. Also the sql nas table simply mimics the clients. (I.e. still uses IP address to find entry). Is there any way to handle clients with dynamic IPs, and use the NAS-Identifier and radius secret to allow/disallow the NAS? Thanks! Cheers, Johan Meiring Cape PC Services CC / Amobia Communications Tel: (021) 883-8271 / (0861) AMOBIA Fax: (021) 886-7782 / (0861) AMOFAX

1 0

adding wimax services
by Tamanna Afroze 28 Jul '08

28 Jul '08

I want to add wimax services in the freeradius server. I need help in this regard. Help me for starting adding services. -- Tamanna Afroze afroze85(a)gmail.com tamanna.afroze(a)csebuet.org Member, Research and Development Group Commlink Infotech Ltd.

2 1

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 28 Jul '08

28 Jul '08

Ok, now we know what not to do at all. we are still wondering what we have to do. - if bootstrap works at your side,there isno reason that it doesn't work at our side: we didn't change nothing on this file, but follow the /etc/raddb/certs/REDME file... hope we will togheter figure rhe problem out . ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 27 Juillet 2008, 19h42mn 23s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Reveal MAP wrote: > Yes, Alan, we already now that thedefault config do works! my mind: > freeradius (in our case, sergio and me) is correctly configured. But, we > encounterd a problem showing no error message. so to make the log > slimmer, why not deactivate some non mandatory module in our scenario?? > so the output will show the strict necessary information... Because editing the config files when you don't know what they do is almost always a bad idea. Recommending that *other* people edit the config files when you don't know what they do is *very* much a bad idea. You are actively confusing people, and making it harder for them to solve their problems. > eg: PAPi don't need PAP module at all to figure out the problem of > PEAP/mschapv2 and Active Directory. > > and Another question Alan: did you test the bootstrap scrip in windows > and can you tell us how it works at your side please? how do you find > the certificatuion chain!!! It works for me. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

freeRADIUS Expiration attribute and unix-time stamp
by Jeep Or Die 28 Jul '08

28 Jul '08

Hello Everyone. I am new to *nix in general, and so when I ran across unix-time for the first time, I took the time to read up on it. I have created a wifi captured portal system using freeRADIUS, Mysql and Open BlueDragon, but I am having a problem with the Expiration attribute in freeRADIUS. Admittedly, the problem is probably DEU (defective end-user), so I am hoping someone here can help me out. Do I have to use the Unix-time for the Expiration attribute, or do I have a more human-readable option? I tried various standard database and programming timestamp values, but freeRADIUS always returns a "can't parse date" error whenever I use anything but unix-time. If I must use unix time, which I understand is GMT zulu, should I pass my expiration dates to the database in GMT zulu as well? Is freeRADIUS taking my (Pacific Time) offset into account which is set on the server? I took the time to write some time conversion code in CFML, so I am ready to go as soon as I can figure out what the freeRADIUS server expects of me. I spent a lot of time the last couple days looking around online, and subsuquently learned quite a bit more on this subject, but never found a solution to my problem. OS: Ubuntu Server 8.04 freeRADIUS version: 1.1.7-1build4 (the version apt installs for Hardy) mySQL: 5.0.51a-3ubuntu5 Thanks in advance, and have a great Sunday night. - mt

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

Yes, Alan, we already now that thedefault config do works! my mind: freeradius (in our case, sergio and me) is correctly configured. But, we encounterd a problem showing no error message. so to make the log slimmer, why not deactivate some non mandatory module in our scenario?? so the output will show the strict necessary information... eg: PAPi don't need PAP module at all to figure out the problem of PEAP/mschapv2 and Active Directory. and Another question Alan: did you test the bootstrap scrip in windows and can you tell us how it works at your side please? how do you find the certificatuion chain!!! thanx a lot ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 27 Juillet 2008, 8h51mn 35s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Sergio wrote: > I'm agree, a good begining would be comment out all modules you're not > using. The instances of the modules are in sites-enabled/default and > sites-enabled/inner-tunnel (for peap and ttls). For debugging... no. The default configuration file WORKS in the widest possible set of circumstances. If it isn't working, it's usually: a) the client (e.g. Windows) b) the NAS (e.g. recent comments about 3com) You should edit the default configuration ONLY for production environments, and ONLY after the debug setup is working to your satisfaction. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

pam module
by Robert Svensson 27 Jul '08

27 Jul '08

Hi, This might be a lame question but I can't get the pam module to work (with vsftpd, or any other pam aware application). I'm runing Ubuntu 8.04 an my config is the following: module version 1.3.17 my /etc/pam.d/vsftpd: auth sufficient /lib/security/pam_radius_auth.so try_first_pass debug my /etc/raddb/server: 127.0.0.1 secret 1 192.168.10.57 123456 30 When I try to login to the vsftp server (for example). The login gets denied and the debug output only shows: Jul 25 16:08:45 robert-laptop vsftpd: pam_radius_auth: Got user name john John is a valid user in the LDAP that our radius server is using (it's not a free radius server) but it seems like the radius request is never sent so therefore I never get a challenge back. What could be wrong? thanx a lot //robert

2 2