- Freeradius-Users - lists.freeradius.org

EAP TLS Authentication failing!!!! "Unknown CA"
by Avinash Patil 07 Jun '08

07 Jun '08

Hi All, I am trying to use authenticate one embedded WLAN device with using freeRadius server 2.0.4 I have radiusd.conf,client.conf files as per my configuration. I have created certificates using bootstrap script.Values in ca.cnf,client.cnf and server.cnf have been modified accordingly. I have copied ca.pem, client.pem to device filesystem.Private key has been extracted from client.pem. Since last week I am trying to authenticate freeradius server but I am getting error like "Unknown CA". Please see attached radius logs. When I verify client certificate using "openssl verify -CApath ca.pem client.pem" I see following error: Error 20 at depth 0 lookup : unable to get local issuer certificate. Device is already tested with Windows 2003 server's TLS(of course with different set of certificates :<) ) and it is working fine. What will be possible reason behind this and where am I going wrong? Appreciate your help. Thanks and Regards, Avinash.

2 1

logging of tls logons
by Vladimir Vassiliev 07 Jun '08

07 Jun '08

I have such entries in my radius.log Fri Jun 6 18:52:31 2008 : Auth: Login OK: [asus_large] (from client wifi port 2 cli 00-19-7D-4A-B7-F4) asus_large - in this example is a common name of SSL certificate and I thought it cannot be forged and I can identify which certificate was used. But today I entered to wifi network from my PDA and saw that I can forge this entry as I want. So, it's not really common name, but something provided by client. So, how can I get in logs exactly common names? -- Vladimir Vassiliev <vova(a)edu.yar.ru>

1 1

Problems compiling Freeradius 2.0.4 on Fedora 8.
by Piero Giobbi 07 Jun '08

07 Jun '08

Hi all. Trying to upgrade my radiusd from 1.1.7 to 2.0.4. When i try make i get this at the end: /root/freeradius-server-2.0.4/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libfreeradius-eap.la -lnsl - lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/ libfreeradius-eap.so /root/freeradius-server-2.0.4/src/lib/.libs/ libfreeradius-radius.so -lnsl -lresolv -lpthread -lssl -lcrypto -Wl,-- rpath -Wl,/usr/local/lib libeap/.libs/libfreeradius-eap.so: undefined reference to `BIO_test_flags' libeap/.libs/libfreeradius-eap.so: undefined reference to `EVP_MD_size' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/freeradius-server-2.0.4/src/modules/ rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-server-2.0.4/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server-2.0.4/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.0.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.0.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.0.4' make: *** [all] Error 2 I really have no clue why or what to do.. Any help apreciated. Regards p

2 1

Compiling FreeRADIUS 2.0.4 on Solaris 10u4 x86
by Zilon X 06 Jun '08

06 Jun '08

When running 'configure' on a Solaris 10u4 x86 container, with version 2.0.4, the modules rlm_krb5 and rlm_python do not get configured - with either Sun Studio 12 ou GCC 3.4.6, and even using CPPFLAGS or --with-rlm-FOO-etc. Also, where can I find reasonable information about how make the rlm_eap_ikev2? Thank you for any advice. checking for DH_new in -lcrypto... yes checking for set_com_err_hook in -lcom_err... no configure: WARNING: the comm_err library isn't found! checking for krb5_init_context in -lkrb5... yes configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. checking for Py_Initialize in -lpython2.3... no configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.3.

1 0

How to get extra attribute
by Reginaldo Russinholi 06 Jun '08

06 Jun '08

4 8

Simultaneos-Use in login for same mac-address
by Jean Carlos Oliveira Guandalini 06 Jun '08

06 Jun '08

Hello, we have a problem of mac-address clone, and we use the Simultaneous-Use: = 1 option to not allow double login, but when this is a case of the clone mac-address the freeradius allows the connection. Log of sql.trace: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'userlogin', '290476', 'Access-Accept', NOW()); INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('81b00935', 'bcc93b20ea389f59', 'userlogin', '', '10.0.6.10', '2447', 'Ethernet', '2008-06-06 11:08:45', '0', '0', 'RADIUS', '', '', '0', '0', 'INTERNET', '00:4F:62:0A:1F:BF', '', 'Framed-User', 'PPP', '111.111.111.111', '0', '0'); UPDATE radacct SET AcctStopTime = '2008-06-06 11:08:46', AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '0', AcctTerminateCause = '', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81b00935' AND UserName = 'userlogin' AND NASIPAddress = '10.0.6.10'; INSERT into radpostauth (id, user, pass, reply, date) values ('', 'userlogin', '290476', 'Access-Accept', NOW()); INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('81b00936', '3f7c1d06dbd205d4', 'userlogin', '', '10.0.6.10', '2448', 'Ethernet', '2008-06-06 11:08:49', '0', '0', 'RADIUS', '', '', '0', '0', 'INTERNET', '00:4F:62:0A:1F:BF', '', 'Framed-User', 'PPP', '111.111.111.111', '0', '0'); Queries in sql.conf: simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" despite the mac-address to match are two different users, and the second to connect without first disconnecting was before. Is there any possibliidade to block it? Thanks Sorry for my english (By Google Tradutor) -- Jean Carlos Oliveira Guandalini Dep. de Redes e Infra-estrutura VisãoNet Tecnologia e Telecomunicações 0800-643-5025

3 5

FreeRadius/eDirectory/802.1X authentication issue
by Newall, Bryce 06 Jun '08

06 Jun '08

1 0

text "files" authentcation fails (2.0.3)
by oz 06 Jun '08

06 Jun '08

Hello group, I try to migrate a freeradius-Server from 1.1.7 to 2.0.3 using the new 2.0 syntax. Authentication uses the plain textfile /etc/raddb/users. Although my test-user matches an entry, I get an error-message "auth: No authenticate method (Auth-Type)..." I have no idea how to change this Auth-Type. The exact error you can see in an excerpt of radiusd -X: #radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 3 2008 at 13:33:47 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... [...] files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "cistron" } [/usr/local/etc/raddb/users]:1 Cistron compatibility checks for entry odsl ... Changing 'Password =' to 'Password ==' Changing 'Huntgroup-Name =' to 'Huntgroup-Name ==' Changing 'Simultaneous-Use =' to 'Simultaneous-Use +=' [...] Ready to process requests. [...] Going to the next request Ready to process requests. User-Password = "XYZ8AB" User-Name = "odsl" Acct-Session-Id = "erx GigabitEthernet 6/0.44:44:0004269184" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 00:a0:c5:53:c9:40" Calling-Station-Id = "#erx705#E60#44" NAS-Port-Type = Ethernet NAS-Port = 1610612780 NAS-Port-Id = "GigabitEthernet 6/0.44:44" NAS-IP-Address = XX.XX.XX.XX NAS-Identifier = "erx705" +- entering group authorize ++[preprocess] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry odsl at line 1 ++[files] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [odsl/XYZ8AB] (from client testerx port 1610612780 cli #erx705#E60#44) Delaying reject of request 0 for 1 seconds Going to the next request I have nothing special in my authorize and authenticate sections, because there was no need for it in 1.1.7 (no pap-settings for example). In short these entries: /etc/raddb/radiusd.conf: [...] files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = cistron } [...] $INCLUDE sites-enabled/ /etc/raddb/sites-available/default: authorize { preprocess } authenticate { } [...] Do I need rlm_pap now in 2.0.3 for using "files"-authentication? Any ideas, how I can make users/files authentication work again? Greetings, oz

3 4

SQL Statements
by Anders Holm 06 Jun '08

06 Jun '08

So, I'm getting closer to my end goal. I have a few questions though regarding SQL statements and what impacts there may be if I go about changing them.. My lovely DBA is telling me the expected traffic figures I have given them may put some interesting load on the DB backend. They'd love for me to change the SQL statements to be just INSERTS for all the accounting traffic. That would be for all the START, STOP and any intermediate accounting traffic I'd receive on the Freeradius platform. (Sorry, but I can't give the interesting figures) We're not planning on using any of the command line tools to check who's got a session or anything like that, but instead we'd use the database to get that information. Needless to say, the database will be replicated, and their queries would go to another instance than what I'll be writing to, so their queries shouldn't impact the performance of the instance I'm using. Would there be any interesting problems I may run into? The consumers of the data are fully aware they will have to correlate all that data themselves, I'm just providing it to them. So, I'm more curious about potential impact on the radius side... Thanks! //anders

2 1

Re: rlm_ippool fail
by tg_melo＠bol.com.br 06 Jun '08

06 Jun '08

>> Does the file exist? FreeRADIUS is at the mercy of the OS here. If >>the OS says "no such file or directory", it means "no such file or >>directory". No amount of playing with the FreeRADIUS configuration will >>make the file suddenly exist. >> Does the db.ippool file exist? >> >> Alan DeKok. >You are suposed to delete those files when you are changing ip pool >range. Module should be able to start without them. > >Ivan Kalik >Kalik Informatika ISP First of all, thanks for your reply Alan and Ivan. But Alan, the deal is what Ivan said. And it was tested with the 1.1.7 version. If you delete the file or it doesn't exist, freeradius creates another one, in order to follow your IP distribution config. And mainly, if you consider that neither the source or the ports install comes with the file. I also tried to put another previously created file there, and even an empty one. But without any result unless the error described. Executing the server as root or freeradius permissions doesn't create the file. If you have any other idea, I'll be thankful. I'm realy in trouble here.

2 1