- Freeradius-Users - lists.freeradius.org

Strategy Advice
by Sturgis, Grant 04 May '08

04 May '08

Greetings list, Brand new freeradius user here, I will try not to be too obnoxious with silly questions. My goal is to replace the Cisco ACS solution with Freeradius, including: 1. Shell (telnet/ssh) access to network switches/routers/firewalls 2. EAP-TLS to the wireless network 3. Potentially 802.1x auth to wired network ports I would like to use our network directory (W2K3 AD) user accounts for all of the above. And I would also like to be able to restrict based on group membership - so that only members of the "Cisco_Admin" group can log into switches and only members of the "wireless" group can authenticate to the WAPs. My questions is: Would it be wiser to pursue the mschap / ntml_auth / winbind module solution or the ldap module solution? I am guessing that this has been done in the past, right? Does anyone have any anecdotes that would be helpful? Thanks in advance, Grant ----------------- Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

6 7

FR failing
by Matt Ashfield 04 May '08

04 May '08

We have two FR servers (running 1.1.15) on Red Hat machines. We are using it to authenticate wireless users against an LDAP directory. Occasionally, one of the FR servers (it happens to each, just not at the same time), stops working. The service remains up, but it's like the conversation between radius and ldap doesn't work for some reason, and radius stops trying altogether afterwards. The log shows: Thu May 1 14:33:02 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu May 1 14:33:02 2008 : Auth: Login incorrect: [rsmall] (from client unbsj111 port 32401 cli 00-1E-C2-C0-8E-36) Thu May 1 14:33:15 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu May 1 14:33:15 2008 : Auth: Login incorrect: [anonymous] (from client hh2380 port 45380 cli 00-12-F0-D3-3C-03) Thu May 1 14:34:02 2008 : Error: Discarding duplicate request from client hh2380:20001 - ID: 200 due to unfinished request 1428 Any help is greatly appreciated. Thanks Matt A mda(a)unb.ca

2 1

freeradius 2.0.4 and peap
by Manuel Sánchez Cuenca 04 May '08

04 May '08

Hello all, I have installed freeradius 2.0.4 and now I'm trying to configure peap. When I try to connect using a Windows XP laptop, the server rejects the user. The log shows this information: rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lolo with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [lolo/<via Auth-Type = EAP>] (from client dame-ap port 0 via TLS tunnel) PEAP: Tunneled authentication was rejected. The configuration files are the following: * eap.conf eap { default_eap_type = peap . . . tls { private_key_password = srvpwd private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem . . . } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } * users lolo Cleartext-Password := "password" * sites-enabled/default authorize { eap { ok = return } ... } authenticate { eap ... } ... Can anybody help me? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Departamento de Ingeniería y Tecnología de Computadores Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://webs.um.es/manuelsc

3 3

Re:Re Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 03 May '08

03 May '08

>Your radius client is not sending Digest-Attributes. It's sending Ascend >VSAs. Read your NAS documentation how to set up digest authentication if >you want that. hi Kalik, I am really sorry to post again the same question, as per your instruction I have check all the clients configurations "radiusclient.conf" as well as SER configuration "ser.cfg", I've uncommented all the modules that will particularly help to do digest authentication in ser.cfg, but still the problem of not getting the values of digest attributes exist, I am using radiusclient 0.5.6 and SER 0.9.6, will it be the problem for incompatible of versions between the radius server and the radius clients or SER. Please tell me the possible problems of not getting these values: 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response' And please tell me the things that I should change in radius server configuration to get these digest attributes. for the information I've mentioning the debug when run in radiusd -X rad_recv: Access-Request packet from host 192.168.1.227 port 33526, id=92, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "6d1bf8eacbbddb82a606811f7e5c76ae" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9f48768 asigned new request. Handled so far: 1 found interpetator at address 0x9f48768 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9f48768 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 33528, id=93, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "6d1bf8eacbbddb82a606811f7e5c76ae" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0xa183d50 asigned new request. Handled so far: 1 found interpetator at address 0xa183d50 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa183d50 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 92 to 192.168.1.227 port 33526 Reply-Message = "Incorrect Password" Waking up in 0.5 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 93 to 192.168.1.227 port 33528 Reply-Message = "Incorrect Password" Waking up in 4.4 seconds. Cleaning up request 0 ID 92 with timestamp +5 Waking up in 0.5 seconds. Cleaning up request 1 ID 93 with timestamp +5 Ready to process requests. Thanks and Regards, Elangbam Johnson

2 1

howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 03 May '08

03 May '08

OK, radiusd -X and /etc/raddb/certs/bootstrap generated some files in /etc/raddb/certs like ca.pem ca.key 01.pem dh index.txt index.txt.attr random serial server.crt srver.key server.p12 server.pem server.csr xpxtensions etc... eap.conf point to the right paths. i intend to authenticate wireless users on xp. i though there was already a certificate and private key for wireless client, but i can see that nowhere. si i think i should create my own certificate and privatekey for client and export install it on windows xp. if i am true and did not forget something to do, my questions are: - is there any problem with the CA private key file and server file extension? (ca.key instead of cakey.pem). - which extension should i use for my windows xp certicate, and please, could you just give me the line! (like openssl req ...., openssl ca - ...-, openssl pkcs12, etc...) sorry for silly questions, but i tried and surely missed something. thank you for helping MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re : authentication problem between supplicant and radius server
by Joel MBA OYONE 03 May '08

03 May '08

thank you guy! It works, with only the @MAC ("00-1c-f0-07-d6-90") instead of "00-1c-f0-07-d6-90\000". I wonder why the Radius server receive that "\000" information. MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 2 Mai 2008, 19h34mn 11s Objet : Re: authentication problem between supplicant and radius server >I need some explanation with what is going wrong in my config! > >i have : > - freeradius 2.0.2-3 AS RADIUS SERVER >- DWS3024 as authenticator (set up for transmit request to radius server correctly) >- (this step) DWL-8500AP as Access point (my spplicant) > >i had not that problem using that config on my previous system (fedora 8 + freeradius 1.1-7). > >"Radiusd - X" telles me that there is no "User-Password" attribute found on the request whent the Access-Point (AP) tries to authenticate. >it shows me "@MAC_ADDRESS" as login and "000# as password. >the suppliers doc says default password is "NOPASSWORD". >when i update the password in "users" file as "NOPASSWORD" or "000" or hen i leave it empty, i have exactly the same results. > >below is my radiusd -X log, a part of my clients.cnf. file and same of "users" file. >maybe could someone tell me what i missed. > .. >rad_recv: Access-Request packet from host 192.168.0.254 port 49153, id=73, length=79 > User-Name = "00-1c-f0-07-d6-90\000" > NAS-Identifier = "00-17-9A-95-0C-18" > Message-Authenticator = 0xe7734b66fdcbf582530af8458ee4627e AP is not sending anything as password. >########################################################### > >"Users" file >########################################################### >#### AP 1 Auth-Type := Local, >00-1c-f0-07-d6-90\000 Auth-Type := Local, User-Password += "000" Alter this to (and leave reply attributes as they are): 00-1c-f0-07-d6-90\000 Auth-Type := Accept Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

authentication problem between supplicant and radius server
by Joel MBA OYONE 02 May '08

02 May '08

Hello I need some explanation with what is going wrong in my config! i have : - freeradius 2.0.2-3 AS RADIUS SERVER - DWS3024 as authenticator (set up for transmit request to radius server correctly) - (this step) DWL-8500AP as Access point (my spplicant) i had not that problem using that config on my previous system (fedora 8 + freeradius 1.1-7). "Radiusd - X" telles me that there is no "User-Password" attribute found on the request whent the Access-Point (AP) tries to authenticate. it shows me "@MAC_ADDRESS" as login and "000# as password. the suppliers doc says default password is "NOPASSWORD". when i update the password in "users" file as "NOPASSWORD" or "000" or hen i leave it empty, i have exactly the same results. below is my radiusd -X log, a part of my clients.cnf. file and same of "users" file. maybe could someone tell me what i missed. thank you # radiusd -X ############## FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Mar 18 2008 at 19:47:59 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dws3024 { ipaddr = 192.168.0.254 require_message_authenticator = yes secret = "wireless" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.254 port 49153, id=73, length=79 User-Name = "00-1c-f0-07-d6-90\000" NAS-Identifier = "00-17-9A-95-0C-18" Message-Authenticator = 0xe7734b66fdcbf582530af8458ee4627e +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "00-1c-f0-07-d6-90", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [00-1c-f0-07-d6-90\000/<no User-Password attribute>] (from client dws3024 port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 00-1c-f0-07-d6-90 ++[attr_filter.access_reject] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 192.168.0.254 port 49153 Waking up in 4.9 seconds. ########################################################### "clients.conf" ########################################################### # format 2.x client dws3024 { ipaddr = 192.168.0.254 # netmask = 24 secret = wireless require_message_authenticator = yes # shortname = DWS-3024 Swithch Controler # nastype = D-Link } ########################################################### "Users" file ########################################################### #### AP 1 Auth-Type := Local, 00-1c-f0-07-d6-90\000 Auth-Type := Local, User-Password += "000" D-Link-Wireless-AP-Mode = WS-Managed, D-Link-Wireless-AP-Location = "Bureau de Joel", D-Link-Wireless-AP-Profile-ID = 1, D-Link-Wireless-AP-Switch-IP = 192.168.10.254, D-Link-Wireless-AP-Radio-1-Chan = Auto, D-Link-Wireless-AP-Radio-2-Chan = Auto, D-Link-Wireless-AP-Radio-1-Power = Auto, D-Link-Wireless-AP-Radio-2-Power = Auto 00-17-9a-d2-e8-f0 Auth-Type := Local, Cleartext-Password == "000" D-Link-Wireless-AP-Mode = WS-Managed, D-Link-Wireless-AP-Location = "Bureau de Joel", D-Link-Wireless-AP-Profile-ID = 1, D-Link-Wireless-AP-Switch-IP = 192.168.0.254, D-Link-Wireless-AP-Radio-1-Chan = Auto, D-Link-Wireless-AP-Radio-2-Chan = Auto, D-Link-Wireless-AP-Radio-1-Power = Auto, D-Link-Wireless-AP-Radio-2-Power = Auto ########################################################################################### __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

DER format in TLS certificates
by Sergio Belkin 02 May '08

02 May '08

Hi, Can I use DER format for certificates? With PEM format TTLS works fine but if I use DER format it outputs: Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.der" certificate_file = "/etc/pki/tls/certs/ips-spectrum-crt.der" CA_file = "/etc/pki/tls/certs/ips-ca-bundle.der" dh_file = "/usr/local-2.0.2/etc/raddb/certs/dh" random_file = "/usr/local-2.0.2/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading certificate file /etc/pki/tls/certs/ips-spectrum-crt.der rlm_eap: Failed to initialize type tls /usr/local-2.0.2/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local-2.0.2/etc/raddb/sites-enabled/default[253]: Failed to find module "eap". /usr/local-2.0.2/etc/raddb/sites-enabled/default[200]: Errors parsing authenticate section. } } Errors initializing modules Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Ldap attribute config stuff
by Pat Riehecky 02 May '08

02 May '08

Ok, to begin I am not a radius guru. In fact, the word novice applies very strongly here.... That being said on to my inquiry. I have two radius systems on site. One of them is for our wireless system and the other for our old trying to die dialup. The wireless system is setup to authenticate to our LDAP repository and make sure that users have a particular attribute before letting them on. Our dial up system is a big mess of flat files on a version of the software I wont admit to. I would very much like to get the radius server doing the wireless work to also do our dial up work. To do this I have loaded some attributes into our LDAP server for it to query, but then I run into a bit of a problem. How do I configure a required attribute of "Wireless=yes" for one set of clients and an attribute of "DialUP=yes" for the other? Can this be done? Did I miss the doc on this? Solaris 9 SPARC, FreeRadius 1.1.6 Any help I can get on this would be very appreciated. Pat

1 0

Discard duplicate requests if received within a specified period
by rsg 02 May '08

02 May '08

Hi, I would like to discard duplicate Auth requests based on certain attributes other than the NAS-IP-Address (e.g. Calling-Station-Id, Pool-Name). For example if there are two requests originating from 2 NASes which corresponds to a particular client, I would like to discard the second request if it is received during a threshold time value (eg. 15 seconds) Specially I find that when using SQL for authorization this situation occurs as it takes a while to perform authorization using SQL. Thanks for your guidance, rg

4 13