- Freeradius-Users - lists.freeradius.org

Suggestion for modules directory
by Jim L. 02 May '08

02 May '08

If the FreeRADIUS team monitors this list, I have a small suggestion. Along with the sites-available/sites-enabled directories, I would like to suggest a similar configuration for the modules section. I have added this to our servers and placed all of my custom module sections in corresponding configuration files under the modules directory. As with the sites directories, this allows me to make less modifications to radiusd.conf. Also, I can easily split up the per-site module configurations into separate module files. I do not know if something like modules-available/modules-enabled is really necessary. Perhaps just "$INCLUDE modules/" in under the modules section would be sufficient. Thanks, Jim Lohiser

2 1

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 02 May '08

02 May '08

>Send a request with Digest-Attributes. hi Kalik, I've tried to called using Digest-Attributes in my perl code like this $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; but still it doesn't get the values..except 'Digest-Response' May it be the problem from the radius client, or is it the problem in my perl code. I can't rectify the problem, I am confusing where should I emphasized Here is the new output when it is run in radiusd -X after rejecting da user. rad_recv: Access-Request packet from host 192.168.1.227 port 32847, id=182, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "1e926599fa0777bef89010421e3e1c41" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9ede730 asigned new request. Handled so far: 1 found interpetator at address 0x9ede730 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9ede730 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 32848, id=183, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "1e926599fa0777bef89010421e3e1c41" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0xa119d28 asigned new request. Handled so far: 1 found interpetator at address 0xa119d28 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa119d28 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 182 to 192.168.1.227 port 32847 Reply-Message = "Incorrect Password" Waking up in 0.5 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 183 to 192.168.1.227 port 32848 Reply-Message = "Incorrect Password" Waking up in 4.4 seconds. Cleaning up request 0 ID 182 with timestamp +10 Waking up in 0.5 seconds. Cleaning up request 1 ID 183 with timestamp +10 Ready to process requests. thanking you Kalik. With Regards, Elangbam Johnson

2 1

Re : Re : Re : EAP-TLS/PEAP problem
by Joel MBA OYONE 02 May '08

02 May '08

Ok, i am sorry! all i had to do is "yast install make" or something like that to be able to run the command... ah... Linux !! MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Joel MBA OYONE <mba_oyone(a)yahoo.fr> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 2 Mai 2008, 9h50mn 05s Objet : Re : Re : EAP-TLS/PEAP problem Hello list, I've just installed SUSE 10.3 and freeradius 2.0.2.2-3 to easily setup my prevoious prob with eap. right now, when i run "radiusd -W" i encounter this error message: === /etc/raddb/certs/bootstrap: line 15: make: command not found Exec-Program output: Exec-Program: returned: 127 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[252]: Failed to find module "eap". /etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section. } } Errors initializing modules == reading the readme file in certs/ directory, i understood that the script bootstrap should create the certificates and some other stuffs, and the should be renamed or destroyed. - that i see is: the script didn't create nothing and could not be run. could you please help me to fix it? ( my final goes is to use eap-tls / eap-peap to athenticate wireless clients, and like i said before, i am really newbie on linux. thanx for help) MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 30 Avril 2008, 11h39mn 36s Objet : Re: Re : EAP-TLS/PEAP problem http://www.freeradius.org/download.html Find the OS version that you have and download the latest freeradius version rpm. Ivan Kalik Kalik Informatika ISP Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piše: >Well, as i am very very newbie on Linux. iuse to work on win2000/2003 before. >Â i chose the easyway to install freeradius; the "yum" commaand gave me that version. >if the latest version is easy to install manuallyÂ on fedora and is able to work on a hp proliant ml-370 g5, i take it. >Why not the latest version. It will create and install the certificates >for you. Even if you don't want to install it you can download it and >use it to create certificates. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piĹĄe: > >>Hello list. >>I am sorry about my poor english skills but hope iĂÂ could be understood anyway. >>I use freeradius 1.1-7 on fedora 8 (installed with yum command).ĂÂ right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. >>iĂÂ intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251ĂÂ (two sheets) which is very helpfull. >>but on the second part of the tuto,ĂÂ i encounter a problem with the extensions part: >>- it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: >>[ xpclient_ext] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.2 >>[ xpserver_ext ] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.1 >>and then to modify my previous certificate like that: >># openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreqpem >># openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreqpem >>when i do this, the system give me an error message: >>[root@ensiasra ensiasCA]# pwd >>/etc/pki/CA/ensiasCA >>[root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem >>Using configuration from /etc/pki/tls/openssl.cnf >>Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: >>Error Loading extension section xpserver_ext >>4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn >>[root@ensiasra ensiasCA]# >> >>i suppose i have problem creating extensions.... >>there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. >>thanx for helping >> >>ĂÂ >>MBA OYONE JoÄĹ¤l >>Lot.. El Firdaous >>BÄËt GH20, Porte A 204, Appt 8 >>20000 Oulfa >>Casablanca - Maroc >>ĂÂ >>TÄĹ l. : +212 69 25 85 70 >> >>__________________________________________________ >>Do You Yahoo!? >>En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitÄĹ s >>http://mail.yahoo.fr Yahoo! Mail >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitĂŠs >http://mail.yahoo.fr Yahoo! Mail > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

EAP/TLS on windows XP clients?
by Johan Nyman 02 May '08

02 May '08

Hello, What certificates are needed on Windows XP clients to make a successful connection? The client.p12? and more? Thanks, Best regards, Johan

3 3

Re : Re : EAP-TLS/PEAP problem
by Joel MBA OYONE 02 May '08

02 May '08

Hello list, I've just installed SUSE 10.3 and freeradius 2.0.2.2-3 to easily setup my prevoious prob with eap. right now, when i run "radiusd -W" i encounter this error message: === /etc/raddb/certs/bootstrap: line 15: make: command not found Exec-Program output: Exec-Program: returned: 127 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[252]: Failed to find module "eap". /etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section. } } Errors initializing modules == reading the readme file in certs/ directory, i understood that the script bootstrap should create the certificates and some other stuffs, and the should be renamed or destroyed. - that i see is: the script didn't create nothing and could not be run. could you please help me to fix it? ( my final goes is to use eap-tls / eap-peap to athenticate wireless clients, and like i said before, i am really newbie on linux. thanx for help) MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 30 Avril 2008, 11h39mn 36s Objet : Re: Re : EAP-TLS/PEAP problem http://www.freeradius.org/download.html Find the OS version that you have and download the latest freeradius version rpm. Ivan Kalik Kalik Informatika ISP Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piše: >Well, as i am very very newbie on Linux. iuse to work on win2000/2003 before. >Â i chose the easyway to install freeradius; the "yum" commaand gave me that version. >if the latest version is easy to install manuallyÂ on fedora and is able to work on a hp proliant ml-370 g5, i take it. >Why not the latest version. It will create and install the certificates >for you. Even if you don't want to install it you can download it and >use it to create certificates. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piĹĄe: > >>Hello list. >>I am sorry about my poor english skills but hope iĂÂ could be understood anyway. >>I use freeradius 1.1-7 on fedora 8 (installed with yum command).ĂÂ right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. >>iĂÂ intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251ĂÂ (two sheets) which is very helpfull. >>but on the second part of the tuto,ĂÂ i encounter a problem with the extensions part: >>- it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: >>[ xpclient_ext] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.2 >>[ xpserver_ext ] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.1 >>and then to modify my previous certificate like that: >># openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreqpem >># openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreqpem >>when i do this, the system give me an error message: >>[root@ensiasra ensiasCA]# pwd >>/etc/pki/CA/ensiasCA >>[root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem >>Using configuration from /etc/pki/tls/openssl.cnf >>Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: >>Error Loading extension section xpserver_ext >>4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn >>[root@ensiasra ensiasCA]# >> >>i suppose i have problem creating extensions.... >>there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. >>thanx for helping >> >>ĂÂ >>MBA OYONE JoÄĹ¤l >>Lot.. El Firdaous >>BÄËt GH20, Porte A 204, Appt 8 >>20000 Oulfa >>Casablanca - Maroc >>ĂÂ >>TÄĹ l. : +212 69 25 85 70 >> >>__________________________________________________ >>Do You Yahoo!? >>En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitÄĹ s >>http://mail.yahoo.fr Yahoo! Mail >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitĂŠs >http://mail.yahoo.fr Yahoo! Mail > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 02 May '08

02 May '08

>No, there is a digest module in default radiusd.conf that should decode >the attributes. Post radiusd -X for request with Digest-Attributes. >Those attributes you want are not in the request - have you tried >$RAD_CHECK. hi Kalik, I've tried $RAD_CHECK but still i didn't get the values of these attributes 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response', I've found a digest module in radiusd.conf but actually don't have any idea how to handle the module. Please tell me how to get the value of these attributes. Here is the full output when the radius is run in debugging mode: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 9 2008 at 21:42:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.227 { require_message_authenticator = no secret = "johnson" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/myperltemp.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. and here is the output after when rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32795, id=73, length=59 User-Name = "johnson" User-Password = "johnson" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x92fa6c8 asigned new request. Handled so far: 1 found interpetator at address 0x92fa6c8 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: User-Name = johnson rlm_perl: RAD_REQUEST: User-Password = johnson rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: ############################################################### rlm_perl: Added pair User-Name = johnson rlm_perl: Added pair User-Password = johnson rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x92fa6c8 ++[perl] returns reject Invalid user: [johnson/johnson] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> johnson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 127.0.0.1 port 32795 Reply-Message = "Incorrect Password" Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +3 Ready to process requests. Thank you Kalik. Wtih Regards, Elangbam Johnson

2 1

Duplicate accounting packets
by Tim Lightfoot 02 May '08

02 May '08

Freeradius 2.0.3 FreeBSD 6.3 I have a problem where accounting packets are not getting acknowledged by Freeradius. I have been using the NTRadPing testing tool and have determined that if the Accounting Start packet contains a NAS-Port attribute, the packet will timeout. If I remove the NAS-Port attribute from the Accounting Start packet I get an instant response. Please see below output from radiusd -X - the line that seems to vary between successful and failed attempts is ++[unix] returns fail (its ++[unix] returns noop when successful). Ready to process requests. User-Name = "80001(a)test.net.uk" Acct-Status-Type = Start Acct-Session-Id = "2476" NAS-IP-Address = 10.0.1.110 NAS-Port = 1073 +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 1073,Client-IP-Address = 10.0.1.110,NAS-IP-Address = 10.0.1.110,Acct-Session-Id = "2476",User-Name = "80001(a)test.net.uk"' rlm_acct_unique: Acct-Unique-Session-ID = "22a2bff7af67d3ea". ++[acct_unique] returns ok rlm_realm: Looking up realm "test.net.uk" for User-Name = "80001(a)test.net.uk <mailto:s80001@test.net.uk> " rlm_realm: Found realm "test.net.uk" rlm_realm: Proxying request from user 80001 to realm test.net.uk rlm_realm: Adding Realm = "test.net.uk" rlm_realm: Accounting realm is LOCAL. ++[suffix] returns noop acct_users: Matched entry DEFAULT at line 22 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> 80001(a)test.net.uk ++[files] returns ok +- entering group accounting expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/10.0.1.110/detail-20080502 rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.0.1.110/detail-20080502 expand: %t -> Fri May 2 09:06:38 2008 ++[detail] returns ok ++[unix] returns fail Finished request 1. Many thanks Tim Any opinions expressed in this email are those of the individual and not necessarily those of Sota Solutions Limited. It is intended only for the person(s) to whom it is addressed and may contain privileged and/or confidential information. Accordingly, the copying, dissemination, distribution, or use of this message to any other person may constitute a breach of Civil or Criminal Law. Please notify the sender immediately if you have received this email by mistake and delete it from your system.

2 1

Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record
by 여친급구 02 May '08

02 May '08

Hello Fedora Core 5 freeradius-1.1.7.tar.gz /var/log/radius/radius.log Thu May 1 05:53:35 2008 : Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Thu May 1 05:53:37 2008 : Error: rlm_radutmp: Logout for NAS localhost port 13, but no Login record Thu May 1 06:19:45 2008 : Info: rlm_sqlippool: ip=[172.16.1.2] len=10 Thu May 1 06:23:19 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 06:23:52 2008 : Info: rlm_sqlippool: ip=[172.16.2.15] len=11 Thu May 1 06:24:15 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 06:46:20 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 06:49:58 2008 : Info: rlm_sqlippool: ip=[172.16.2.7] len=10 Thu May 1 07:10:33 2008 : Error: rlm_radutmp: Logout for NAS localhost port 15, but no Login record Thu May 1 07:32:56 2008 : Error: rlm_radutmp: Logout for NAS localhost port 6, but no Login record Thu May 1 07:35:40 2008 : Error: rlm_radutmp: Logout for NAS localhost port 1, but no Login record Thu May 1 08:03:33 2008 : Error: rlm_radutmp: Logout for NAS localhost port 10, but no Login record Thu May 1 08:14:10 2008 : Error: rlm_radutmp: Logout for NAS localhost port 8, but no Login record Thu May 1 08:46:54 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 09:10:02 2008 : Info: rlm_sqlippool: ip=[172.16.1.2] len=10 Thu May 1 09:11:05 2008 : Info: rlm_sqlippool: ip=[172.16.1.8] len=10 Thu May 1 09:11:44 2008 : Info: rlm_sqlippool: ip=[172.16.1.9] len=10 Thu May 1 09:22:00 2008 : Info: rlm_sqlippool: ip=[172.16.2.15] len=11 Thu May 1 09:22:33 2008 : Info: rlm_sqlippool: ip=[172.16.2.4] len=10 Thu May 1 09:37:14 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 09:55:46 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 10:10:48 2008 : Info: rlm_sqlippool: ip=[172.16.2.13] len=11 Thu May 1 10:59:31 2008 : Error: Invalid operator for item Expiration: reverting to '==' Thu May 1 10:59:31 2008 : Info: rlm_sqlippool: ip=[172.16.2.6] len=10 Thu May 1 11:16:17 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 11:21:35 2008 : Error: rlm_radutmp: Logout for NAS localhost port 16, but no Login record Thu May 1 11:24:37 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 11:26:33 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 11:38:15 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 11:39:46 2008 : Info: rlm_sqlippool: ip=[172.16.2.16] len=11 Thu May 1 11:48:10 2008 : Info: rlm_sqlippool: ip=[172.16.2.8] len=10 Thu May 1 11:56:14 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 12:30:39 2008 : Info: rlm_sqlippool: ip=[172.16.1.13] len=11 Thu May 1 13:05:56 2008 : Info: rlm_sqlippool: ip=[172.16.2.5] len=10 Thu May 1 13:08:26 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 13:09:47 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 13:20:23 2008 : Info: rlm_sqlippool: ip=[172.16.2.17] len=11 Thu May 1 13:55:59 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 14:09:19 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 14:09:47 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 14:24:28 2008 : Error: rlm_radutmp: Logout for NAS localhost port 0, but no Login record Thu May 1 14:28:16 2008 : Error: rlm_radutmp: Logout for NAS localhost port 17, but no Login record Thu May 1 14:29:15 2008 : Error: rlm_radutmp: Logout for NAS localhost port 7, but no Login record Thu May 1 14:30:05 2008 : Error: rlm_radutmp: Logout for NAS localhost port 11, but no Login record Thu May 1 14:30:17 2008 : Error: rlm_radutmp: Logout for NAS localhost port 2, but no Login record Thu May 1 14:33:03 2008 : Info: rlm_sqlippool: ip=[172.16.1.1] len=10 ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

1 0

HOWTO PEAP + FreeRadius + XP Client
by George KNIGHT 02 May '08

02 May '08

Hello everyone, Before I write my question here, I just want to let all of you know that I did lots of searching in both google and this email list. But couldn't find anything to get the answer. My question is I have been looking for a HOWTO paper for a beginner to set freeradius as an AAA server in a wireless environment to Windows XP SP2 clients. I will use Windows' own PEAP client. Is there such a paper someone can give me the link? I'm very frustrated to find out that there is no information available for a setup from the scratch. I wrote papers like that before for various topics such as subversion implementation for a multiple OS environment, VoIP implementation with a Linux based open sources S/W etc. I have intention to write such a paper for how to set up PEAP implementation with freeradius as well. But for that, I'm hoping someone can give me a good start. OK, here is my network settings and needed information; I have a SUSE SLES 10 server to be used as an AAA server. This server is called store-AAA and also acts as a DHCP server for the clients. I have a few of Cisco 1242 AP as an authenticator. Clients are going to be computers with WinCE as their OS and they will contact to the LAN wirelessly. What I want to achieve is authenticating this clients with server-AAA using PEAP before letting them use the other network resources. Thank you in advance for your time and effort. George Knight

5 16

LDAP Not recognising User-Name attribute in tunneled authentication FR 2.0.4
by Arran Cudbard-Bell 02 May '08

02 May '08

Hi, Exactly the same config used between 2.0.3 and 2.0.4, but now the LDAP module fails lookups because it claims it can't find the User-Name attribute.... PEAP: Got tunneled EAP-Message EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 PEAP: Setting User-Name to ac221(a)sussex.ac.uk PEAP: Sending tunneled request EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ac221(a)sussex.ac.uk" State = 0xc771177ac78f0d80e7ad35c717d8d32f Framed-MTU = 1480 NAS-IP-Address = 139.184.6.156 NAS-Identifier = "hp-e-falm-g-77-sw1" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001c2ec47180" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" server default-inner { +- entering group authorize expand: %{outer.request:Realm} -> local expand: %{outer.request:NAS-Flags} -> 010010110000000 expand: %{outer.request:SS-Flags} -> 0000000000 expand: %{outer.request:Supplicant-Flags} -> 0001000000 expand: %{outer.request:Called-Station-SSID} -> ++[request] returns notfound ++? if ("%{User-Name}") expand: %{User-Name} -> ac221(a)sussex.ac.uk ? Evaluating ("%{User-Name}") -> TRUE ++? if ("%{User-Name}") -> TRUE ++- entering if ("%{User-Name}") +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{User-Name} -> ac221(a)sussex.ac.uk ? Evaluating ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++- entering if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{1} -> ac221 ++++[request] returns notfound expand: %{3} -> sussex.ac.uk expand: %{%{3}:-sussex.ac.uk} -> sussex.ac.uk ++++[request] returns notfound +++- if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) returns notfound +++ ... skipping else for request 5: Preceding "if" was taken ++- if ("%{User-Name}") returns notfound rlm_ldap: - authorize rlm_ldap: Attribute "User-Name" is required for authorization. ++[ldap] returns noop Relevant filter line in LDAP is : filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Why is there now a static requirement for the User-Name attribute to be present anyway? Especially when the filter is defined in the config... -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 3