- Freeradius-Users - lists.freeradius.org

Re : EAP-TLS/PEAP problem
by Joel MBA OYONE 30 Apr '08

30 Apr '08

Well, as i am very very newbie on Linux. iuse to work on win2000/2003 before. i chose the easyway to install freeradius; the "yum" commaand gave me that version. if the latest version is easy to install manually on fedora and is able to work on a hp proliant ml-370 g5, i take it. Why not the latest version. It will create and install the certificates for you. Even if you don't want to install it you can download it and use it to create certificates. Ivan Kalik Kalik Informatika ISP Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piše: >Hello list. >I am sorry about my poor english skills but hope iÂ could be understood anyway. >I use freeradius 1.1-7 on fedora 8 (installed with yum command).Â right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. >iÂ intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251Â (two sheets) which is very helpfull. >but on the second part of the tuto,Â i encounter a problem with the extensions part: >- it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: >[ xpclient_ext] >extendedKeyUsage = 1.3.6.1.5.5.7.3.2 >[ xpserver_ext ] >extendedKeyUsage = 1.3.6.1.5.5.7.3.1 >and then to modify my previous certificate like that: ># openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreq.pem ># openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreq.pem >when i do this, the system give me an error message: >[root@ensiasra ensiasCA]# pwd >/etc/pki/CA/ensiasCA >[root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem >Using configuration from /etc/pki/tls/openssl.cnf >Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: >Error Loading extension section xpserver_ext >4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn >[root@ensiasra ensiasCA]# > >i suppose i have problem creating extensions.... >there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. >thanx for helping > >Â >MBA OYONE JoĂŤl >Lot.. El Firdaous >BĂ˘t GH20, Porte A 204, Appt 8 >20000 Oulfa >Casablanca - Maroc >Â >TĂŠl. : +212 69 25 85 70 > >__________________________________________________ >Do You Yahoo!? >En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitĂŠs >http://mail.yahoo.fr Yahoo! Mail > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

Freeradius with LAC setup
by Ashraf Albasti 30 Apr '08

30 Apr '08

Dear all, im using the freeradius as proxy server with checking for the calling station id using the radcheck; i have a REDBACK used as LNS; and now want to use it as LAC too for a special context; i want domain (abc.com) to be proxyed and domain (xyz.com) to send back the needed attribute to the LAC without authenticate him on the freeradius can do this setup, and how? Thanks

2 1

EAP-TLS/PEAP problem
by Joel MBA OYONE 30 Apr '08

30 Apr '08

Hello list. I am sorry about my poor english skills but hope i could be understood anyway. I use freeradius 1.1-7 on fedora 8 (installed with yum command). right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. i intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251 (two sheets) which is very helpfull. but on the second part of the tuto, i encounter a problem with the extensions part: - it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: [ xpclient_ext] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 and then to modify my previous certificate like that: # openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreq.pem # openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreq.pem when i do this, the system give me an error message: [root@ensiasra ensiasCA]# pwd /etc/pki/CA/ensiasCA [root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: Error Loading extension section xpserver_ext 4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn [root@ensiasra ensiasCA]# i suppose i have problem creating extensions.... there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. thanx for helping MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

GPRS project with dynamic IP configuration
by Didier Wintgens 30 Apr '08

30 Apr '08

Hi everybody, I use FreeRadius since 3 years to manage GPRS connections with a static IP configuration. Each account has a Framed-IP-Address attritube in the Radius radreply table to specify his static IP address (I use MySQL as database and that's work fine). In the future, I need to be able to work with a dynamic IP configuration with an another GSM/GPRS operator. In this case, two GGSN are in charge to allocate dynamically the IP adress from two differents pools (not overlapped) managed by the GGSN. For my software application, I need to known permanently the last IP adress allocated to each SIM card (identified by his MSISDN number). After each authentication, the GGSN must send a accounting request to the Radius server (with a Framed-Address attribute containing the address IP really allocated). My question is the following : Does FreeRadius really use the attribute Framed-Address provided by the accounting request to trace the informations in the raddacct table ? I search a documentation or a experience which could confirm this functionality. Thanks in advance. Didier. __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

Active Directory anonymous rebinding when following references
by Hughes, Scott GRE/MG 30 Apr '08

30 Apr '08

Numerous posts about Active Directory OU searching and FreeRadius can be found easily via Google, but none seem to have the definitive answer/workaround for the "Windows 2003 rebind failure when searching the root of the active directory" On the latest freeradius-2.0.3 compiled from source, I get the the rlm_ldap errors below whenever I use the basedn = "dc=my,dc=domainname,dc=com" rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed I am binding to LDAP with a username/password (not anonymous) All seem to point back to bug 183, which has been open for a long time: http://bugs.freeradius.org/show_bug.cgi?id=183 Is this bug still considered valid? What further needs to be done to get the patch or a similar fix integrated into the main code tree, especially the 2.0 release? I see the patch there, and have applied it to my old freeradius-1.0.1 installation, but stability issues prompted me to investigate an upgrade, and I am not entirely sure that the patch didn't *cause* my stability problems to begin with (the comment by Alan DeKok in the bugzilla entry sounds a little ominous). FWIW, my specific stability problem is the following: Wed Apr 2 17:40:31 2008 : Error: rlm_ldap: All ldap connections are in use Wed Apr 2 17:40:31 2008 : Error: rlm_ldap: All ldap connections are in use Wed Apr 2 17:40:31 2008 : Error: rlm_ldap: All ldap connections are in use Wed Apr 2 17:40:31 2008 : Error: rlm_ldap: All ldap connections are in use Wed Apr 2 17:40:31 2008 : Error: rlm_ldap: All ldap connections are in use And the server rejects all requests until it is restarted. The server is not under a high load. The errors only occur after the server has been running for a few weeks. I could increase ldap_connections_number, but I suspect that will only band-aid the problem so it runs for a few more weeks before failing. My LDAP configuration block is below: ldap { server = "xxx" identity = "yyy(a)my.domain.com" password = zzz basedn = "dc=my,dc=domain,dc=com" filter = "(SamAccountName=%U)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupmembership_filter = "(&(objectClass=Group)(member=%{Ldap-UserDn}))" } I would be happy to produce more configuration files upon request, if it would help. Thoughts are appreciated Scott Sr. Network Engineer Great River Energy

2 1

Configuration trouble with fail-over
by Guillaume Rousse 30 Apr '08

30 Apr '08

Hello list. I've recently upgraded my freeradius servers from 1.1.7 to 2.0.0, and I've been hit badly by the change in the handling of LDAP-UserDn attribute, as detailed in http://www.nabble.com/Re%3A-LDAP-Groups-and-EAP-p14886209.html I think this ought to be documented in rlm_ldap documentation (as well as minor other changes, such as the new tls subsection). I also tried to clean up my configuration a little bit. I think a found a bug in the handling of set_auth_type directive. From what I understood, this directive governs the setting of the Auth-Type attribute to 'LDAP' during the authorisation phase. However, whatever its value, it's automatically disabled when launching radius at startup: Tue Apr 29 14:07:17 2008 : Debug: rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. Here is my autenticate section, using two ldap modules in fail-over: authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 handled } } } If I drop failover, everything work as expected. Should I report this as a bug ? So far, the only workaround I found is to force the Auth-Type attribute in the user file: DEFAULT ldap1-LDAP-Group == admins, Auth-Type := LDAP, Huntgroup-Name == AdminNet Service-Type = Login, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT ldap2-LDAP-Group == admins, Auth-Type := LDAP, Huntgroup-Name == AdminNet Service-Type = Login, Cisco-AVPair = "shell:priv-lvl=15" But I can't make my mind if it is a good solution or not. According to the comment in default configuration file: "In general, you SHOULD NOT set the Auth-Type attribute". According to Alan answer in http://www.nabble.com/Re%3A-Force-Auth-Type-p15069162.html "The LDAP module setting Auth-Type to LDAP is a bit of a hack." Which one should I believe ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

2 7

Reply-Items in Ldap-Group
by Giovanni Lovato 30 Apr '08

30 Apr '08

I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user belonging to that group authenticates. Is that possible? Thank you!

3 5

Huntgroup and regular expression
by Bill Shaver 30 Apr '08

30 Apr '08

I am running a fairly old version of FreeRADIUS (1.0.1). I would like to define a regular expression (such as Guest\d+) for a set of users in the huntgroup file for a specific NAS. Based on my reading of the docs, this does not look like it is possible/supported, but I wanted to check with the experts on the list in case I over had looked something obvious. Thanks for your time and wisdom. --Bill

2 1

Re: Possible to limit user access to different types of authentication?
by Ryan 30 Apr '08

30 Apr '08

Got it figured. Was actually trying to ask if it will terminate all EAP requests regardless of realm. Regards, Ryan Date: Tue, 22 Apr 2008 16:41:33 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Possible to limit user access to different types of authentication? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <480DF91D.3060404(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ryan wrote: > I have worked around it using the proxy-inner-tunnel method to > terminal the EAP on the front radius and then proxy MS-CHAP to an > internal radius that will do an LDAP bind with an additional > attribute. Ok... > As the front radius will also handle EAP requests that will not be > handled by the internal radius, will it just proxy the EAP request > based on the domain or it will terminate and forward to my internal > radius instead? Huh? You said in the first paragraph that it will terminate & forward. Where's the confusion? Alan DeKok.

1 0

Re: HOWTO PEAP + FreeRadius + XP Client
by Gustavo Chavelas 29 Apr '08

29 Apr '08

Hi. George KNIGHT Here there are many people's experts. I have an infrastructure as yours EAP, PEAP, WinCE with HANDHELD, WIN XP, WIN VISTA and Cisco. It's working very good in a two CentOS Servers, 1 master and 1 backup for redundancy. Alan Dekok sends you instructions but don't worry, if you have any questions and I can help you, I do it. Saludos! -----Mensaje original----- De: freeradius-users-bounces+gchavelas=bfmx.com.mx(a)lists.freeradius.org [mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org] En nombre de freeradius-users-request(a)lists.freeradius.org Enviado el: Martes, 29 de Abril de 2008 02:08 p.m. Para: freeradius-users(a)lists.freeradius.org Asunto: Freeradius-Users Digest, Vol 36, Issue 173 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: can peap and ttls live together? (Sergio Belkin) 2. dot1x specification EAPOL-Logoff clarification (Arran Cudbard-Bell) 3. Re: dot1x specification EAPOL-Logoff clarification (Arran Cudbard-Bell) 4. HOWTO PEAP + FreeRadius + XP Client (George KNIGHT) 5. Re: HOWTO PEAP + FreeRadius + XP Client (Michael Schwartzkopff) 6. Re: SPAM-LOW: Re: EAP/TLS connection problem.. (Alan DeKok) 7. Re: HOWTO PEAP + FreeRadius + XP Client (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Apr 2008 12:56:38 -0300 From: "Sergio Belkin" <sebelk(a)gmail.com> Subject: Re: can peap and ttls live together? To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8c6f7f450804290856oce00b42h557aba09dfb7ee22(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-2 2008/4/29 Ivan Kalik <tnt(a)kalik.net>: > That probably won't work in 2.0. Mapping to Cleartext-Password will. I am using 2.0.2 :) > > > Ivan Kalik > Kalik Informatika ISP > > > > Dana 29/4/2008, "Sergio Belkin" <sebelk(a)gmail.com> pi?e: > > > > >2008/4/29 Ivan Kalik <tnt(a)kalik.net>: > >> You need to add the entry for Cleartext-Password. Something like: > >> > >> checkItem Cleartext-Password clrtxtPassword > >> > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> > >> > >Hmmmm. I advanced and before of reading your answer I added: > > > >checkItem User-Password userPassword > > > >replyItem Tunnel-Type radiusTunnelType > >replyItem Tunnel-Medium-Type radiusTunnelMediumType > >replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId > > > >end of snip > > > >It worked! Anywat Is that right? > > > >-- > >-- > >Open Kairos http://www.openkairos.com > >Watch More TV http://sebelk.blogspot.com > >Sergio Belkin - > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - ------------------------------ Message: 2 Date: Tue, 29 Apr 2008 17:33:06 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Subject: dot1x specification EAPOL-Logoff clarification To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48174DC2.3060205(a)sussex.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, Having some interesting issues with a HP ProCurve 2510 an Apple Mac Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same wired port. I know this isn't strictly the list for this as this isn't really RADIUS, but i'm not sure where to post... Two questions: IEE802.1x-2004 8.1.3 EAPOL-Logoff When a Supplicant wishes the Authenticator PAE to perform a logoff (i.e., to set the controlled Port state to unauthorized), the Supplicant PAE originates an EAPOL-Logoff message (see 7.5.4) to the Authenticator PAE. As a result, the Authenticator PAE immediately places the controlled Port in the unauthorized state 1) It appears in the spec that there is no requirement or indeed method of the Supplicant PAE of confirming that the EAPOL-Logoff has been honoured. So the supplicant PAE could be in the unauthorised state while the Authenticator could be in the authorised state. Is this an over site of the dot1x spec, or is this meant to be handled at a higher level with EAP ? --- 2) On the termination of an EAP session, VLAN membership is usually altered, either to a MAC-Authorised VID a default unauthorised VID, or the port is blocked. Windows clients are pretty crap in terms of DHCP when this happens, and fail to renew their leases when moving between authorised and unauthorised states. Apple Mac clients however are very good in terms of DHCP dot1x integration. Unfortunately with EAP-Based and MAC-Based authentication transistions, DHCP renewal doesn't appear to work. This is what i've seen from the traces: FRAME 6436 - TS 212.482482 - Assumed VLAN 603 - Actual VLAN 603 - EAPOL Logoff FRAME 6440 - TS 212.484947 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP REQUEST FRAME 6443 - TS 212.487252 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP ACK (Answered by server on 603) FRAME 6454 - TS 212.529774 - Assumed VLAN 134 - Actual VLAN 134 - EAP Failure (Seems to denotate MAC Authentication succeeding) So it appears after the supplicant sends the EAPOL-Logoff, the DHCP client attempts to get a lease very quickly; so quickly in fact that the switch hasn't altered the state of the port. The result being that the DHCP request is acked by the DHCP server on the dot1x authorised VLAN, the VLAN transistion *then* occurs, but as the DHCP client has satisfied itself that it has a valid lease for the PAE unauthorised state it doesn't renew the lease until it expires... Should I be shouting at HP to get their switches to register the state change faster, or shouting at Apple to make their DHCP timings less agressive ? Many Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 ------------------------------ Message: 3 Date: Tue, 29 Apr 2008 17:50:14 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Subject: Re: dot1x specification EAPOL-Logoff clarification To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <481751C6.7050301(a)sussex.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Arran Cudbard-Bell wrote: > Hi, > > Having some interesting issues with a HP ProCurve 2510 an Apple Mac > Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same > wired port. > > I know this isn't strictly the list for this as this isn't really > RADIUS, but i'm not sure where to post... > > Two questions: > > IEE802.1x-2004 > 8.1.3 EAPOL-Logoff > When a Supplicant wishes the Authenticator PAE to perform a > logoff (i.e., to set the controlled Port state to > unauthorized), the Supplicant PAE originates an EAPOL-Logoff > message (see 7.5.4) to the Authenticator > PAE. As a result, the Authenticator PAE immediately places the > controlled Port in the unauthorized state > > 1) It appears in the spec that there is no requirement or indeed > method of the Supplicant PAE of confirming that the EAPOL-Logoff has > been honoured. So the supplicant PAE could be in the unauthorised > state while the Authenticator could be in the authorised state. Is > this an over site of the dot1x spec, or is this meant to be handled at > a higher level with EAP ? Sorry. Looking at the diagrams in 8-5 it appears my suspicion is correct. Unless a re-auth timer is implemented by the Authenticator PAE, this mismatched authentication state could persist indefinitely. The EAPOL-LOGOFF frame is *not* retransmitted to the Authentication server... and the Authenticator PAE does not respond to EAPOL-LOGOFF frames, it just alters it's state. So if the EAPOL-LOGOFF frame was lost in transit... damn, why no EAPOL-LOGOFF-CONFIRMATION packet ... In every other part of the EAP/dot1x spec a request *should* always be answered by a response... but not here... are these guys idiots, or am I being dense ?! See this would solve the issue in question 2 perfectly. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 ------------------------------ Message: 4 Date: Tue, 29 Apr 2008 14:14:16 -0400 From: "George KNIGHT" <georgeknight(a)gmail.com> Subject: HOWTO PEAP + FreeRadius + XP Client To: freeradius-users(a)lists.freeradius.org Message-ID: <d6da8e1d0804291114g56d9d9bfr2f58e923357e093e(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hello everyone, Before I write my question here, I just want to let all of you know that I did lots of searching in both google and this email list. But couldn't find anything to get the answer. My question is I have been looking for a HOWTO paper for a beginner to set freeradius as an AAA server in a wireless environment to Windows XP SP2 clients. I will use Windows' own PEAP client. Is there such a paper someone can give me the link? I'm very frustrated to find out that there is no information available for a setup from the scratch. I wrote papers like that before for various topics such as subversion implementation for a multiple OS environment, VoIP implementation with a Linux based open sources S/W etc. I have intention to write such a paper for how to set up PEAP implementation with freeradius as well. But for that, I'm hoping someone can give me a good start. OK, here is my network settings and needed information; I have a SUSE SLES 10 server to be used as an AAA server. This server is called store-AAA and also acts as a DHCP server for the clients. I have a few of Cisco 1242 AP as an authenticator. Clients are going to be computers with WinCE as their OS and they will contact to the LAN wirelessly. What I want to achieve is authenticating this clients with server-AAA using PEAP before letting them use the other network resources. Thank you in advance for your time and effort. George Knight

1 0