- Freeradius-Users - lists.freeradius.org

Re: newbie on radiustesting
by Si St 16 Apr '08

16 Apr '08

> ----- Original Message ----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Wed, 16 Apr 2008 20:11:11 +0100 > > > Hi, > > > Does the rlm_eap message tell you anything: > > yes, no EAP-Message - but thats just talking about the incoming > packet. are you running SELinux by any chance (just thinking > about the file permissions and why the servers cannot read the > cert....) A: I am running SuSE linux 10.0 and use the radius packages directly from that installation. Apparmor/subdomain is deactivated, due to the demands on the dazuko-module running AVIRA antivir. Do not think there is any security enhanced system here: linux:/etc/raddb # uname -a Linux linux 2.6.13-15.18-default #1 Tue Oct 2 17:36:20 UTC 2007 i686 i686 i386 GNU/Linux linux:/etc/raddb # l /boot/ insgesamt 6262 drwxr-xr-x 3 root root 584 2008-03-24 11:24 ./ drwxr-xr-x 27 root root 664 2008-04-13 13:22 ../ -rw------- 1 root root 512 2006-01-30 10:51 backup_mbr lrwxrwxrwx 1 root root 1 2006-01-30 10:48 boot -> ./ -rw------- 1 root root 512 2006-01-30 10:51 boot.0300 -rw-r--r-- 1 root root 512 2006-02-21 17:43 boot.0800 -rw-r--r-- 1 root root 63954 2007-10-03 20:33 config-2.6.13-15.18-default drwxr-xr-x 2 root root 456 2006-01-30 13:26 grub/ lrwxrwxrwx 1 root root 27 2008-03-24 11:21 initrd -> initrd-2.6.13-15.18-default -rw-r--r-- 1 root root 1748236 2008-03-24 11:20 initrd-2.6.13-15.18-default -rw------- 1 root root 220160 2008-03-24 11:24 map -rw-r--r-- 1 root root 133120 2008-03-07 18:16 message -rw-r--r-- 1 root root 73696 2007-10-03 20:33 symvers-2.6.13-15.18-i386-default.gz -rw-r--r-- 1 root root 756977 2007-10-03 20:24 System.map-2.6.13-15.18-default -rw-r--r-- 1 root root 1840531 2007-10-03 20:33 vmlinux-2.6.13-15.18-default.gz lrwxrwxrwx 1 root root 28 2008-03-24 11:21 vmlinuz -> vmlinuz-2.6.13-15.18-default -rw-r--r-- 1 root root 1545043 2007-10-03 20:24 vmlinuz-2.6.13-15.18-default -I did a online update recently, weeks ago, but the message after that on YaST gave inconsistency warning and a possible unstable system on radius, so I chose to go back to the original radius-package of the 10.0 CDs. After that no warning anymore, but should I go back and reinstall the update? > does it all work fine when you, as root, run 'radiusd -X' ? A: All running, both radiusd -X and rcradiusd start, is done as root, and unfortunately all messages comes from the user root. > > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

regular expression
by Kevin J 16 Apr '08

16 Apr '08

Is there a way that I can use for a regular expression to validate the username attribute? Something like User-Name =~ [0-9a-zA-Z.#_] I think . or # does not work. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Assistance with Compiling pam_radius_auth Please.
by chase pettet 16 Apr '08

16 Apr '08

Greetings list, This host is running CentOS 4.3. uname -r output "2.6.9-67.0.4.plus.c4smp". I have tried looking for an already compiled module for PAM on centos without success, my google-foo is weak apparently. I downloaded the tar file straight from freeradius.org. When I unpacked and tried using "make" (as root) in the folder I get the following output. I am not much of a programmer so this error looks very confusing to me. Any help would be greatly appreciated. > [root@host pam_radius-1.3.17]# make > cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o > pam_radius_auth.c:63:34: security/pam_modules.h: No such file or directory > pam_radius_auth.c:156: error: syntax error before '*' token > pam_radius_auth.c: In function `_int_free': > pam_radius_auth.c:158: error: `x' undeclared (first use in this function) > pam_radius_auth.c:158: error: (Each undeclared identifier is reported only > once > pam_radius_auth.c:158: error: for each function it appears in.) > pam_radius_auth.c: In function `host2server': > pam_radius_auth.c:270: error: `PAM_AUTHINFO_UNAVAIL' undeclared (first use > in this function) > pam_radius_auth.c:312: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c: In function `initialize': > pam_radius_auth.c:600: error: `PAM_ABORT' undeclared (first use in this > function) > pam_radius_auth.c:659: error: `PAM_AUTHINFO_UNAVAIL' undeclared (first use > in this function) > pam_radius_auth.c:691: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c: In function `talk_radius': > pam_radius_auth.c:798: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:995: error: `PAM_IGNORE' undeclared (first use in this > function) > pam_radius_auth.c:997: error: `PAM_AUTHINFO_UNAVAIL' undeclared (first use > in this function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1014: error: syntax error before '*' token > pam_radius_auth.c: In function `rad_converse': > pam_radius_auth.c:1017: error: storage size of 'resp_msg' isn't known > pam_radius_auth.c:1022: error: `msg_style' undeclared (first use in this > function) > pam_radius_auth.c:1023: error: `message' undeclared (first use in this > function) > pam_radius_auth.c:1027: warning: implicit declaration of function > `pam_get_item' > pam_radius_auth.c:1027: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1027: error: `PAM_CONV' undeclared (first use in this > function) > pam_radius_auth.c:1028: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:1030: error: dereferencing pointer to incomplete type > pam_radius_auth.c:1030: error: dereferencing pointer to incomplete type > pam_radius_auth.c:1033: error: `password' undeclared (first use in this > function) > pam_radius_auth.c:1042: error: dereferencing pointer to incomplete type > pam_radius_auth.c:1017: warning: unused variable `resp_msg' > pam_radius_auth.c: At top level: > pam_radius_auth.c:1061: error: syntax error before "int" > pam_radius_auth.c:1062: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_authenticate': > pam_radius_auth.c:1070: error: `PAM_AUTH_ERR' undeclared (first use in > this function) > pam_radius_auth.c:1078: error: `argc' undeclared (first use in this > function) > pam_radius_auth.c:1078: error: `argv' undeclared (first use in this > function) > pam_radius_auth.c:1081: warning: implicit declaration of function > `pam_get_user' > pam_radius_auth.c:1081: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1082: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:1082: warning: implicit declaration of function > `pam_set_data' > pam_radius_auth.c:1088: error: `PAM_USER_UNKNOWN' undeclared (first use in > this function) > pam_radius_auth.c:1097: error: `PAM_RUSER' undeclared (first use in this > function) > pam_radius_auth.c:1102: warning: assignment from incompatible pointer type > pam_radius_auth.c:1121: error: `PAM_SERVICE' undeclared (first use in this > function) > pam_radius_auth.c:1135: error: `PAM_AUTHTOK' undeclared (first use in this > function) > pam_radius_auth.c:1152: error: `PAM_PROMPT_ECHO_OFF' undeclared (first use > in this function) > pam_radius_auth.c:1168: error: `PAM_RHOST' undeclared (first use in this > function) > pam_radius_auth.c:1199: error: `PAM_AUTHINFO_UNAVAIL' undeclared (first > use in this function) > pam_radius_auth.c:1216: error: `PAM_PROMPT_ECHO_ON' undeclared (first use > in this function) > pam_radius_auth.c:1241: warning: implicit declaration of function > `pam_set_item' > pam_radius_auth.c: At top level: > pam_radius_auth.c:1268: error: syntax error before "int" > pam_radius_auth.c:1269: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_setcred': > pam_radius_auth.c:1273: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:1275: warning: implicit declaration of function > `pam_get_data' > pam_radius_auth.c:1275: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1283: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_private_session': > pam_radius_auth.c:1289: error: `PAM_AUTH_ERR' undeclared (first use in > this function) > pam_radius_auth.c:1297: error: `argc' undeclared (first use in this > function) > pam_radius_auth.c:1297: error: `argv' undeclared (first use in this > function) > pam_radius_auth.c:1300: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1301: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:1301: error: `PAM_SESSION_ERR' undeclared (first use in > this function) > pam_radius_auth.c:1306: error: `PAM_USER_UNKNOWN' undeclared (first use in > this function) > pam_radius_auth.c:1321: error: `PAM_SERVICE' undeclared (first use in this > function) > pam_radius_auth.c:1336: error: `status' undeclared (first use in this > function) > pam_radius_auth.c:1355: error: `PAM_PERM_DENIED' undeclared (first use in > this function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1369: error: syntax error before "int" > pam_radius_auth.c:1370: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_open_session': > pam_radius_auth.c:1373: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1373: error: `flags' undeclared (first use in this > function) > pam_radius_auth.c:1373: error: `argc' undeclared (first use in this > function) > pam_radius_auth.c:1373: error: `argv' undeclared (first use in this > function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1376: error: syntax error before "int" > pam_radius_auth.c:1377: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_close_session': > pam_radius_auth.c:1380: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1380: error: `flags' undeclared (first use in this > function) > pam_radius_auth.c:1380: error: `argc' undeclared (first use in this > function) > pam_radius_auth.c:1380: error: `argv' undeclared (first use in this > function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1387: error: syntax error before "int" > pam_radius_auth.c:1388: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_chauthtok': > pam_radius_auth.c:1395: error: `PAM_AUTHTOK_ERR' undeclared (first use in > this function) > pam_radius_auth.c:1404: error: `argc' undeclared (first use in this > function) > pam_radius_auth.c:1404: error: `argv' undeclared (first use in this > function) > pam_radius_auth.c:1407: error: `pamh' undeclared (first use in this > function) > pam_radius_auth.c:1408: error: `PAM_SUCCESS' undeclared (first use in this > function) > pam_radius_auth.c:1413: error: `PAM_USER_UNKNOWN' undeclared (first use in > this function) > pam_radius_auth.c:1428: error: `PAM_SERVICE' undeclared (first use in this > function) > pam_radius_auth.c:1437: error: `PAM_OLDAUTHTOK' undeclared (first use in > this function) > pam_radius_auth.c:1442: error: `PAM_AUTHTOK' undeclared (first use in this > function) > pam_radius_auth.c:1447: error: `flags' undeclared (first use in this > function) > pam_radius_auth.c:1447: error: `PAM_PRELIM_CHECK' undeclared (first use in > this function) > pam_radius_auth.c:1449: error: `PAM_PROMPT_ECHO_OFF' undeclared (first use > in this function) > pam_radius_auth.c:1475: error: `PAM_PERM_DENIED' undeclared (first use in > this function) > pam_radius_auth.c:1500: error: `PAM_ERROR_MSG' undeclared (first use in > this function) > pam_radius_auth.c:1552: error: `PAM_UPDATE_AUTHTOK' undeclared (first use > in this function) > pam_radius_auth.c: At top level: > pam_radius_auth.c:1616: error: syntax error before "int" > pam_radius_auth.c:1617: error: syntax error before '*' token > pam_radius_auth.c: In function `pam_sm_acct_mgmt': > pam_radius_auth.c:1620: error: `PAM_SUCCESS' undeclared (first use in this > function) > make: *** [pam_radius_auth.o] Error 1 Thanks, Chase

2 1

Re: newbie on radiustesting
by Si St 16 Apr '08

16 Apr '08

> ----- Original Message ----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Wed, 16 Apr 2008 18:51:12 +0100 > > > Hi, > > FreeRADIUS Version 1.0.4, for host , built on Sep 13 2005 > > > > I might not know what I am doing, but what is the first thing for > > me do to here? > > ...update to 2.0.3? ;-) > > > But changing no other tings, leaving the test-setup (unchanged > > files in /etc/raddb/certs from the installation of radius-package > > in YaST) as it was. > > you need to ensure that the process you run freeradius (radiusd daemon) as > (which is probably 'radiusd' id) has permission to read the /etc/raddb/certs > directory. > > alan > - ------------------------------------------ Answ to Alan: I think it has the permissions: linux:/etc/raddb # id radiusd uid=105(radiusd) gid=104(radiusd) Gruppen=104(radiusd) ls -l: drw-r----- 3 root radiusd 472 2008-03-31 22:53 certs/ /etc/group: radiusd:!:104: -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

newbie on radiustesting
by Si St 16 Apr '08

16 Apr '08

FreeRADIUS Version 1.0.4, for host , built on Sep 13 2005 I might not know what I am doing, but what is the first thing for me do to here? (take a look at the /linux:~ # radiusd -X / part further down) Are these errors in the debugmode caused by not running the script saying in eap.conf: ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh Or are the errors caused by other tings? What I simply have done is to uncomment the EAP part in eap.conf in this way: tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # check_cert_cn = %{User-Name} } But changing no other tings, leaving the test-setup (unchanged files in /etc/raddb/certs from the installation of radius-package in YaST) as it was. ----------------------------------------------------------------------------------- linux:~ # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" 21278:error:0200100D:system library:fopen:Permission denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') 21278:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: 21278:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:274: rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed. ------------------------------------------------------------- Here is another output after the reconfiguration of eap.conf: linux:/etc/raddb # rcradiusd status Checking for service radiusd unused linux:/etc/raddb # rcradiusd start Starting RADIUS daemon 21816:error:0200100D:system library:fopen:Permission denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') 21816:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: 21816:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:274: startproc: exit status of parent of /usr/sbin/radiusd: 1 failed -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

ENV variables in external scripts
by rsg 16 Apr '08

16 Apr '08

Hi, I need to check an environmental varible with an external script. For example to capture Calling-Station-Id and check it in an external database using a perl script # ../users : . DEFAULT Auth-Type = None Exec-Program-Wait = "/root/check.pl %i", Reply-Message := "Valid Caller-Id, access granted -> %{Calling-station-Id}", Fall-Through = Yes : . How could I call this ENV variable in my perl script ("/root/check.pl) ? I unsuccessfully attempted the options given by ../docs/variables.txt. Please help with the correct syntax. Thanks in advance. rsg

5 27

Cisco NAS and 4GB Problem
by Andreas M. 16 Apr '08

16 Apr '08

Hello, i have some troubles with a cisco NAS, with a 4GB problem in the Accounting Data. First i have gigawords enabled, also the sql queries, but this is not the reason. I have also accounting for the upstream interface enabled, but the error exists only for users, that are connected via virtual-interfaces (pptp dialup). Maybe this problem is not realy radius related, but i hope to find an answer. I included some log entries and config examples, maybe someone has any experience with this errors. regards, Andreas M. Here is the last interim update: Tue Apr 15 23:23:46 2008 Acct-Session-Id = "00000006" Tunnel-Medium-Type:0 = IPv4 Tunnel-Assignment-Id:0 = "1" Tunnel-Server-Auth-Id:0 = "A_Router" Acct-Tunnel-Connection = "40682" Framed-Protocol = PPP Framed-IP-Address = 10.1.0.1 User-Name = "6543765" Acct-Session-Time = 28088 Acct-Input-Octets = 18615686 Acct-Output-Octets = 218389141 Acct-Input-Packets = 226199 Acct-Output-Packets = 305451 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual NAS-Port = 3 NAS-Port-Id = "Uniq-Sess-ID3" Service-Type = Framed-User NAS-IP-Address = 192.168.1.11 Acct-Delay-Time = 0 Client-IP-Address = 192.168.1.11 Acct-Unique-Session-Id = "ba144af9c3c26fc1" Timestamp = 1208294626 Here is the last stop record from the nas: Tue Apr 15 23:26:28 2008 Acct-Session-Id = "00000006" Tunnel-Medium-Type:0 = IPv4 Tunnel-Assignment-Id:0 = "1" Tunnel-Server-Auth-Id:0 = "A_Router" Acct-Tunnel-Connection = "40682" Framed-Protocol = PPP Framed-IP-Address = 10.1.0.1 User-Name = "6543765" Acct-Authentic = RADIUS Acct-Session-Time = 28250 Acct-Input-Octets = 4294967295 Acct-Output-Octets = 4294966951 Acct-Input-Packets = 0 Acct-Output-Packets = 4294967290 Acct-Terminate-Cause = NAS-Error Acct-Status-Type = Stop NAS-Port-Type = Virtual NAS-Port = 3 NAS-Port-Id = "Uniq-Sess-ID3" Service-Type = Framed-User NAS-IP-Address = 192.168.1.11 Acct-Delay-Time = 0 Client-IP-Address = 192.168.1.11 Acct-Unique-Session-Id = "ba144af9c3c26fc1" Timestamp = 1208294788 Cisco config: System image file is "flash:c180x-advipservicesk9-mz.124-11.XW6.bin" A_Router#sh aaa attributes | inc giga Type=118 Name=input-giga-words Format=Ulong Type=250 Name=output-giga-words Format=Ulong aaa new-model ! ! aaa authentication login default local aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization commands 15 default local aaa authorization network default group radius local aaa accounting delay-start aaa accounting nested aaa accounting update periodic 3 aaa accounting network default start-stop group radius interface Virtual-Template1 ip unnumbered Loopback0 ip nat inside no ip virtual-reassembly no logging event link-status no snmp trap link-status ppp encrypt mppe 128 required ppp authentication ms-chap ms-chap-v2

2 4

detail sql logging problem
by A.L.M.Buxey＠lboro.ac.uk 16 Apr '08

16 Apr '08

hi, further to last email, heres example packet: Tue Apr 15 12:20:56 2008 User-Name = "xxxxx" NAS-Port = 29 NAS-IP-Address = 192.168.1.28 Framed-IP-Address = 192.168.0.3 NAS-Identifier = "wism" Airespace-Wlan-Id = 1 Acct-Session-Id = "48048f97/00:11:12:12:14:11/8514" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "222" Acct-Status-Type = Stop Acct-Input-Octets = 1942107 Acct-Output-Octets = 5085070 Acct-Input-Packets = 9162 Acct-Output-Packets = 8299 Acct-Terminate-Cause = Lost-Service Acct-Session-Time = 0 Acct-Delay-Time = 0 Calling-Station-Id = "192.168.0.3" Called-Station-Id = "192.168.1.28" Acct-Unique-Session-Id = "f7ebd89424c03437" Timestamp = 1208258456 Request-Authenticator = Verified as you can see, Stop request, due to lost service. however, sessio-time is 0 - i suspect this is because of mobility. they've moved from one wism controller to another or from one AP to another and then left the network altogther. either way, kit is reporting the value. in our SQL logging we look for the Acct-Session-Id, and the Timestamp and then use those to create the session time due to wierdnesses (see the example UPDATE comand in sql/postgresl/dialup.conf to get what I mean) so hope we dont actually care about what the kit tells us(!) alan

2 4

encrypted passwords in users file
by ashish verma 16 Apr '08

16 Apr '08

Hi all, Is it possible to keep encrypted passwords in users file? For e.g. test Cleartext-Password := "test" Service-type = NAS-Prompt-User instead of cleartext can we have encrypted passwords here. Thanks. On Thu, Mar 13, 2008 at 4:32 PM, < freeradius-users-owner(a)lists.freeradius.org> wrote: > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > freeradius-users-owner(a)lists.freeradius.org. > > > > ---------- Forwarded message ---------- > From: "ashish verma" <ashish.scit(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Date: Thu, 13 Mar 2008 16:32:21 +0530 > Subject: encrypted passwords in users file > Hi all, > > Is it possible to keep encrypted passwords in users file? > > For e.g. test Cleartext-Password := "test" > Service-type = NAS-Prompt-User > > instead of cleartext can we have encrypted passwords here. > > Thanks. > > > > On Tue, Oct 23, 2007 at 2:03 PM, < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Are SHA-256 certificates supported? (hannu.lammi(a)wipsl.com) > > 2. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Alan DeKok) > > 3. Re: TTLS with Mutual Authentication (Alan DeKok) > > 4. Re: Are SHA-256 certificates supported? (Alan DeKok) > > 5. FreeRADIUS and SNMP questions (Geoffroy Arnoud) > > 6. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (primoz) > > 7. Re: FreeRADIUS and SNMP questions (Alan DeKok) > > 8. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Alan DeKok) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 23 Oct 2007 10:10:05 +0300 (EEST) > > From: hannu.lammi(a)wipsl.com > > Subject: Are SHA-256 certificates supported? > > To: freeradius-users(a)lists.freeradius.org > > Message-ID: <14671.192.100.116.143.1193123405.squirrel(a)mail.wipsl.com> > > Content-Type: text/plain;charset=utf-8 > > > > Hi, > > > > I need to set up a RADIUS server that accepts certificates which use > > SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have set > > up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the > > box. > > > > After verifying that EAP-TLS authentication works with SHA-1 > > certificates > > I switched to SHA-256 certificate that was created with OpenSSL 0.9.8b, > > the same that FreeRADIUS was compiled against. > > > > Here's a snippet of the log I got from my SHA-256 test: > > > > ===== > > --> verify error:num=7:certificate signature failure > > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error > > TLS Alert write:fatal:decrypt error > > TLS_accept:error in SSLv3 read client certificate B > > rlm_eap: SSL error error:0D0C50A1:asn1 encoding > > routines:ASN1_item_verify:unknown message digest algorithm > > ===== > > > > It would seem there's a problem somewhere. It may very well be in the > > client I'm using. > > > > So, I'd like to know if FreeRADIUS supports SHA-256 certificates? > > If it doesn't, is the support for them planned? > > > > thanks in advance, > > - Hannu > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 23 Oct 2007 09:12:03 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: Freeradius doesn't detect EAP when authenticating against > > MySQL > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471D9EC3.4090609(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > preem wrote: > > > So, what is a common practice to do this then? > > > > It's not. > > > > People store MD5 or crypt'd passwords when the ONLY authentication > > they're doing is PAP. i.e. Unix logins, where the user supplies a > > clear-text password to the authentication system. > > > > For many EAP types, people do NOT store MD5 or crypt'd passwords, > > because they're useless. > > > > > I understand its not very > > > safe nor sane to store passwords in clear text, thats why I wanted to > > avoid > > > that, however it seems inevitable. > > > > It is safe, sane, and common practice to store passwords in clear text. > > > > > I am managing a wired network for some 300 users, its a student dorm > > and the > > > university owns the network and they require authentication for the > > ease of > > > management and control. 802.1x felt like the right way to go, because > > we are > > > planning some wireless access points as well. There are HP's Procurve > > 2650 > > > switches in use. I choose mysql db backend, because I also created set > > of > > > PHP scripts, where users can change their passwords and admin can > > > add/del/modify user info. > > > So what can one do to avoid storing passes in clear text or is it sane > > > enough? The server also serves some web pages and dhcp requests. > > > > Ensure that no one has physical access to the system storing the > > passwords. Ensure that no one has network access to the system storing > > the passwords. > > > > I would also suggest running the RADIUS server and/or the MySQL server > > with passwords on a separate machine from the web/dhcp server. That > > way, if someone breaks into the web server, they won't have access to > > the passwords. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 3 > > Date: Tue, 23 Oct 2007 09:23:50 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: TTLS with Mutual Authentication > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471DA186.5030601(a)deployingradius.com> > > Content-Type: text/plain; charset=UTF-8 > > > > Zolotov, Eyal wrote: > > > By ?mutual authentication? I refer to the following authentication > > process: > > > > > > 1. The client authenticate the server > > > > Give the client the CA cert used to sign the server cert. > > > > > 2. The server authenticate the client > > > > Create a client cert, signed by the server cert. > > > > > 3. Only than ? the clients sends username + password using > > MSCHAPv2 > > > > In unlang, set: > > > > update control { > > EAP-TLS-Require-Client-Cert = yes > > } > > > > This forces the server to validate the client cert, which is normally > > not required for TTLS. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 4 > > Date: Tue, 23 Oct 2007 09:25:33 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: Are SHA-256 certificates supported? > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471DA1ED.9050806(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > hannu.lammi(a)wipsl.com wrote: > > > I need to set up a RADIUS server that accepts certificates which use > > > SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have > > set > > > up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the > > > box. > > > > If OpenSSL supports it, AND the client supplicant supports it, it > > should work. > > > > > Here's a snippet of the log I got from my SHA-256 test: > > > > > > ===== > > > --> verify error:num=7:certificate signature failure > > > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error > > > TLS Alert write:fatal:decrypt error > > > TLS_accept:error in SSLv3 read client certificate B > > > rlm_eap: SSL error error:0D0C50A1:asn1 encoding > > > routines:ASN1_item_verify:unknown message digest algorithm > > > > That would seem to be an SSL issue. > > > > > So, I'd like to know if FreeRADIUS supports SHA-256 certificates? > > > If it doesn't, is the support for them planned? > > > > FreeRADIUS doesn't support SSL. It uses OpenSSL, which *does* support > > SSL. So if there are SSL issues, find out why OpenSSL doesn't like the > > TLS session. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 5 > > Date: Tue, 23 Oct 2007 10:04:23 +0200 (CEST) > > From: Geoffroy Arnoud <garnoud(a)yahoo.co.uk> > > Subject: FreeRADIUS and SNMP questions > > To: FreeRADIUS users <freeradius-users(a)lists.freeradius.org> > > Message-ID: <626622.60897.qm(a)web27314.mail.ukl.yahoo.com> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Hi all, > > > > I have 2 questions regarding FreeRADIUS and SNMP: > > > > 1/ Is it possible to run 2 FreeRADIUS servers on the > > same box, with SNMP support activated? I understand > > it's possible, using distinct values for smux_password > > parameter. > > > > 2/ Connecting FreeRADIUS to Net-SNMP using SMUX is > > quite easy. Has anyone connected FreeRADIUS with BMC > > PAtrol agent using SMUX? > > > > Thanks for any answer > > > > Geoff. > > > > > > > > _____________________________________________________________________________ > > Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! > > Mail > > > > > > ------------------------------ > > > > Message: 6 > > Date: Tue, 23 Oct 2007 10:08:22 +0200 > > From: primoz <primski(a)gmail.com> > > Subject: Re: Freeradius doesn't detect EAP when authenticating against > > MySQL > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: > > <ead364dc0710230108u752b2593h4a7885ca04e61ce7(a)mail.gmail.com> > > Content-Type: text/plain; charset="iso-8859-1" > > > > On 10/23/07, Alan DeKok <aland(a)deployingradius.com> wrote: > > > > > > preem wrote: > > > > So, what is a common practice to do this then? > > > > > > It's not. > > > > > > People store MD5 or crypt'd passwords when the ONLY authentication > > > they're doing is PAP. i.e. Unix logins, where the user supplies a > > > clear-text password to the authentication system. > > > > > > > > And PAP is not very safe and smart way to go as i read it. > > > > For many EAP types, people do NOT store MD5 or crypt'd passwords, > > > because they're useless. > > > > > > > > So, crypted passwords are usefull only in web applications? I read a lot > > lately about, how one should never store passwords in clear text, i > > guess > > that applies only to web apps. > > > > > I understand its not very > > > > safe nor sane to store passwords in clear text, thats why I wanted > > to > > > avoid > > > > that, however it seems inevitable. > > > > > > It is safe, sane, and common practice to store passwords in clear > > text. > > > > > > > > I do not have many experience with this, in fact its my first project on > > the > > matter. > > > > > I am managing a wired network for some 300 users, its a student dorm > > and > > > the > > > > university owns the network and they require authentication for the > > ease > > > of > > > > management and control. 802.1x felt like the right way to go, > > because we > > > are > > > > planning some wireless access points as well. There are HP's > > Procurve > > > 2650 > > > > switches in use. I choose mysql db backend, because I also created > > set > > > of > > > > PHP scripts, where users can change their passwords and admin can > > > > add/del/modify user info. > > > > So what can one do to avoid storing passes in clear text or is it > > sane > > > > enough? The server also serves some web pages and dhcp requests. > > > > > > Ensure that no one has physical access to the system storing the > > > passwords. Ensure that no one has network access to the system > > storing > > > the passwords. > > > > > > > > That will be no problem, since I'm the only one with physical access. > > > > I would also suggest running the RADIUS server and/or the MySQL server > > > with passwords on a separate machine from the web/dhcp server. That > > > way, if someone breaks into the web server, they won't have access to > > > the passwords. > > > > > > I am using VMWare server, so that won't require much work. > > > > Alan DeKok. > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > > Thanks again, for clearing this up. > > > > primski > >

3 9

pam_radius authentication problem - no password?
by Enno 16 Apr '08

16 Apr '08

Hi, I have problems using pam_radius to authenticate users using our freeradius server. I want to use it with openvpn but tested it with ssh. The new part of my /etc/pam.d/ssh looks like: # /etc/security/pam_env.conf. auth required pam_env.so # [1] auth sufficient /lib/security/pam_radius_auth.so debug try_first_pass To nail the problem down I added some debug info to pam_radius_auth.c: /* grab the password (if any) from the previous authentication layer */ retval = pam_get_item(pamh, PAM_AUTHTOK, (CONST void **) &password); DPRINT(LOG_DEBUG, "Get password retval: %d, %d", retval, PAM_SUCCESS); PAM_FAIL_CHECK; DPRINT(LOG_DEBUG, "X Got password %s", password); if(password) { password = strdup(password); DPRINT(LOG_DEBUG, "Got password %s", password); } My auth.log file then says: Apr 15 13:55:04 openvpnserver sshd[29747]: pam_radius_auth: Got user name enno Apr 15 13:55:04 openvpnserver sshd[29747]: pam_radius_auth: Get password retval: 0, 0 Apr 15 13:55:04 openvpnserver sshd[29747]: pam_radius_auth: X Got password (null) Apr 15 13:55:04 openvpnserver sshd[29747]: pam_radius_auth: Sending RADIUS request code 1 Apr 15 13:55:09 openvpnserver sshd[29747]: pam_radius_auth: RADIUS server <our_radius_server> failed to respond Apr 15 13:55:09 openvpnserver sshd[29747]: pam_radius_auth: All RADIUS servers failed to respond. Apr 15 13:55:09 openvpnserver sshd[29747]: pam_radius_auth: authentication failed There seem to be problems connecting to the radius server sometimes, but I think this isn't the problem here. When the connection works, I get radius response code 3 (afair). I'm testing this on the target machine (openvpn server) using "ssh -l enno 127.0.0.1" and some random password (first I tried with the correct password and then started debugging). Looking at the code of pam_radius_auth.c and at the output of auth.log I would say the call to pam seems to not return the AUTHTOK. The call succedes, but the password pointer is NULL. Any ideas? Thanks in advance Enno Gröper

2 1