- Freeradius-Users - lists.freeradius.org

generating tls certificates for radius under centos
by David Hláčik 10 Apr '08

10 Apr '08

Hi all, i need to generate certificate files for radius tls. I am using CentOS 5.1 and scripts in /etc/pki/tls/misc for generated own CA key, and for own keys signed with my CA. For Radius i need a server certificate with xpextensions support. How can i generate server certificate with xpextensions which will be signed with my own CA on CentOS5.1? Thanks in advance! David

2 1

I have been struggling to get the EAP-TTLS to work.
by Johan Nyman 10 Apr '08

10 Apr '08

Hello all, I have been struggling to get the EAP-TTLS to work. I have been following this guide: <http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html> http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html And i think the setup of all things has gone fine (biggest problem i had was creating the certifcates). I have tested the connection with "raddtest" and the tool "NTRadPing" and everything seems ok. However when i try to connect from my Linux machine using WPA supplicant, the following errors appear in the Radius server console: ............................................................................ ....... Going to the next request Waking up in 4.9 seconds. User-Name = "johan(a)mediavisiongroup.se" NAS-IP-Address = 192.168.1.144 Called-Station-Id = "00-20-a6-64-c3-b1:MVG-Personal" Calling-Station-Id = "00-0f-cb-f9-3b-f9;MVG-Personal" NAS-Identifier = "MVG-1" State = 0xdea187e5dea3836d25979821eb25f055 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 Message-Authenticator = 0x80154e870b93b69627ead5a0eee17643 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "mediavisiongroup.se" for User-Name = "johan@med iavisiongroup.se" rlm_realm: No such realm "mediavisiongroup.se" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdea187e5dfa2926d25979821eb25f055 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 48 with timestamp +3 Cleaning up request 1 ID 49 with timestamp +3 Ready to process requests. ............................................................................ ....... The connection conf from the Linux box is (/etc/wpa_supplicant.conf): network={ ssid="MVG-Personal" scan_ssid=1 key_mgmt=WPA-EAP eap=TTLS identity="johan(a)mediavisiongroup.se" anonymous_identity="anonymous(a)example.com" password="foobar" ca_cert="/etc/cert/ca.pem" phase2="auth=MD5" } - I am guessing that the /etc/cert/ca.pem is the "client certification" i created from the freeradius. - User and password above (in the file /etc/wpa_supplicant.conf) do exist and is correct. They match the user and password in the file on the freeradius "/usr/local/etc/raddb/users". ............................................................................ ....... Also so i understand this, three certficates are needed for EAP-TTLS ? CA= root certifcate stored on the freeradius machine Server = certifcate also stored on the freeradius machine Client = certifcate copied to the client trying to connect And on the client the path in the "wpa_supplicant.conf" to the client certificate is correct. In short: the client seem to connect to the freeradius, but i am getting no IP to the client. ............................................................................ ....... Thanks very much for help! Best regards, Johan

3 2

windows cisco radius opendlap
by alois blasbichler 10 Apr '08

10 Apr '08

Hello list I am trying to let authenticate my users with radius/ldap before he can enter with hers windows-xp-clients my wireles-lan. We use a Cisco wireless lan controller 4400. We use opendlap for the users attributes : name, password(md5), sambapasswords But i cant get login to my WLAN with an windows-xp-client. Below is the log To explain the log : 10.53.240.10 is my cisco wireless lan controller The mac of my windows-xp-client is : 00-0E-35-5A-86-69 The username i tried is "test". The strange for me is that at the end i see: Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) But i see this message also when i use a wrong password Is this a miskonfiguration of my cisco ? I hope somebody can give me a help luis ################################################################### modcall: entering group authorize for request 284 modcall[authorize]: module "preprocess" returns ok for request 284 modcall[authorize]: module "chap" returns noop for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated for request 284 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 284 users: Matched DEFAULT at 162 users: Matched DEFAULT at 181 modcall[authorize]: module "files" returns ok for request 284 modcall[authorize]: module "mschap" returns noop for request 284 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'dc=sb-brixen,dc=it' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=sb-brixen,dc=it, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by radiusFilterId rlm_ldap: Added password {MD5}z+0c65+jByhDM1ldJwmp9w== in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value 54D7A5EF2DC6130A2831D83B84846A87 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value DB6CF596B290E59AC2265B23734E0DAC & op=21 rlm_ldap: Adding userPassword as User-Password, value { & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value pippoisok & op=11 rlm_ldap: user test authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 284 modcall: group authorize returns updated for request 284 rad_check_password: Found Auth-Type EAP auth: type "EAP" modcall: entering group authenticate for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: Unknown EAP type 21, reverting to default_eap_type rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns ok for request 284 modcall: group authenticate returns ok for request 284 Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) Sending Access-Challenge of id 121 to 10.53.240.10:32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Filter-Id = "pippoisok" EAP-Message = 0x0121001604108dbc391981d5f73f5291db28b51df479 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0fa7d26d9c7e4f52a6000443ea25ea878bdefd47999b2dd4735b2e46aefd2e0102593e6b Finished request 284 Going to the next request Waking up in 5 seconds... ###################################################################

2 1

Simultaneous use without DB
by Eduardo Lima 10 Apr '08

10 Apr '08

I want to limit one access per user on freeradius 2.0.2 but I don't want to use a database. Is that possible? I red the topic "FreeRadius V2.0.0 Simultaneous-Use Problems" wrote on january, but the author uses mysql. I'm using PEAP authentication with server-side certificate on freeradius 2.0.2. My users file is like this: eduardo Cleartext-Password := "emprel" Auth-Type := System, Simultaneous-Use := 1, Fall-Through = 1 Any idea?? --------------------------------- Abra sua conta no Yahoo! Mail, o único sem limite de espaço para armazenamento!

2 5

Hello,
by Johan Nyman 10 Apr '08

10 Apr '08

Hello all! I am trying to get a wireless client to connect to the Freeradius server using WPA & WPA2 Enterprise . I have followed this guide: http://www.smallnetbuilder.com/content/view/30213/98/1/5/ But I am getting a few error messages from the radius console: 1: ++[mschap] returns noop rlm_realm: No '@' in User-Name = "puppypc", looking up realm NULL rlm_realm: No such realm "NULL 2: rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation 3: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because o ++[pap] returns noop I am gussing that any of the above are a hint to what could be the problem, could anyone point me in the right direction here? On where to look/what to change. how to fix. Attaching the entire outtake from the radius console. Thanks for help, Best regards, Johan

1 0

WPA enterprise
by David Hláčik 10 Apr '08

10 Apr '08

Hi i have freeradius mschap ldap working configuration - i am using it for pptpd (VPN server) to authentificate against freeradius with ldap . Windows VPN client can connect to our company network and use it. Next i want to add user/password auth to our WIFI (based on Dlink AP - with radius support). We are currently using wpa-preshared key. i want to use wpa enterprise with ldap authentification (providing username and password) without need to install any certificate on windows. First to make a clear - how do i achieve it? --- i mean exactly which protocol i need to use and how it works (some shortcut to such howto) How do i arrange to use same freeradius for currently working VPN and for my plan to make wpa enterprise. Thanks in advance! David

2 7

WildcardCllients
by Andre Hübner 10 Apr '08

10 Apr '08

Hello List, i use freeradius 0.8.1 coming with my distribution (yes, older system) Is it necessary to declare every single client in clients.conf ? I want to use a "wildcard" client ip 0.0.0.0 to accept every client. This client ip is accepted in clients.conf but connect of real ip is ignored which is logged. I tried with 0.0.0.0/0 but this is errorneous. Is this setup possible or not wanted by developers? I did search the faq and web but did not found related topics. Thank you Andre

2 2

wpa2 - huntgroup problems
by Hans Bornemann 10 Apr '08

10 Apr '08

Hi, I have a problem with huntgroups and wpa2. It concerns the following: First, huntgroups works with ntradping and crypt-passwd: mysql-db unzinn | NT-Password | := | 7C53CFA5EA7D0F9B3B968AA0FB51A3F5 unzinn | crypt-password | == | $1$7ftISFCW$xp.n8LMOxfPD7GqdSJqZC1 unzinn | Huntgroup-Name | == | hrzvpn with wpa2 (PEAP/MSCHAPv2) it works only without the huntgroup entry. Is this a problem because of different adresses? Access-Request packet from host 129.217.169.191 .. NAS-IP-Address = 129.217.157.246 ? huntgroups: hrzvpn NAS-IP-Address == 129.217.157.246 debug: rad_recv: :32769, id=33, length=176 User-Name = "unzinn" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-9A-2D-30:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 129.217.157.246 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0201000b01756e7a696e6e Message-Authenticator = 0x2bf90a315bc202464b3819722bfef98e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "unzinn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 radius_xlat: 'unzinn' rlm_sql (sql): sql_set_user escaped user --> 'unzinn' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'unzinn' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'unzinn' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'unzinn' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'unzinn' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): No matching entry in the database for request from user [unzinn] modcall[authorize]: module "sql" returns notfound for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" .... Thanks Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

3 6

eap_tnc.c source not stricly C
by Andrew Hood 10 Apr '08

10 Apr '08

I know good style says newbies should lurk before posting, but anyway: Is freeradius supposed to be C89? src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c Is full of C++ comments and C99isms. -- REALITY.SYS not found: Universe halted.

3 4

unlang to overcome cisco zero tag issue and for dynamic vlan assignment
by bluelip＠gmail.com 10 Apr '08

10 Apr '08

We'd like to setup the following: A workstation is booted, the supplicant asks for the credentials, the cisco switch pa sses the credentials to a freeradius server, freeradius authenticates the user to an edirectory ldap server, freeradius decides which Tunnel-Private-Group-Id to send bac k to the switch to place the user into the correct VLAN. The authentication/authorization works fine. The cisco switch accepts the returned VL AN info if we 'hard code it into the users files such as with: DEFAULT Tunnel-Private-Group-ID:1 := 901 Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802 We attempted to make the configuration more generic by setting Tunnel-Private-Group-I D equal to an LDAP attribute in ldap.attrmap. This would automatically associate the VLAN ID w/ the user. replyItem Tunnel-Private-Group-ID ourldapattribforthevlan That didn't work because freeradius wasn't associating a tag with the attribute(or wa s setting it to zero when responding to the switch. A wireshark capture confirmed the 0 tag. We attempted to add a :1 after Tunnel-Private-Group-ID, but that didn't pan o ut either. We then attempted to use unlang in the users file to accomplish the same thing. (Tunn el-Client-Endpoint was added to ldap.attrmap as dummy variable to hold the 'ourldapat tribforthevlan' from LDAP) DEFAULT Tunnel-Private-Group-ID:1 := `%{reply:Tunnel-Client-Endpoint}`, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802 With this configuration, we tried countless combinations of backticks, single quotes, and double quotes. The best response we could send back to the switch was: Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "" Has anyone else come across the issue with Cisco not dealing w/ 0 tags? Is there a wa y to use unlang to pull in the variables to be used in the users file? Thank you for taking the time to read this. After a couple of days of searching, we s till haven't come up w/ the correct search terms for google. Thank you, Mike Coles -- This message was sent on behalf of bluelip(a)gmail.com at openSubscriber.com http://www.opensubscriber.com/messages/freeradius-users@lists.freeradius.or…

2 1