- Freeradius-Users - lists.freeradius.org

Dan Schaffer is out of the office.
by Dan Schaffer 11 Apr '08

11 Apr '08

I will be out of the office starting 04/11/2008 and will not return until 04/14/2008. Thank you and have a nice day, Dan

1 0

starting FreeRADIUS server
by patel bhavin 11 Apr '08

11 Apr '08

Hi, I have installed radius server but when i enter radius -X. It shows the following error. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: /usr/local/etc/raddb/radiusd.conf[210]: Error binding to port for 0.0.0.0 port 1812 What should I do? I want to install Free radius for simple authentication with JAAS. Thanking you, -- Bhavinkumar G Patel __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: Modifying User-Name and User-Password attributes in a module
by Stefan Winter 11 Apr '08

11 Apr '08

Hi! > Thanks, You're right, unlang is a powerful tool. I just finished reading > it's man page. it has very interesting features. (accessing run-time The suggested way of working with this software is 1. read the man page and other documentation 2. ask the mailing list 3. modify source code Your complete inversion of this order didn't seem to work well. > variables is wonderful). Your assumptions on my scenario is almost true > and I do believe that your suggestion (regex in unlang) can completely > remove any need for using a module in order to modify a request. > However, In this specific scenario, I need much more further processing > which should be done before I can decide to send a REJECT or ACCEPT. For > example, I have to send extracted OTP to a remote authentication manager > which it's answer would determine final authentication result. > In more detail it should be something like: open a socket, create a > specific request packet, send it, wait for answer, parse the answer > packet, and do further processing based on received answer from 2FA server. > Also, if we consider multi threading operation, there might be more > issues that need to be taken care of. > Nevertheless, I believe even using a powerful tool like unlang cannot > eliminate the need for an extra module. However, having a significant > part of the whole job done by unlang this might only need a small python > or perl module. Yes. rlm_perl can be used to safely embed perl into pakcet processing, and it should even be thread-safe, if perl is compiled accordingly. In your scenario, I guess you would want to use the mangling we talked about to send the request to the remote RADIUS proxy, and then when its answer comes back do your out-of-band perl post-processing. The place for this is in the post-auth { } section. Yes, in post-auth you can turn a Access-Accept from a remote reply into a reject. Make your rlm_perl module return failure as return code and you're done. > Well, even if I just need to use a "update" in configuration files to do > the job, I need to do it in right the place, I mean request, reply, > proxy or proxy_reply. candidates for this one (password modification) > are "request" and "proxy". I wonder if doing it in "proxy" can confuse > freeradius for doing further process on it. I'm not sure. All I can say is that I do all my mangling during authorize { }, and it works. pre-proxy might as well, you just have to try it. > Again. Thanks for your great and helpful suggestions. Sometimes I'm tempted to kick my butt because I give free consultancy. I accept Ferraris as gratuity gifts, you know? ;-) Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

ttls with mschapV2 authentication problem
by Cristian Novac 11 Apr '08

11 Apr '08

Could someone please take a look at the attached log file and give me a hint about how to solve the problem. Please ignore the lines beggining with ***********;I used them to debug something else previously. Thank you. Cristian Starting FreeRADIUS:FreeRADIUS Version 2.0.0, for host i686-pc-linux-gnu, built on Apr 7 2008 at 15:56:51 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/radiusd.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/proxy.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/clients.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/snmp.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/eap.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/sql.conf including configuration file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/sql/mysql/dialup.conf including dictionary file /udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/dictionary main { prefix = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/" localstatedir = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var" logdir = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius" libdir = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//lib" radacctdir = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/run/radiusd/radiusd.pid" checkrad = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = no } log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes log_stripped_names = no log_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius/radius.log" } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = yes dead_time = 120 wake_all_if_all_dead = no } realm asb.com { authhost = LOCAL accthost = LOCAL } realm LOCAL { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//etc/raddb/certs/NEW/server-key.pem" certificate_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//etc/raddb/certs/NEW/server.pem" CA_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//etc/raddb/certs/NEW/ca-cert.pem" private_key_password = "asb#1234" dh_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//etc/raddb/certs/NEW/dh" random_file = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//etc/raddb/certs/NEW/random" fragment_size = 1024 include_length = yes check_crl = yes } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/huntgroups" hints = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/users" acctusersfile = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/acct_users" preproxy_usersfile = "/udir/novac/FREERADIUS_WIMAX_INSTALLED/etc/raddb/preproxy_users" compat = "no" } ************************************** cp after=000000100104a501 *********************subattr_name=PacketDataFlowID *********************subattr_value=0083 ************************************* da->attr=1 *********************subattr_name=ServiceDataFlowID *********************subattr_value=0083 ************************************* da->attr=2 *********************subattr_name=Direction *********************subattr_value=03 ************************************* da->attr=4 *********************subattr_name=ActivationTrigger *********************subattr_value=04 ************************************* da->attr=5 *********************subattr_name=TransportType *********************subattr_value=01 ************************************* da->attr=6 *********************subattr_name=UplinkQosID *********************subattr_value=83 ************************************* da->attr=7 *********************subattr_name=DownlinkQoSID *********************subattr_value=84 ************************************* da->attr=8 ************************************** cp after=000104008302040083040303050304060301070383080384 *********************subattr_name=QoSID *********************subattr_value=83 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=02 ************************************* da->attr=4 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=000F4000 ************************************* da->attr=6 *********************subattr_name=MediaFlowType *********************subattr_value=02 ************************************* da->attr=12 ************************************** cp after=800103830403020606000F40000c0302 *********************subattr_name=QoSID *********************subattr_value=84 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=02 ************************************* da->attr=4 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=001F4000 ************************************* da->attr=6 *********************subattr_name=MediaFlowType *********************subattr_value=02 ************************************* da->attr=12 ************************************** cp after=000103840403020606001F40000c0302 ************************************** cp after=0001041111040303050304060301070311 ************************************** cp after=000103110403060706000fa0000906000000140a06000000140c03010d040014 ************************************** cp after=0001041111040303050304060301070312 ************************************** cp after=000103120403060706002ee3e80906000000140a06000000140c03010d040014 ************************************** cp after=800104008302040083040303050304060301070383080384 ************************************** cp after=0001041111040303050304060301070312 ************************************** cp after=800103830403020606000F40000c0302 ************************************** cp after=800103840403020606001F40000c0302 ************************************** cp after=000103120403060706002ee3e80906000000140a06000000140c03010d040014 ************************************** cp after=0001041112040303050304060301070313080314 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 ************************************** cp after=000103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 *********************subattr_name=PacketDataFlowID *********************subattr_value=1112 ************************************* da->attr=1 *********************subattr_name=Direction *********************subattr_value=03 ************************************* da->attr=4 *********************subattr_name=ActivationTrigger *********************subattr_value=04 ************************************* da->attr=5 *********************subattr_name=TransportType *********************subattr_value=01 ************************************* da->attr=6 *********************subattr_name=UplinkQosID *********************subattr_value=13 ************************************* da->attr=7 *********************subattr_name=DownlinkQoSID *********************subattr_value=14 ************************************* da->attr=8 ************************************** cp after=8001041112040303050304060301070313080314 *********************subattr_name=PacketDataFlowID *********************subattr_value=0083 ************************************* da->attr=1 *********************subattr_name=ServiceDataFlowID *********************subattr_value=0083 ************************************* da->attr=2 *********************subattr_name=Direction *********************subattr_value=03 ************************************* da->attr=4 *********************subattr_name=ActivationTrigger *********************subattr_value=04 ************************************* da->attr=5 *********************subattr_name=TransportType *********************subattr_value=01 ************************************* da->attr=6 *********************subattr_name=UplinkQosID *********************subattr_value=83 ************************************* da->attr=7 *********************subattr_name=DownlinkQoSID *********************subattr_value=84 ************************************* da->attr=8 ************************************** cp after=000104008302040083040303050304060301070383080384 *********************subattr_name=QoSID *********************subattr_value=13 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=05 ************************************* da->attr=4 *********************subattr_name=TrafficPriority *********************subattr_value=03 ************************************* da->attr=5 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=000fa000 ************************************* da->attr=6 *********************subattr_name=MinimumReservedTrafficRate *********************subattr_value=0007d000 ************************************* da->attr=7 *********************subattr_name=ToleratedJitter *********************subattr_value=0000000a ************************************* da->attr=9 *********************subattr_name=MaximumLatency *********************subattr_value=00000014 ************************************* da->attr=10 *********************subattr_name=MediaFlowType *********************subattr_value=80 ************************************* da->attr=12 *********************subattr_name=UnsolicitedGrantInterval *********************subattr_value=0014 ************************************* da->attr=13 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 *********************subattr_name=QoSID *********************subattr_value=14 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=05 ************************************* da->attr=4 *********************subattr_name=TrafficPriority *********************subattr_value=03 ************************************* da->attr=5 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=002ee3e8 ************************************* da->attr=6 *********************subattr_name=MinimumReservedTrafficRate *********************subattr_value=000fa000 ************************************* da->attr=7 *********************subattr_name=ToleratedJitter *********************subattr_value=0000000a ************************************* da->attr=9 *********************subattr_name=MaximumLatency *********************subattr_value=00000014 ************************************* da->attr=10 *********************subattr_name=MediaFlowType *********************subattr_value=80 ************************************* da->attr=12 ************************************** cp after=800103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 *********************subattr_name=QoSID *********************subattr_value=83 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=02 ************************************* da->attr=4 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=000F4000 ************************************* da->attr=6 *********************subattr_name=MediaFlowType *********************subattr_value=02 ************************************* da->attr=12 ************************************** cp after=800103830403020606000F40000c0302 *********************subattr_name=QoSID *********************subattr_value=84 ************************************* da->attr=1 *********************subattr_name=ScheduleType *********************subattr_value=02 ************************************* da->attr=4 *********************subattr_name=MaximumSustainedTrafficRate *********************subattr_value=001F4000 ************************************* da->attr=6 *********************subattr_name=MediaFlowType *********************subattr_value=02 ************************************* da->attr=12 ************************************** cp after=000103840403020606001F40000c0302 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070312 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 ************************************** cp after=800103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 ************************************** cp after=000103120403060706002ee3e80906000000140a06000000140c03010d040014 ************************************** cp after=8001041111040303050304060301070312 ************************************** cp after=0001041112040303050304060301070313080314 ************************************** cp after=800103120403060706000fa0000906000000140a06000000140c03010d040014 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 ************************************** cp after=000103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070312 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 ************************************** cp after=800103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 ************************************** cp after=000103120403060706002ee3e80906000000140a06000000140c03010d040014 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070311 ************************************** cp after=800103130403050503030606000fa00007060007d00009060000000a0a06000000140c03800d040014 ************************************** cp after=800103140403050503030606002ee3e80706000fa00009060000000a0a06000000140c0380 ************************************** cp after=000103110403060706000fa0000906000000140a06000000140c03010d040014 ************************************** cp after=0001041112040303050304060301070313080314 ************************************** cp after=8001031304030305030107060003e8000c0382 ************************************** cp after=0001031404030305030107060007d0000c0382 ************************************** cp after=0001041112040303050304060301070313080314 ************************************** cp after=8001031304030305030106060007d00007060007d0000c0382 ***************** Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/udir/novac/FREERADIUS_WIMAX_INSTALLED//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. ********************* cp after=000103140403030503010606000fa0000706000fa0000c0382 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070312 ************************************** cp after=8001031304030305030106060007d00007060007d0000c0382 ************************************** cp after=800103140403030503010606000fa0000706000fa0000c0382 ************************************** cp after=000103120403060706002ee3e80906000000140a06000000140c03010d040014 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=000104008302040083040303050304060301070383080384 ************************************** cp after=8001031304030305030106060007d00007060007d0000c0382 ************************************** cp after=800103140403030503010606000fa0000706000fa0000c0382 ************************************** cp after=800103830403020606000F40000c0302 ************************************** cp after=000103840403020606001F40000c0302 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070311 ************************************** cp after=8001031304030305030106060007d00007060007d0000c0382 ************************************** cp after=800103140403030503010606000fa0000706000fa0000c0382 ************************************** cp after=000103110403060706000fa0000906000000140a06000000140c03010d040014 ************************************** cp after=0001041112040303050304060301070313080314 ************************************** cp after=800103130403040503020606000FA00007060007d0000a06000000640c03810f040032 ************************************** cp after=000103140403040503020606001f40000706000fa0000a06000000640c0381 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=000104008302040083040303050304060301070383080384 ************************************** cp after=800103130403040503020606000FA00007060007d0000a06000000640c03810f040032 ************************************** cp after=800103140403040503020606001f40000706000fa0000a06000000640c0381 ************************************** cp after=800103830403020606000F40000c0302 ************************************** cp after=000103840403020606001F40000c0302 ************************************** cp after=8001041112040303050304060301070313080314 ************************************** cp after=0001041111040303050304060301070311 ************************************** cp after=800103130403040503020606000FA00007060007d0000a06000000640c03810f040032 ************************************** cp after=800103140403040503020606001f40000706000fa0000a06000000640c0381 ************************************** cp after=800103140403030503010606000fa0000706000fa0000c0382 ************************************** cp after=000103110403060706000fa0000906000000140a06000000140c03010d040014 rad_recv: Access-Request packet from host 127.0.0.1 port 32776, id=24, length=166 QoSID = 0x616e6f6e796d6f7573406173622e636f6d ScheduleType = 0x7f000001 TrafficPriority = 0x00000000 Called-Station-Id = "00-00-00-00-00-00:" Calling-Station-Id = "00-13-49-C3-C5-30" MediaFlowType = 0x00000578 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0206001601616e6f6e796d6f7573406173622e636f6d Message-Authenticator = 0xf3763cb9e2245f701f5e645477aabcaf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "asb.com" for User-Name = "anonymous(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry DEFAULT at line 367 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ************************************** cp after=00 ++[eap] returns handled Sending Access-Challenge of id 24 to 127.0.0.1 port 32776 EAP-Message = 0x010700061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd99b9956d99c8c9338d70856535d0709 Finished request 0. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32776, id=25, length=270 QoSID = 0x616e6f6e796d6f7573406173622e636f6d ScheduleType = 0x7f000001 TrafficPriority = 0x00000000 Called-Station-Id = "00-00-00-00-00-00:" Calling-Station-Id = "00-13-49-C3-C5-30" MediaFlowType = 0x00000578 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0207006c150016030100610100005d030147fe1bbab68ca66dcea8ffe3050798e1c791305d5ae8f844fdbc6e511d8f397b00003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 State = 0xd99b9956d99c8c9338d70856535d0709 Message-Authenticator = 0x5bb8fdd1fbfce657f4bbe925da19f5d8 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "asb.com" for User-Name = "anonymous(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 108 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry DEFAULT at line 367 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0438], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ************************************** cp after=00 ++[eap] returns handled Sending Access-Challenge of id 25 to 127.0.0.1 port 32776 EAP-Message = 0x0108040015c0000005a7160301004a02000046030147fe2bba6ed4e4b07672c2d9e9a788f26f123361e05d0d848f15f9717cf8f9a1208d6a2ccc9a237ba766409902c3ae2355bbcec3fee2c7aadb84db3a289bf564b600390016030104380b000434000431000218308202143082017d020105300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d3037313131393038303533305a170d3038313131383038303533305a3055310b3009060355 EAP-Message = 0x040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b13037264723110300e060355040313076173622e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b0634f379d38220d960a6f7c80abd51a2b7a9cac830613ec665fae7c1ca6215b60ea222142e7c6832c6d344dae7bc5cc3385db768824fbc63c93bfe9c79af932248380799e7f7bbb1ad953ac64adf590f2af0d02a5440e7a67769c92fcb74b4e20cb6776513eb13297599961c1be81ec0c6633ef709da026e96feebe5d0ab5e70203010001300d06092a864886f70d010104 EAP-Message = 0x05000381810069e6b80739a38b06b15a28ace28510b0fc9a26d291c4b9ab9102bc349827197bce7bf4d3bca49e5a5bc61da2b1d9f96e504a469deaf4cf1d915b844f8506ccdd9e995654aafca0e93598b19ab21667ecb40617b4a0e80816a89e3924aeb0c53d93dad0a14e8c678197708ad92f1769673a4499d5ec811a090253bf18df6dd5b50002133082020f30820178020100300d06092a864886f70d01010405003050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b3009060355040313026361301e170d30373131 EAP-Message = 0x31393038303433315a170d3038313131383038303433315a3050310b3009060355040613026368310b3009060355040813027368310b3009060355040713027368310c300a060355040a1303617362310c300a060355040b1303726472310b300906035504031302636130819f300d06092a864886f70d010101050003818d0030818902818100dc70ad4fc5351431abb49e7f58f1d25e90634ea6dcb7f5f440ac2059ccb4d5b47a0c6c1c62014d96c48cb295344fa36bea1dfeb171dab4aa2238087937ac41e513c49af623af2ab3170628cb1d954fdc4587171caae000e325620f5d35aee55712d8f28af71e1be41bed4970bc00c4320a3208bae176 EAP-Message = 0x2d816730040ada827c0d0203 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd99b9956d8938c9338d70856535d0709 Finished request 1. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32776, id=26, length=168 QoSID = 0x616e6f6e796d6f7573406173622e636f6d ScheduleType = 0x7f000001 TrafficPriority = 0x00000000 Called-Station-Id = "00-00-00-00-00-00:" Calling-Station-Id = "00-13-49-C3-C5-30" MediaFlowType = 0x00000578 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020800061500 State = 0xd99b9956d8938c9338d70856535d0709 Message-Authenticator = 0xc4dcb0d4e3790f0746b2ec8c71a5e87b +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "asb.com" for User-Name = "anonymous(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry DEFAULT at line 367 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ************************************** cp after=00 ++[eap] returns handled Sending Access-Challenge of id 26 to 127.0.0.1 port 32776 EAP-Message = 0x010901bb1580000005a7010001300d06092a864886f70d010104050003818100321f6dace1aa2f6e55d16f64eb6363393119b3da5c41a7127c7b46e0931d115b6ecb9f52a33868ab8e969dc418740767936cb9f9da02837b868ba824fcad2df8fe3a2fe5cff8dac483603ce312e0218bb93681b208d15fe55ac185416d56696c75d5dd0d8981f3b49962b3b23608fd7010e0ccd32501a7240ec82973066c7332160301010d0c0001090040ea491ab5e523f0f500b96463241287517f2ef085934a4977d6d7484bdfd4dadf7eb552b0e7e3154925eea5c6ad362d72e39a694dfaf9a0bc58dc18aa0e638f0b0001020040426ffc359de2c9fb9cda60c1a0 EAP-Message = 0x1e0f0118e8484519c0c5217adc8de0ad1c4a20370cbb0bb1cc0244dd354d745a6f396a0c9393cdb00a94538430cc727025f0c6008049828458e7b9472e0ab564e98b260c10dfe4e722b7825489fbd0502af8c05938ebe39d9cb1d351806ee994e83bb0e32b2992e4ace4770094caab3902c27b6a46a4d635919a384ac3623f83d24d33744fd760579d2eea4b3a413daacc60fde5514c671391956bc15e901cb0e39d12aa23ab2c7036ba7ca1f3ab7be97edcb0787916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd99b9956db928c9338d70856535d0709 Finished request 2. Going to the next request Waking up in 0.5 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32776, id=27, length=302 QoSID = 0x616e6f6e796d6f7573406173622e636f6d ScheduleType = 0x7f000001 TrafficPriority = 0x00000000 Called-Station-Id = "00-00-00-00-00-00:" Calling-Station-Id = "00-13-49-C3-C5-30" MediaFlowType = 0x00000578 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209008c1500160301004610000042004055b5552282f3e2b403cb95ebafe1775d9745c1e28caffe410d0c9ddcb53215c48fb9fe4089571488886d206d0b6d1477f96e41f60ce4c571db632263859d5ac21403010001011603010030d9d62590005656c6a68b85a81bf3372ce074b399ad3cd901e6c01c8843cad950a8331ac521da18d1a058cab3db826059 State = 0xd99b9956db928c9338d70856535d0709 Message-Authenticator = 0xe8bb979b6e4487cddab43e461cd5c3f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "asb.com" for User-Name = "anonymous(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 140 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry DEFAULT at line 367 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 ************************************** cp after=00 ++[eap] returns handled Sending Access-Challenge of id 27 to 127.0.0.1 port 32776 EAP-Message = 0x010a004515800000003b1403010001011603010030ceb5957b02c100e31eafcd91a62160c6e280c309e3a1801a96b773674452e84573dbd2282b5a76864615e85fded34ad8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd99b9956da918c9338d70856535d0709 Finished request 3. Going to the next request Waking up in 0.2 seconds. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32776, id=28, length=354 QoSID = 0x616e6f6e796d6f7573406173622e636f6d ScheduleType = 0x7f000001 TrafficPriority = 0x00000000 Called-Station-Id = "00-00-00-00-00-00:" Calling-Station-Id = "00-13-49-C3-C5-30" MediaFlowType = 0x00000578 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020a00c01500170301002075b9ecb64bd478294e53d8974b9ab6b2aba82994aba94cca4813de38d98024551703010090a547448c7e85c24c6646e4267961917e069b4bda8568ea3889ba39dd3d44c68c3f60d9f216eb82411fe73d0285efbf28f250ee44c8ad9234f044ef3bbaecf04b813f66919dac8330989a6ced5fcfaac5f64958daf0cae184eef6a8574ac94d92b974e64f7448d93536ec41cb47520c7570bcd4958c9307fff13264755078051c890d65009dbf1c3c53306ec07db630b6 State = 0xd99b9956da918c9338d70856535d0709 Message-Authenticator = 0x6c4cd222e98a1db76a3b564e93301450 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "asb.com" for User-Name = "anonymous(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry DEFAULT at line 367 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: Looking up realm "asb.com" for User-Name = "ERTVR_BE(a)asb.com" rlm_realm: Found realm "asb.com" rlm_realm: Adding Stripped-User-Name = "ERTVR_BE" rlm_realm: Proxying request from user ERTVR_BE to realm asb.com rlm_realm: Adding Realm = "asb.com" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry ERTVR_BE at line 146 ++[files] returns ok rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for ERTVR_BE(a)asb.com with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject auth: Failed to validate the user. Login incorrect: [ERTVR_BE(a)asb.com/<via Auth-Type = mschap>] (from client localhost port 0 cli 00-13-49-C3-C5-30) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [anonymous(a)asb.com/<via Auth-Type = EAP>] (from client localhost port 0 cli 00-13-49-C3-C5-30) Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.2 seconds. Waking up in 0.3 seconds. Waking up in 0.3 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 28 to 127.0.0.1 port 32776 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.3 seconds. Cleaning up request 0 ID 24 with timestamp +6 Waking up in 0.5 seconds. Cleaning up request 1 ID 25 with timestamp +6 Waking up in 0.3 seconds. Cleaning up request 2 ID 26 with timestamp +6 Waking up in 0.3 seconds. Cleaning up request 3 ID 27 with timestamp +7 Waking up in 1.3 seconds. Cleaning up request 4 ID 28 with timestamp +7 Ready to process requests.

3 3

SNMP in 2.0.2: segmentation Fault
by Norbert Wegener 11 Apr '08

11 Apr '08

I have 2.0.2 running and snmp enabled. When the snmp daemon dies, freeradius follows... Ready to process requests. SMUX connection closed: 278 SMUX connect try 1 Can't connect to SNMP agent with SMUX: Connection refused Ready to process requests. Exiting... Speicherzugriffsfehler - Segmentation Fault I can reproduce this, by killing the snmpd. Norbert Wegener

3 2

EAP-TTLS (PAP) not working with NT domain - debian freeradius 1.1.7
by James McOrmond 10 Apr '08

10 Apr '08

Okey, i've searched and searched for a hint, hopefully this isn't one of those RTFM messages, and hopefully I didn't read an invalid FM ;-) I'm trying to "emulate" the edunet network wireless roaming network, which primarily uses (in this order): EAP-TTLS PEAP EAP-MSCHAPv2 My Access point is a router running the DD-WRT firmware which AFAICT should work fine for 802.1x support. I first started on this page: http://www.linuxinsight.com/building-debian-freeradius-package-with-eap-tls… which provides instructions on rebuilding the debian freeradius 1.1.7 package with ttls/peap/etc.. I'm authenticating from our local NT domain since we already have it, and in theory, these particular auth choices all work fine with the ntdomain password - according to the "Deploying Radius: The Book" chart I found online. With that, and a few configuration options (like making sure the host was connected to the domain and ntlm_auth functioned as required), i've managed to get PEAP and EAP-MSCHAPv2 working fine to the ntdomain. EAP-TTLS works fine with an account in the "users" file that has a clear text password, as well as a local /etc/password account. Ideally this should work with the ntdomain as well. I'm testing with a laptop running XP, with the secureW2 package installed to provide TTLS. I've also installed "NTRadPing" which provides the same failure result. Hopefully someone will have an idea, or a swift kick in the head pointing to a better direction. ---------------------------------- dns1:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/radius.key.pem" tls: certificate_file = "/etc/freeradius/certs/radius.pem" tls: CA_file = "/etc/freeradius/certs/newca.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "gtc" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. These are failed tests from NTRadPing - let me know if you'd prefer to see something from the actual failed wireless AP session (which is much longer due to the eap/ssl encryption, etc..). rad_recv: Access-Request packet from host 172.16.13.254:2752, id=6, length=46 User-Name = "jamesm" User-Password = "*******" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jamesm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "jamesm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect: [jamesm] (from client moodie port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 6 to 172.16.13.254 port 2752 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 6 with timestamp 47e13ada Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.16.13.254:2753, id=7, length=53 User-Name = "jamesm@MOODIE" User-Password = "*********" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "MOODIE" for User-Name = "jamesm@MOODIE" rlm_realm: No such realm "MOODIE" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "jamesm@MOODIE", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Login incorrect: [jamesm@MOODIE] (from client moodie port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 7 to 172.16.13.254 port 2753 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 7 with timestamp 47e13b09 Nothing to do. Sleeping until we see a request. -- James A. McOrmond Network Administrator Xandros Corporation, Ottawa, Canada. Morpheus: ...after a century of war I remember that which matters most: *We are still HERE!*

5 17

RE: All attributes in rlm_sql_log or rlm_sql ?
by Dean Smith 10 Apr '08

10 Apr '08

I guess I'm asking is there an unlang equivalent to this snippet from rlm_detail.c. .. /* Write each attribute/value to the log file */ for (pair = packet->vps; pair != NULL; pair = pair->next) { vp_print(outfp, pair); } Dean From: Dean Smith [mailto:dean@eatworms.org.uk] Sent: 10 April 2008 00:14 To: 'freeradius-users(a)lists.freeradius.org' Subject: All attributes in rlm_sql_log or rlm_sql ? Is there a way of using either rlm_sql_log or the post-auth query within rlm_sql to log all the request and/or reply attributes to mysql ? E.g. I could populate one SQL field with a string of the whole packet (just as you would see in the detail log). I would still add my key attributes to named fields but I would like to record "the rest" of the attributes for later reference without having to define a field for every possible attribute I might see. Clearly I could parse/upload the detail files independently but wanted to check if it was possible within the existing framework. Thanks Dean Smith

2 1

generating tls certificates for radius under centos
by David Hláčik 10 Apr '08

10 Apr '08

Hi all, i need to generate certificate files for radius tls. I am using CentOS 5.1 and scripts in /etc/pki/tls/misc for generated own CA key, and for own keys signed with my CA. For Radius i need a server certificate with xpextensions support. How can i generate server certificate with xpextensions which will be signed with my own CA on CentOS5.1? Thanks in advance! David

2 1

I have been struggling to get the EAP-TTLS to work.
by Johan Nyman 10 Apr '08

10 Apr '08

Hello all, I have been struggling to get the EAP-TTLS to work. I have been following this guide: <http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html> http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html And i think the setup of all things has gone fine (biggest problem i had was creating the certifcates). I have tested the connection with "raddtest" and the tool "NTRadPing" and everything seems ok. However when i try to connect from my Linux machine using WPA supplicant, the following errors appear in the Radius server console: ............................................................................ ....... Going to the next request Waking up in 4.9 seconds. User-Name = "johan(a)mediavisiongroup.se" NAS-IP-Address = 192.168.1.144 Called-Station-Id = "00-20-a6-64-c3-b1:MVG-Personal" Calling-Station-Id = "00-0f-cb-f9-3b-f9;MVG-Personal" NAS-Identifier = "MVG-1" State = 0xdea187e5dea3836d25979821eb25f055 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 Message-Authenticator = 0x80154e870b93b69627ead5a0eee17643 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "mediavisiongroup.se" for User-Name = "johan@med iavisiongroup.se" rlm_realm: No such realm "mediavisiongroup.se" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdea187e5dfa2926d25979821eb25f055 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 48 with timestamp +3 Cleaning up request 1 ID 49 with timestamp +3 Ready to process requests. ............................................................................ ....... The connection conf from the Linux box is (/etc/wpa_supplicant.conf): network={ ssid="MVG-Personal" scan_ssid=1 key_mgmt=WPA-EAP eap=TTLS identity="johan(a)mediavisiongroup.se" anonymous_identity="anonymous(a)example.com" password="foobar" ca_cert="/etc/cert/ca.pem" phase2="auth=MD5" } - I am guessing that the /etc/cert/ca.pem is the "client certification" i created from the freeradius. - User and password above (in the file /etc/wpa_supplicant.conf) do exist and is correct. They match the user and password in the file on the freeradius "/usr/local/etc/raddb/users". ............................................................................ ....... Also so i understand this, three certficates are needed for EAP-TTLS ? CA= root certifcate stored on the freeradius machine Server = certifcate also stored on the freeradius machine Client = certifcate copied to the client trying to connect And on the client the path in the "wpa_supplicant.conf" to the client certificate is correct. In short: the client seem to connect to the freeradius, but i am getting no IP to the client. ............................................................................ ....... Thanks very much for help! Best regards, Johan

3 2

windows cisco radius opendlap
by alois blasbichler 10 Apr '08

10 Apr '08

Hello list I am trying to let authenticate my users with radius/ldap before he can enter with hers windows-xp-clients my wireles-lan. We use a Cisco wireless lan controller 4400. We use opendlap for the users attributes : name, password(md5), sambapasswords But i cant get login to my WLAN with an windows-xp-client. Below is the log To explain the log : 10.53.240.10 is my cisco wireless lan controller The mac of my windows-xp-client is : 00-0E-35-5A-86-69 The username i tried is "test". The strange for me is that at the end i see: Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) But i see this message also when i use a wrong password Is this a miskonfiguration of my cisco ? I hope somebody can give me a help luis ################################################################### modcall: entering group authorize for request 284 modcall[authorize]: module "preprocess" returns ok for request 284 modcall[authorize]: module "chap" returns noop for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated for request 284 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 284 users: Matched DEFAULT at 162 users: Matched DEFAULT at 181 modcall[authorize]: module "files" returns ok for request 284 modcall[authorize]: module "mschap" returns noop for request 284 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'dc=sb-brixen,dc=it' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=sb-brixen,dc=it, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by radiusFilterId rlm_ldap: Added password {MD5}z+0c65+jByhDM1ldJwmp9w== in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value 54D7A5EF2DC6130A2831D83B84846A87 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value DB6CF596B290E59AC2265B23734E0DAC & op=21 rlm_ldap: Adding userPassword as User-Password, value { & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value pippoisok & op=11 rlm_ldap: user test authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 284 modcall: group authorize returns updated for request 284 rad_check_password: Found Auth-Type EAP auth: type "EAP" modcall: entering group authenticate for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: Unknown EAP type 21, reverting to default_eap_type rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns ok for request 284 modcall: group authenticate returns ok for request 284 Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) Sending Access-Challenge of id 121 to 10.53.240.10:32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Filter-Id = "pippoisok" EAP-Message = 0x0121001604108dbc391981d5f73f5291db28b51df479 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0fa7d26d9c7e4f52a6000443ea25ea878bdefd47999b2dd4735b2e46aefd2e0102593e6b Finished request 284 Going to the next request Waking up in 5 seconds... ###################################################################

2 1