- Freeradius-Users - lists.freeradius.org

Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 08 Apr '08

08 Apr '08

Hi, I'm using FreeRADIUS Version 1.1.6 for Freebsd 6.2 to authenticate Wi-Fi clients. Im using WPA2. My users are in a MySQL database and i'm using EAP-PEAP and mschapv2 for authentication. When i create a user "test", for example, in the radcheck table and configure this user in a Windows XP the authentication proceeds without problem, but when i create a user "test(a)some.domain.com" in radcheck and configure this user in Windows XP client, the authentication fails. In my proxy.conf i have two entries, the realm NULL and the realm some.domain.com, both authenticating locally, and the realm some.domain.com with the nostrip option. In my radiusd.conf, i'm using realm suffix with @ as delimiter. The strange is that with the same configuration, the user "test" was authenticate correctly but the user "test(a)some.domain.com" was not. Any suggestions? Follow my configuration options: Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = xxx.xxx.xxx.xxx IP address [xxx.xxx.xxx.xxx] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "xxxxxxxxxxxx" sql: radius_db = "phpradmin" sql: nas_table = "nas" sql: sqltrace = yes sql: sqltracefile = "/var/log/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 2 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/phpradmin rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT * FROM nas rlm_sql (sql): Read entry nasname=xxx.xxx.xxx.xxx,shortname=Localhost,secret=xxxxxxxx rlm_sql (sql): Adding client xxx.xxx.xxx.xxx (Localhost) to clients list rlm_sql (sql): Read entry nasname=xxx.xxx.xxx.xxx,shortname=AP01,secret=xxxxxxxx rlm_sql (sql): Adding client xxx.xxx.xxx.xxx (AP01) to clients list rlm_sql (sql): Released sql socket id: 1 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication xxx.xxx.xxx.xxx:1812 Listening on accounting xxx.xxx.xxx.xxx:1813 Ready to process requests.

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 08 Apr '08

08 Apr '08

Ivan, nice to see that you're always there to provide support. I've managed to have it working somehow. using nokia wifi enabled phones & laptops. All throughout the sessions, I've been using Sony Ericsson's P1i to test the setup (Chillispot + Freeradius + Mysql). Now I'm checking the reason why it fails when I use Sony Ericsson. ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, April 8, 2008 12:53:57 Subject: Re: Freeradius + CHAP Server debug please. Ivan Kalik Kalik Informatika ISP Dana 8/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >[root@host SPECS]# radtest s sandy locahost 1645 testing123 >radclient: Failed to find IP address for host locahost: Success > >----- Original Message ---- >From: Ivan Kalik <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Monday, April 7, 2008 18:11:04 >Subject: Re: Freeradius + CHAP > >Can you do radtest from the machine on which chillispot is installed? If >radtest does OK - it's a chilli bug. If radtest fails as well - crypto >libraries on that machine are broken. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 7/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piĹĄe: > >>chillispot hotspotlogin.cgi contains >> >># Shared secret used to encrypt challenge with. Prevents dictionary attacks. >># You should change this to your own shared secret. >>$uamsecret = "testing123"; >> >># Uncomment the following line if you want to use ordinary user-password >># for radius authentication. Must be used together with $uamsecret. >>$userpassword=1; >> >>nas table >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>>| id | nasname | shortname | type | ports | secret | community | description | >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>>| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >> >>radcheck table >>mysql> select * from radcheck; >>+----+----------+--------------------+----+-------+ >>| id | UserName | Attribute | op | Value | >>+----+----------+--------------------+----+-------+ >>| 1 | s | Cleartext-Password | := | sandy | >>| 2 | steve | Cleartext-Password | := | s | >>+----+----------+--------------------+----+-------+ >>2 rows in set (0.00 sec) >> >>clients.conf >>client 192.168.182.1/24 { >> secret = testing123 >> shortname = private-network >>} >> >> >>nas table and clients.conf are both on radius server. You need to make >>testing123 secret on the portal that is sending those reqests. >> >>Ivan Kalik >>Kalik Informatika ISP >> >> >>Dana 7/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piÄšÄe: >> >>>I've checked the clients.conf and it uses testing123 as the secret. >>>I've created a record on nas >>>mysql> select * from nas; >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>>| id | nasname | shortname | type | ports | secret | community | description | >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>>| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >>>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>> >>>here is a portion of the radiusd -X output >>> >>>rlm_pap: Found existing Auth-Type, not changing it. >>>++[pap] returns noop >>> rad_check_password: Found Auth-Type >>>auth: type Local >>>auth: user supplied User-Password does NOT match local User-Password >>>auth: Failed to validate the user. >>>Login incorrect: [s/\365\010\343\323] (from client localhost port 0 cli 00-1C-A4-6F-21-10) >>> WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! >>> Found Post-Auth-Type Reject >>>+- entering group REJECT >>> expand: %{User-Name} -> s >>> attr_filter: Matched entry DEFAULT at line 11 >>> >>> >>> >>>----- Original Message ---- >>>From: Ivan Kalik <tnt(a)kalik.net> >>>To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >>>Sent: Monday, April 7, 2008 16:22:38 >>>Subject: Re: Freeradius + CHAP >>> >>>> User-Password = "\340\334\351\234" >>> >>>Shared secret in clents.conf and on the NAS is not the same. >>> >>>Ivan Kalik >>>Kalik Informatika ISP >>> >>>- >>>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>> >>> >>> >>> >>>Send instant messages to your online friends http://uk.messenger.yahoo.com >>> >>>- >>>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>> >>> >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> >> >> >>Send instant messages to your online friends http://uk.messenger.yahoo.com >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: Freeradius + CHAP
by SANDY KALUGDAN 08 Apr '08

08 Apr '08

[root@host SPECS]# radtest s sandy locahost 1645 testing123 radclient: Failed to find IP address for host locahost: Success ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, April 7, 2008 18:11:04 Subject: Re: Freeradius + CHAP Can you do radtest from the machine on which chillispot is installed? If radtest does OK - it's a chilli bug. If radtest fails as well - crypto libraries on that machine are broken. Ivan Kalik Kalik Informatika ISP Dana 7/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >chillispot hotspotlogin.cgi contains > ># Shared secret used to encrypt challenge with. Prevents dictionary attacks. ># You should change this to your own shared secret. >$uamsecret = "testing123"; > ># Uncomment the following line if you want to use ordinary user-password ># for radius authentication. Must be used together with $uamsecret. >$userpassword=1; > >nas table >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>| id | nasname | shortname | type | ports | secret | community | description | >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ > >radcheck table >mysql> select * from radcheck; >+----+----------+--------------------+----+-------+ >| id | UserName | Attribute | op | Value | >+----+----------+--------------------+----+-------+ >| 1 | s | Cleartext-Password | := | sandy | >| 2 | steve | Cleartext-Password | := | s | >+----+----------+--------------------+----+-------+ >2 rows in set (0.00 sec) > >clients.conf >client 192.168.182.1/24 { > secret = testing123 > shortname = private-network >} > > >nas table and clients.conf are both on radius server. You need to make >testing123 secret on the portal that is sending those reqests. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 7/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piĹĄe: > >>I've checked the clients.conf and it uses testing123 as the secret. >>I've created a record on nas >>mysql> select * from nas; >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>| id | nasname | shortname | type | ports | secret | community | description | >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >>| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >>+----+-----------+-----------+------+-------+------------+-----------+-------------+ >> >>here is a portion of the radiusd -X output >> >>rlm_pap: Found existing Auth-Type, not changing it. >>++[pap] returns noop >> rad_check_password: Found Auth-Type >>auth: type Local >>auth: user supplied User-Password does NOT match local User-Password >>auth: Failed to validate the user. >>Login incorrect: [s/\365\010\343\323] (from client localhost port 0 cli 00-1C-A4-6F-21-10) >> WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! >> Found Post-Auth-Type Reject >>+- entering group REJECT >> expand: %{User-Name} -> s >> attr_filter: Matched entry DEFAULT at line 11 >> >> >> >>----- Original Message ---- >>From: Ivan Kalik <tnt(a)kalik.net> >>To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >>Sent: Monday, April 7, 2008 16:22:38 >>Subject: Re: Freeradius + CHAP >> >>> User-Password = "\340\334\351\234" >> >>Shared secret in clents.conf and on the NAS is not the same. >> >>Ivan Kalik >>Kalik Informatika ISP >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> >> >> >>Send instant messages to your online friends http://uk.messenger.yahoo.com >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Fwd: EAP Authentication
by Devinder Singh 08 Apr '08

08 Apr '08

I want to authenticate users through using EAP authentication. I managed to generate the client and root certs from Free Radius. I have installed the client sert in my notebook. and managed to get authenticated via AP to Radius. But i cant seem to find them in the Free Radius accounting database. There is no log event in the database. I want them to be authenticated in the radcheck table so that i can set bandwidth to them. Hope you can help me on this. Would it be possible to also have monowall users to log into the captive portal at the same time with EAP turned on in Free Radius. I want private users to authenticate via certs and also go through captive portal. If i enable EAP TLS then users cant login using the captive portal login page. Regards, -- Devinder -- Devinder

2 2

Re: EAP-TLS certificate
by xia sihua 07 Apr '08

07 Apr '08

> Message: 8 > Date: Sat, 05 Apr 2008 08:49:35 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: EAP-TLS certificate > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <47F720FF.3040406(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > xia sihua wrote: > ... > > CA_file = ${cadir}/ca.pem > > .... > > > > The supplicant I use TeraDot1x Tester from Spirent communication. > > ... > > Configuration: > ... > > Root Certificate Filename: server.pem > > I think that should be "ca.pem". Actually, it can only pass using server.pem provided by spirent certificate. If replace ca.pem provided by spirent, it will fails. > > > rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca > > TLS Alert read:fatal:unknown CA > > Yes, the client is telling you that it doesn't know anything about ca.pem. > > > If I change Root Certificate Filename from server.pem to ca.pem, will > > come out following error. > > .... > > eaptls_verify returned 11 > > rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate > > TLS Alert read:fatal:bad certificate > > Ask the supplicant vendor why they don't like the certificate we provide. > > > If I use those certificates provided by spirent, can pass. I donot know why? > > Any ideas? > > Print out the spirent certificates, and post the result here. Maybe > there's some extra magic needed. > > $ openssl x509 -text -in spirent.crt I have print out ca.pem, server.pem, client.pem provided by spirent. But server.pem and client.pem cannot verify pass uising openssl. pls see the late. [root@localhost test_spirent]# openssl x509 -text -in ca.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com Validity Not Before: Apr 29 01:15:25 2005 GMT Not After : Apr 28 01:15:25 2008 GMT Subject: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:ab:b8:1a:5f:13:92:83:1e:29:af:f0:66:8d:7f: 7f:68:8f:40:0d:6b:8b:2d:52:ed:57:ec:97:f3:8a: 1b:8a:cb:87:8f:33:fe:bd:5a:ab:2a:e4:62:f0:bd: 98:28:2d:54:db:b2:34:fa:47:e7:18:02:86:e9:f3: 3c:dc:5c:d4:2b:81:f2:6e:82:2f:a5:5f:e7:94:dd: 86:02:6d:9c:e4:ed:2e:a5:9d:8a:bc:52:e2:e4:6d: ed:30:07:57:bd:e9:1d:08:33:37:26:a9:27:a2:39: 71:cf:0f:63:0c:8e:6b:24:ee:c1:9a:09:aa:c8:d2: dc:a1:b3:16:79:7e:37:1d:75:14:a3:28:eb:2c:bb: cc:94:b0:a7:38:e7:0a:a9:45:60:02:95:23:59:00: 72:a7:c5:66:a5:7c:e9:01:83:bf:ec:5d:69:e2:f7: d6:5b:97:b8:9a:35:bc:55:02:d1:3f:7d:c7:46:0b: f9:fd:d3:b9:f5:ba:69:6d:e6:6b:e6:d2:c3:f4:ee: a1:59:8b:c2:cc:db:22:7d:8e:90:f8:7e:33:fd:ac: d0:00:14:d6:6d:5e:3b:fa:3e:84:3f:45:72:4b:ef: 19:63:4a:4e:aa:30:c2:c6:b4:6e:27:cc:03:29:5e: 01:2f:c3:e1:4d:cf:e7:ce:5d:7c:a5:8d:c0:ea:af: b3:8b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 0F:5E:3D:62:CB:05:F2:02:9C:0D:74:B4:D7:98:CE:B5:15:3C:5F:9F X509v3 Authority Key Identifier: keyid:0F:5E:3D:62:CB:05:F2:02:9C:0D:74:B4:D7:98:CE:B5:15:3C:5F:9F DirName:/C=US/ST=CA/L=Calabasas/O=Spirent/OU=Engn/CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com serial:00 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: md5WithRSAEncryption a7:4b:cd:04:86:e1:cd:2f:3a:b8:68:6b:3a:0b:18:b7:c1:8c: f0:88:b2:f7:9d:3f:f8:31:7c:6c:59:2c:61:1e:3e:0a:ac:52: ae:d2:ca:42:5a:ff:46:89:12:80:75:e4:e1:89:3d:71:e3:d9: 31:05:f8:b9:02:c4:cc:a7:6e:73:52:ad:4a:74:30:01:3d:24: 97:93:6f:fb:8f:7b:2d:36:0a:a8:63:dc:35:31:0a:33:31:bb: ff:0e:32:29:30:c3:76:bd:3f:13:8a:6b:35:af:99:5e:ea:5d: 5e:aa:49:ac:d3:8b:22:64:19:a8:48:e5:a2:54:9d:ea:a4:1c: a4:e3:e4:ff:86:18:77:c1:c2:17:61:dd:9e:f4:d0:b8:4c:23: 95:f2:16:45:03:fa:9a:38:08:48:c7:d6:74:72:46:86:a3:93: fe:df:d4:80:cd:d0:52:23:0b:61:f2:ad:6b:24:01:a6:31:ee: 17:49:b5:ee:27:f4:f8:15:eb:c1:51:25:c3:e5:94:09:20:93: 69:fa:31:3d:88:f7:50:bb:95:5d:92:91:7d:f7:6e:90:df:d1: 67:77:56:10:0f:79:dc:94:5e:ea:3e:39:73:28:a7:59:db:b8: 3e:a0:f4:7d:cf:9f:70:63:e0:3a:a0:6d:61:a3:1c:2a:50:dc: 38:51:9e:3c -----BEGIN CERTIFICATE----- MIIEiDCCA3CgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBjjELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlDYWxhYmFzYXMxEDAOBgNVBAoTB1NwaXJl bnQxDTALBgNVBAsTBEVuZ24xEzARBgNVBAMTCkl2YW4gWWV1bmcxKDAmBgkqhkiG 9w0BCQEWGWl2YW4ueWV1bmdAc3BpcmVudGNvbS5jb20wHhcNMDUwNDI5MDExNTI1 WhcNMDgwNDI4MDExNTI1WjCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIw EAYDVQQHEwlDYWxhYmFzYXMxEDAOBgNVBAoTB1NwaXJlbnQxDTALBgNVBAsTBEVu Z24xEzARBgNVBAMTCkl2YW4gWWV1bmcxKDAmBgkqhkiG9w0BCQEWGWl2YW4ueWV1 bmdAc3BpcmVudGNvbS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCruBpfE5KDHimv8GaNf39oj0ANa4stUu1X7JfzihuKy4ePM/69Wqsq5GLwvZgo LVTbsjT6R+cYAobp8zzcXNQrgfJugi+lX+eU3YYCbZzk7S6lnYq8UuLkbe0wB1e9 6R0IMzcmqSeiOXHPD2MMjmsk7sGaCarI0tyhsxZ5fjcddRSjKOssu8yUsKc45wqp RWAClSNZAHKnxWalfOkBg7/sXWni99Zbl7iaNbxVAtE/fcdGC/n907n1umlt5mvm 0sP07qFZi8LM2yJ9jpD4fjP9rNAAFNZtXjv6PoQ/RXJL7xljSk6qMMLGtG4nzAMp XgEvw+FNz+fOXXyljcDqr7OLAgMBAAGjge4wgeswHQYDVR0OBBYEFA9ePWLLBfIC nA10tNeYzrUVPF+fMIG7BgNVHSMEgbMwgbCAFA9ePWLLBfICnA10tNeYzrUVPF+f oYGUpIGRMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCUNh bGFiYXNhczEQMA4GA1UEChMHU3BpcmVudDENMAsGA1UECxMERW5nbjETMBEGA1UE AxMKSXZhbiBZZXVuZzEoMCYGCSqGSIb3DQEJARYZaXZhbi55ZXVuZ0BzcGlyZW50 Y29tLmNvbYIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4IBAQCnS80E huHNLzq4aGs6Cxi3wYzwiLL3nT/4MXxsWSxhHj4KrFKu0spCWv9GiRKAdeThiT1x 49kxBfi5AsTMp25zUq1KdDABPSSXk2/7j3stNgqoY9w1MQozMbv/DjIpMMN2vT8T ims1r5le6l1eqkms04siZBmoSOWiVJ3qpByk4+T/hhh3wcIXYd2e9NC4TCOV8hZF A/qaOAhIx9Z0ckaGo5P+39SAzdBSIwth8q1rJAGmMe4XSbXuJ/T4FevBUSXD5ZQJ IJNp+jE9iPdQu5VdkpF9926Q39Fnd1YQD3nclF7qPjlzKKdZ27g+oPR9z59wY+A6 oG1hoxwqUNw4UZ48 -----END CERTIFICATE----- [root@localhost test_spirent]# [root@localhost test_spirent]# openssl x509 -text -in server.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Radius/emailAddress=radius(a)spirentcom.com Validity Not Before: Apr 29 01:19:08 2005 GMT Not After : Apr 28 01:19:08 2008 GMT Subject: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Radius/emailAddress=radius(a)spirentcom.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:b3:bf:e4:75:11:ac:b0:71:87:23:91:e7:f7:88: 35:98:dc:59:17:b8:30:3e:bc:6b:fa:93:5d:e1:50: b7:02:aa:43:82:d5:95:71:c0:21:39:be:2b:2a:90: bb:a7:58:42:7e:d9:1e:62:bd:77:1d:5e:ea:b9:92: 0f:8e:cd:e0:62:af:2f:02:c4:1e:b1:85:39:6c:df: 79:ca:c9:5d:72:22:bd:34:11:3b:42:2e:8e:a4:ce: 44:0d:0e:7c:74:11:3a:c0:ca:28:31:c1:50:67:6c: e5:98:e6:b0:e2:37:55:9a:3d:ef:9d:37:b9:e3:dc: 9a:68:03:2b:f7:20:05:21:2a:65:6f:78:03:55:7e: 67:71:5c:af:e3:be:f8:20:56:01:4d:49:3e:9d:66: 1b:cf:35:08:b8:be:36:d3:63:65:22:1e:79:72:09: e2:d6:d3:0c:7e:b7:e5:92:a3:91:fa:b2:08:55:f1: 87:6c:a7:35:7c:dc:d0:2f:a4:1a:fd:03:cb:1b:61: 6a:ee:48:96:4c:19:e3:30:88:f9:a0:57:04:e0:14: da:d8:0d:0d:54:b6:cd:3a:67:d2:2e:85:aa:d7:b6: 14:7d:10:20:51:70:d6:63:e0:b3:08:70:6a:f7:d4: 3f:02:15:33:92:9d:56:19:2e:54:66:4b:8d:2b:50: ac:e3 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 4E:72:80:A1:2E:2A:E0:0B:42:ED:B2:E0:3B:94:81:E4:6A:85:A2:FE X509v3 Authority Key Identifier: keyid:4E:72:80:A1:2E:2A:E0:0B:42:ED:B2:E0:3B:94:81:E4:6A:85:A2:FE DirName:/C=US/ST=CA/L=Calabasas/O=Spirent/OU=Engn/CN=Radius/emailAddress=radius@spirentcom.com serial:00 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: md5WithRSAEncryption 65:01:f8:58:99:69:8d:5f:cb:82:2b:38:23:72:ae:9f:fb:07: 51:c8:ca:b0:4e:43:49:35:41:f0:3d:aa:64:e5:04:9c:31:e1: 0d:d4:41:05:29:78:96:cd:51:b0:79:dc:f5:2f:a9:d7:8f:95: db:9b:45:3b:ed:0d:e8:76:0c:b3:80:71:24:74:59:74:52:a6: be:fd:a3:4c:7d:45:9f:38:b2:39:ca:02:80:f2:3e:ca:d2:4d: f6:a4:59:38:d2:b3:ed:ba:a2:62:eb:6f:e2:29:44:21:87:fe: 01:b2:c3:f6:4b:38:fb:d0:5e:07:3e:8e:5e:ee:7d:05:02:51: 08:f2:1b:3a:cc:44:b6:9c:85:65:36:57:6c:b3:9b:ad:9a:6e: eb:c1:5f:4d:a5:0d:4b:ce:12:a3:f4:41:d7:29:46:b5:b3:b7: 3d:e8:ae:5f:83:0d:e4:9b:8d:a9:c6:6e:c8:0c:16:4e:eb:c9: d4:ec:98:27:23:34:8c:1f:40:84:cb:0d:ee:11:e6:c1:c6:4a: 46:ba:cb:1a:42:0e:39:1a:96:ca:82:36:86:e7:33:a7:29:22: a7:e8:ac:c9:90:ed:48:5d:85:57:67:d8:58:0f:5c:3c:dc:4e: 9f:da:4c:fb:e6:e0:49:85:ea:f2:dc:cf:30:7c:04:e1:4e:d5: e1:fa:c0:7c -----BEGIN CERTIFICATE----- MIIEcDCCA1igAwIBAgIBADANBgkqhkiG9w0BAQQFADCBhjELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlDYWxhYmFzYXMxEDAOBgNVBAoTB1NwaXJl bnQxDTALBgNVBAsTBEVuZ24xDzANBgNVBAMTBlJhZGl1czEkMCIGCSqGSIb3DQEJ ARYVcmFkaXVzQHNwaXJlbnRjb20uY29tMB4XDTA1MDQyOTAxMTkwOFoXDTA4MDQy ODAxMTkwOFowgYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJ Q2FsYWJhc2FzMRAwDgYDVQQKEwdTcGlyZW50MQ0wCwYDVQQLEwRFbmduMQ8wDQYD VQQDEwZSYWRpdXMxJDAiBgkqhkiG9w0BCQEWFXJhZGl1c0BzcGlyZW50Y29tLmNv bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALO/5HURrLBxhyOR5/eI NZjcWRe4MD68a/qTXeFQtwKqQ4LVlXHAITm+KyqQu6dYQn7ZHmK9dx1e6rmSD47N 4GKvLwLEHrGFOWzfecrJXXIivTQRO0IujqTORA0OfHQROsDKKDHBUGds5ZjmsOI3 VZo97503uePcmmgDK/cgBSEqZW94A1V+Z3Fcr+O++CBWAU1JPp1mG881CLi+NtNj ZSIeeXIJ4tbTDH635ZKjkfqyCFXxh2ynNXzc0C+kGv0Dyxthau5IlkwZ4zCI+aBX BOAU2tgNDVS2zTpn0i6Fqte2FH0QIFFw1mPgswhwavfUPwIVM5KdVhkuVGZLjStQ rOMCAwEAAaOB5jCB4zAdBgNVHQ4EFgQUTnKAoS4q4AtC7bLgO5SB5GqFov4wgbMG A1UdIwSBqzCBqIAUTnKAoS4q4AtC7bLgO5SB5GqFov6hgYykgYkwgYYxCzAJBgNV BAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJQ2FsYWJhc2FzMRAwDgYDVQQK EwdTcGlyZW50MQ0wCwYDVQQLEwRFbmduMQ8wDQYDVQQDEwZSYWRpdXMxJDAiBgkq hkiG9w0BCQEWFXJhZGl1c0BzcGlyZW50Y29tLmNvbYIBADAMBgNVHRMEBTADAQH/ MA0GCSqGSIb3DQEBBAUAA4IBAQBlAfhYmWmNX8uCKzgjcq6f+wdRyMqwTkNJNUHw Papk5QScMeEN1EEFKXiWzVGwedz1L6nXj5Xbm0U77Q3odgyzgHEkdFl0Uqa+/aNM fUWfOLI5ygKA8j7K0k32pFk40rPtuqJi62/iKUQhh/4BssP2Szj70F4HPo5e7n0F AlEI8hs6zES2nIVlNldss5utmm7rwV9NpQ1LzhKj9EHXKUa1s7c96K5fgw3km42p xm7IDBZO68nU7JgnIzSMH0CEyw3uEebBxkpGussaQg45GpbKgjaG5zOnKSKn6KzJ kO1IXYVXZ9hYD1w83E6f2kz75uBJhery3M8wfAThTtXh+sB8 -----END CERTIFICATE----- [root@localhost test_spirent]# [root@localhost test_spirent]# openssl x509 -text -in client.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com Validity Not Before: Apr 29 01:15:25 2005 GMT Not After : Apr 28 01:15:25 2008 GMT Subject: C=US, ST=CA, L=Calabasas, O=Spirent, OU=Engn, CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:ab:b8:1a:5f:13:92:83:1e:29:af:f0:66:8d:7f: 7f:68:8f:40:0d:6b:8b:2d:52:ed:57:ec:97:f3:8a: 1b:8a:cb:87:8f:33:fe:bd:5a:ab:2a:e4:62:f0:bd: 98:28:2d:54:db:b2:34:fa:47:e7:18:02:86:e9:f3: 3c:dc:5c:d4:2b:81:f2:6e:82:2f:a5:5f:e7:94:dd: 86:02:6d:9c:e4:ed:2e:a5:9d:8a:bc:52:e2:e4:6d: ed:30:07:57:bd:e9:1d:08:33:37:26:a9:27:a2:39: 71:cf:0f:63:0c:8e:6b:24:ee:c1:9a:09:aa:c8:d2: dc:a1:b3:16:79:7e:37:1d:75:14:a3:28:eb:2c:bb: cc:94:b0:a7:38:e7:0a:a9:45:60:02:95:23:59:00: 72:a7:c5:66:a5:7c:e9:01:83:bf:ec:5d:69:e2:f7: d6:5b:97:b8:9a:35:bc:55:02:d1:3f:7d:c7:46:0b: f9:fd:d3:b9:f5:ba:69:6d:e6:6b:e6:d2:c3:f4:ee: a1:59:8b:c2:cc:db:22:7d:8e:90:f8:7e:33:fd:ac: d0:00:14:d6:6d:5e:3b:fa:3e:84:3f:45:72:4b:ef: 19:63:4a:4e:aa:30:c2:c6:b4:6e:27:cc:03:29:5e: 01:2f:c3:e1:4d:cf:e7:ce:5d:7c:a5:8d:c0:ea:af: b3:8b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 0F:5E:3D:62:CB:05:F2:02:9C:0D:74:B4:D7:98:CE:B5:15:3C:5F:9F X509v3 Authority Key Identifier: keyid:0F:5E:3D:62:CB:05:F2:02:9C:0D:74:B4:D7:98:CE:B5:15:3C:5F:9F DirName:/C=US/ST=CA/L=Calabasas/O=Spirent/OU=Engn/CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com serial:00 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: md5WithRSAEncryption a7:4b:cd:04:86:e1:cd:2f:3a:b8:68:6b:3a:0b:18:b7:c1:8c: f0:88:b2:f7:9d:3f:f8:31:7c:6c:59:2c:61:1e:3e:0a:ac:52: ae:d2:ca:42:5a:ff:46:89:12:80:75:e4:e1:89:3d:71:e3:d9: 31:05:f8:b9:02:c4:cc:a7:6e:73:52:ad:4a:74:30:01:3d:24: 97:93:6f:fb:8f:7b:2d:36:0a:a8:63:dc:35:31:0a:33:31:bb: ff:0e:32:29:30:c3:76:bd:3f:13:8a:6b:35:af:99:5e:ea:5d: 5e:aa:49:ac:d3:8b:22:64:19:a8:48:e5:a2:54:9d:ea:a4:1c: a4:e3:e4:ff:86:18:77:c1:c2:17:61:dd:9e:f4:d0:b8:4c:23: 95:f2:16:45:03:fa:9a:38:08:48:c7:d6:74:72:46:86:a3:93: fe:df:d4:80:cd:d0:52:23:0b:61:f2:ad:6b:24:01:a6:31:ee: 17:49:b5:ee:27:f4:f8:15:eb:c1:51:25:c3:e5:94:09:20:93: 69:fa:31:3d:88:f7:50:bb:95:5d:92:91:7d:f7:6e:90:df:d1: 67:77:56:10:0f:79:dc:94:5e:ea:3e:39:73:28:a7:59:db:b8: 3e:a0:f4:7d:cf:9f:70:63:e0:3a:a0:6d:61:a3:1c:2a:50:dc: 38:51:9e:3c -----BEGIN CERTIFICATE----- MIIEiDCCA3CgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBjjELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlDYWxhYmFzYXMxEDAOBgNVBAoTB1NwaXJl bnQxDTALBgNVBAsTBEVuZ24xEzARBgNVBAMTCkl2YW4gWWV1bmcxKDAmBgkqhkiG 9w0BCQEWGWl2YW4ueWV1bmdAc3BpcmVudGNvbS5jb20wHhcNMDUwNDI5MDExNTI1 WhcNMDgwNDI4MDExNTI1WjCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIw EAYDVQQHEwlDYWxhYmFzYXMxEDAOBgNVBAoTB1NwaXJlbnQxDTALBgNVBAsTBEVu Z24xEzARBgNVBAMTCkl2YW4gWWV1bmcxKDAmBgkqhkiG9w0BCQEWGWl2YW4ueWV1 bmdAc3BpcmVudGNvbS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCruBpfE5KDHimv8GaNf39oj0ANa4stUu1X7JfzihuKy4ePM/69Wqsq5GLwvZgo LVTbsjT6R+cYAobp8zzcXNQrgfJugi+lX+eU3YYCbZzk7S6lnYq8UuLkbe0wB1e9 6R0IMzcmqSeiOXHPD2MMjmsk7sGaCarI0tyhsxZ5fjcddRSjKOssu8yUsKc45wqp RWAClSNZAHKnxWalfOkBg7/sXWni99Zbl7iaNbxVAtE/fcdGC/n907n1umlt5mvm 0sP07qFZi8LM2yJ9jpD4fjP9rNAAFNZtXjv6PoQ/RXJL7xljSk6qMMLGtG4nzAMp XgEvw+FNz+fOXXyljcDqr7OLAgMBAAGjge4wgeswHQYDVR0OBBYEFA9ePWLLBfIC nA10tNeYzrUVPF+fMIG7BgNVHSMEgbMwgbCAFA9ePWLLBfICnA10tNeYzrUVPF+f oYGUpIGRMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCUNh bGFiYXNhczEQMA4GA1UEChMHU3BpcmVudDENMAsGA1UECxMERW5nbjETMBEGA1UE AxMKSXZhbiBZZXVuZzEoMCYGCSqGSIb3DQEJARYZaXZhbi55ZXVuZ0BzcGlyZW50 Y29tLmNvbYIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4IBAQCnS80E huHNLzq4aGs6Cxi3wYzwiLL3nT/4MXxsWSxhHj4KrFKu0spCWv9GiRKAdeThiT1x 49kxBfi5AsTMp25zUq1KdDABPSSXk2/7j3stNgqoY9w1MQozMbv/DjIpMMN2vT8T ims1r5le6l1eqkms04siZBmoSOWiVJ3qpByk4+T/hhh3wcIXYd2e9NC4TCOV8hZF A/qaOAhIx9Z0ckaGo5P+39SAzdBSIwth8q1rJAGmMe4XSbXuJ/T4FevBUSXD5ZQJ IJNp+jE9iPdQu5VdkpF9926Q39Fnd1YQD3nclF7qPjlzKKdZ27g+oPR9z59wY+A6 oG1hoxwqUNw4UZ48 -----END CERTIFICATE----- [root@localhost test_spirent]# [root@localhost test_spirent]# openssl verify -CApath . client.pem client.pem: /C=US/ST=CA/L=Calabasas/O=Spirent/OU=Engn/CN=Ivan Yeung/emailAddress=ivan.yeung(a)spirentcom.com error 18 at 0 depth lookup:self signed certificate OK [root@localhost test_spirent]# [root@localhost test_spirent]# openssl verify -CAfile ca.pem server.pem server.pem: /C=US/ST=CA/L=Calabasas/O=Spirent/OU=Engn/CN=Radius/emailAddress=radius(a)spirentcom.com error 18 at 0 depth lookup:self signed certificate OK [root@localhost test_spirent]# > > Alan DeKok. -- Best regards！ walter *************************************** Nothing is impossible! ***************************************

1 0

RPM Build Errors
by Austin G. Smith 07 Apr '08

07 Apr '08

I am attempting an rpmbuild of freeradius due to the version included in Centos (1.14)- We are experiencing issues with windows vista, and read something in an earlier post regarding such a bug that 1.17 and later will fix. However, during the build, I receive this error: See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- + RADDB=/var/tmp/freeradius-server-root/etc/raddb + perl -i -pe 's/^#user =.*$/user = radiusd/' /var/tmp/freeradius-server-root/etc/raddb/radiusd.conf + perl -i -pe 's/^#group =.*$/group = radiusd/' /var/tmp/freeradius-server-root/etc/raddb/radiusd.conf + perl -i -pe 's/# shadow =/shadow =/' /var/tmp/freeradius-server-root/etc/raddb/radiusd.conf + rm -f /var/tmp/freeradius-server-root/usr/sbin/rc.radiusd + install -m 0644 CREDITS /var/tmp/freeradius-server-root/usr/share/doc/freeradius-server-2.0.3 + install -m 0644 COPYRIGHT /var/tmp/freeradius-server-root/usr/share/doc/freeradius-server-2.0.3 + install -m 0644 LICENSE /var/tmp/freeradius-server-root/usr/share/doc/freeradius-server-2.0.3 + cd redhat + install -m 755 rc.radiusd-redhat /var/tmp/freeradius-server-root/etc/rc.d/init.d/radiusd + install -m 644 radiusd-logrotate /var/tmp/freeradius-server-root/etc/logrotate.d/radiusd + install -m 644 radiusd-pam /var/tmp/freeradius-server-root/etc/pam.d/radius + cd .. + /usr/lib/rpm/brp-compress + /usr/lib/rpm/brp-strip + /usr/lib/rpm/brp-strip-static-archive strip: Unable to recognise the format of the input file `/var/tmp/freeradius-server-root/usr/lib64/rlm_perl.a(DynaLoader.a)' strip: Unable to recognise the format of the input file `/var/tmp/freeradius-server-root/usr/lib64/rlm_perl.a(DynaLoader.a)' + /usr/lib/rpm/brp-strip-comment-note Processing files: freeradius-server-2.0.3-0 error: File not found: /var/tmp/freeradius-server-root/usr/share/freeradius-server error: File must begin with "/": %{_incdir}/freeradius/* RPM build errors: File not found: /var/tmp/freeradius-server-root/usr/share/freeradius-server File must begin with "/": %{_incdir}/freeradius/* ANY assistance in this issue would be wonderful! Thank you, Austin G. Smith, A+, MCP Digital Son, I.T. Services www.digitalson.com 678.213.0550 x:101 Office 678.213.0535 Fax Need reliable hosting? www.digitalsonhosting.com

6 21

Re: Freeradius + CHAP
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

chillispot hotspotlogin.cgi contains # Shared secret used to encrypt challenge with. Prevents dictionary attacks. # You should change this to your own shared secret. $uamsecret = "testing123"; # Uncomment the following line if you want to use ordinary user-password # for radius authentication. Must be used together with $uamsecret. $userpassword=1; nas table >+----+-----------+-----------+------+-------+------------+-----------+-------------+ >| id | nasname | shortname | type | ports | secret | community | description | >+----+-----------+-----------+------+-------+------------+-----------+-------------+ >| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >+----+-----------+-----------+------+-------+------------+-----------+-------------+ radcheck table mysql> select * from radcheck; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | sandy | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec) clients.conf client 192.168.182.1/24 { secret = testing123 shortname = private-network } nas table and clients.conf are both on radius server. You need to make testing123 secret on the portal that is sending those reqests. Ivan Kalik Kalik Informatika ISP Dana 7/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >I've checked the clients.conf and it uses testing123 as the secret. >I've created a record on nas >mysql> select * from nas; >+----+-----------+-----------+------+-------+------------+-----------+-------------+ >| id | nasname | shortname | type | ports | secret | community | description | >+----+-----------+-----------+------+-------+------------+-----------+-------------+ >| 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | >+----+-----------+-----------+------+-------+------------+-----------+-------------+ > >here is a portion of the radiusd -X output > >rlm_pap: Found existing Auth-Type, not changing it. >++[pap] returns noop > rad_check_password: Found Auth-Type >auth: type Local >auth: user supplied User-Password does NOT match local User-Password >auth: Failed to validate the user. >Login incorrect: [s/\365\010\343\323] (from client localhost port 0 cli 00-1C-A4-6F-21-10) > WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! > Found Post-Auth-Type Reject >+- entering group REJECT > expand: %{User-Name} -> s > attr_filter: Matched entry DEFAULT at line 11 > > > >----- Original Message ---- >From: Ivan Kalik <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Monday, April 7, 2008 16:22:38 >Subject: Re: Freeradius + CHAP > >> User-Password = "\340\334\351\234" > >Shared secret in clents.conf and on the NAS is not the same. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

I've checked the clients.conf and it uses testing123 as the secret. I've created a record on nas mysql> select * from nas; +----+-----------+-----------+------+-------+------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+------+-------+------------+-----------+-------------+ | 1 | 127.0.0.1 | localhost | NULL | NULL | testing123 | NULL | NULL | +----+-----------+-----------+------+-------+------------+-----------+-------------+ here is a portion of the radiusd -X output rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [s/\365\010\343\323] (from client localhost port 0 cli 00-1C-A4-6F-21-10) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> s attr_filter: Matched entry DEFAULT at line 11 ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, April 7, 2008 16:22:38 Subject: Re: Freeradius + CHAP > User-Password = "\340\334\351\234" Shared secret in clents.conf and on the NAS is not the same. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Problem with proxy.conf freeradius-server-2.0.1
by Herve Brunet 07 Apr '08

07 Apr '08

Dear, I want authenticate user "name(a)mydomain.fr" to my local server and all others requets "name@xxxxx" will be proxied to rad1.eduroam.fr. My configuration doesn't works, all the request "name@xxxxx" will be sent to my local server. here my configuration : proxy.conf : realm mydomain.fr { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = rad1.eduroam.fr:1812 accthost = rad1.eduroam.fr:1813 secret = xxxxxxxxxxxxxxxxxxxxxxxx nostrip } radius.conf: ...... proxy_requests = yes $INCLUDE proxy.conf ....... realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } ........ sites-enabled/default: authorize { preprocess mschap suffix eap { ok = return } ldap files } /usr/local/sbin/radiusd -X : ....... rad_recv: Access-Request packet from host 140.77.63.15 port 1249, id=88, length=144 NAS-IP-Address = 140.77.63.15 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "toto(a)ens-les.fr" Calling-Station-Id = "000e35a547b4" Called-Station-Id = "00147c88fb55" NAS-Identifier = "AP-GN1S-N2-13" EAP-Message = 0x0201001401746f746f40656e732d6c65732e6672 Message-Authenticator = 0x3347f7dd6a664503fc2f2f0eea7d989b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "ens-les.fr" for User-Name = "toto(a)ens-les.fr" rlm_realm: No such realm "ens-les.fr" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for toto(a)ens-les.fr expand: %{Stripped-User-Name} -> ..... The directive DEFAULT in proxy.conf doesn't match the string toto(a)ens-les.fr What the problem ? Thanks by advance for any help. -- Hervé Brunet

2 2

Re: Freeradius + CHAP
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

mysql> select * from radcheck; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | s | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec) radiusd -X Ready to process requests. User-Name = "s" User-Password = "\340\334\351\234" NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.9 Calling-Station-Id = "00-1C-A4-6F-21-10" Called-Station-Id = "00-18-F8-0A-70-69" NAS-Identifier = "nas01" Acct-Session-Id = "47fa0f3e00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x93c5a4f9db43704aee2b6e5cec36707f WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "s", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{User-Name} -> s rlm_sql (sql): sql_set_user escaped user --> 's' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 's' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 's' ORDER BY id rlm_sql: Failed to create the pair: Failed to find IP address for rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail Invalid user: [s/\340\334\351\234] (from client localhost port 0 cli 00-1C-A4-6F-21-10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> s attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +66 Ready to process requests. I think that you should have figured out by now that you need to post relevant data: database entries for that user radiusd -X output from the request Ivan Kalik Kalik Informatika ISP Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1