- Freeradius-Users - lists.freeradius.org

Problems using EAP-TLS with freeradius version 2
by Stefan Puch 08 Feb '08

08 Feb '08

Hello again, @Alan DeKok > But I would first suggest trying to use the test certificates that come with > 2.0.1. If those work, then the issue isn't 2.0.0 versus 1.1.7, it's that > there is something special about the certificates you're using. I tried to generate some test certificates using the README file provided in the source-code under "freeradius-server-2.0.1/raddb/certs/" Therefore the Makefile is used in the same directory. I'm not really sure, but in Line 93 where the "client.pem" is created it must be -passin pass:$(PASSWORD_CLIENT) instead of -passin pass:$(PASSWORD_SERVER) Most of the time you will not recognize, because in server.cnf and client.cnf all the passwords are set to "whatever" so they are identical, but when you set them, you will get an error (like me). It would also be helpful to integrate the following command into the ca section, when generating a self-signed CA certificate, because using Windows you need the CA in DER-format: openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der This evening I will try to test if this certificates are working. @Reimer Karlsen-Masur > We know of problems with EE certificates in PDAs containing the > "non-repudiation" flag. > Additionally Windows build-in supplicants don't like EE certificates with > the extendedKeyUsage "Microsoft Smartcard Logon" (1.3.6.1.4.1.311.20.2.2) > when doing EAP-TLS. > Apparently the latter issue can also be solved by just disabling the valid > certificate usage of Microsoft Smartcard Logon in the issuing CAs trusted > usages properties on the system. I'm not sure if understand correctly what you want to say to me (I'm stupid :-)) First I've used TinyCA to generate my certificates, now I will try the Makefile provided in the source-code of freeradius. I think the extendedKeyUsage "Microsoft Smartcard Logon" should not be set in both variants. Or do you mean that the extendedKeyUsage "Microsoft Smartcard Logon" must be disabled on the PDA? Best regards and thanks in advance Stefan Puch

7 16

Problem when removing Auth-Type := Ldap in users file
by cxu 08 Feb '08

08 Feb '08

Hi, I am testing the freeradius server, and try to clarify rules applied in freeradius. In the following trials, I could not figure out how to make Autz-Type Ldap1 in authorize section to correctly set Auth-Type used in authentication without the help from "Auth-Type := Ldap1". With the following entry in users file, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1, Auth-Type := Ldap1 ************** the user authentication worked fine. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=19, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 189 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 70 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/unbCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok rad_check_password: Found Auth-Type Ldap1 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type "Ldap1" +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authenticate rlm_ldap: login attempt by "tester" with password "testing" rlm_ldap: user DN: uid=tester,ou=people,dc=myu,dc=ca rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=tester,ou=people,dc=myu,dc=ca/testing to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user tester authenticated succesfully +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok Login OK: [tester] (from client unbsj113 port 189) Sending Access-Accept of id 19 to 192.168.1.113 port 20000 Finished request 0. Going to the next request Waking up in 0.8 seconds. Waking up in 4.1 seconds. Cleaning up request 0 ID 19 with timestamp +99 Ready to process requests. ************** However when I removed Auth-Type := Ldap1 in the entry, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1 ************** the user authentication failed. The Auth Type is set to Local instead of Ldap. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=20, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 192 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 71 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap2.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap2.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap] returns ok ++- redundant-load-balance group redundant-load-balance returns ok !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [tester] (from client unbsj113 port 192) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 20 to 192.168.1.113 port 20000 Waking up in 4.9 seconds. Cleaning up request 0 ID 20 with timestamp +111 Ready to process requests. ************** In radiusd.conf, ldap myldap { server = "ldap2.myu.ca" identity = "uid=radius,dc=myu,dc=ca" password = PWD12345678 basedn = "ou=people,dc=myu,dc=ca" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt cacertfile = /usr/local/etc/raddb/certs/myuCA.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd require_cert = "never" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword # password_header = "{clear}" edir_account_policy_check = no # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName groupmembership_attribute = eduPersonPrimaryAffiliation # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes set_auth_type = yes #ldap_debug = 0x0028 } ldap myldap2 { ... } authorize { ... Autz-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } authenticate { ... Auth-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } Thanks for your help! Andrew

3 5

How can I start the freeradius server with user privileges other than root?
by Deepak Panigrahy 07 Feb '08

07 Feb '08

I need the instructions to start the freeradius server from any user account of the linux machine other than root. Can anyone help me out? Thanks, Deepak

2 1

RE: FreeRadius deployment
by pablo.cuesta＠bt.com 07 Feb '08

07 Feb '08

Me again. I feel pretty stupid now as the listen section was documented on the radiusd.conf file but i read over it.Anyway,I had checked the 1.1.7 i got installed and it has the "listen" section which seems to allow to use the same FreeRADIUS server to listen at different IPs and ports. However, would the radius listen to auth and acct packets or only to auth packets? I mean, *******************start config********************** listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1 type = auth } listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1+1 type = acct } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2 type = auth } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2+1 type = acct } *********************end config*********** Will work, listening to auth and acct packets? Anyway I will upgrade to version 2 but 1.1.7 is installed in our test machine right now. Thank you in advanced, Pablo Cuesta -----Mensaje original----- De: Cuesta Fernandez,P,Pablo,JPW32 R Enviado el: jueves, 07 de febrero de 2008 20:44 Para: 'ac221(a)sussex.ac.uk'; 'FreeRadius users mailing list' Asunto: RE: FreeRadius deployment > Has anyone try this? Use FreeRadius 2 , yo can instantiate two virtual servers and bind them to different ip addresses. Downloading it right now. Thanks. Pablo Cuesta

1 0

FreeRADIUS and RSA RADIUS Server
by Jakub Morávek 07 Feb '08

07 Feb '08

Hello, I have not many experiences with radius, so my question may be stupid. Has anybody experience with using freeradius (Version 1.1.3 in Debian Sarge) as proxy for RSA RADIUS Server included in RSA Authentication Manager 6.1? I need to solve following problem with the "Agent host" i.e. host which send authenticate request to RSA Auth Manager. When authentication request goest through freeradius proxy, RSA Manager thinks that Agent host is my freeradius proxy instead of original host which sent authenticate request. Below is pasted part of pre-proxy detail log and debug log. part of output from: freeradius -X: Sending Access-Request of id 0 to 10.100.25.2 port 1812 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Proxy-State = 0x313039 output of /var/log/freeradius/radacct/10.5.0.31/pre-proxy-detail-20080204: Packet-Type = Access-Request Mon Feb 4 23:55:50 2008 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Client-IP-Address = 10.5.0.31 Stripped-User-Name = "jakub" Realm = "NULL" Realm = "NULL" Proxy-State = 0x313039 Does this mean, that freeradius process all attributes from pre-proxy-detail-20080204 log, but sends only attributes, which are shown in extended debug mode? If so, can anybody give me any advice how can I configure freeradius to send more attributes? Jakub

5 9

attr rewrite issue
by Keith Dovale - HostworX.co.za 07 Feb '08

07 Feb '08

Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

1 0

PEAP mschapv2 Proxy not working.
by Andrew Olson 07 Feb '08

07 Feb '08

Hello, I'm having trouble getting freeradius-1.1.7 to proxy PEAP-mshcapv2 to another RADIUS server. My other server doesn't do EAP, so I'm just sending mschapv2 achieved with proxy_tunneled_request_as_eap = no in eap.conf. When I proxy to my other server, I get back an Access-Accept packet. Then, freeradius sends an Access Challenge to the client, receives a response and then things appear to break. I am able to successfully authenticate users with PEAP by defining them locally in the users file. Additionally, I have gotten TTLS to work by proxying to another server, it's just PEAP that I'm having problems with. The differing line in the debug seems to be: <proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 -vs- <non-proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. I'm running a pretty standard config, I think. I can send copies of it, if that would help. Thanks, Andrew Olson The complete proxied debug starting with the Access-Request is as follows: Sending Access-Request of id 0 to 198.82.247.36 port 1812 User-Name = "anolson" NAS-IP-Address := 198.82.245.57 MS-CHAP-Challenge = 0x85feba9cbed9e9191bf72a29f0f82312 MS-CHAP2-Response = 0x0700b776d1433b4d6dab43d5bde9163e8b450000000000000000ee7fcb070f3766e7e7b0f198b72754b44a9ef0255d712db1 Proxy-State = 0x3136 Service-Type := Framed-User Waking up in 6 seconds... rad_recv: Access-Accept packet from host 198.82.247.36:1812, id=0, length=189 Filter-Id = "CNS_NET1" MS-CHAP2-Success = 0x07533d43433041424443323542333046453444414131394238363737413941334136454631364134454634 MS-MPPE-Send-Key = 0x7b5fcacde0c3798261894df701a5cdd5 MS-MPPE-Recv-Key = 0x3900c03d5b5851da66e8fb27d90077f9 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x0000000e Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8170500 2 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8170500 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 POST-PROXY 2 POST-AUTH 2 PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 Sending Access-Challenge of id 16 to 128.173.10.131 port 56945 EAP-Message = 0x0107005b190017030100502c303c60e1337bcb4c17a281f71910d23777fd5f4a4d5aefab92a23ff28a993aa17ebc2d6bd7567b9386fec7c4e6f2f7ae4c4655a8492000e0e473fc7e8be63a1bf372449cba9f795dc6535b04648cdb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23a96486ec5dbd008e1eddcee31dfa93 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56945, id=17, length=151 User-Name = "anolson" State = 0x23a96486ec5dbd008e1eddcee31dfa93 EAP-Message = 0x0207005419800000004e170301002050f4490743b89308d9bb84f411a1629e7b6f06dd6c02c2525747560f657f63d117030100209d0c853d82e17d05938ab49201447c135a90d068d1641a23db5fc04cfcc0dd08 Message-Authenticator = 0x3c828120c544cde1b5d4366b7e735350 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 84 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to anolson PEAP: Adding old state with dc 84 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 57 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 PEAP: Calling authenticate in order to initiate tunneled EAP session. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 47a8d136 Cleaning up request 1 ID 11 with timestamp 47a8d136 Cleaning up request 2 ID 12 with timestamp 47a8d136 Cleaning up request 3 ID 13 with timestamp 47a8d136 Cleaning up request 4 ID 14 with timestamp 47a8d136 Cleaning up request 5 ID 15 with timestamp 47a8d136 Cleaning up request 6 ID 16 with timestamp 47a8d136 Sending Access-Reject of id 17 to 128.173.10.131 port 56945 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 17 with timestamp 47a8d136 Nothing to do. Sleeping until we see a request. The complete non-proxied debug starting with the final Access-Challenge is as follows: Sending Access-Challenge of id 18 to 128.173.10.131 port 56939 EAP-Message = 0x0108002b190017030100206ae9bd54b7c0124979401818f662bec45aea2853b277e8dda897e8a645571887 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56939, id=19, length=166 User-Name = "andrew" State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 EAP-Message = 0x0208006419800000005e1703010020a0257f0df72e93adb495d9ab98f8e65ee4b526e563dd80bcdd464a3735f1d83417030100304c5de1fa016827d3181b8a26a7a31091f8f4474167c5424e0b51913e0ede50c14e04ec233670bd9888b1ea89ed510131 Message-Authenticator = 0xf3079323771a635bac1bdaa00b2e850f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "andrew", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_eap: EAP packet type response id 8 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 users: Matched entry andrew at line 53 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns updated) for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 41 modcall: leaving group authenticate (returns ok) for request 41 Sending Access-Accept of id 19 to 128.173.10.131 port 56939 MS-MPPE-Recv-Key = 0x1aa22f77848e2c89b4a6681bd67b45483d25b05232dd9e37748bba578fff2700 MS-MPPE-Send-Key = 0x62d67197e6bfbce385f1b6e2ccd03c183281bca70e810a79cd85e7d2a38d654d EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "andrew" Finished request 41 Going to the next request Waking up in 6 seconds...

3 5

EAP/TTLS on LDAP with freeradius 2.0.1
by Thierry CHICH 07 Feb '08

07 Feb '08

Hello, I know that my problem is so simple that I should be ashamed to ask help, but I have to say that I can't find a good way to do what I want to do. With the previous release of freeradius 1.1.7, I could do the following things: - people with a correct outer identity and inner identity (login/password) could be authorized and authenticate on a LDAP server, using an EAP-TTLS tunnel, obtained a WPA key. - with the same radius server, I could authenticate people with EAP-PEAP and mschapv2 on a sql database. It was nice, but I had a small problem: accounting was done using the outer identity. Since I was using the ldap to do the authorization, people who put an other valid identity didn't be correctly accounted. Then, I decided to use freeradius 2.0.1. And then I don't see how to obtain a basic configuration that is doing my first point. I always finished by : rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user If I put an Auth-Type := LDAP, it seems better in the first time, but it is worst: rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY. ++[ldap] returns invalid auth: Failed to validate the user. At this point, I don't understand what freeradius want. I don't know how to say : authorize on waht you want, I don't care, and authenticate on my LDAP server. Is it a good configuration sample I can find anywhere ? Regards, -- Thierry CHICH

3 7

password failover
by jonr＠destar.net 07 Feb '08

07 Feb '08

Hello, How do I set up a freeradius server so that if the password fails for the primary radius server it tries the secondary for the password. In my scenario, the primary is up and servicing requests, but the password for the device is incorrect. Now the device looks to the secondary to get authorized and the secondary holds the correct secret for the device. I have looked at fail-over and load-balancing but am not sure if either of these are what I am looking for. Can someone tell me what I am looking for and I can do the rest. Thanks for any help, Jon

4 9

freeradius doesn't start at boot-time : mysql error
by mailinglists 07 Feb '08

07 Feb '08

Hello, I use freeradius-1.1.3-1.2.el5 and freeradius-mysql-1.1.3-1.2.el5. the mysql database (mysql-server-5.0.22-2.1.0.1) is hosted on a remote host (both centos5). When I use /etc/init.d/radiusd as root it starts up correctly. But when the service is launched at boot time, I get this error-log : Wed Feb 6 16:17:46 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 6 16:17:46 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.1.1:/radius Wed Feb 6 16:17:46 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.1:radius Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.1' (113)' Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Feb 6 16:17:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): generate_sql_clients() returned error Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[14]: sql: Module instantiation failed. Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1844] Unknown module "sql". Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1773] Failed to parse authorize section. I look at tcpdump on the mysql-server host, and during the boot of my freeradius server, I see no traffic comming from freeradius host. There is no reject in the firewall. I've tried to put the radius rc.d script in S99 to start it as late as possible, but nothing changes. I also noticed that it doesen't seem to retry to connect to the database later. Or is it after a long time ? Is this a bug ? Where is the retry time configured (I cant try to set up to 5 seconds) ? Thanks for answers Laetitia.

1 0