- Freeradius-Users - lists.freeradius.org

How to connect to mySql
by johnson elangbam 04 Feb '08

04 Feb '08

hi, I am a new user in free radius server, i wanted to keep the username/password in mySql database. I've read almost all the radiusd.conffile to make through, but it doesn't help, please help me to configure to connect the database to make it work. Thanks, with regards, Elangbam Johnson

4 3

CRL signature failure
by zz zz 04 Feb '08

04 Feb '08

Hello, I have a lot of strange messages in radius.log regarding CRL signature failure (randomly). When this message occur in the log, users can't be authenticated on EAP-TLS -> Login Incorrect. Problem is solved with full restart of freeradius service (service freeradius restart). I'm running the latest version 1.1.7 of freeradius compiled from sources on RHEL3 with RHEL openssl-0.9.7a-33.24 (openssl is installed by up2date from RHEL3 repository). Every hour is CRL updated by external cron script together with c_rehash. Mon Feb 4 09:13:24 2008 : Error: --> verify error:num=8:CRL signature failure Mon Feb 4 09:13:24 2008 : Error: TLS Alert write:fatal:decrypt error Mon Feb 4 09:13:24 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Mon Feb 4 09:13:24 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Mon Feb 4 09:13:24 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Mon Feb 4 09:13:24 2008 : Auth: Login incorrect: [Kris Jacob] (from client BEBRU765CZ101 port 1 cli 00-16-6F-61-5E-09) eap.conf -------- eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { CA_path = ${raddbdir}/certs/ check_crl = yes CA_file = ${raddbdir}/certs/CA.pem crl_file = ${raddbdir}/certs/crl.pem certificate_file = ${raddbdir}/certs/radius.pem private_key_file = ${raddbdir}/certs/radius.key dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } } I can't found any similar problem in the radius discussion. Thanks --- Cajt ------------------------------------------ http://search.atlas.cz/

1 0

EAP-ttls tunnel inner outer authentication credential management
by theSnail 04 Feb '08

04 Feb '08

Is there a way to manage in a different way the inner and the outer authentication credential in a EAP-ttls + PAP tunnel? for example authenticate the outter credential against a file and the inner against ldap dir. thanks arjuna -- View this message in context: http://www.nabble.com/EAP-ttls-tunnel-inner-outer-authentication-credential… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Help me please!!
by aziz yucelen 04 Feb '08

04 Feb '08

Hi.. I am receiving this "Access-Challenge " message.I dont know what I do.Please help me. Thanks... ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request> Thread 2 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=162> Cleaning up request 0 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 3 got semaphore> Thread 3 handling request 1, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> EAP-Message => 0x0202005019800000004616030100410100003d030147ac558d77684de77a5d4e927a0c8abbd79d3e8c289aa3006aa63ea402fae95c00001600040005000a000900640062000300060013001200630100> Message-Authenticator = 0xb38e6c9574648ff3b9b43230ab24f470> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 2 length 80> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> TLS Length 70> rlm_eap_tls: Length Included> eaptls_verify returned 11> (other): before/accept initialization> TLS_accept: before/accept initialization> rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello> TLS_accept: SSLv3 read client hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello> TLS_accept: SSLv3 write server hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0589], Certificate> TLS_accept: SSLv3 write certificate A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone> TLS_accept: SSLv3 write server done A> TLS_accept: SSLv3 flush data> TLS_accept: Need to read more data: SSLv3 read client certificate A> In SSL Handshake Phase> In SSL Accept mode> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x0103040019c0000005e6160301004a02000046030147a319d725ef54f7b8675834e99662060c8f0d046180fc473283e66e4672c67a205ba7f2ccb2f755a847a0e47c06522a98b521b9d02fe5a07f13bc49b5cb49637800040016030105890b00058500058200029730820293308201fca003020102020101300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564> EAP-Message => 0x752e7472301e170d3038303230313132353931325a170d3039303133313132353931325a30818d310b3009060355040613025452310d300b0603550408130454524e43311330110603550407130a646979617262616b697231153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100b45cb01aaa76827408cd147b1e395998e31ce1fb2124f5f199f8bf9ba98c85b87dc6f425eafd260829153b36> EAP-Message => 0x1ed91744ac08f259793c02c6033d4bcb7c443b5d01e179b81f19182a4f6fbe212616e54184512b813d0f7fa7b71cd0a0b8f479a3841e079339f070594cc15799cb20cb370aa6ad5e1bb607676186a80c40145e1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003e369a0269de8132e852e07c3e8d41ca9a8feabbddbec18ba7d87c8a93c8f711d84485d528c1e52db85d6d233eae7f08fc9d45579ba7dd8b7eb0a9864dfd88eda4d5eead488dddb371af95a81d786abd18a1950fce63c9872c6c6e874983090b85578bba6a2a4fc523b36e463b78cd5d9de64abbf462ef0a> EAP-Message => 0x18c65cf0625345740002e5308202e13082024aa003020102020100300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e7472301e170d3038303230313132343535315a170d3131303133313132343535315a3078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a> EAP-Message = 0x060355040b130342494d3110> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> Finished request 1.> Going to the next request> Thread 3 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 1 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 5 got semaphore> Thread 5 handling request 2, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> EAP-Message = 0x020300061900> Message-Authenticator = 0xf30dca65a4d02ac05f72f49a8c603c32> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 3 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x010401f61900300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100c74f8084794bb5e24142b92ed730c80507ff7a16fbb013b222787dd18b7d1f9d19d72ba7c41da18a32b32db41ae6de80c3113a615ff7016120b14dddbc5f2a5b696e501ff9f317a000448de5c9e60ab6f6ce295538591c208504cc3f9ec6dc0703c92372b4f98189b57c20a7a78edc18ef58627aa1e789fad4f7f7a8bccbd5910203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d> EAP-Message => 0x4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0301f0603551d23041830168014a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0300d06092a864886f70d010105050003818100a53c167b89b48d0b030926b38a337e7ac9e65f3bd4f788f2e7d132859059ddd63ca436149dd929ff168de011bf53e5b5a51189c44467589c4eabfef504c25507510a3749e2e8fa3189f5a571260458fbf2d4e58b3857a1726a0af4a21c5539472e24e96f7678256e32141babf86921d8c7f57a5b92790a5782c7d232fadbd3bc16030100040e000000> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> Finished request 2.> Going to the next request> Thread 5 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 2 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 4 got semaphore> Thread 4 handling request 3, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> EAP-Message = 0x020400061900> Message-Authenticator = 0x7011b465e9976763874b73745ac1d791> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 4 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message = 0x010500061900> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f47cff0d3d2c202f1c7a8b9c> Finished request 3.> Going to the next request> Thread 4 waiting to be assigned a request> Waking up in 4.0 seconds. _________________________________________________________________ Need to know the score, the latest news, or you need your Hotmail®-get your "fix". http://www.msnmobilefix.com/Default.aspx

2 1

UserName, Password + MAC authentication using Cisco's BBSM 5.3
by javkhlanbaatar＠newcomsystems.mn 04 Feb '08

04 Feb '08

Hello, I'm using Freeradius 1.1.17 version with Cisco's BBSM. With MySqL database too. I've storing username, passwords in mysql db. For now, authentication is OK. I want to check MAC address of users while they are authenticating. Inmy radcheck table: | id | UserName | Attribute | op | Value | +----+-------------+--------------------+----+-------------------+ | 3 | java | Password | == | password | | 18 | java | Calling-Station-Id | == | aa-bb-cc-dd-ee-ff | Also, BBSM's snmp is enabled. So I can get users' MAC addresses. I want Radius server checks username, password and MAC addresses at the same time when the user authenticate. Without Calling-Station-Id, authentication is OK. When I add Calling-Station-Id, the user cannot authenticate. In which table, do I enter this attribute? Also i cannot close or deactivate user session when I want to. When i removing from BBSM Mysql db, session is still open. Or can I put expiration time at every 03 o'clock? Could someone help me abt these?

6 10

ascend data filters not being returned
by Don James 04 Feb '08

04 Feb '08

Hi, When I run radtest, I get the following response: Sending Access-Request of id 64 to 192.168.1.41 port 1645 User-Name = "donjames(a)hendersonisp.com" User-Password = "donjames" NAS-IP-Address = 255.255.255.255 NAS-Port = 5 rad_recv: Access-Accept packet from host 192.168.1.41:1645, id=64, length=20 As you can see, the data from the ascend data filters is not being returned. I suspect that I have somehow turned on encryption. How do I set "plain text" communication? Sincerely, Don James

3 4

802.1x Authentication
by Devinder Singh 03 Feb '08

03 Feb '08

Hi Does Free Radius has support for 802.1x authentication such as providing Certificate. Can it also integrate with MIcrosoft Active Direcrtory, Regards -- Devinder

3 2

xpextension problems...
by SnahaD00 03 Feb '08

03 Feb '08

Hi, now I managed to setup and made freeradius -x is sending this: ... bunch of code... ... rad_recv: Access-Request packet from host 192.168.1.1:2049, id=0, length=150 User-Name = "Client Certificate" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0018f8db044b" Calling-Station-Id = "001de00fa589" NAS-Identifier = "0018f8db044b" NAS-Port = 35 Framed-MTU = 1400 State = 0x9adb99ca64043c01aaa3595d2f6348c7 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 Message-Authenticator = 0xef092ad0a33933ac15c7340d538ca9a5 Sending Access-Challenge of id 0 to 192.168.1.1 port 2049 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5298c579adf1167ca687f17658f9e092 I could say that winxp box and radius server see each other, but winxp box does nothing. help :) regards,

2 1

Debugging RLM modules
by Ali Majdzadeh 03 Feb '08

03 Feb '08

Hello All Is there any way to debug an RLM module using gdb? Kind Regards Ali Majdzadeh Kohbanani

3 4

Sql_log against postgresql
by Roy Walker 03 Feb '08

03 Feb '08

Have 2.0 running against a Postgresql database. The sql_log code looks like it functions differently than the sql statements in the postgres driver (stop packets are another insert instead of an update). Has anyone already changed out the sql lines match the way it works without sql_log, don't see why it would be an issue... if you have would you mind sharing it? PS Nice to see the column names were corrected in 2.0 (between MySql and Postgresql schemas). Thanks, Roy

2 1