- Freeradius-Users - lists.freeradius.org

Problem with XP Clients
by Patrice OLIVER 30 Jan '08

30 Jan '08

Hello, I recently setup freeradius 1.1.7 to run a EAP-TLS authentication. My clients run on windows xp pro sp2, with microsoft hotfixes to be abble to use WPA2 and EAP. Encryption is WPA2-AES. All certificates (root and client) are installed in the computer storage and in the user storage, as documented on the Internet (root in trusted, client in personnal). When I log in with an administrator account, everything works fine. When I log in with a domain user account, I can't access to the network. A look at freeradius logs shows that it authenticate every 1 second, so the network connection does not stay up ... All access requests are accepted. Does anyone of you have an idea of what's happening ? Regards, -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

1 0

trouble seting up freeradius :((
by SnahaD00 30 Jan '08

30 Jan '08

Hi, I really (desperatelly) need freeradius to work on my schools network - it's urgent. I've got server on Ubuntu 7.04. I setup freeradius accoring to some howtoos and tutorials, but with no luck. What I did was: - made deb package with tls support - installed deb freeradius package - did setup freeradius as told here http://ubuntuforums.org/showthread.php?t=478804&highlight=freeradius+openssl - problems... When I issue command freeradius -x i got this: rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1944] Unknown module "eap". radiusd.conf[1891] Failed to parse authenticate section. Any idea ?

3 2

eap authentication problem
by Mike Zoeteweij 30 Jan '08

30 Jan '08

Can anyone tell me what I'm doing wrong here? trying to auth. a wireless user with freeradius. I'm not sure if the mistake is in the certificates of the radius config. authebtication process gets stuck in "attempting to authenticate" EAP-Message = 0x064d5a2d6166740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x55a44efe0a103d2b2a24bb8f72998edc Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.5:4855, id=3, length=191 Message-Authenticator = 0xfab5bbc4d21c025b436d243b9579b617 Service-Type = Framed-User User-Name = "wireless" Framed-MTU = 1488 State = 0x55a44efe0a103d2b2a24bb8f72998edc Called-Station-Id = "00-18-F8-F5-87-53:mikiemike" Calling-Station-Id = "00-13-E8-94-F3-B5" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.100.5 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "wireless", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched wireless at 231 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 3 to 192.168.100.5:4855 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf025c40824435e386c6a8b6a1ad5735 Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 0 with timestamp 479f9369 Cleaning up request 5 ID 1 with timestamp 479f9369 Cleaning up request 6 ID 2 with timestamp 479f9369 Cleaning up request 7 ID 3 with timestamp 479f936 thanks a lot in advance for any help. reg. Mike

2 1

Different outgoing then ingoing IP when proxying
by Jørn Kostøl 29 Jan '08

29 Jan '08

Hi, I have a 2.0.1 server running as proxy, with a virtual server handling the proxied requests. However a firewall, which cannot be changed, does not let me send packets from the external IP to the localhost on which the virtual server is listening. Is it possible to have Freeradius listen on one IP for the NAS, but proxy on a different IP (localhost) ? Cheers, Jørn

3 2

Enterasys gear and freeradius
by Kent Nasveschuk 29 Jan '08

29 Jan '08

Anyone using freeradius with Enterasys switches/routers for mac authentication with openldap backend? Currently using SBR with some problems that can only be fixed by upgrading to the GEE edition $$. Radius system: CentOS 5 Linux Freeradius 1.1.3 OpenLDAP server: CentOS 5 Linux OpenLDAP 2.3.39 Already using RADIUS-LDAPv3.schema with SBR Regards, Kent

1 0

users file matching rules
by theSnail 29 Jan '08

29 Jan '08

hi, i have a problem with the users file rules. I can use "NAS-IP-Address", "User-Name", "NAS-Port-Type" field in order to filter the packet and make different type of authentication inside users file. for example DEFAULT NAS-Port-Type == Wireless-802.11 , Autz-Type := wireless , Auth-Type := wireless this rule matches the packet and start wireless auth-type etc etc... but if i use DEFAULT Called-Station-Id == "0A-11-22-33-44-55:ssid" , Autz-Type := wireless , Auth-Type := wireless with or without double quotes this rule doesn't match the packet. I'm using EAP-TTLS+pap , maybe there's a problem with the session inside the tunnel and the one outside the tunnel? the simple question is, why if i see that field i 'm not able to use it? where's my misconfiguration? of course radiusd -X gives rad_recv: Access-Request packet from host 192.168.123.251.:1365, id=69, length=744 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "0A-11-22-33-44-55:ssid" Calling-Station-Id = "00-00-11-11-11-55" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" (i didn't send the whole radiusd -X output because i thought it was useless) arjuna -- View this message in context: http://www.nabble.com/users-file-matching-rules-tp15156740p15156740.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Authentication Problem with EAP-PEAP
by debug afone 29 Jan '08

29 Jan '08

Hi, I've got a new problem when I try to authenticate a Windows Vista client with Freeradius. Vista sends to the radius a User-Name like DOMAIN\USER. When I use nt_domain_hack or the realm ntdomain, the domain disappear from the User-Name attribute. The authentication goes on, the login/password match in LDAP database but EAP fails. Here's a trace : rlm_ldap: user nsouleman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 3 modcall: leaving group authenticate (returns invalid) for request 3 auth: Failed to validate the user. As you can see, ldap module returns OK but I have this message just after : rlm_eap: Identity does not match User-Name, setting from EAP Identity. Does anybody help me ? Thanks. Nicolas SOULEMAN.

6 8

radclient from xtradius always fail?
by Stephane Bortzmeyer 28 Jan '08

28 Jan '08

I configured a FreeRadius server and tested it with FreeRadius' radclient. It works. However, when I try the radclient from xtradius, I always get an access denied. I think that FreeRadius is supposed to work with other Radius implementations :-) so there is something strange. With FreeRadius's radclient: % echo "User-Name = bortzmeyer\nUser-Password = theuserpassword" | radclient jezabel auth mysharedsecret Received response ID 181, code 2, length = 44 Service-Type = Framed-User Framed-Protocol = PPP ... With xtradius' radclient, same client machine: % echo "User-Name = bortzmeyer\nUser-Password = theuserpassword" | radclient jezabel auth mysharedsecret Sending request to server jezabel, port 1812. Warning: Received invalid reply digest from server radrecv: Packet from host 10.1.82.2 code=3, id=13, length=20 Access denied. And, on the FreeRadius server, when it fails: rad_recv: Access-Request packet from host 10.1.82.1:32774, id=13, length=50 User-Name = "bortzmeyer" User-Password = "\274\016N\002\363\206\206a&.P06\270\363\335" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bortzmeyer", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bortzmeyer at line 52 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "pap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password ¼?N?ó??a&.P06¸óÝ rlm_pap: Using clear text password "theuserpassword". rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: leaving group PAP (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! The clients.conf config: client lilith.generic-nic.net { secret = mysharedsecret shortname = lilith nastype = other }

2 4

Question about forum
by Marinko Tarlac 28 Jan '08

28 Jan '08

I saw that freeradius project has his own chat channel but what about forum? I read all emails in this list and some of these mails should be available on some kind of forum so we can share experience. What do you think?

10 16

RE: Creating rpm problem
by Laurent RAYSSIGUIER 28 Jan '08

28 Jan '08

Ok, with the explainations of Joe I do this : tar xvfz freeradius-server-2.0.1.tar.gz mv freeradius-server-2.0.1 freeradius-2.0.1 tar cvfz freeradius-2.0.1.tar.gz freeradius-2.0.1 cp freeradius-2.0.1.tar.gz /usr/src/redhat/SOURCES echo "%_incdir /usr/include" >>.rpmmacros rpmbuild -ta freeradius-2.0.1.tar.gz And Now, the rpm will be created correctly. Thank You Joe, and anyone who has try to answer :-) Bye Laurent

1 0