- Freeradius-Users - lists.freeradius.org

EAP-TLS: Certificate creation doesn't work (Debian)
by Julian Stöver 15 Dec '07

15 Dec '07

Hi! I'm using Freeradius 1.1.3 under Debian Etch! I want to configure Freeradius with EAP-TLS in my network but there some problems with the certficate creation. I get this message when i run the file "certs.sh" in the "docs/ freeradius/examples/" directory: > ################## > create private key > name : name-root > CA.pl -newcert > ################## > > Generating a 1024 bit RSA private key > .............++++++ > ....................................++++++ > writing new private key to 'newreq.pem' > ----- > You are about to be asked to enter information that will be > incorporated > into your certificate request. > What you are about to enter is what is called a Distinguished Name > or a DN. > There are quite a few fields but you can leave some blank > For some fields there will be a default value, > If you enter '.', the field will be left blank. > ----- > Country Name (2 letter code) [AU]:State or Province Name (full name) > [Some-State]:Locality Name (eg, city) []:Organization Name (eg, > company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, > section) []:Common Name (eg, YOUR name) []:Email Address []: > ################## > create CA > use just created 'newreq.pem' private key as filename > CA.pl -newca > ################## > > CA certificate filename (or enter to create) > > ################## > exporting ROOT CA > CA.pl -newreq > CA.pl -signreq > openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem - > out root.pem > openssl pkcs12 -in root.cer -out root.pem > ################## > > MAC verified OK > > ################## > creating client certificate > name : name-clt > client certificate stored as cert-clt.pem > CA.pl -newreq > CA.pl -signreq > ################## > > Generating a 1024 bit RSA private key > ......................++++++ > .++++++ > writing new private key to 'newreq.pem' > ----- > You are about to be asked to enter information that will be > incorporated > into your certificate request. > What you are about to enter is what is called a Distinguished Name > or a DN. > There are quite a few fields but you can leave some blank > For some fields there will be a default value, > If you enter '.', the field will be left blank. > ----- > Country Name (2 letter code) [AU]:State or Province Name (full name) > [Some-State]:Locality Name (eg, city) []:Organization Name (eg, > company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, > section) []:Common Name (eg, YOUR name) []:Email Address []: > Please enter the following 'extra' attributes > to be sent with your certificate request >> A challenge password []:An optional company name []:Using >> configuration from /usr/lib/ssl/openssl.cnf >> ./demoCA/serial: No such file or directory >> error while loading serial number > 11733:error:02001002:system library:fopen:No such file or > directory:bss_file.c:352:fopen('./demoCA/serial','r') > 11733:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: > Failed to do sign certificate I think the 6 last lines are important and i search for a "serial" file, but i doesn't exist. Are there other users with this problem? How can i solve this problem? Mfg Julian

2 2

Freeradius and AD
by Dave Gibelli 15 Dec '07

15 Dec '07

Hi I am testing Freeradius within an 802.1x environment. I want to send authentication request to 4 different AD DC's depending on the Domain sent from the client to the Authenticator. Can Freeradius forward request in this way? Dave

4 4

Re: 802.1x machine authentication patch help
by Michael Patzer 15 Dec '07

15 Dec '07

i found the topic about "No logon workstation trust account (0xc0000199)". i've the same problem using freeradius-2.0.0-pre2 samba 3.0.24 on debian etch is it required to update to samba 3.0.28 (debian unstable) to fix this issue, or could it be anything else? thx michael freeradius-log: +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/trelane.ka.foobar.de with NT-Password expand: --username=%{mschap:User-Name} -> --username=trelane$ mschap2: 95 expand: --challenge=%{mschap:Challenge} -> --challenge=36fc487a5fe99e03 expand: --nt-response=%{mschap:NT-Response} -> --nt-response=b8ec109fa4b1a1ed3b2832f4e9704456febebeb4d790574e Exec-Program output: No logon workstation trust account (0xc0000199) Exec-Program-Wait: plaintext: No logon workstation trust account (0xc0000199) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject -----Original Message----- From: [EMAIL PROTECTED] [EMAIL PROTECTED] On Behalf Of Phil Mayers Sent: 01 October 2007 09:55 To: FreeRadius users mailing list Subject: Re: 802.1x machine authentication patch help On Fri, 2007-09-28 at 12:06 +0100, Marco Casulli wrote: > Hi Jamie, > > Marco from BBC in london. > > I have read your message > (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/0485 > 76.html related to the error when the radius is trying to authenticate > in AD and I am getting exactly the same message. > > "No logon workstation trust account (0xc0000199)". > > The article is dated Nov 2005 so I hope you have the solution by now! > ;-) You need a suitably recent version of Samba. I can't remember the exact version number, but I'm sure judicious use of Google will find it, or just use the most recent.

2 1

unlang question
by Norbert Wegener 15 Dec '07

15 Dec '07

In pre2 an update reply works, when I have: update reply { ... Tunnel-Private-Group-ID ="%{control:Huntgroup-Name}" ... } Enterasys have a unusual syntax. They need for the same something like: update reply { ... filter-id = Enterasys:version=1:mgmt=su:policy="%{control:Huntgroup-Name}" ... } This does not work for me. Trying different quoting do not yet help. Is this possible at all? Norbert Wegener

2 1

wds eap-ttls
by Sergio Belkin 14 Dec '07

14 Dec '07

Hi, I've configured freeradius with eap-ttls, and is working fine, but I have one doubt: Can I use this kind of settings for use several APs with WDS? I ask this because I've read this: "This means that Wi-Fi Protected Access (WPA) and other dynamic key assignment technology may not be used" http://www.smallnetbuilder.com/?option=com_content&task=view&id=24308&pop=1… Is that right? If I can, should I modify something of my config? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4

Re: EAP-TLS - About username sent by supplicant
by Alexism 14 Dec '07

14 Dec '07

Hello, I have the same problem but this procedure don't work in my environment (FREERADIUS, OpenLDAP, SAMBA). I have this eap error : rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler Can you send me your radiusd.conf ? Regards OLIVER Patrice wrote: > > Hello, > > It works, thanks. :) > > Regards. > > -----Original Message----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Date: Fri, 14 Dec 2007 09:39:08 +0000 > Subject: Re: EAP-TLS - About username sent by supplicant > >> Hi, >> >> > My question deals with the username sent by the supplicant when the >> authentication goes on. At >> boot >> > time, the username sent is : host/user_name. After the login, the >> username sent is : user_name. >> So, I >> > have to create 2 users. I want to cut 'host/' to make this task easier. >> It is possible ? How do I >> do this ? >> >> attr_filter or somesuch eg put these into radiusd.conf >> >> attr_rewrite copy-user-name { >> attribute = Stripped-User-Name >> new_attribute = yes >> searchfor = "" >> searchin = packet >> replacewith = "%{User-Name}" >> } >> >> attr_rewrite remove-host { >> attribute = Stripped-User-Name >> searchfor = "^(host/.*)" >> searchin = packet >> new_attribute = no >> replacewith = "%{1}" >> } >> >> and then call these 2 functions in your authorize section >> (radiusd.conf or sites-enabled/wherever (for FR 2.0) ) >> >> copy-user-name >> remove-host >> >> just before the other modules are called - eg chap, auth_log etc etc >> >> alan >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- View this message in context: http://www.nabble.com/EAP-TLS---About-username-sent-by-supplicant-tp1433164… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

RE: 802.1x machine authentication patch help
by Michael Patzer 14 Dec '07

14 Dec '07

i fixed the issue by building and installing my own windbind-package from the debian unstable source for etch: winbind_3.0.28-1_i386.deb now i've only left the problem, that freeradius converts username: "host/trelane.ka.foobar.de" to username: trelane$ domain: ka i did a workaround for this by adding the domainname directly to the ntlm_auth command, becouse at the moment we only use one domain. but is there any better way? regards, michael -----Original Message----- From: freeradius-users-bounces+michael.patzer=netviewer.com(a)lists.freeradius.o rg [mailto:freeradius-users-bounces+michael.patzer=netviewer.com@lists.free radius.org] On Behalf Of Michael Patzer Sent: Friday, December 14, 2007 1:04 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: 802.1x machine authentication patch help i found the topic about "No logon workstation trust account (0xc0000199)". i've the same problem using freeradius-2.0.0-pre2 samba 3.0.24 on debian etch is it required to update to samba 3.0.28 (debian unstable) to fix this issue, or could it be anything else? thx michael freeradius-log: +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/trelane.ka.foobar.de with NT-Password expand: --username=%{mschap:User-Name} -> --username=trelane$ mschap2: 95 expand: --challenge=%{mschap:Challenge} -> --challenge=36fc487a5fe99e03 expand: --nt-response=%{mschap:NT-Response} -> --nt-response=b8ec109fa4b1a1ed3b2832f4e9704456febebeb4d790574e Exec-Program output: No logon workstation trust account (0xc0000199) Exec-Program-Wait: plaintext: No logon workstation trust account (0xc0000199) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject -----Original Message----- From: [EMAIL PROTECTED] [EMAIL PROTECTED] On Behalf Of Phil Mayers Sent: 01 October 2007 09:55 To: FreeRadius users mailing list Subject: Re: 802.1x machine authentication patch help On Fri, 2007-09-28 at 12:06 +0100, Marco Casulli wrote: > Hi Jamie, > > Marco from BBC in london. > > I have read your message > (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/0485 > 76.html related to the error when the radius is trying to authenticate > in AD and I am getting exactly the same message. > > "No logon workstation trust account (0xc0000199)". > > The article is dated Nov 2005 so I hope you have the solution by now! > ;-) You need a suitably recent version of Samba. I can't remember the exact version number, but I'm sure judicious use of Google will find it, or just use the most recent. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

EAP-TLS - About username sent by supplicant
by OLIVER Patrice 14 Dec '07

14 Dec '07

Hello, I use EAP-TLS to authenticate the computers on my wlan. As the supplicants run on Windows XP, I had to store the certificates in the 'local computer' and 'user account' stores and create the register key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\AuthMode with the value '1' (dword). You may ask me why. The reason is simple. Certificates stored in 'local computer' are used at boot time and certiticates store in 'user account' and used at login time. The value of the register key tells Windows to authenticate at boot time and after login time. So, if the WIFI card is removed and inserted, the authentication works fine. :) My question deals with the username sent by the supplicant when the authentication goes on. At boot time, the username sent is : host/user_name. After the login, the username sent is : user_name. So, I have to create 2 users. I want to cut 'host/' to make this task easier. It is possible ? How do I do this ? Regards, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 2

Question about nt-domain.
by Hangjun He 14 Dec '07

14 Dec '07

Hi, FreeRADIUS 1.1.6. Use users file as user store. When I use username/password, It can work. When I user username/password/domain, It not work. I try to set preprocess module with_ntdomain_hack = yes. I get "rlm_eap: Identity does not match User-Name, setting from EAP Identity." I try to add with_ntdomain_hack = yes in mschap module, It does not work. Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.84:1030, id=1, length=166 User-Name = "HH\\hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0224000e0148485c686865313233 Message-Authenticator = 0xe02bcaa4c6065250f6dcd3ccd60386f6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "hhe123", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user hhe123 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 36 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Sending Access-Reject of id 1 to 10.155.20.84 port 1030 Reply-Message = "Hello" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... John --------------------------------- 天生购物狂，狂抢购物券，你还等什么！

2 1

EAP-TLS authentication
by anoop_c＠sifycorp.com 14 Dec '07

14 Dec '07

HI I am using EAP_TLS authentication ie certificate based authentication with free radius.The setup is working fine . I have one query.Is there any way to lock the client certificate to a particular laptop MAC address so that the certificate cannot be used in another machine..Is there any config in Free radius for this purpose so that one certificate should not be used by another user Regards Anoop ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com Complete Coverage of the ICC World Cup '07! Log on to www.sify.com/khel for latest updates, expert columns, schedule, desktop scorecard, photo galleries and more! Watch the hottest videos from Bollywood, Fashion, News and more only on www.sifymax.com For the Expert view of the ICC World Cup log on to www.sify.com/khel. Read exclusive interviews with Sachin, Ganguly, Yuvraj, Sreesanth, Expert Columns by Gavaskar, Web chat with Dhoni and more! .

2 1