- Freeradius-Users - lists.freeradius.org

Re: Freeradius as a proxy to Windows IAS - Solved!
by Clive Gould 31 Jul '07

31 Jul '07

Hi everyone Please ignore my postings about problems with IAS authentication. I have just read this in the FAQ: "FreeRADIUS is limited to 16 characters for the shared secret." The shared secret on our IAS server is 25 characters long :-( Thanks anyway Clive

3 3

CalledStationID
by Jeffrey Sewell 31 Jul '07

31 Jul '07

I'm trying to solve a design issue and wonder if anyone has done something similar with hotspots. I would like to send back different values in the VSAs when a user logs in from one calledStationID vs another. For example. User joe logs in from hotspot1. the calledStationID is sent. FreeRADIUS takes that and sends back the local DNS server IP address (or whatever is specific to that region) instead of the one tied to, say, hotspot100. The goal is to allow me to setup different regions in FreeRADIUS with region-specific parameters. I had some things that I thought would work, but I'm wondering how others have solved this problem. Jeffrey

4 8

EAP-TLS
by abhishek singh 31 Jul '07

31 Jul '07

Hi, I have a setup where my client is trying to perform authentication to server by using EAP-TLS. The server is a pass through server, which forwards the packet to the free radius. The free radius, instead of sending the server certificates, bails out on seeing the client Hello and the TLS handshake aborts. I am not being able to figure out the exact cause. Any help will be appreciated. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/temp/freeradius- 1.1.6/raddb/certs/cert- srv.pem" tls: certificate_file = "/root/temp/freeradius-1.1.6/raddb/certs/cert- srv.pem" tls: CA_file = "/root/temp/freeradius-1.1.6/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/root/temp/freeradius-1.1.6/raddb/certs/dh" tls: random_file = "/root/temp/freeradius-1.1.6/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.25.13.61:32772, id=172, length=112 EAP-Message = 0x02f9001d01727361757365723140736166656e65742d696e632e636f6d User-Name = "rsauser1@****** inc.com" Framed-MTU = 1400 Message-Authenticator = 0x2250f6cd977a5d08a36d9b763bcbb0e4 NAS-Identifier = "127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "******inc.com" for User-Name = "rsauser1(a)safenet-inc.com " rlm_realm: No such realm "*****inc.com" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 249 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 172 to 172.25.13.61 port 32772 EAP-Message = 0x01fa00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab07f776af1e85b77ff4701c377b35b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772 , id=6, length=164 EAP-Message = 0x02fa003f0d160301003501000031030146ae5a6d0160fe0dfa54bb07a4621ff0f61c35aeb429d6b516224dc14464553200000a0004000500070009000a0100 User-Name = " rsauser1(a)safenet-inc.com" Framed-MTU = 1400 State = 0xab07f776af1e85b77ff4701c377b35b0 Message-Authenticator = 0xb29d99250e4ec7907b0db64636f40e2d NAS-Identifier = " 127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "safenet-inc.com" for User-Name = "rsauser1(a)safenet-inc.com " rlm_realm: No such realm "safenet-inc.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 250 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: Need to read more data: SSLv3 read client hello B rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=6, length=164 Sending Access-Reject of id 6 to 172.25.13.61 port 32772 EAP-Message = 0x04fa0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 6 with timestamp 46af0b4f Cleaning up request 0 ID 172 with timestamp 46af0b4f Nothing to do. Sleeping until we see a request.

1 0

Re: Freeradius as a proxy to Windows IAS (Peter Nixon)
by Clive Gould 31 Jul '07

31 Jul '07

Hi Peter Thanks for the prompt reply. The Windows IAS server is working fine and I have been successfully authenticating against it using Moodle/PHP on the Linux server for several years. I've put the Freeradius server in between Moodle and IAS purely to test out my proxing configuration and then authentication fails despite the shared secrets being identical. This is the response from the IAS server (10.200.0.2) as received by the Freeradius acting as a proxy: Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.200.0.2:1812, id=0, length=236 Received Access-Accept packet from 10.200.0.2:1812 with invalid signature (err=2)! (Shared secret is incorrect.) Server rejecting request 0. Are there any characters (e.g. \) which must not be used in a shared secret with a Freeradius server? Best wishes Clive On Tue 31 Jul 2007, Clive Gould wrote: > Hi > > Thanks for the replies to my posting yesterday. > > Perhaps I can explain the situation more clearly. My goal is to > authenticate login to the digital repository DSpace against a Windows IAS > server. I do not have physical access to the IAS server and cannot change > it's shared secret. So far I have been unable to successfully authenticate > DSpace directly against the remote IAS server. Well, I would suggest you solve this problem first. > As a result of this I came up with the idea of setting up a Freeradius > proxy server running on the same Linux box as DSpace, which would act as a > proxy to the remote IAS server for authentication purposes in the hope > that this would work. FreeRADIUS is not magic... Fix the IAS server and the FreeRADIUS bit should just work.. --

1 0

Re: Freeradius as a proxy to Windows IAS
by Clive Gould 31 Jul '07

31 Jul '07

Hi Thanks for the replies to my posting yesterday. Perhaps I can explain the situation more clearly. My goal is to authenticate login to the digital repository DSpace against a Windows IAS server. I do not have physical access to the IAS server and cannot change it's shared secret. So far I have been unable to successfully authenticate DSpace directly against the remote IAS server. As a result of this I came up with the idea of setting up a Freeradius proxy server running on the same Linux box as DSpace, which would act as a proxy to the remote IAS server for authentication purposes in the hope that this would work. I have been able to successfully validate login to Dspace against the FreeRADIUS server when authentication is carried out against the unix account files /etc/passwd and /etc/shadow on the local machine. However, I have been unsucessful in validating DSpace login against the IAS server with Freeradius is acting as a proxy. We also use the Moodle VLE running on the same Linux box as DSpace and Freeradius, which has been using a PHP module to successfully validate against the IAS server using the mschapv2 protocol for several years. As part of debugging I decided to try pointing Moodle at the Freeradius proxy instead of directly at IAS. I append the log trace resulting from this below. Dspace, Moodle and Freeradius are on 10.200.0.14 Windows IAS is on 10.200.0.2 It suggests to me that the shared secrets are wrong, but I've double checked them and they are identical. Any suggestions very greatfully received :-) Dspace, Moodle and Freeradius are on 10.200.0.14 Windows IAS is on 10.200.0.2 Thanks very much Clive [root@vle raddb]# /usr/sbin/radiusd -sfxxyz -l stdout > radlog [root@vle raddb]# cat radlog Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.200.0.14 IP address [10.200.0.14] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.200.0.14:1812 Listening on accounting 10.200.0.14:1813 Listening on proxy 10.200.0.14:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.200.0.14:41775, id=238, length=178 NAS-Identifier = "vle.bromley.ac.uk" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cliveg(a)staff.bromley.local" MS-CHAP2-Response = removed from this email MS-CHAP-Challenge = removed from this email Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: Looking up realm "staff.bromley.local" for User-Name = "cliveg(a)staff.bromley.local" rlm_realm: Found realm "staff.bromley.local" rlm_realm: Proxying request from user cliveg to realm staff.bromley.local rlm_realm: Adding Realm = "staff.bromley.local" rlm_realm: Preparing to proxy authentication request to realm "staff.bromley.local" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched DEFAULT at 183 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 Sending Access-Request of id 0 to 10.200.0.2:1812 NAS-Identifier = "vle.bromley.ac.uk" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cliveg(a)staff.bromley.local" MS-CHAP2-Response = removed from this email MS-CHAP-Challenge = removed from this email NAS-IP-Address = 10.200.0.14 Proxy-State = 0x323338 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.200.0.2:1812, id=0, length=236 Received Access-Accept packet from 10.200.0.2:1812 with invalid signature (err=2)! (Shared secret is incorrect.) Server rejecting request 0. Finished request 0 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.200.0.14:41775, id=238, length=178 Sending Access-Reject of id 238 to 10.200.0.14:41775 --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.200.0.14:41775, id=238, length=178 Sending duplicate reply to client vle:41775 - ID: 238 Re-sending Access-Reject of id 238 to 10.200.0.14:41775 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 238 with timestamp 46af04de Nothing to do. Sleeping until we see a request. [root@vle raddb]#

2 1

EAP-TLS
by abhishek singh 31 Jul '07

31 Jul '07

Hi, I have a setup where my client is trying to perform authentication to server by using EAP-TLS. The server is a pass through server, which forwards the packet to the free radius. The free radius, instead of sending the server certificates, bails out on seeing the client Hello and the TLS handshake aborts. I am not being able to figure out the exact cause. Any help will be appreciated. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/temp/freeradius-1.1.6/raddb/certs/cert- srv.pem" tls: certificate_file = "/root/temp/freeradius-1.1.6/raddb/certs/cert- srv.pem" tls: CA_file = "/root/temp/freeradius-1.1.6/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/root/temp/freeradius-1.1.6/raddb/certs/dh" tls: random_file = "/root/temp/freeradius-1.1.6/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.25.13.61:32772, id=172, length=112 EAP-Message = 0x02f9001d01727361757365723140736166656e65742d696e632e636f6d User-Name = "rsauser1(a)******inc.com" Framed-MTU = 1400 Message-Authenticator = 0x2250f6cd977a5d08a36d9b763bcbb0e4 NAS-Identifier = "127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "******inc.com" for User-Name = " rsauser1(a)safenet-inc.com" rlm_realm: No such realm "*****inc.com" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 249 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 172 to 172.25.13.61 port 32772 EAP-Message = 0x01fa00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab07f776af1e85b77ff4701c377b35b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=6, length=164 EAP-Message = 0x02fa003f0d160301003501000031030146ae5a6d0160fe0dfa54bb07a4621ff0f61c35aeb429d6b516224dc14464553200000a0004000500070009000a0100 User-Name = "rsauser1(a)safenet-inc.com" Framed-MTU = 1400 State = 0xab07f776af1e85b77ff4701c377b35b0 Message-Authenticator = 0xb29d99250e4ec7907b0db64636f40e2d NAS-Identifier = "127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "safenet-inc.com" for User-Name = " rsauser1(a)safenet-inc.com" rlm_realm: No such realm "safenet-inc.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 250 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: Need to read more data: SSLv3 read client hello B rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=6, length=164 Sending Access-Reject of id 6 to 172.25.13.61 port 32772 EAP-Message = 0x04fa0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 6 with timestamp 46af0b4f Cleaning up request 0 ID 172 with timestamp 46af0b4f Nothing to do. Sleeping until we see a request.

1 0

(no subject)
by Kennie Lionheart 31 Jul '07

31 Jul '07

Hi, I have a question about Freeradius' log. My costomer has used Remote Access VPN with Freeradius and Cisco VPN 3000, and 2 months ago, they added Cisco ASA on their system in order to expanse their VPN system. Now their users can use both VPN 3000 and ASA. VPN 3000's IP address is xx.xxx.xxx.9 and ASA's IP address is xxx.xxx.xxx.10. Both are global addresses. When their users use VPN through VPN 3000, ahthentication log can be seen on /var/log/radius/radacct/xxx.xxx.xxx.9, however when their users use VPN though ASA, no log can be seen in /var/log/radius/radacct/. I think xxx.xxx.xxx.10 should be seen there for the newly added ASA. Of course their users can connect to servers since they are ahtenticated and authorized, but no log are made on radius server. Does nyone have any idea about this? any solutions? any more configurations? This is the Linux and Radius version that they use; Linux Server: fedora-release-1-3Radius version: freeradius-0.9.3-1.1 This is the configuration on the client.conf on the server;} client xxx.xxx.xxx.10 { secret = tti shortname = VPN2 nastype = cisco # localhost isn't usually a NAS...} client xxx.xxx.xxx.9 { secret = tti shortname = VPN nastype = cisco # localhost isn't usually a NAS...} client xxx.xxx.xxx.1 { secret = tti shortname = localhost nastype = other # localhost isn't usually a NAS...} Thanks,Ken _________________________________________________________________ Missed the show? Watch videos of the Live Earth Concert on MSN. http://liveearth.msn.com

2 1

FreeRADIUS as proxy to Windows IAS
by Clive Gould 31 Jul '07

31 Jul '07

Hi I'd be grateful to hear from anyone out there who has got Freeradius (on a Linux box) running as a proxy server successfully validating usernames and passwords against a Windows IAS server using the MSChapv2 protocol. I have the Freeradius server up and running on CentOS 4.5, but can't get it to validate against the IAS server successfully. Please feel free to contact me off list. Thanks in advance. Clive

4 3

[OT] Out of Office AutoReply: Re[2]: Adding a NAS via SQL
by Claudiu Filip 30 Jul '07

30 Jul '07

[Out of Topic AutoReply] ATMEL is still in vacation! ARM rulz :) Claudiu Filip @: claudiu(a)globtel.ro Http://www.globtel.ro T:+40344880100 F:+40344880113 This is a forwarded message From: Ulrich.Hofacker(a)hno.atmel.com <Ulrich.Hofacker(a)hno.atmel.com> To: claudiu(a)globtel.ro Date: Monday, July 30, 2007, 7:11:02 PM Subject: Out of Office AutoReply: Re[2]: Adding a NAS via SQL ===8<==============Original message text=============== danke für ihre mail, aber ich bin bis einschliesslich 19.08.2007 nicht im büro. wenden Sie sich bei dringenden anfragen bitte an ito.admins(a)hno.atmel.com. i'm out of office until 19.08.2007 in urgent cases please send your email to ito.admins(a)hno.atmel.com Ulrich Hofacker IT2 ===8<===========End of original message text===========

1 0

Using the various User-Password, Chap-Password, etc... with MySQL
by liran tal 30 Jul '07

30 Jul '07

Hey everyone, I was wondering if someone can clearly explain the use of different Password attributes when they're used in a scenario where MySQL is involved. The basic case of User-Password is clear. When the attribute in the radcheck table is User-Password then it's value is the password in clear text and the op is == What about Cleartext-Password? I've added this attribute with op of := and value password in clear text and used radtest as a test, and it results in just re-transmission of Access-Request queries, and basically not working. What about Chap-Password, MD5-Password, SHA1-Password, what are their corresponding values and op like? As a side note, I remember reading somewhere the use of the PASSWORD('somepass') function in MySQL for radcheck's password attributes but I'm really not sure in which context was it. Thanks, Lir.

3 4