- Freeradius-Users - lists.freeradius.org

Re : EAP-TLS authentication
by Eshun Benjamin 16 Jul '07

16 Jul '07

There is log file. Check your configure log to find out the path you specified for the log. You can also run in debug mode. radiusd -X ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : "anoop_c(a)sifycorp.com" <anoop_c(a)sifycorp.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Lundi, 16 Juillet 2007, 11h41mn 05s Objet : Re: EAP-TLS authentication Dear Alan I have been using Navis radius.Now i decided to move to free radius.In the navis radius there is a log file .So it will be shown as \"Username\" login ok or \"user login failed due to..\" So these logs will be very helpful for troubleshooting. In free radius thers is no log file is getting updated. This is not accounting. Regards Anoop Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > Everything is working fine.But the logs are not coming when user authenticates. What logs? Accounting? If so, see the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Re: EAP-TLS authentication
by anoop_c＠sifycorp.com 16 Jul '07

16 Jul '07

Dear Alan I have been using Navis radius.Now i decided to move to free radius.In the navis radius there is a log file .So it will be shown as \"Username\" login ok or \"user login failed due to..\" So these logs will be very helpful for troubleshooting. In free radius thers is no log file is getting updated. This is not accounting. Regards Anoop Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > Everything is working fine.But the logs are not coming when user authenticates. What logs? Accounting? If so, see the FAQ. Alan DeKok.

2 1

Re: EAP-TLS authentication (Alan DeKok)
by anoop_c＠sifycorp.com 16 Jul '07

16 Jul '07

Message: 6 Date: Fri, 13 Jul 2007 14:25:43 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: EAP-TLS authentication (Alan DeKok) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Hi Everything is working fine.But the logs are not coming when user authenticates. Regards Anoop Message-ID: <46976F47.4030904(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > pls find the attached ... > Sending Access-Accept of id 4 to 192.168.0.50 port 1026 The RADIUS server thinks everything is OK. Alan DeKok.

2 1

Reccomended switches for dynamic vlans
by Jacob Jarick 16 Jul '07

16 Jul '07

Can any1 reccomend a brand / model of wireless switches that will support dynamic vlans. I finally have freeradius working very nicely, just need to (hopefully) find an inexpensive solution for the hardware side. I am currently looking into the openwrt distro to see if that will provide dynamic vlans. Thanks for all the help guys, wouldnt have gotten Freeradius setup without this mailing list thats for sure.

7 26

Autoconf SNMP Library checks
by Arran Cudbard-Bell 15 Jul '07

15 Jul '07

Hi, Just wondering if theres any particular reason the configure script still checks for the ucd snmp libraries, is there some legacy code that will only work with ucd snmp functions? or can the snmp include test be updated to look for the net-snmp headers (in acinclude.m4) ? <net-snmp/net-snmp-config.h> <net-snmp/library/asn1.h> <net-snmp/library/snmp.h> <net-snmp/library/snmp_impl.h> ... we could check for both, without too much hastle... Thanks, Arran

2 1

freeradius and mysql
by "jose a. zúñiga" 14 Jul '07

14 Jul '07

Hi: I need a tutorial in order to connect freeradius and mysql thanks jose a.

2 1

eap-tls and checking crl
by Stefan Nowak 14 Jul '07

14 Jul '07

OK, i find where was that stupid error :) i dont know why but i wrote in CA_path = /bin/raddb/certs/. ofcourse /raddb isn`t in /bin/ only /etc/ :P. Thx. for spend your time to help fix this problem. ---------------------------------------------------- Co robisz w tym tygodniu? Chcesz zasmakować żeglarskiej przygody? Czekamy na Ciebie z imprezą "Tydzień Żeglarski w Giżycku"! Info: http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fd117.html&sid=…

1 0

eap-tls and checking crl
by Stefan Nowak 14 Jul '07

14 Jul '07

this is all logs from radiusd -X: Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.9:1812, id=11, length=140 NAS-IP-Address = 192.168.1.9 NAS-Port = 50003 NAS-Port-Type = Ethernet User-Name = "klient" Called-Station-Id = "00-0F-F7-54-C3-03" Calling-Station-Id = "00-11-09-26-48-FA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x01a863756b2ba130f66e9727b986f126 EAP-Message = 0x020a00060d00 Message-Authenticator = 0x2304361a723e66a2de23e5efa06788ba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "klient", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 190 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 11 to 192.168.1.9 port 1812 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010b00cd0d80000008c319060355040813124b756a6177736b6f2d506f6d6f72736b69653112301006035504071309427964676f737a637a3121301f060355040a131857797a737a6120537a6b6f6c6120476f73706f6461726b6931283026060355040b131f496e73747974757420496e666f726d6174796b692053746f736f77616e656a3121301f0603550403131857797a737a6120537a6b6f6c6120476f73706f6461726b69311f301d06092a864886f70d010901161070696f6e617240676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6cac8a19b1391d1900c65604d6c49bca Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.9:1812, id=12, length=1277 NAS-IP-Address = 192.168.1.9 NAS-Port = 50003 NAS-Port-Type = Ethernet User-Name = "klient" Called-Station-Id = "00-0F-F7-54-C3-03" Calling-Station-Id = "00-11-09-26-48-FA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x6cac8a19b1391d1900c65604d6c49bca EAP-Message = 0x020b046f0d800000046516030104350b00032500032200031f3082031b30820284a003020102020102300d06092a864886f70d01010405003081cf310b300906035504061302504c311b3019060355040813124b756a6177736b6f2d506f6d6f72736b69653112301006035504071309427964676f737a637a3121301f060355040a131857797a737a6120537a6b6f6c6120476f73706f6461726b6931283026060355040b131f496e73747974757420496e666f726d6174796b692053746f736f77616e656a3121301f0603550403131857797a737a6120537a6b6f6c6120476f73706f6461726b69311f301d06092a864886f70d010901161070696f EAP-Message = 0x6e617240676d61696c2e636f6d301e170d3037303731333038343832315a170d3038303731323038343832315a3081bd310b300906035504061302504c311b3019060355040813124b756a6177736b6f2d506f6d6f72736b69653112301006035504071309427964676f737a637a3121301f060355040a131857797a737a6120537a6b6f6c6120476f73706f6461726b6931283026060355040b131f496e73747974757420496e666f726d6174796b692053746f736f77616e656a310f300d060355040313066b6c69656e74311f301d06092a864886f70d010901161070696f6e617240676d61696c2e636f6d30819f300d06092a864886f70d010101 EAP-Message = 0x050003818d0030818902818100c65b79117fa57390280bad5dc10fb29acfa60e804e3a8bc39d6bc74d2d972c52e3d9a6cb022732f701098cae13b3a9cdc184d7b726e6cf7a8b89d9fd29e4b44868160df069810d5dbe85ed96ea97d23bd1ee3ac2efbb5da2f74f86dd7e6bd2cfed5f92d67d8a0206738265900057443d80666243fbf0f9e3109ccc837b5589bd0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d0101040500038181001465a163c5e5b40d2416ef34c2738366482fd3e1b4baa5cde1ac99ef2f6563987860d299e6858c965955c33ec4f0ed7075a3151831d68edb9c835bc2758e57 EAP-Message = 0x5cd01e036bae41be44dce4d2e5d66c98c12e7ac149271e3668166ded29abf6cc5cb1b24d77ca85475a812d2f96de5fc03b0c5395b4bee66b26d4598c54fb1ec2ce10000082008079ac8747ab54cf36aae112a6b1ddf6213a5f35ab6173acb355225c519135f8edf30a5e0dd31c593c0ab732f97ad98b7043d29d2cbc0e6bd78b058dff78fe06907d1511f0a4f5b91e7f67a0785befa93b68aac053fd664950407c97f7c4be10206d0e87d3df5b39070515f448c713cd10b2b9a0fc0ea0eae199249fd2f2421e650f000082008004da665683881d8fa8492037cd78addac8fa272e62caa6296dccce6b4067a6eb77a6f4e4047c9bf6f72ab6a3cafc4073 EAP-Message = 0x15032586f5230e82c51180edb559aac7be1a241f744e3f8b61db80714d7f1f2307f6a997e1758f1fadd57d1d80324e64f4dd59f7fd90d0c26505890f4f51fd22c4f296f71579fe1bc071dc0fb50261f71403010001011603010020b1cae07451a060ca2116569c2cf3636804816030195ca978ebf9926f23f8426f Message-Authenticator = 0xb5105d34ed04a2e8f86f745be477abd8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "klient", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 11 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 190 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0329], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 12 to 192.168.1.9 port 1812 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010c00110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa483477851e66e0f4e32edcd0f27c1bd Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.9:1812, id=13, length=140 NAS-IP-Address = 192.168.1.9 NAS-Port = 50003 NAS-Port-Type = Ethernet User-Name = "klient" Called-Station-Id = "00-0F-F7-54-C3-03" Calling-Station-Id = "00-11-09-26-48-FA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xa483477851e66e0f4e32edcd0f27c1bd EAP-Message = 0x020c00060d00 Message-Authenticator = 0x605a7ee69287c9cdbcf211bdd49a2410 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "klient", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 12 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 190 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.9:1812, id=13, length=140 Sending Access-Reject of id 13 to 192.168.1.9 port 1812 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Cleaning up request 0 ID 8 with timestamp 4698bbcc Cleaning up request 1 ID 9 with timestamp 4698bbcc Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 10 with timestamp 4698bbcd Cleaning up request 3 ID 11 with timestamp 4698bbcd Cleaning up request 4 ID 12 with timestamp 4698bbcd Cleaning up request 5 ID 13 with timestamp 4698bbcd Nothing to do. Sleeping until we see a request. ---------------------------------------------------- Jesteś fanem filmu "Seks w wielkim mieście"? Ta komedia romantyczna jest dla Ciebie! MIŁOŚĆ I INNE NIESZCZĘŚCIA - w kinach od 20 lipca! http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fmilosc_i_inne.…

1 0

eap-tls and checking crl
by Stefan Nowak 14 Jul '07

14 Jul '07

Hi. I configured Freeradius with eap/tls , everything is ok, the clients have access-accept but i have set in eap.conf "check_crl=no" and now i wanna use crl, then i changed "check_crl=yes" and write "CA_path= /bin/raddb/certs/" i create crl.pem and move it to /etc/raddb/certs/, next i used 'c_rechash /etc/raddb/certs/'. I think it was everything what i must do, but in radiusd -X show me some problem. rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 If i hash this 2 lines in eap.conf that means 'check_crl=yes' and 'CA_path= /bin/raddb/certs/' then freeradius works ok. where is problem with using crl? ---------------------------------------------------- Oto pierwsza męska para w historii łyżwiarstwa figurowego! Zobacz ostrą jazdę po bandzie w komedii OSTRZA CHWAŁY - w kinach od 20 lipca! http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fostrza_chwaly.…

2 1

postgres vs mysql start / stop times
by Hugh Messenger 13 Jul '07

13 Jul '07

Something I noticed whilst comparing the postgres and mysql rlm_sql configs is that when postgres sets an AcctStartTime or AcctStopTime, it figures in the delay time, whereas the mysql queries don't. For example, in accounting_stop_query, postgres has: AcctStopTime = (now() - '%{Acct-Delay-Time:-0}'::interval) . whereas mysql just has: AcctStopTime = '%S' Where %S is "request timestamp in SQL format". Which should be pretty darn close to now(). I presume this is just down to the personal preferences of whoever wrote the two sets of queries? Personally, I wouldn't expect the queries to apply the delay time to the start/stop time, so the MySQL version is "correct". IMHO interpretation of the data should be left to the backend provisioning. No biggie, just an observation. -- hugh

2 3