- Freeradius-Users - lists.freeradius.org

radexample (Postgres authenticaation)
by Ibrar Ahmed 24 Mar '07

24 Mar '07

Hi, I am a newbie in radius installation/configuration. I want to setup my radius client / server so I can authenticate/authorize a user name/password from postgresql database in plain text. For client I am using radexample.c file.. --ibrar ____________________________________________________________________________________ Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains. http://farechase.yahoo.com/promo-generic-14795097

1 1

CRL List does not appear to work with Freeradius
by Matt Harlum 24 Mar '07

24 Mar '07

Hey guys, I've been using freeradius for a while now, and i want to be able to revoke my certs, however when i have revoked them it can't find the CRL and as such nobody can log in - even people who have certs that are not revoked. i just get the following message, even thugh my crl.pem is in the folder with the other certs, rlm_eap_tls: <<< TLS 1.0 Handshake [length 0896], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

1 0

CRL Signature failure
by Jeremy Pastin 23 Mar '07

23 Mar '07

Sorry forgot a subject I am trying to set up EAP-TLS using FreeRadius, and I am using EJBCA to sign my certs. I have been able to get everything to work correctly except the CRL. I have created a directory /usr/local/etc/raddb/certs/crls where I am storing my CRL info. In this directory I have the certificate chain of the signing CA (in pem format) and the latest CRL for that CA (also in pem format). After the CRL is copied into this directory I execute c_rehash on the directory and everything runs fine. When I run radiusd, however, all attempts to authenticate are denied. The pertinent portion of the output from radiusd -X -A is : rlm_eap_tls: <<< TLS 1.0 Handshake [length 07b8], Certificate --> verify error:num=8:CRL signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. This seems to tell me that FreeRadius cannot verify the CRL against the CA cert. However, when I run: openssl crl -in my-crl.pem -inform PEM -CAfile my-cacert.pem -issuer -lastupdate -nextupdate -noout it returns verify OK and the correct info on issuer and update times. Also when I run: openssl verify -CApath ./ -crl_check test.pem it behaves as expected. Any Ideas? Jeremy Pastin helpdesk(a)firstindustrial.com 312-344-4444 First Industrial Realty Trust, Inc. 311 S Wacker Dr Chicago, IL 60606 Phone: 312-344-4425 Fax: 312-895-9425

1 0

(no subject)
by Jeremy Pastin 23 Mar '07

23 Mar '07

I am trying to set up EAP-TLS using FreeRadius, and I am using EJBCA to sign my certs. I have been able to get everything to work correctly except the CRL. I have created a directory /usr/local/etc/raddb/certs/crls where I am storing my CRL info. In this directory I have the certificate chain of the signing CA (in pem format) and the latest CRL for that CA (also in pem format). After the CRL is copied into this directory I execute c_rehash on the directory and everything runs fine. When I run radiusd, however, all attempts to authenticate are denied. The pertinent portion of the output from radiusd -X -A is : rlm_eap_tls: <<< TLS 1.0 Handshake [length 07b8], Certificate --> verify error:num=8:CRL signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. This seems to tell me that FreeRadius cannot verify the CRL against the CA cert. However, when I run: openssl crl -in my-crl.pem -inform PEM -CAfile my-cacert.pem -issuer -lastupdate -nextupdate -noout it returns verify OK and the correct info on issuer and update times. Also when I run: openssl verify -CApath ./ -crl_check test.pem it behaves as expected. Any Ideas? Jeremy Pastin helpdesk(a)firstindustrial.com 312-344-4444 First Industrial Realty Trust, Inc. 311 S Wacker Dr Chicago, IL 60606 Phone: 312-344-4425 Fax: 312-895-9425

1 0

What is the real meaning and use of cache-size in ippool declaration [resend]
by Florin 23 Mar '07

23 Mar '07

Sorry guys, this is in fact a resend of a previous email, now using Thunderbird in an attempt to avoid sending HTML format message. Hope it'll be OK this time. ~~~~~~~~~~~~~~ Hi everyone, FreeRadius 1.0.1 here, the one which comes as standard with RHEL 4. I want to use a whole class B subnet (172.16.0.0/16) in an ippool declaration to assign IP addresses from. Now it is said that the cache-size parameter should be equal to the number of IP addresses in the pool. But if I try to set it to 65536, the server won't start (it'll crash actually). So what is the **real** meaning and use of this parameter ? You have to specify the start and end of the pool, so then why set another parameter with a value that can be trivially calculated by the server anyway ? And more importantly, what are the right guidlines on setting the value for this parameter ? Making it equal to the number of IP addresses in the pool won't work and it just doesn't make any sense to me. Finally, if I change the value of this parameter, beside restarting FreeRadius, do I have to do anything else ? Do I have to delete the related database and index files in order for the change to take place ? Thank you in advance. Best regards, Florin

1 0

RE: Re: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, Found the problem. The database was saving the password in some kind of hash instead of clear-text. Once I manually changed the password to clear-text, it I got an Auth-Accept response from the server. Now onto the EAP-TTLS & client configurations. Thanks again Alan. Scott >------- Original Message ------- >From : Alan DeKok[mailto:aland@deployingradius.com] >Sent : 3/23/2007 1:39:03 AM >To : scott(a)renshawauto.com; freeradius-users(a)lists.freeradius.org >Cc : >Subject : RE: Re: New Server Build > >Scott Hughes wrote: .. > The DB structure is: 8 tables as follows: nas, > radacct, radcheck, radgroupcheck, radgroupreply, > radpostauth, radreply, usergroup. Yes... but what's *in* the DB? What attributes, operators, and values are there, that you expect to match? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

RE: Re: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, The only thing in the database is the userid and password. I put nothing else in. I believe it has to do with my Default Auth-Type setting in the Users file. Thank you, Scott >------- Original Message ------- >From : Alan DeKok[mailto:aland@deployingradius.com] >Sent : 3/23/2007 1:39:03 AM >To : scott(a)renshawauto.com; freeradius-users(a)lists.freeradius.org >Cc : >Subject : RE: Re: New Server Build > >Scott Hughes wrote: .. > The DB structure is: 8 tables as follows: nas, > radacct, radcheck, radgroupcheck, radgroupreply, > radpostauth, radreply, usergroup. Yes... but what's *in* the DB? What attributes, operators, and values are there, that you expect to match? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Res: Res: Res: EAP-TTLS + Post-auth clear password
by Erico Augusto 23 Mar '07

23 Mar '07

----- Mensagem original ---- De: Alan DeKok <aland(a)deployingradius.com> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Sexta-feira, 23 de Março de 2007 3:54:41 Assunto: Re: Res: Res: EAP-TTLS + Post-auth clear password Erico Augusto wrote: > All I can say is "huh"? You want to use a custom app, and you >solution is to write a shell script that does... nothing? sure not! > Perhaps you could explain how the custom app *currently* interacts > with FreeRADIUS. From the examples you've posted, it doesn't. it's called learning ... > My suggestion was to write a program that would send the username && > password to the custom app. See the documentation for how to see the >username && password in a shell script run by rlm_exec. that's what I'm looking for ... constructive suggestions ... > What makes you think that the shell script changes the password? >Nothing in the documentation or examples would lead you to believe that >simple echoing a number would have the magic side-effect of changing the >password. just learning how the tool works... > The configurations you've shown don't match the documentation. i.e. >You think they do one thing, but the documentation says they do >something else. The interaction with JRadius now works ... it wasn't an issue with freeradius ... JRadius API was outputing [Encrypted String] to the password ... in truth, it's just in ASCII ... a simple casting fix everything. So, to get cleartext password with WinXP SecureW2(EAP-TTLS) Supplicant configured to PAP at Authentication Tab, using JRadius API, just gather password bytes as following: byte [] passByte = requestPacket.getAttributes().get(Attr_UserPassword.NAME). getValue().getBytes(); where requestPacket is a RadiusPacket object. Erico. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

freeradius, ldap error - HELP ME!
by peppeska 23 Mar '07

23 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please freeradius User... HELP ME! So, I use a pppoe-freeradius-ldap system for access and autenticate user.. but some go wrong.. and when I try to connect me appare this error... what's wrong in my configuration? look this! this is the freeradius output Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1027, id=159, length=54 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "peppeska" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "peppeska", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for peppeska radius_xlat: '(cn=peppeska)' radius_xlat: 'dc=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=admin,dc=example/root to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=example, with filter (cn=peppeska) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 0 modcall: leaving group authorize (returns userlock) for request 0 Invalid user (rlm_ldap: Access Attribute denies access): [peppeska/<no User-Password attribute>] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request - --- Walking the entire request list --- Waking up in 1 seconds... - --- Walking the entire request list --- Sending Access-Reject of id 159 to 127.0.0.1 port 1027 Waking up in 3 seconds... - --- Walking the entire request list --- Cleaning up request 0 ID 159 with timestamp 45ffa841 Nothing to do. Sleeping until we see a request. But the Ldap database work good! the User peppeska have the password and the direct access to ldap database work! what I must do? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |donpeppiniello(a)tiscali.it - http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF/6qQkA6hcnFZI/YRAlRfAKDVYKu8MkY8QSz80gnaJTkGgtnttACbBaPU wPIiKiVRmzm2c91/6a6jSjA= =ZqNs -----END PGP SIGNATURE-----

4 25

SUMMARY: ldap groups + freeradius
by Karen R McArthur 23 Mar '07

23 Mar '07

Thank you to this list! I am posting snips from my "users", "radiusd.conf" and "huntgroup" files that work. ********** huntgroups ********** admin NAS-IP-Address == 192.168.1.1 Session-Timeout = 60, Idle-Timeout = 30 public NAS-IP-Address == 192.168.1.2 NAS-IP-Address == 192.168.1.3, Idle-Timeout = 3600 vpn NAS-IP-Address == 192.168.1.4 ********** radiusd.conf ********** <snip> ldap { server = "ldap.example.com" port = xxxx identity = "cn=proxy,dc=example,dc=com" password = itsasecret basedn = "ou=People,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{ Ldap-UserDn}))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } <snip> ********** users ********** <snip> DEFAULT Auth-Type = LDAP Fall-Through = yes DEFAULT Huntgroup-Name == public, Ldap-Group == public Reply-Message = "Welcome to the dial-in service", Fall-Through = no DEFAULT Huntgroup-Name == admin, Ldap-Group == admin Reply-Message = "Welcome to the admin Termial Server", Fall-Through = no DEFAULT Huntgroup-Name == vpn, Ldap-Group == vpn Reply-Message = "Welcome to the VPN Gateway", Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "You are not authorized to use this service. If you believe you have received this message in error, please contact our Helpdesk." <snip> ***** user ldap record ***** dn: uid=user1,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public radiusGroupName: vpn radiusGroupName: admin dn: uid=user2,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public dn: uid=user3,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public radiusGroupName: vpn -- Karen R. McArthur <kmcarthu(a)bates.edu> Systems Administrator Information and Library Services, Bates College Lewiston, Maine 04240 USA ph:(207)786-8236 fax:(207)786-6057 > > RedHat EL 4 (managed through RHN, so latest available versions) > freeradius-1.0.1-3 > openldap-2.2.13-6 > > I have 4 NAS-IP-Addresses. > > My users are split into 6 groups (some are in multiple groups): public, > faculty, staff, student, vpn, and admin. > > I would like the users to get access to the NAS by virtue of being in a > group. > > 192.168.1.1 > admin > 192.168.1.2 > vpn > 192.168.1.3 & 192.168.1.4 > faculty, staff, student & public > > What steps do I need to follow to implement this? I have tried many > combinations in "huntgroups", "users", and "radiusd.conf". > > Any directions or urls to documentation would be appreciated.

1 0