- Freeradius-Users - lists.freeradius.org

SSL locking code
by King, Michael 24 Jan '07

24 Jan '07

Back on October 18th, we had a conversation about threading issues. In the message it was said: > The issues is "bad record mac", not "failed in system call". The >second error message is a result of the first. > > I suspect threading issues. Try running the server in non-threaded >mode. If that works, then the SSL locking code should be back-ported >from the CVS head (src/main/threads.c) > > Alan DeKok. I was wondering if anything had come of this? Vista is on the way, and I can't stay at version 1.0.4 indefinatly. (I know there have been some major fixes since then) Michael King

2 7

RADIUS will no longer start!
by Michelle Gates 24 Jan '07

24 Jan '07

All, Our RADIUS server has been up and running fine for 127 days now. Suddenly today it no longer runs. I tried to put it into debug mode and got the following output: ---- [root@RAD01 ~]# /opt/freeradius/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/trs_proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/trs_clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/sqlcounter.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "trustive" main: group = "trustive" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients /opt/freeradius/etc/raddb/radiusd.conf[751]: Missing client name ----- Can anyone shed any light on this? Unfortunately for me, one of our developers was working on our production server but *claims* not to have changed anything of any consequence... I'm really unsure of where this is coming from! Has anyone seen this error before or could anyone at least point me in the right direction? Best regards, -michelle.

7 7

Setting check pairs in script when using exec
by Patric 24 Jan '07

24 Jan '07

Hi guys, This is my previous mail phrased differently, as after further investigation I found what Im supposed to be asking. Up till now have been using sql to authenticate, and am trying to change to my own script and mysql db. In radiusd.conf I have : modules { exec exec-radauth { wait = yes program = "/path/to/script.php -- %{User-Name} %{Password}" input_pairs = request output_pairs = reply } authorize { exec-radauth } This all works perfectly when I include "files" in the authorize section and place the following in the users file : DEFAULT Auth-Type = Accept But if I exclude "files" from the authorize section I get : auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. So now I know that I need to set the Auth-Type check pair in my external authentication script, but am not sure how to accomplish this. Can anyone point me in the right direction with this problem? radiusd: FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu, built on Sep 20 2006 at 14:13:13 Thanks in advance Patric ---------------------------------------------------------------------- Looking For the Right College? Let us help find the best online criminal justice program for you! http://tags.bluebottle.com/fc/MhtYWUjFdpo7ZzqpDkaZhGRgrChcJrdZy3oBy/

1 0

Auth Type when running exec script to authenticate
by Patric 24 Jan '07

24 Jan '07

Hi all, Up till now have been using sql to authenticate, and am trying to change to my own script and mysql db. In radiusd.conf I have : modules { exec exec-radauth { wait = yes program = "/path/to/script.php -- %{User-Name} %{Password}" input_pairs = request output_pairs = reply } authorize { exec-radauth } This all works perfectly when I include "files" in the authorize section and place the following in the users file : DEFAULT Auth-Type = Accept But if I exclude "files" from the authorize section I get : auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Can anyone point me in the right direction with this problem? radiusd: FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu, built on Sep 20 2006 at 14:13:13 Thanks in advance Patric ---------------------------------------------------------------------- Click for free info on adult education and start making $150k/ year http://tags.bluebottle.com/fc/CAaCMPJnSlqlx5S4A8vYLM5adNYw4Lck/

1 0

The EAP Saga begins.
by Evan Vittitow 24 Jan '07

24 Jan '07

Here is the result of my first attempt. I added a Pukey-EAP entry in the LDAP tree but it didn't do much good. And I can't tell whats the matter with my CA. rad_recv: Access-Request packet from host 192.168.0.250:1110, id=8, length=159 User-Name = "Pukey-EAP" Cisco-AVPair = "ssid=Pukey-EAP" NAS-IP-Address = 192.168.0.250 Called-Station-Id = "004096285ceb" Calling-Station-Id = "00095b679ccf" NAS-Identifier = "AP340-285ceb" NAS-Port = 37 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x020d000e0150756b65792d454150 Message-Authenticator = 0xebe4683da315ee95109c4736a19a37cd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for Pukey-EAP radius_xlat: '(uid=Pukey-EAP)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=pukey, with filter (uid=Pukey-EAP) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "Pukey-EAP", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "Pukey-EAP" rlm_realm: Proxying request from user Pukey-EAP to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 13 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 8 to 192.168.0.250 port 1110 EAP-Message = 0x010e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5a40fabb5846577f6543672d9313801 Finished request 7 Going to the next request Here is my /etc/xsupplicant.conf network_list = all default_netname = Pukey-EAP Pukey-EAP { type = wireless allow_types = eap_peap identity = Pukey-EAP eap-peap { random_file = /dev/urandom root_cert = /etc/raddb/certs/root.pem chunk_size = 1398 allow_types = eap_mschapv2 eap-mschapv2 { username = User password = Password } } } I've created a SSID called Pukey-EAP it requires EAP.

3 6

RE: Proxying based on SSID
by Ana Gallardo Gómez 24 Jan '07

24 Jan '07

I think you have to use the attribute "Stripped-User-Name" to authenticate the user.> Date: Wed, 24 Jan 2007 14:21:59 +0800> From: LFK(a)cc.hku.hk> To: freeradius-users(a)lists.freeradius.org> Subject: Proxying based on SSID> > Hi,> > Sorry if the questions have been asked. I have done a lot of searches,> but could not find the answer.> > Normally, I proxy a PEAP request whenever the realm is unknown to us> (i.e. using the DEFAULT realm without stripping user name). However, for> some SSIDs, I want requests to be handled locally with ldap, independent> of what the realm is (and with the user name stripped). What I did is to> find those SSIDs in "Called-Station-ID" and> set proxy-to-realm to a local realm.> > But the problem (I guess) is that when freeradius processes the realm> file, the user name is not stripped. When later on processed by the> local realm, the request fails because the user name still contains the> domain.> > Any suggestions to solve it is appreciated. Thanks in advance.> > Best Regards,> Lai> > Users> =====> DEFAULT NAS-Port-Type == "Wireless-802.11", Called-Station-Id =~> "MY-SSID$", St> rip-User-Name := Yes, Autz-Type := usePlainTextPwd, Proxy-to-realm :=> "hku.hk"> > DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := usePlainTextPwd> > Radiusd -X> =========> rad_recv: Access-Request packet from host 17.18.28.26:20002, id=136,> length=152> NAS-Port-Id = "2098/1"> Calling-Station-Id = "00-18-DE-83-3E-1B"> Called-Station-Id = "00-16-E0-FD-47-40:VIP-peap"> Service-Type = Framed-User> EAP-Message = 0x02010012017063637732406173642e636f6d> User-Name = "pcw2(a)asd.com"> NAS-Port-Type = Wireless-802.11> NAS-Identifier = "3Com"> NAS-IP-Address = 17.18.28.26> Message-Authenticator = 0x46e6da4a3ad7d253157a9f21a110807b> Processing the authorize section of radiusd.conf> modcall: entering group authorize for request 0> modcall[authorize]: module "preprocess" returns ok for request 0> rlm_realm: Looking up realm "asd.com" for User-Name = "pcw2(a)asd.com"> rlm_realm: Found realm "DEFAULT"> rlm_realm: Proxying request from user pcw2 to realm DEFAULT> rlm_realm: Adding Realm = "DEFAULT"> rlm_realm: Preparing to proxy authentication request to realm> "DEFAULT"> modcall[authorize]: module "suffix" returns updated for request 0> modcall[authorize]: module "chap" returns noop for request 0> modcall[authorize]: module "mschap" returns noop for request 0> users: Matched entry DEFAULT at line 171> users: Matched entry DEFAULT at line 244> modcall[authorize]: module "files" returns ok for request 0> rlm_eap: EAP packet type response id 1 length 18> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> modcall[authorize]: module "eap" returns updated for request 0> modcall: leaving group authorize (returns updated) for request 0> Found Autz-Type usePlainTextPwd> Processing the authorize section of radiusd.conf> modcall: entering group usePlainTextPwd for request 0> modcall: entering group redundant for request 0> rlm_ldap: - authorize> rlm_ldap: performing user authorization for pcw2(a)asd.com> radius_xlat: '(&(uid=pcw2(a)asd.com)))'> radius_xlat: 'ou=ldap,o=hku,c=hk'> rlm_ldap: ldap_get_conn: Checking Id: 0> rlm_ldap: ldap_get_conn: Got Id: 0> rlm_ldap: attempting LDAP reconnection> rlm_ldap: (re)connect to ldap1.hku.hk:389, authentication 0> rlm_ldap: starting TLS> rlm_ldap: bind as cn=net,o=hku,c=hk/M134aNaa to ldap1.hku.hk:389> rlm_ldap: waiting for bind result ...> rlm_ldap: Bind was successful> rlm_ldap: performing search in ou=ldap,o=hku,c=hk, with filter> (&(uid=pcw2(a)asd.com))> rlm_ldap: object not found or got ambiguous search result> rlm_ldap: search failed> rlm_ldap: ldap_release_conn: Release Id: 0> modcall[authorize]: module "withNTPwd" returns notfound for request 0> modcall: leaving group redundant (returns notfound) for request 0> modcall: leaving group usePlainTextPwd (returns notfound) for request 0> WARNING: You set Proxy-To-Realm = hku.hk, but it is a LOCAL realm!> Cancelling> invalid proxy request.> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> Processing the authenticate section of radiusd.conf> modcall: entering group authenticate for request 0> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> modcall[authenticate]: module "eap" returns handled for request 0> modcall: leaving group authenticate (returns handled) for request 0> WARNING: Cancelling proxy to Realm hku.hk, as the realm is local.> Sending Access-Challenge of id 136 to 17.18.28.26 port 20002> Framed-IP-Address = 255.255.255.254> Framed-MTU = 576> Service-Type = Framed-User> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xfd7f032f1c3ed7e8e39bf1872727e771> Finished request 0> Going to the next request> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Consigue el nuevo Windows Live Messenger http://get.live.com/messenger/overview

1 0

Mac OS X EAP-TLS with wrong usename kills freeradius when check_cert_cn is set
by Miika Räisänen 24 Jan '07

24 Jan '07

Hi, We are building freeradius server to authenticate WLAN users with EAP-TLS and EAP-PEAP. EAP-PEAP works great with all tested operating systems, but Mac OS X 802.1X client with EAP-TLS kills freeradius if check_cert_cn is set on and Mac OS X user sends user name which does not match with certificate's common name. Operating system version is 10.4.8 and it runs on Macbook. If Window XP user sets different outer identity than cert's common name freeradius works ok (user gets rejected). We have tested following freeradius server versions on following platforms Freeradius 1.1.1 / SUN Os 5.8 Freeradius 1.1.3 (FC6's rpm) / FC6 Freeradius 1.1.4 (build from source)/ FC6 Freeradius snapshot 20070118 (build from source) / FC6 Freeradius 1.1.4 (build from source) / CentOS 4.4 FC and Centos are using distros default openssl libs etc. Heres some log and debug from CentOS with freerad 1.1.4 http://cc.oulu.fi/~mraisane/tmp/radiusd.txt Any ideas, fixes or workarounds?

3 8

RE: a freeradious/wireless solution for a school
by German Kalinec 24 Jan '07

24 Jan '07

Therein lies the problem. My potential users are a lot of my students. The idea of having to install certificates in 200+ laptops is not really feasible. And showing them how to install is an exercise in futility, since most of our students are not computer savvy enough to do it. German Kalinec Systems Manager New Roads School 3131 Olympic Blvd. Santa Monica, CA 90404 (310) 828-5582 -----Original Message----- From: freeradius-users-bounces+gkalinec=newroads.org(a)lists.freeradius.org [mailto:freeradius-users-bounces+gkalinec=newroads.org@lists.freeradius. org] On Behalf Of Nazeer Khan Sent: Monday, January 22, 2007 1:44 PM To: FreeRadius users mailing list Cc: freeradius-users(a)lists.freeradius.org Subject: Re: a freeradious/wireless solution for a school Hi, Use EAP-TLS, the most secure one. It will automatically give encryption key to the clients. U have to do onething, install the client certificates in the beginning in each client machine that will use your wireless and thats it. There are other options like EAP-PEAP, LEAP etc Check out for the types of EAP and you will find out. Cheers. tml > ------------------------------------------------------------------------ -- This email and any attachments may be confidential. They may contain legally privileged information or copyright material. You should not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages. We do not accept liability in connection with computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment. This notice should not be removed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

7 10

Splitting the password field in freeRADIUS
by Drumm, Daniel 24 Jan '07

24 Jan '07

As some of you may know, RSA SecurID servers now support RADIUS. The Auth Manager comes with the Funk RADIUS sever embedded into it, and supports a number of auth types, including EAP-OTP as well as the usual types such as CHAP. Is it possible to front end this type of server with FreeRADIUS, so that NAS-Clients can send a tokencode prepended to, say, a Kerberos password - and have the FreeRADIUS server forward the first 6 digits of the field to the RSA server for tokencode validation - and the remaining charcters to another RADIUS server, one that front-ends a Kerberos system? Only when both fields return true is the authentication true. Is this possible? I was looking at the various scripting options in radius.conf, and don't know of anyone who has done this. Or if it can be done. Thank you. Dan. # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files }

4 3

post-proxy section and local proxy
by Markus Krause 24 Jan '07

24 Jan '07

Hi List, i am still stuck in the problem on how to overwrite replies from freeradius to a nas depending on realms (see http://marc.theaimsgroup.com/?l=freeradius-users&m=116824114228037&w=2 and http://marc.theaimsgroup.com/?l=freeradius-users&m=116903668505574&w=2) and trying different things to solve this (i got no repsonses so far which, of course, is not a complaint! maybe i am asking the wrong or a too dump question ...) i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf) the section "post-proxy", which contains "attr_filter", is _not_ processed. If i am using a "real" proxy (authhost = anotherradius:1812) "attr_filter" does what i want it to do, it replaces some reply-attributes (for VLAN in my case). Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?) Or does someone know a better solution for my problem? Thanks in advance for any help! Regards markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4