- Freeradius-Users - lists.freeradius.org

rlm_eap: SSL error
by James Lever 19 Jan '07

19 Jan '07

Hi List, FreeRADIUS 1.1.4 on FreeBSD (5-STABLE), Apple Airport Extreme NAS, MacBook Pro client, WPA2 Enterprise with 2k keys. I'm having the much mentioned but very hard to get real information about error below: Wed Jan 17 08:00:11 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jan 17 08:00:11 2007 : Error: rlm_eap: SSL error error: 00000000:lib(0):func(0):reason(0) Wed Jan 17 08:00:11 2007 : Error: rlm_eap: SSL error error: 00000000:lib(0):func(0):reason(0) Wed Jan 17 08:00:11 2007 : Auth: Login OK: [wireless- client.jamver.id.au] (from client apple-basestation port 255 cli xx- xx-xx-xx-xx-xx) Now, the best explanation I can find on list is that it's safe to ignore the 3 lines of errors, which, although appears to be very accurate in that they have no effect on the running service, should not be there if they are really not errors. Can anybody explain what is actually causing these errors (and why) and what would be required to silence them? cheers, James

3 3

How to send tome clients to the same detail file
by Angel L. Mateo 18 Jan '07

18 Jan '07

Hello, I have a running server with this configuration: detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } I have activated the detail file in the accounting section and the auth_log in the authorize and are working fine. But now I want to send all the logs for requests from a group of clients (defined as a huntgroup) to the same files, and the request for all other clients as now (classified with the IP address of the client). Is there any way to redefine this files for a set of clients? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 3

EAP-TLS/seg fault with 4096 bit keys
by James Lever 18 Jan '07

18 Jan '07

Hi again list, Another issue I have had in setting up a WPA2 Enterprise environment is that I can get it to work as expected with 2k keys, however, if I go to 4k keys, freeradius 1.1.4 loads properly but seg faults when handling a 4k key request. The environment is Apple Airport Extreme base station, and MacBook Pro client wth FreeRADIUS 1.1.4 under FreeBSD 5-STABLE. As soon as I migrate back to 2k keys it again works as expected. Can anybody make any suggestions on how to debug this? cheers, James

2 1

Feeding an LDAP replyItem to an MS-CHAPv2 ntlm_auth request
by Haas Florian 18 Jan '07

18 Jan '07

Since this is my first post to this list, hello everyone. I do apologize if this question has been asked before; unfortunately I've been unable to find this information in the list archives. I have a working setup with Windows XP clients, MSAD, FreeRADIUS 1.1.0 running on SLES 10, and Enterasys switches. Authentication via PEAP and MS-CHAPv2. Everything works perfectly fine when a Windows user logs on; ldap module looks up the user, mschap authenticates, client is dropped into the right VLAN... beautiful. However, what I am also trying to achieve is to force the client into a specific VLAN when no user is logged on (this corresponds to the "Authenticate as computer when computer information is available" option in the "Authentication" tab of the Windows connection properties dialog). The tricky part is that XP's supplicant, which supplies the username as "DOMAIN\\Username" while a user is logged on, supplies a username in the form of "host/computername.my.domain" otherwise -- this corresponds to the servicePrincipalName attribute on the machine's object in MSAD. This is of course a format that ntlm_auth can't deal with. So, my approach is this: 1. When authorizing, look up the LDAP DN using a filter that checks both sAMAccountName and servicePrincipalName: radiusd.conf: modules { # [...] ldap { # [...] filter = "(|(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(servicePrincipalName=%{S tripped-User-Name:-%{User-Name}}))" # [...] } } } 2. While authorizing, retrieve the value of the sAMAccountName from LDAP. For this purpose, I have the following entry in the LDAP Attribute map: replyItem MSAD-SAM-Account-Name sAMAccountName 3. When authenticating, feed mschap's ntlm_auth the MSAD-SAM-Account-Name if it is available: modules { # [...] mschap { # [...] ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{MSAD-SAM-Account-Name:-%{Stripped-User-Name:-%{User-Name:-None}}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" # [...] } } } >From the debug logs, it appears such that the computer's LDAP object is looked up successfully (using the servicePrincipalName host/testpc.demo.com) and that the MSAD-SAM-Account-Name replyItem is set correctly (to "TESTPC$"). However, ntlm_auth is invoked with the username None instead, so it appears that the LDAP replyItems are not made available to the mschap authentication module. rlm_ldap: performing search in dc=demo,dc=com, with filter (|(sAMAccountName=host/testpc.demo.com)(userPrincipalName=host/testpc.demo.com)( servicePrincipalName=host/testpc.demo.com)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding sAMAccountName as MSAD-SAM-Account-Name, value TESTPC$ & op=11 rlm_ldap: user host/testpc.demo.com authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/testpc.demo.com with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: e8 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=None --challenge=30585713439262e1 --nt-response=bbef10b2df1d9a084db75e86b02df137e7166eb6ce3e4d30' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=None --challenge=30585713439262e1 --nt-response=bbef10b2df1d9a084db75e86b02df137e7166eb6ce3e4d30 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) ... and then subsequently, the whole request of course fails. I'm almost certain that I am missing something very obvious. Would someone be kind enough to enlighten me? Thanks very much. Florian -- Mag.(FH) Florian G. Haas | Systemingenieur Kapsch BusinessCom AG | Wienerbergstraße 53 | A-1120 Wien www.kapschbusiness.com | www.kapsch.net Firmenbuch HG Wien FN 178368g | Firmensitz Wien The information contained in this e-mail message is privileged and confidential and is for the exclusive use of the addressee. The person who receives this message and who is not the addressee, one of his employees or an agent entitled to hand it over to the addressee, is informed that he may not use, disclose or reproduce the contents thereof.

2 3

sqlcounter problem
by satish patel 18 Jan '07

18 Jan '07

Dear ALL I have configure freeradius-1.1.4 version with mysql and my NSA is cisco with VPDN configuration now i have create user "aaa" in mysql with this attributes Max-Daily-Session | := | 1800 my sql counter configuration is sqlcounter dailycounter { driver = "rlm_sqlcounter" counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sqlcca3 key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" now problem is when i login throgh AAA user my user disconnect after 3 min but when i login again through this user it was login again and disconnnect after 3 min why ??? i want to allow user to access only 3 min per day measn after 3 min completed use not allowd to login again what is the configuration for that ??? Urgent Satish Patel System administrator --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 2

freeradius and ssh
by Zion 18 Jan '07

18 Jan '07

Hi All I hope you can help I’m net in the freeradius world and I’m trying to use freeradius as an authentication server for ssh sessions i have the following setup: client --> server (useing pam) --> radius server Under /etc/pam.d I have sshd with the following: # auth required pam_stack.so service auth required pam_radius_auth.so #auth required pam_nologin.soetc #account required pam_stack.so service=system-auth account required pam_radius_auth.so password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so …………. under /etc/raddb server <radius server ip> testing123 3 On the client I have the radius server config file Radius server config files: users see the attach Can you please send me an example files foe the radius server or which files need to be change and which params are importuned for my setup Thanks in advance please be advice that the only wat for me to login is to have an entry in the server which i want to skip Zion

2 1

disconnect user and clear session
by satish patel 18 Jan '07

18 Jan '07

Dear ALL I have usering freeradius version 1.1.4 with mysql it is working fine but i dont know how to kick off user during login time means i want to disconnect user from radius then how to do it and i also have one more problem of session i have disconnected user but whn i use radwho command i give me u r login why ??? how do i clear old session in radwho caz whn i try to reconnect it give me error your are already connected - access denied??? Satish Pate system administrator --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

RE: help
by John Wan 18 Jan '07

18 Jan '07

Hi Alan, Now everything works but the Active Directory authentication,Please see the following output from "$ Radiusd -X" when a wireless client uses "administrator" logon into the chillispot web logon page: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 User-Name = "administrator" CHAP-Challenge = 0xa784482e8ac92fd573e87bbbad9ca58f CHAP-Password = 0x00f54cc04e288eec67feff0b13e9448bd2 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.5 Calling-Station-Id = "00-16-6F-79-91-F4" Called-Station-Id = "00-05-5D-9E-0F-94" NAS-Identifier = "nas01" Acct-Session-Id = "45aec9a900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x97668bae73249b0dd4755ab03d364f34 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "administrator" with CHAP password rlm_chap: Could not find clear text password for user administrator modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 Sending Access-Reject of id 0 to 127.0.0.1:32772 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 45aecedc Nothing to do. Sleeping until we see a request. -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of John Wan Sent: Friday, 5 January 2007 11:26 AM To: FreeRadius users mailing list Subject: RE: help Hi Alan, Many thanks for your help. Now the kerberos service and the Samba service are running now, I have followed your instructions on your webpage, but I still have experenced the similar issue, please see the folloewing: [root@sun ~]# net join -U Administrator Administrator's password: [2007/01/05 10:10:15, 0] libads/kerberos.c:ads_kinit_password(146) kerberos_kinit_password Administrator(a)MBUS.LOCAL failed: Cannot find KDC for requested realm [2007/01/05 10:10:15, 0] utils/net_ads.c:ads_startup(186) ads_connect: Cannot find KDC for requested realm Joined domain MBUS. [root@sun ~]# wbinfo -a administrator%password plaintext password authentication failed Could not authenticate user administrator%password with plaintext password could not obtain winbind separator! could not obtain winbind domain name! challenge/response password authentication failed Could not authenticate user administrator with challenge/response Would you please give me some hints so I could try it again. All I need is to allow the freeradius server and Chillispot to hand over the authentication (for wireless client) to the Win2k3 Active Directory. To be able to achive that, I have to make sure the above two steps are working (at moment they are not working). Many thanks again in advance. Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, 14 December 2006 12:20 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > Would you please give me some hints how to start the Kerberos server > and how to solve the issue of > "ads_connect: Invalid credentials". Unfortunately, I'm not a kerberos or Samba expert. I know just enough to follow the script. If it doesn't work, I suggest asking on the Samba / kerberos lists. i.e. the people who wrote the software are the ones most likely to be able to help you. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- ________________________________________________________________________ _______ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ________________________________________________________________________ ______ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

monitoring freeradius with nagios
by Mike 18 Jan '07

18 Jan '07

All, When trying to use the "radauth" tool from nagios to monitor freeradius, I get the following in the freeradius log: Error: WARNING: Malformed RADIUS packet from host ... too long (length 18432 > maximum 4096) radtest seems to be ok. has anyone else experienced this or knows what is wrong?

4 3

SPLAT question
by Enright Patrick - penrig 18 Jan '07

18 Jan '07

Hello, This pertains to Feeradius 1.1.0. I am having trouble setting up freeradius and Checkpoint's Secureplatform Pro (SPLAT) firewall (which is a stripped down Linux) so that administrators logging into the firewalls will be authenticated by the freeradius server. According to the SPLAT pro user guide I should be able to set up a group on the firewall and I should not have to define all the individual users on the firewall. Once the user enters the username and password that info will be passed to the freeradius server along with the group (which is already defined on the firewall). When I start the freeradius server with the -AX switches I really don't see it reading the following that I set up in the radiusd.conf file: passwd etc_group { filename = /etc/freeradius/group format = "=Group-Name:::*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } I'm not sure if this is how you tell it to look in the group file and not sure why I do not see this in the messages when I start freeradius....??? Is anybody else doing this and if so can you provide some guidance? Thanks so much. Regards, Patrick Enright Information Security Architecture Team patrick.enright(a)acxiom.com <mailto:patrick.enright@acxiom.com> ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

3 2