- Freeradius-Users - lists.freeradius.org

Slow Aceess-Reject if pasword id INVALID
by Alex M 30 Nov '06

30 Nov '06

Hi, For some reason I'm getting slow response of access-reject when user uses wrong passwords. I'm using MySQL and first I thought that the delay is due to db, but if user password is ok im getting access-accept in 1.9ms. Where if user pass is incorrect im getting access-rject only after 1 minute. And if I run radius in debug mode im getting system message that password is invalid like in 2ms and only after 4000ms in getting the access-reject on the screen Any ideas how to fix that? Thanks!

2 1

Help in Radius....
by raviprakash sunkara 30 Nov '06

30 Nov '06

Hello. Uses... Good Morning... So long back I mailing to Users List. I ownning two openser System are Linux... one is Fedora core 5. other is RedHat AS 4. I don't have any problem in Fedora core 5 while installing the FreeRadius1.1.3 , it working fine and clear When I using RHEL AS 4 with mysql database + FreeRadius. Problem... is below.... rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. -- Thanks and Regards Ravi Prakash Sunkara ravi.sunkara(a)hyperion-tech.com M:+91 9985077535 O:+91 40 23114549 F:+91 40 40208727 ravi.sunkara(a)hyperion-tech.com www.hyperion-tech.com

12 49

Mac based auth
by jonr＠destar.net 30 Nov '06

30 Nov '06

This is what I am trying to accomplish: I want to use mac address based authentication with WPA+PEAP. I have finally figured out how to get my Wireless laptop to connect and get a DHCP address through freeradius using the certificates created with openssl using the CA.all script. How do I validate a user by mac address so that the users mac would be their username? What is the format of the MAC in the 'users' file? I have seen it as 01020304-0a020304 or something similiar, is that correct? Does anybody have a good suggestion on how to get the root.der cert to the client if they can't connect to the AP until they get authenticated, and they can't get authenticated until they have the cert. And finally, is there some sort of session management so that only one matching mac can be on at one time? Sorry if these are lame questions but I am completely lost at this and am reaching out for help. Thanks for any help, Jon

5 12

solved (was: Re: logging to normal radius.log and syslog)
by Michael Messner 30 Nov '06

30 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hey, we start the radiusd in debugging mode and with the following line in rc.local we now just get the loggin attempts into the radius.log: tail -f /var/log/radius/radius_complete.log | grep --line-buffered \:\ Login >> /var/log/radius/radius.log ca mIke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFbrwKyUY4xkIcFVQRAu/kAJwISuux9C2DjahkQcJ3RBF6a3gjuACg8YUU /Oe091a34P/LLI4TCnJsXhQ= =mA6Y -----END PGP SIGNATURE-----

1 0

eap/peap
by Daniel Romero 30 Nov '06

30 Nov '06

Hi. I'm istalling freeradius on a debian machine, with OpenSSL 0.9.8d 28 Sep 2006, but i'm having some problems (i'm a newbie in radius) eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no #md5 { #} #leap { #} #gtc { # challenge = "Password: " # auth_type = PAP #} # To generate ctest certificates, run the script # ../scripts/certs.sh # http://www.dslreports.com/forum/remark,9286052~mode=flat tls { private_key_password = radiusUDP private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = yes check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" } #ttls { #default_eap_type = peap #copy_request_to_tunnel = no #use_tunneled_reply = no #} peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } mschapv2 { } } radius.conf can be downloaded here<http://200.14.84.251/%7Edromero/radiusd.conf> The log: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "radiusUDP" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[398] Unknown module "eap". radiusd.conf[381] Failed to parse authenticate section. Help!!! ;)

3 4

Swapping RADIUS servers.
by Lin Richardson 30 Nov '06

30 Nov '06

I'm hoping somebody can shed a little light on this, I found it very strange. btw: we're talking about freeradius version 1.1.3 here. We currently run some lesser radius server on our network, and I have been engaged in converting the environment to freeradius (yea!). I believe we have worked out (lab and pilot-site testing) all the kinks for our authentication needs, and today we attempted to implement the change across our whole network. Our lesser radius server lives on two physical boxes and listens on ports 1645/1646 AND 1812/1813 (can freeradius mimic this and listen on both sets of ports?) Our plan has been to make sure appropriate radius client devices were all pointing to the 1812/1813 authentication ports prior to the change. The change involved stopping the lesser server and bringing up freeradius on the ports 1812/1813 on both of the two physical servers. The idea was that the clients (chiefly Cisco WAPs) would have a seemless conversion and continue to authenticate using the same IP and ports they were previously using. This however was not the observed result. What happened was almost universal failure. What we saw were requests coming into freeradius, being processed as expected, and returning the appropriate response - many Accept responses clearly visible in the logs. The radius clients however did not accept these responses and treated them as authentication failure. The pilot: We ran freeradius on ports 11812/11813 on these same physical servers, side-by-side with the lesser radius server. We then pointed the client devices to the alternate port combination. They were successful and behaved exactly as expected. Log (debug) output from freeradius for the successful pilots and the failed implementation today are identical, however, with the new ports today 1812/1813 the pilot sites who had previously been working also failed. Does anyone have an idea what could have happened here? If a radius client was talking to server X, and then suddenly recieves a response from server Y on the same IP / port combination... is there some way that the client can tell the server has changed, and thus reject any responses from it as invalid? Does the radius client bind in some way to the server (on the application layer I would assume)? Shared secrets are the same and the request is clearly visible and processed by freeradius. debug output for a request looks like the following: freeradius does it's job but the client device doesn't authenticate the user. Please note that LDAP should fail in this instance. LDAP is used for another kind of authentication. The users file which matches DEFAULT at line 7798 is where the authentication comes from. Nov 29 10:58:48 rad_recv: Access-Request packet from host 10.32.251.10:32768, id=105, length=183 Nov 29 10:58:48 User-Name = "0014a4858ad0" Nov 29 10:58:48 Called-Station-Id = "00-15-62-a9-cc-50:guest" Nov 29 10:58:48 Calling-Station-Id = "00-14-a4-85-8a-d0" Nov 29 10:58:48 NAS-Port = 29 Nov 29 10:58:48 NAS-IP-Address = 10.32.251.10 Nov 29 10:58:48 NAS-Identifier = "co-lp-wlc01" Nov 29 10:58:48 Airespace-Wlan-Id = 7 Nov 29 10:58:48 User-Password = "********" Nov 29 10:58:48 Service-Type = Call-Check Nov 29 10:58:48 Framed-MTU = 1300 Nov 29 10:58:48 NAS-Port-Type = Wireless-802.11 Nov 29 10:58:48 Tunnel-Type:0 = VLAN Nov 29 10:58:48 Tunnel-Medium-Type:0 = IEEE-802 Nov 29 10:58:48 Tunnel-Private-Group-Id:0 = "2250" Nov 29 10:58:48 Processing the authorize section of radiusd.conf Nov 29 10:58:48 modcall: entering group authorize for request 0 Nov 29 10:58:48 hints: Matched DEFAULT at 39 Nov 29 10:58:48 modcall[authorize]: module "preprocess" returns ok for request 0 Nov 29 10:58:48 rlm_realm: No '@' in User-Name = "0014a4858ad0", looking up realm NULL Nov 29 10:58:48 rlm_realm: No such realm "NULL" Nov 29 10:58:48 modcall[authorize]: module "suffix" returns noop for request 0 Nov 29 10:58:48 users: Matched entry DEFAULT at line 7798 Nov 29 10:58:48 modcall[authorize]: module "files" returns ok for request 0 Nov 29 10:58:48 radius_xlat: '/usr/local/freeradius/etc/scripts/wireless.atz 0014a4858ad0' Nov 29 10:58:48 Exec-Program: /usr/local/freeradius/etc/scripts/wireless.atz 0014a4858ad0 Nov 29 10:58:48 Exec-Program output: Requested WLAN is not restricted, deferring authentication. Nov 29 10:58:48 Exec-Program-Wait: plaintext: Requested WLAN is not restricted, deferring authentication. Nov 29 10:58:48 Exec-Program: returned: 0 Nov 29 10:58:48 modcall[authorize]: module "wireless" returns ok for request 0 Nov 29 10:58:48 rlm_ldap: - authorize Nov 29 10:58:48 rlm_ldap: performing user authorization for 0014a4858ad0 Nov 29 10:58:48 radius_xlat: '(&(uid=0014a4858ad0)(accesslist=)(isaccountenabled=true))' Nov 29 10:58:48 radius_xlat: 'o=xyz' Nov 29 10:58:48 rlm_ldap: ldap_get_conn: Checking Id: 0 Nov 29 10:58:48 rlm_ldap: ldap_get_conn: Got Id: 0 Nov 29 10:58:48 rlm_ldap: attempting LDAP reconnection Nov 29 10:58:48 rlm_ldap: (re)connect to ldapvip.co.ihc.com:389, authentication 0 Nov 29 10:58:48 rlm_ldap: bind as appl=VPN Radius Server, ou=applications, o=xyz/******** to ldapvip.xyz.com:389 Nov 29 10:58:48 rlm_ldap: waiting for bind result ... Nov 29 10:58:48 rlm_ldap: Bind was successful Nov 29 10:58:48 rlm_ldap: performing search in o=xyz, with filter (&(uid=0014a4858ad0)(accesslist=)(isaccountenabled=true)) Nov 29 10:58:48 rlm_ldap: object not found or got ambiguous search result Nov 29 10:58:48 rlm_ldap: search failed Nov 29 10:58:48 rlm_ldap: ldap_release_conn: Release Id: 0 Nov 29 10:58:48 modcall[authorize]: module "ldap" returns notfound for request 0 Nov 29 10:58:48 modcall: leaving group authorize (returns ok) for request 0 Nov 29 10:58:48 rad_check_password: Found Auth-Type Accept Nov 29 10:58:48 rad_check_password: Auth-Type = Accept, accepting the user Nov 29 10:58:48 Sending Access-Accept of id 105 to 10.32.251.10 port 32768 Nov 29 10:58:48 Finished request 0 Thanks, Lin

2 3

romel invites you to join Zorpia
by romel 30 Nov '06

30 Nov '06

Hi freeradius-users! Your friend romel from , just invited you to his online photo albums and journals at Zorpia.com. About romel : Know Me Know Fun No Me No Fun So what is Zorpia? It is an online community that allows you to upload unlimited amount of photos, write journals and make friends. We also have a variety of skins in store for you so that you can customize your homepage freely. Join now for free! Please click the following link to join Zorpia: http://signup.zorpia.com/signup?invitation_key=7d3391e3c6586a56fcd14ad5a68f… This message was delivered with the romel's initiation. If you wish to discontinue receiving invitations from us, please click the following link: http://signup.zorpia.com/email/optout/freeradius-users@lists.freeradius.org

1 0

Redundant LDAP servers
by Peter Param 30 Nov '06

30 Nov '06

hi all, is it possible to have multiple ldap servers for lookup for redundancy purposes in a similar way below? ldap { server = ldap1.myorg.com, ldap2.myorg.com, ldap3.myorg.com login = "cn=admin,o=myorg,c=au" password = mypass } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

EAP-AKA support?
by Ramm-Ericson, Johannes 29 Nov '06

29 Nov '06

Hi, searching through the mail archive and the Freeradius bugzilla on Freeradius support for EAP-AKA authentication I found this : http://bugs.freeradius.org/show_bug.cgi?id=386 (Yes, I know that this Wiki page http://wiki.freeradius.org/EAP does not include EAP-AKA in the list of supported methods) Does anyone have any input on the status of this code? Is it stable, does it need further testing? Thanks and Regards, Johannes

2 1

radiusd.conf: Why extra "Auth-Type" in authenticate section?
by Martin Gadbois 29 Nov '06

29 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, - From a typical radiusd.conf: authenticate { Auth-Type PAP { pap } ... snip ... eap } Why the "Auth-Type PAP { }" construct? I tried RTFM and RTFC, but I have not seen an actual description of why that is there. From the "authenticate" radiusd.conf documentation: # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. So why specify "Auth-Type PAP { pap }" at all if the system will select authentication 'pap' when Auth-Type == PAP? Thanks, - -- ============== +----------------------------------------------+ Martin Gadbois | "Windows might take you from 0 to 60 faster, | S/W Developer | but to go to 100 you need Unix." | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFbIvs9Y3/iTTCEDkRAqf0AJ9Phxbej5KtfSVULJwtCnmMV1GbjACeJbGO aDtM2jrSJ+rO5zgGLbrJu5U= =q6pD -----END PGP SIGNATURE-----

2 3