- Freeradius-Users - lists.freeradius.org

Re: WPA authentication works only with MacOS clients
by Jason Wittlin-Cohen 17 Oct '06

17 Oct '06

Message: 5 Date: Mon, 16 Oct 2006 22:36:14 +0200 From: "Josh Shamir" <josh.shamir(a)gmail.com> Subject: Re: WPA authentication works only with MacOS clients To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8b3d60af0610161336k20473a1cw4410cbaa6eda17c7(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" "Hi Jason, I want to use PEAP. So I can use PEAP on a WinXP SP2 client without any other supplicant, using his native supplicant. The problem is that with native WinXP supplicant the authentication process failed, and freeradius server give me an error regarding certificates. The strange thing is that with the same certificates, PEAP works fine with MacOSx. Could be a problem of certificates ? I generate certificates with CA.all. Any ideas about how generate certificates that works also with MS WixXP client?" This is a common problem. Windows XP requires that the server and client certificates have specific attributes. This is useful as it prevents a main-in-the-middle attack where an authentic client masquerades as a server with his client cert. You need to use Microsoft's Extended Attributes: [ xpclient_ext] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 See http://www.linuxjournal.com/node/8095/print for detailed instructions how to create a server certificate that will work with PEAP and MS clients. The HOWTO is for EAP-TLS which requires client and server certificates. Since you are using PEAP, you just need to create the server certificate. Good luck. In particular you'll want to do: openssl req -new -keyout server_key.pem -out server_req.pem -days 730 -config ./openssl.cnf openssl ca -config ./openssl.cnf \ -policy policy_anything -out server_cert.pem \ -extensions xpserver_ext -extfile ./xpextensions \ -infiles ./server_req.pem You'll now have server_cert.pem (Public Certificate) and server_key.pem (Private Key which has no password). The public certificate will have the Server extended key usage extensions set and now your XP client should authenticate.

2 1

RE: [sec: unclas] Huntgroupname checkitem in LDAP
by Jonathan De Graeve 17 Oct '06

17 Oct '06

> Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Ranner, > Frank MR > Verzonden: dinsdag 17 oktober 2006 4:17 > Aan: FreeRadius users mailing list > Onderwerp: RE: [sec: unclas] Huntgroupname checkitem in LDAP > > > DEFAULT Ldap-Group == `%{Huntgroup-Name}` > Access-Level := RW, > Service-Type = Administrative-User, > Cisco-AVPair := "shell:priv-lvl=15", > Passport-Command-Impact = configuration > Although this approach Works if you just want to add attributes for a certain huntgroup if a user is member of it. My problem is, I have 2 user databases, one being SQL the other being LDAP/AD I want to be able to specify to which NASses the LDAP/AD user has access too. If it were only LDAP/AD users, everything would work like this: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type := REJECT In this way, every user that is not a member of a specific Group that matches a Huntgroup name is denied access. But I still have the SQL users and the above rules breaks them. So I changed it to this: DEFAULT SQL-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type := REJECT In this way, I need to change my SQL users setup from instead having the Huntgroup-Name in SQL as a checkitem (radgroupcheck) to add every SQL user to a SQL-group having the same name as the huntgroup. This behaviour works but is not really desirable. After searching and experimenting the trick to NOT break EAP/LDAP/SQL but still having everything working like I wanted it to be was just as follows: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type = LOCAL Fall-Through = Yes This configuration allows for the default SQL behaviour to stay the same, having EAP AND locking Ldap users to the NASes controlled by there groupmembership. Since I spent a long time figuring this out I wanted to share this to the list. My current setup has SQL users + Complete Active Directory integration (having EAP=>NTLM) + LDAP(PAP/etc...) Kind Regards, J.

1 0

problem with proxy configuration
by Prabhdeep Singh 17 Oct '06

17 Oct '06

Hello, I am having following problem with proxy. In proxy.conf, I have following entries realm myPartnerRealm { type = radius authhost = mypartner.server.com:1812 accthost = mypartner.server.com:1813 secret = mypartnersecret nostrip } realm myCustomRealm { type = radius authhost = localhost:1812 accthost = localhost:1813 secret = mysecret nostrip } realm DEFAULT { type = radius authhost = localhost:1812 accthost = localhost:1813 secret = mysecret } I am able to authenticate against myPartnerRealm and default relam, but when I submit request for "myCustomRealm", the server seems to go in a loop and marks the "myCustomRealm" as dead with the following error. marking authentication server localhost:1812 for realm myCustomRealm dead I also get the following warning message WARNING: Possible DoS attack from host 127.0.0.1: Too many attributes in request (received 201, max 200 are allowed). I read in one of the post that proxying to same server (localhost) is not allowed.... , but i need this feature as I do not want to strip certain Realms. Thanks for your help. Prabh -- MyBlog: http://things-on-my-mind.blogspot.com/ Get your news at www.DailyHeadlines.NET

2 1

variable escaping ins sql.conf
by Norbert Wegener 17 Oct '06

17 Oct '06

in sql.conf I use something like: usergroup.GroupName like 'v%y' and radius -AX tells me: WARNING: Unknown variable '%y': See 'doc/variables.txt' How would I escape that kind of variable to pass it to the sql query? The usual \ did not work. Thanks Norbert Wegener

2 1

Inserting attributes into the check table from Perl?
by Jan Mulders 17 Oct '06

17 Oct '06

Hello all, I've just finished writing a perl program to give a user a different speed of service based on their accounting total for the last month in MySQL, and I'd like to also assign these users an IP based on this usage too. I wanted to do this by setting the Pool-Name check value from my script, after it's figured out what group the user being authenticated falls under. However, apparently the $RAD_CHECK hash is read-only. How do I write to the Check table from perl? Is it possible? Is there a way of invoking ip_pools from perl? thanks, Jan

2 1

core dump with freeradius-1.1.3-mysql
by Kostas Kalevras 17 Oct '06

17 Oct '06

Hello, i 've been encountering core dumps with freeradius-1.1.3 in the mysql module. Information: OS: SunOS radius 5.8 Generic_108528-29 sun4u sparc SUNW,UltraAX-i2 After code dump: Radius process still exists but won't handle requests GDB: #0 0xfdfc89e4 in mysql_errno () from /opt/csw/mysql4/lib/mysql/libmysqlclient_r.so.14 #1 0xfe150e38 in sql_query () from /usr/local/freeradius-1.1.3/lib/rlm_sql_mysql-1.1.3.so #2 0xfe176fc0 in rlm_sql_query () from /usr/local/freeradius-1.1.3/lib/rlm_sql-1.1.3.so #3 0xfe174fe8 in rlm_sql_accounting () from /usr/local/freeradius-1.1.3/lib/rlm_sql-1.1.3.so #4 0x22568 in module_post_auth () #5 0x23088 in modcall () #6 0x2262c in module_post_auth () #7 0x227ec in module_post_auth () #8 0x22fbc in modcall () #9 0x210c8 in find_module_instance () #10 0x21fd0 in module_accounting () #11 0x139d8 in rad_accounting () #12 0x2c008 in session_zap () #13 0xfe175ed0 in rlm_sql_checksimul () from /usr/local/freeradius-1.1.3/lib/rlm_sql-1.1.3.so #14 0x22568 in module_post_auth () #15 0x23088 in modcall () #16 0x2262c in module_post_auth () #17 0x227ec in module_post_auth () #18 0x22fbc in modcall () #19 0x210c8 in find_module_instance () #20 0x22078 in module_checksimul () #21 0x155f8 in rad_authenticate () #22 0x284f4 in rad_respond () #23 0x2cf88 in rad_check_ts () As can be seen, i m using the thread safe mysql libraries. PKGINST: CSWmysql4rt NAME: mysql4rt - run-time libraries for mysql4 CATEGORY: system ARCH: sparc VERSION: 4.1.21,REV=2006.07.29 Lines in source file: /src/freeradius-1.1.3/src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c static int sql_query(SQLSOCK * sqlsocket, SQL_CONFIG *config, char *querystr) { [..........] mysql_query(mysql_sock->sock, querystr); return sql_check_error(mysql_errno(mysql_sock->sock)); } Log file: Tue Oct 17 11:11:51 2006 : Error: Discarding duplicate request from client adsl.ira:1645 - ID: 141 due to unfinished request 482895 Tue Oct 17 11:11:51 2006 : Auth: Login OK: [r-165dim-athin] (from client cas1.att port 20211 cli XXXXXXXX) Tue Oct 17 11:11:52 2006 : Error: Discarding duplicate request from client adsl.ira:1645 - ID: 144 due to unfinished request 482980 Tue Oct 17 11:11:52 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:52 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:52 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:52 2006 : Auth: Login incorrect: [sch.gr] (from client adsl.ach port 581 cli atm 2) Tue Oct 17 11:11:52 2006 : Auth: Login OK: [r-gym-amaliad] (from client cas.ilei port 20026 cli XXXXXXX) Tue Oct 17 11:11:52 2006 : Auth: Login OK: [r-gym-saval] (from client cas.ilei port 20111 cli XXXXXXX) Tue Oct 17 11:11:52 2006 : Auth: Login OK: [digital] (from client cas1.att port 20629 cli XXXXXX) Tue Oct 17 11:11:52 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Auth: Login OK: [r-2gym-aigio(a)sch.gr] (from client adsl.ach port 382 cli atm 2) Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Auth: Login OK: [distrat] (from client cas.ait port 20006 cli XXXXXX) Tue Oct 17 11:11:53 2006 : Error: Discarding duplicate request from client adsl.att:1645 - ID: 182 due to unfinished request 482899 Tue Oct 17 11:11:53 2006 : Auth: Login OK: [digital] (from client cas1.att port 20725 cli XXXXXX) Tue Oct 17 11:11:53 2006 : Error: Discarding duplicate request from client adsl.ira:1645 - ID: 142 due to unfinished request 482907 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Auth: Login OK: [iekrethya(a)sch.gr] (from client adsl.ira port 1039 cli atm 10) Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0 Tue Oct 17 11:11:53 2006 : Info: rlm_sql (radacct): There are no DB handles to use! skipped 0, tried to connect 0

1 0

Re: WPA authentication works only with MacOS clients
by Jason Wittlin-Cohen 17 Oct '06

17 Oct '06

Message: 5 Date: Mon, 16 Oct 2006 22:36:14 +0200 From: "Josh Shamir" <josh.shamir(a)gmail.com> Subject: Re: WPA authentication works only with MacOS clients To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8b3d60af0610161336k20473a1cw4410cbaa6eda17c7(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" "Hi Jason, I want to use PEAP. So I can use PEAP on a WinXP SP2 client without any other supplicant, using his native supplicant. The problem is that with native WinXP supplicant the authentication process failed, and freeradius server give me an error regarding certificates. The strange thing is that with the same certificates, PEAP works fine with MacOSx. Could be a problem of certificates ? I generate certificates with CA.all. Any ideas about how generate certificates that works also with MS WixXP client?" This is a common problem. Windows XP requires that the server and client certificates have specific attributes. This is useful as it prevents a main-in-the-middle attack where an authentic client masquerades as a server with his client cert. You need to use Microsoft's Extended Attributes: [ xpclient_ext] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 See http://www.linuxjournal.com/node/8095/print for detailed instructions how to create a server certificate that will work with PEAP and MS clients. The HOWTO is for EAP-TLS which requires client and server certificates. Since you are using PEAP, you just need to create the server certificate. Good luck. In particular you'll want to do: openssl req -new -keyout server_key.pem -out server_req.pem -days 730 -config ./openssl.cnf openssl ca -config ./openssl.cnf \ -policy policy_anything -out server_cert.pem \ -extensions xpserver_ext -extfile ./xpextensions \ -infiles ./server_req.pem You'll now have server_cert.pem (Public Certificate) and server_key.pem (Private Key which has no password). The public certificate will have the Server extended key usage extensions set and now your XP client should authenticate. Jason Wittlin-Cohen P.S: Sorry for the double post. My last message had flowed text making it very difficult to read so I decided to resend it.

1 0

Huntgroupname checkitem in LDAP
by Jonathan De Graeve 17 Oct '06

17 Oct '06

Hello, i'm looking for a way to have my huntgroups defined in LDAP similar to the way they are in SQL. For example if a user belongs to Ldap-Group vpn, the Group in ldap contains an attribute containing the huntgroup names which the Group gives access to. I tried adding 'checkItem Huntgroup-Name' info to my ldap.attrmap with attribute 'info' having value: '=~ ^(vpn|sslvpn)$' (without succes) I had success with the following setup: In users: DEFAULT Huntgroup-Name == vpn, Ldap-Group == vpn Fall-Through = no DEFAULT Huntgroup-Name == sslvpn, Ldap-Group == sslvpn Fall-Through = no DEFAULT Auth-Type := Reject This allows to specify which user has access to which nasgroup by adding groupmemberships to the user. But it breaks the users existing in SQL. I could off course also add the specific SQL-Groups into the users file but this would still require a reorganisation of the SQL users since they only have a Huntgroup-Name attribtue for there grouplevel which specifies multiple huntgroups by using regexp. I'm kinda stuck in how to implement it. Any advice would be greatly appreciated. J.

2 1

Out of touch for a bit...
by Alan DeKok 16 Oct '06

16 Oct '06

I've been away and unable to get mail for the past few days, and now my main net connection has a fibre cut. Hopefully I'll be back up and running tomorrow. Alan DeKok.

1 0

WPA authentication works only with MacOS clients
by Jason Wittlin-Cohen 16 Oct '06

16 Oct '06

> Date: Mon, 16 Oct 2006 13:25:22 +0200 > From: "Josh Shamir" <josh.shamir(a)gmail.com> > Subject: WPA authentication works only with MacOS clients > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <8b3d60af0610160425xc076a00x139432f4db89c1e2(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hello all, > I'm using WPA with EAP-TTLS and PEAP with a MacOS .Authentication works fine > (even if enough slowly). > The problem is that I can't authenticate WinXP client. > I've readed that for using EAP-TTLS are required some other supplicant like > SecureW2. Is SecureW2 required also for PEAP? > You are correct. The Windows supplicant on XP SP2 supports PEAP-MSCHAPv2 otherwise known as PEAPv0 and EAP-TLS. If you want to use EAP-TTLS you have a few choices. You can use a commercial supplicant like Funk Odyssey Access Client (30 day free trial here: http://www.juniper.net/customers/support/products/oac.jsp. It's a great supplicant and supports EAP-TTLS, PEAPv0, PEAPv1, EAP-TLS, EAP-SIM, EAP-GTC etc. You also may want to check if your wireless card has its own supplicant that supports TTLS. Most new laptops come with an Intel Centrino chipset and Intel's Proset Wireless supplicant does support TTLS. It's also faster and has more features than the MS supplicant. If these aren't available options, why not just use PEAP-MSCHAPv2? If you're just doing username/password authentication this should work fine. PEAP and TTLS are very similar in nature and PEAP is supported in OS X and in the Windows supplicant. > Thanks for attention > Best Regards, Josh >

2 1