- Freeradius-Users - lists.freeradius.org

RE: EAP-TLS Certificate problems.
by Jason Wittlin-Cohen 09 Oct '06

09 Oct '06

> Hi, I'm trying to get Freeradius up and running on a WinXP box (win haters. > be nice ;) ) I have downloaded, installed, and configured the Freeradius > version from www.freeradius.net. The server starts seemingly without errors. > However when I try to connect with my XP laptop I get a certificate error on > the radius systems log. I have created 3 certificates, Root, Client, Server. > The Root and Client certificates were installed via the MMC snapin and > Import wizard in XP. Any idea on what could be causing the errors? If I > need to post file contents, let me know which ones. Using EAP-TLS(cert > based) not EAP-TTLS(user-pass based). Xp laptop is stuck at "Attempting to > Authenticate." > Welcome to the Freeradius mailing list, and thank you for providing debug log to help us sort out this issue. The debug information will tell you exactly why it's being rejected (i.e. no certificate was sent, certificate was signed by another CA). I believe I know what's going wrong. The CA public cert should be stored in the "Trusted Root Certification Authorities" certificate store. If it's anywhere else, Windows won't authenticate the server and it will look like it's failing- when it's doing what you asked it to do. In this scenario you won't see any error output from Freeradius because Windows has stopped attempting to connect. Your user public certificate must be stored in either your User or Machine Account "Personal" Certificate store (this is the first option in the snap-in). Also, if you have more than one certificate in your personal store, do not use "simply certificate selection". Windows will choose the one highest in the list (It did for me). Manually select the certificate you want to use. Read this howto and follow the "Configuring Windows XP Clients" guide. It will tell you exactly what to do. See http://www.linuxjournal.com/node/8151/print Here is what's happening currently: > Error 1 is seen if I have Validate Server Certificate check on the XP > Laptop. > > --Error 1-- > Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > ------ > > When you enable Server verification, Windows checks to see if the server's certificate is signed by a trusted Root CA that you specify. Since you didn't install the CA to the "Trusted Root Certificate Authorities" certificate store, the Windows supplicant refuses to continue authenticating and Freeradius has nothing to do. This error doesn't actually mean anything. I see it when I have a successful login. You're not seeing an error- which means the problem is on the client side. This can be remedied by installing your Root CA in the "Trusted Root Certification Authorities" certificate store. Here's a successful authenticaiton from my radiusd.log. You'll notice the read client certificate A error. It can safely be ignored. Sun Oct 8 03:13:56 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Auth: Login OK: [Jason Wittlin-Cohen] (from client WLAN port 8 cli 00095b93459e) > Error 2 is seen if Validate is unchecked on the laptop > > --Error 2-- > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get > local issuer certificate > Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate B > Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system > call (-1), TLS session fails. > Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no > User-Password attribute>] (from client netnas port 11 cli 0014a5104864) > ----- > > Error 2 tells us exactly what the problem is. "Unable to get local issuer certificate" AND "Unknown CA". In other words, the certificate used is not the one it should be using as it's signed by another CA. This can be remedied by either installing the correct certificate in the "Personal" user certificate store and turning off "simple certificate selection". I hope this resolves your problem. Jason Wittlin-Cohen

2 3

free radius ntlm_auth problem
by Alan DeKok 09 Oct '06

09 Oct '06

Andris wrote: ... > Usernames without whitespaces authorize succesfully. When > run ntlm_auth manal and write usernames like 'user 1' than work. And > i want put a NT group requirment too like a 'Domain Users' ntlm_auth > string is: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" Try using: ntlm_auth = '...', i.e. use single quotes rather than double quotes. The issue appears to be that the User-Name string is expanded *before* the 'exec program' code is being called. That means the splitting of the program arguments by spaces is hitting the space in the username. What *should* happen is that entire string gets sent to the 'exec program' code, which splits the string by spaces, and *then* expands User-Name. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 2

Multiple users mysql backend
by Collen Blijenberg 09 Oct '06

09 Oct '06

I'm still looking for a good solution, authenticating multiple users with the same login name and with mysql as backend. in the mysql table 'radcheck' i have entered the following: UserName Attribute op Value gebruiker Calling-Station-Id == 00166f980e78 gebruiker NT-Password := <NT-HASH> gebruiker Calling-Station-Id == 00166f97d99d gebruiker NT-Password := <NT-HASH> it does work with the 'Users' plain text file. but as soon as i turn to mysql, it failles... ?! dunno is there some bug, or incomplete code, for the mysql backend ? Cheers, Collen.

2 2

rlm_perl CLONE/thread identification ?
by Jakub Wartak 09 Oct '06

09 Oct '06

Hello group, I tried using "use threads" and quering by simple: my $id = threads->tid; But it always returns 0 ( meaning that the perl code is running under main() program ), but how do I identifiy each CLONE ?? I want to obtain unique identified of each CLONE, because the goal is to create DB connection for each CLONE for performance reasons, the DBI object/handle AFAIK shouldn't be shared. Maybe enumerating in sub CLONE() ?? Is this launching CLONE of perl module serialized ? And I could fetch current running CLONE id from authorize () ? wiki.freeradius.org states ( about CLONE() ): "In this function you can initialize some variables that should be local for this thread. For example an Database connection." -- Jakub Wartak -vnull http://vnull.pcnet.com.pl/

2 1

EAP-TLS Certificate problems.
by Brian vb 08 Oct '06

08 Oct '06

Hi, I'm trying to get Freeradius up and running on a WinXP box (win haters. be nice ;) ) I have downloaded, installed, and configured the Freeradius version from www.freeradius.net. The server starts seemingly without errors. However when I try to connect with my XP laptop I get a certificate error on the radius systems log. I have created 3 certificates, Root, Client, Server. The Root and Client certificates were installed via the MMC snapin and Import wizard in XP. Any idea on what could be causing the errors? If I need to post file contents, let me know which ones. Using EAP-TLS(cert based) not EAP-TTLS(user-pass based). Xp laptop is stuck at "Attempting to Authenticate." Checked options on laptop are.. Authenticate as Computer when info is available (checked) Authenticate as guest when comp/user info unavailable (UNCHECKED) Use a Certificate on this computer.(checked) Use Simple Cert selection (sub option, also checked) Validate Server Cert (checked) Trusted root I created/installed is checked Thanks, Brian. --- System configuration --- XP Desktop, SP2, FreeRadius, Wired to Network. Firewall off. XP Laptop, SP2, Wireless to network, firewall off. Netgear WG302 Prosafe AP. Wired to network. ---------------- 3 Logs to post.. Debug and two errors. ---Logs--- -Debug- C:\PROGRA~1\FreeRADIUS.net-1.1.1-r0.0.1\bin>radiusd.exe -d C:\progra~1\freeradiu s.net-1.1.1-r0.0.1\etc\raddb -AX Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/proxy.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/clients.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/snmp.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/eap.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/var" main: logdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log/" main: libdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/lib" main: radacctdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: certificate_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: CA_file = "C:/Docume~1/radius/rcerts/root.pem" tls: private_key_password = "SuperSecretCode" tls: dh_file = "C:/Docume~1/radius/rcerts/dh" tls: random_file = "C:/Docume~1/radius/rcerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/hun tgroups" preprocess: hints = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/users" files: acctusersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/acct_users" files: preproxy_usersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radacct/%{Client-IP-Address}/d etail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.189:1039, id=48, length=143 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 EAP-Message = 0x0201000f01736861646f77776f6c66 Message-Authenticator = 0x0cfc3dbdb33f6d9f62cbd59c4e849d14 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 48 to 10.1.1.189 port 1039 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6c44d3605cb5a79d23198397347d2bba Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.189:1039, id=49, length=226 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 State = 0x6c44d3605cb5a79d23198397347d2bba EAP-Message = 0x020200500d800000004616030100410100003d030145283c25a8eae2 7a9fa8512761940517cc1e13455dbded74ed69dfba9118ba3a00001600040005000a00090064 0062 000300060013001200630100 Message-Authenticator = 0xc1a89b0fc9d91251ff1efed32a5d4ab2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 025e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00c1], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 49 to 10.1.1.189 port 1039 EAP-Message = 0x010303820d8000000378160301004a02000046030145283c2743a408 aa5de69864552c046af9b0bb6e4ec5d083dd730d94289377da2094a65c39b362e5bb81d263c0 afbd efb6dc85ecb9bc0564708226cab3ea4d2200000400160301025e0b00025a0002570002543082 0250 308201faa00302010202020122300d06092a864886f70d01010505003060310b300906035504 0613 024155310c300a06035504081303514c4431193017060355040a13104d696e636f6d20507479 2e20 4c74642e310b3009060355040b13024353311b30190603550403131253534c6561792064656d 6f20 736572766572301e170d3036313030373032313732355a170d EAP-Message = 0x3037313030373032313732355a3081a2310b30090603550406130255 53311730150603550408130e536f757468204361726f6c696e61310e300c0603550407130541 696b 656e31173015060355040a130e4c6f636b65722053797374656d73311a3018060355040b1311 4d65 74616c204661627269636174696f6e31123010060355040313096c6967687477617665312130 1f06 092a864886f70d01090116127a65746f406c6f636b65727379732e766f6430819f300d06092a 8648 86f70d010101050003818d0030818902818100e2056bc302f8b1466a56602016699368280121 58d0 226d3fd02431e962f0acb8540f635f1a9a06e0a9d0843c7615 EAP-Message = 0x014fe79bfc4bb4d6b15db505d60fe699343794a09eb0b613cb3c4fc9 b090b88c2ad417fbc5104cf428dffeed87b20f683f332970ca36d4961efb5f9e32019d5fe3dd 811a b715cefbc39dc78a3890701e30190203010001a317301530130603551d25040c300a06082b06 0105 05070301300d06092a864886f70d01010505000341008afb125e6d5e10a665c6d482763ea4af c56e 59bb72a8fc6e3788a700259d5a72c5450c33d9968a88a3ec349376c4023a591425a20654dbfe d97a f2617f4ca44516030100c10d0000b90301020500b300b13081ae310b30090603550406130255 5331 1730150603550408130e536f757468204361726f6c696e6131 EAP-Message = 0x0e300c0603550407130541696b656e31173015060355040a130e4c6f 636b65722053797374656d73311a3018060355040b13114d6574616c20466162726963617469 6f6e 311e301c060355040313154c6f636b657220536563757269747920526f6f742e3121301f0609 2a86 4886f70d01090116127a65746f406c6f636b65727379732e766f640e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x57f6a443bf2f47b815e42769229d1aeb Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.189:1039, id=50, length=152 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 State = 0x57f6a443bf2f47b815e42769229d1aeb EAP-Message = 0x020300060d00 Message-Authenticator = 0xe39222cf4fd6f6860c85ffe560aa5428 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 50 to 10.1.1.189 port 1039 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2f07585b4ad88459f3f0f28a7fa6fb2 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 48 with timestamp 45283c27 Cleaning up request 1 ID 49 with timestamp 45283c27 Cleaning up request 2 ID 50 with timestamp 45283c27 Nothing to do. Sleeping until we see a request. ----------- Error 1 is seen if I have Validate Server Certificate check on the XP Laptop. --Error 1-- Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client certificate A ------ Error 2 is seen if Validate is unchecked on the laptop --Error 2-- Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get local issuer certificate Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client certificate B Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no User-Password attribute>] (from client netnas port 11 cli 0014a5104864) -----

2 2

two or more ippool
by Roberto Gonzalez Azevedo 08 Oct '06

08 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm having some trouble with ippool. I have some ip pools who need to be distributed for my clients. There is a example, my radiusd.conf: ... ippool p0 { range-start = xx.xx.xx.1 range-stop = xx.xx.xx.20 netmask = 255.255.255.0 cache-size = 32 session-db = ${raddbdir}/ippool/db.ippool.p0 ip-index = ${raddbdir}/ippool/db.ipindex.p0 override = yes maximum-timeout = 0 } ippool p1 { range-start = xx.xx.xx.21 range-stop = xx.xx.xx.40 netmask = 255.255.255.0 cache-size = 32 session-db = ${raddbdir}/ippool/db.ippool.p1 ip-index = ${raddbdir}/ippool/db.ipindex.p1 override = yes maximum-timeout = 0 } ... In accounting: accounting { ... group mypools { p0 p1 } ... } In post-auth: post-auth { ... group mypools { p0 p1 } ... } In (mysql) radgroupcheck : +-----+-------------------+------------------+----+-------------+------+ | id | GroupName | Attribute | op | Value | prio | +-----+-------------------+------------------+----+-------------+------+ | 30 | mygroup | Pool-Name | := | p0 | 1 | | 31 | mygroup | Pool-Name | := | p1 | 1 | ... It's working, but my clients only catch IP from the first pool (p0). They never catch from others pools (p1, p2 ...). Somebody already had a problem like this? Thanks !!! - -- - ---------------------------- Roberto Gonzalez Azevedo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFJmaWF+EMwkXLsEwRAt+jAJ45YW7n1JkYxje54bNCtsRs5rmwXgCfUnf/ NFDvR7t4usmdljxm/xB26XQ= =xMzx -----END PGP SIGNATURE-----

4 5

Freeradius + MikroTik problem (only 1 user allowed to be online)
by toxie＠budisava.net 08 Oct '06

08 Oct '06

Recently I`ve configured freeradius with mikrotik to connect users via pppoe, pptp or l2tp. The problem is that, when one user is connected, the other user is unable to connect. Here are the logs. --------------------------------------First user connects ------------------------- (46 messages discarded) Echo: radius,debug,packet Calling-Station-Id = "00:50:8D:68:DB:20" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet Acct-Session-Id = "81000000" Echo: radius,debug,packet Framed-IP-Address = 10.194.244.149 Echo: radius,debug,packet Acct-Authentic = 1 Echo: radius,debug,packet Acct-Status-Type = 1 Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.248 Echo: radius,debug,packet Acct-Delay-Time = 0 Echo: radius,debug,packet received Accounting-Response with id 124 from 10.194.2 3.246:1813 Echo: radius,debug,packet Signature = 0x16c0ffe781452ce6261046058ecf4f61 [admin@MikroTik] > Echo: radius,debug received reply for 53:00 Echo: radius,debug request 53:00 processed [admin@MikroTik] > (8 messages discarded) ---------------------------------- Second user is trying to connect -------------- Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > (7 messages discarded) Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > (7 messages discarded) Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > Echo: radius,debug timeout for 53:04 [admin@MikroTik] > ------------------------------------------------------------------------------------ The usernames and the passwords are ok. When I tried to connect one user to one MT and the second user to another mikrotik everything works fine.But when I`m using only 1 MT, only one user can be logged in. Does anybody had some issues like this before ? It`s really annoying me, cause I can`t figure it out where could be the problem. I noticed that when nobody is connected to radius, radius server can ping mikrotik and mikrotik can ping radius too.When somebody connects to radius, radius can`t ping mikrotik anymore, neither the user, but mikrotik can ping the radius server and the user too without no problem.

1 0

CVS web interface b0rked?
by Alex French 08 Oct '06

08 Oct '06

Hi, I'm not sure who maintains the web interface to the CVS tree, but it's giving a 500 Internal Server Error at the moment. Alex

1 0

Compatibility issue with Nortel?
by Juan Pablo Espino 08 Oct '06

08 Oct '06

Hello, I have beeen experimenting some problems connecting a nortel router 1430 with freeradius (v1.0.1, using mysql). When I try telnet I couldn't get the command line, although the authentication process is ok. Then I added the specific vendor attributes as a new dictionary file. It looks as follows: ############################################################### VENDOR Nortel 1584 ATTRIBUTE Bay-User-Level 100 integer VALUE Bay-User-Level Manager 2 VALUE Bay-User-Level User 4 VALUE Bay-User-Level Operator 8 ################################################################ Also I added the following line into /etc/raddb/dictionary: $INCLUDE /usr/local/freeradius/share/dictionary.nortel However I still have the same problem, the router doesn't give me command line access. The logs in the router doesn't provide me any helpful information. I attached the freeradius -X logs at the end. Probably I have something wrong with the configuration because it seems the values of the new attributes are not correct when they are sent. Perhaps one of you have had a similar situation. I really appreciate any help, thanks. Regards, Juan Pablo Logs: radiusd -X ------------------------ rad_recv: Access-Request packet from host 10.0.2.26:21741, id=19, length=57 Service-Type = Framed-User NAS-IP-Address = 10.0.2.26 User-Name = "test1" User-Password = "test1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password radius_xlat: 'prueba!!!' Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW())' radius_xlat: '/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 19 to 10.0.2.26:21741 Bay-User-Level = Manager Reply-Message = "prueba!!!" Service-Type = NAS-Prompt-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 19 with timestamp 4528045f

2 3

Freeradius is not restarting properly (fails to quit and becomes a zombie process)
by Jason Wittlin-Cohen 08 Oct '06

08 Oct '06

Over the last few days I've been having a recurring problem. Whenever I start Freeradius either with radiusd in a terminal or as a service in Debian, I can not restart/kill radiusd properly if it's authenticated any clients. Restarting the service says it's successful but the radius log states that port 1812 is already in use. "top" shows 100% cpu usage after I attempt to restart radiusd. In addition, kill will not work. I need to use kill -9. No errors are thrown when I try to kill it in debug mode either. It just says exiting and sits there but doesn't die. The only change I have made to radiusd.conf was to set the user and group to nobody and nogroup respectively. I've copied the contents of my eap.conf configuration file below. # -*- text -*- # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4.4.3 2006/04/28 18:25:03 aland Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = tls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { private_key_password = private_key_file = /etc/ssl/newCA/certs/server_key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = /etc/ssl/newCA/certs/server_cert.pem # Trusted Root CA list CA_file = /etc/ssl/newCA/cacert.pem dh_file = /etc/ssl/newCA/certs/dh dh_key_length = 3072 random_file = /etc/ssl/newCA/certs/random CA_path = /etc/ssl/newCA/crl/ # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd check_crl = yes # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. # check_cert_issuer = "/C=US/ST=NJ/L=East Brunswick/CN=Jason Wittlin-Cohen's ROOT CA" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "HIGH" } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # #ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. # default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = no #} # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. # default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. # copy_request_to_tunnel = no # use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes #} # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } }

3 5