- Freeradius-Users - lists.freeradius.org

EAP-TLS Certificate problems.
by Brian vb 08 Oct '06

08 Oct '06

Hi, I'm trying to get Freeradius up and running on a WinXP box (win haters. be nice ;) ) I have downloaded, installed, and configured the Freeradius version from www.freeradius.net. The server starts seemingly without errors. However when I try to connect with my XP laptop I get a certificate error on the radius systems log. I have created 3 certificates, Root, Client, Server. The Root and Client certificates were installed via the MMC snapin and Import wizard in XP. Any idea on what could be causing the errors? If I need to post file contents, let me know which ones. Using EAP-TLS(cert based) not EAP-TTLS(user-pass based). Xp laptop is stuck at "Attempting to Authenticate." Checked options on laptop are.. Authenticate as Computer when info is available (checked) Authenticate as guest when comp/user info unavailable (UNCHECKED) Use a Certificate on this computer.(checked) Use Simple Cert selection (sub option, also checked) Validate Server Cert (checked) Trusted root I created/installed is checked Thanks, Brian. --- System configuration --- XP Desktop, SP2, FreeRadius, Wired to Network. Firewall off. XP Laptop, SP2, Wireless to network, firewall off. Netgear WG302 Prosafe AP. Wired to network. ---------------- 3 Logs to post.. Debug and two errors. ---Logs--- -Debug- C:\PROGRA~1\FreeRADIUS.net-1.1.1-r0.0.1\bin>radiusd.exe -d C:\progra~1\freeradiu s.net-1.1.1-r0.0.1\etc\raddb -AX Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/proxy.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/clients.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/snmp.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/eap.conf Config: including file: C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/var" main: logdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log/" main: libdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/lib" main: radacctdir = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: certificate_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: CA_file = "C:/Docume~1/radius/rcerts/root.pem" tls: private_key_password = "SuperSecretCode" tls: dh_file = "C:/Docume~1/radius/rcerts/dh" tls: random_file = "C:/Docume~1/radius/rcerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/hun tgroups" preprocess: hints = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/users" files: acctusersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/acct_users" files: preproxy_usersfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radacct/%{Client-IP-Address}/d etail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "C:/Progra~1/FreeRADIUS.net-1.1.1-r0.0.1/log//radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.189:1039, id=48, length=143 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 EAP-Message = 0x0201000f01736861646f77776f6c66 Message-Authenticator = 0x0cfc3dbdb33f6d9f62cbd59c4e849d14 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 48 to 10.1.1.189 port 1039 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6c44d3605cb5a79d23198397347d2bba Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.189:1039, id=49, length=226 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 State = 0x6c44d3605cb5a79d23198397347d2bba EAP-Message = 0x020200500d800000004616030100410100003d030145283c25a8eae2 7a9fa8512761940517cc1e13455dbded74ed69dfba9118ba3a00001600040005000a00090064 0062 000300060013001200630100 Message-Authenticator = 0xc1a89b0fc9d91251ff1efed32a5d4ab2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 025e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00c1], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 49 to 10.1.1.189 port 1039 EAP-Message = 0x010303820d8000000378160301004a02000046030145283c2743a408 aa5de69864552c046af9b0bb6e4ec5d083dd730d94289377da2094a65c39b362e5bb81d263c0 afbd efb6dc85ecb9bc0564708226cab3ea4d2200000400160301025e0b00025a0002570002543082 0250 308201faa00302010202020122300d06092a864886f70d01010505003060310b300906035504 0613 024155310c300a06035504081303514c4431193017060355040a13104d696e636f6d20507479 2e20 4c74642e310b3009060355040b13024353311b30190603550403131253534c6561792064656d 6f20 736572766572301e170d3036313030373032313732355a170d EAP-Message = 0x3037313030373032313732355a3081a2310b30090603550406130255 53311730150603550408130e536f757468204361726f6c696e61310e300c0603550407130541 696b 656e31173015060355040a130e4c6f636b65722053797374656d73311a3018060355040b1311 4d65 74616c204661627269636174696f6e31123010060355040313096c6967687477617665312130 1f06 092a864886f70d01090116127a65746f406c6f636b65727379732e766f6430819f300d06092a 8648 86f70d010101050003818d0030818902818100e2056bc302f8b1466a56602016699368280121 58d0 226d3fd02431e962f0acb8540f635f1a9a06e0a9d0843c7615 EAP-Message = 0x014fe79bfc4bb4d6b15db505d60fe699343794a09eb0b613cb3c4fc9 b090b88c2ad417fbc5104cf428dffeed87b20f683f332970ca36d4961efb5f9e32019d5fe3dd 811a b715cefbc39dc78a3890701e30190203010001a317301530130603551d25040c300a06082b06 0105 05070301300d06092a864886f70d01010505000341008afb125e6d5e10a665c6d482763ea4af c56e 59bb72a8fc6e3788a700259d5a72c5450c33d9968a88a3ec349376c4023a591425a20654dbfe d97a f2617f4ca44516030100c10d0000b90301020500b300b13081ae310b30090603550406130255 5331 1730150603550408130e536f757468204361726f6c696e6131 EAP-Message = 0x0e300c0603550407130541696b656e31173015060355040a130e4c6f 636b65722053797374656d73311a3018060355040b13114d6574616c20466162726963617469 6f6e 311e301c060355040313154c6f636b657220536563757269747920526f6f742e3121301f0609 2a86 4886f70d01090116127a65746f406c6f636b65727379732e766f640e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x57f6a443bf2f47b815e42769229d1aeb Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.189:1039, id=50, length=152 User-Name = "shadowwolf" NAS-IP-Address = 10.1.1.189 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905a09" Calling-Station-Id = "0014a5104864" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 14 NAS-Port-Id = "14" Framed-MTU = 1400 State = 0x57f6a443bf2f47b815e42769229d1aeb EAP-Message = 0x020300060d00 Message-Authenticator = 0xe39222cf4fd6f6860c85ffe560aa5428 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "shadowwolf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 50 to 10.1.1.189 port 1039 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2f07585b4ad88459f3f0f28a7fa6fb2 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 48 with timestamp 45283c27 Cleaning up request 1 ID 49 with timestamp 45283c27 Cleaning up request 2 ID 50 with timestamp 45283c27 Nothing to do. Sleeping until we see a request. ----------- Error 1 is seen if I have Validate Server Certificate check on the XP Laptop. --Error 1-- Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client certificate A ------ Error 2 is seen if Validate is unchecked on the laptop --Error 2-- Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get local issuer certificate Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client certificate B Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no User-Password attribute>] (from client netnas port 11 cli 0014a5104864) -----

2 2

two or more ippool
by Roberto Gonzalez Azevedo 08 Oct '06

08 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm having some trouble with ippool. I have some ip pools who need to be distributed for my clients. There is a example, my radiusd.conf: ... ippool p0 { range-start = xx.xx.xx.1 range-stop = xx.xx.xx.20 netmask = 255.255.255.0 cache-size = 32 session-db = ${raddbdir}/ippool/db.ippool.p0 ip-index = ${raddbdir}/ippool/db.ipindex.p0 override = yes maximum-timeout = 0 } ippool p1 { range-start = xx.xx.xx.21 range-stop = xx.xx.xx.40 netmask = 255.255.255.0 cache-size = 32 session-db = ${raddbdir}/ippool/db.ippool.p1 ip-index = ${raddbdir}/ippool/db.ipindex.p1 override = yes maximum-timeout = 0 } ... In accounting: accounting { ... group mypools { p0 p1 } ... } In post-auth: post-auth { ... group mypools { p0 p1 } ... } In (mysql) radgroupcheck : +-----+-------------------+------------------+----+-------------+------+ | id | GroupName | Attribute | op | Value | prio | +-----+-------------------+------------------+----+-------------+------+ | 30 | mygroup | Pool-Name | := | p0 | 1 | | 31 | mygroup | Pool-Name | := | p1 | 1 | ... It's working, but my clients only catch IP from the first pool (p0). They never catch from others pools (p1, p2 ...). Somebody already had a problem like this? Thanks !!! - -- - ---------------------------- Roberto Gonzalez Azevedo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFJmaWF+EMwkXLsEwRAt+jAJ45YW7n1JkYxje54bNCtsRs5rmwXgCfUnf/ NFDvR7t4usmdljxm/xB26XQ= =xMzx -----END PGP SIGNATURE-----

4 5

Freeradius + MikroTik problem (only 1 user allowed to be online)
by toxie＠budisava.net 08 Oct '06

08 Oct '06

Recently I`ve configured freeradius with mikrotik to connect users via pppoe, pptp or l2tp. The problem is that, when one user is connected, the other user is unable to connect. Here are the logs. --------------------------------------First user connects ------------------------- (46 messages discarded) Echo: radius,debug,packet Calling-Station-Id = "00:50:8D:68:DB:20" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet Acct-Session-Id = "81000000" Echo: radius,debug,packet Framed-IP-Address = 10.194.244.149 Echo: radius,debug,packet Acct-Authentic = 1 Echo: radius,debug,packet Acct-Status-Type = 1 Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.248 Echo: radius,debug,packet Acct-Delay-Time = 0 Echo: radius,debug,packet received Accounting-Response with id 124 from 10.194.2 3.246:1813 Echo: radius,debug,packet Signature = 0x16c0ffe781452ce6261046058ecf4f61 [admin@MikroTik] > Echo: radius,debug received reply for 53:00 Echo: radius,debug request 53:00 processed [admin@MikroTik] > (8 messages discarded) ---------------------------------- Second user is trying to connect -------------- Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > (7 messages discarded) Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > (7 messages discarded) Echo: radius,debug,packet User-Name = "toxie" Echo: radius,debug,packet Calling-Station-Id = "00:C0:26:6D:16:09" Echo: radius,debug,packet Called-Station-Id = "service1" Echo: radius,debug,packet NAS-Port-Id = "bridge1" Echo: radius,debug,packet MS-CHAP-Challenge = 0xc87049d986b943c7773272b9f6c0 76dd Echo: radius,debug,packet MS-CHAP2-Response = 0x0100820169c2908c12b7cfbe01f2 55ef Echo: radius,debug,packet c1c200000000000000004320c48df468 Echo: radius,debug,packet 8a58f84d8d4727c73ee24d4a4e886258 Echo: radius,debug,packet e85c Echo: radius,debug,packet NAS-Identifier = "MikroTik" Echo: radius,debug,packet NAS-IP-Address = 10.194.23.246 Echo: radius,debug could not receive packet for 53:04: Connection refused [admin@MikroTik] > Echo: radius,debug timeout for 53:04 [admin@MikroTik] > ------------------------------------------------------------------------------------ The usernames and the passwords are ok. When I tried to connect one user to one MT and the second user to another mikrotik everything works fine.But when I`m using only 1 MT, only one user can be logged in. Does anybody had some issues like this before ? It`s really annoying me, cause I can`t figure it out where could be the problem. I noticed that when nobody is connected to radius, radius server can ping mikrotik and mikrotik can ping radius too.When somebody connects to radius, radius can`t ping mikrotik anymore, neither the user, but mikrotik can ping the radius server and the user too without no problem.

1 0

CVS web interface b0rked?
by Alex French 08 Oct '06

08 Oct '06

Hi, I'm not sure who maintains the web interface to the CVS tree, but it's giving a 500 Internal Server Error at the moment. Alex

1 0

Compatibility issue with Nortel?
by Juan Pablo Espino 08 Oct '06

08 Oct '06

Hello, I have beeen experimenting some problems connecting a nortel router 1430 with freeradius (v1.0.1, using mysql). When I try telnet I couldn't get the command line, although the authentication process is ok. Then I added the specific vendor attributes as a new dictionary file. It looks as follows: ############################################################### VENDOR Nortel 1584 ATTRIBUTE Bay-User-Level 100 integer VALUE Bay-User-Level Manager 2 VALUE Bay-User-Level User 4 VALUE Bay-User-Level Operator 8 ################################################################ Also I added the following line into /etc/raddb/dictionary: $INCLUDE /usr/local/freeradius/share/dictionary.nortel However I still have the same problem, the router doesn't give me command line access. The logs in the router doesn't provide me any helpful information. I attached the freeradius -X logs at the end. Probably I have something wrong with the configuration because it seems the values of the new attributes are not correct when they are sent. Perhaps one of you have had a similar situation. I really appreciate any help, thanks. Regards, Juan Pablo Logs: radiusd -X ------------------------ rad_recv: Access-Request packet from host 10.0.2.26:21741, id=19, length=57 Service-Type = Framed-User NAS-IP-Address = 10.0.2.26 User-Name = "test1" User-Password = "test1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password radius_xlat: 'prueba!!!' Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW())' radius_xlat: '/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test1', 'test1', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 19 to 10.0.2.26:21741 Bay-User-Level = Manager Reply-Message = "prueba!!!" Service-Type = NAS-Prompt-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 19 with timestamp 4528045f

2 3

Freeradius is not restarting properly (fails to quit and becomes a zombie process)
by Jason Wittlin-Cohen 08 Oct '06

08 Oct '06

Over the last few days I've been having a recurring problem. Whenever I start Freeradius either with radiusd in a terminal or as a service in Debian, I can not restart/kill radiusd properly if it's authenticated any clients. Restarting the service says it's successful but the radius log states that port 1812 is already in use. "top" shows 100% cpu usage after I attempt to restart radiusd. In addition, kill will not work. I need to use kill -9. No errors are thrown when I try to kill it in debug mode either. It just says exiting and sits there but doesn't die. The only change I have made to radiusd.conf was to set the user and group to nobody and nogroup respectively. I've copied the contents of my eap.conf configuration file below. # -*- text -*- # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4.4.3 2006/04/28 18:25:03 aland Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = tls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { private_key_password = private_key_file = /etc/ssl/newCA/certs/server_key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = /etc/ssl/newCA/certs/server_cert.pem # Trusted Root CA list CA_file = /etc/ssl/newCA/cacert.pem dh_file = /etc/ssl/newCA/certs/dh dh_key_length = 3072 random_file = /etc/ssl/newCA/certs/random CA_path = /etc/ssl/newCA/crl/ # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd check_crl = yes # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. # check_cert_issuer = "/C=US/ST=NJ/L=East Brunswick/CN=Jason Wittlin-Cohen's ROOT CA" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "HIGH" } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # #ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. # default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = no #} # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. # default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. # copy_request_to_tunnel = no # use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes #} # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } }

3 5

checking attributes in MySQL 'radgroupcheck'?
by Jan Mulders 08 Oct '06

08 Oct '06

Hello, I'm trying to assign users a different speed of service based on how much data they've used on the service. I found the following in the experimental.conf information on sqlcounter: # # DEFAULT Max-Daily-Session > 3600, Auth-Type = Reject # Reply-Message = "You've used up more than one hour today" # How do I do a similar thing in MySQL? There aren't enough fields to do this. Am I overlooking something, or is this not actually possible? Regards, Jan

1 0

Prevent certain ip ranges from accounting
by Van Der Westhuizen, Eldridge (Mr) (Summerstrand Campus North) 07 Oct '06

07 Oct '06

Hi I'm busy setting up a community network. I'm using freeradius and mysql to authenticate users and do accounting. After the users authenticated to the freeradius system, i only want to do accounting for any internet services. All the free community services, like local chatting within the community network, local voice over ip, etc, should not be billed. All of this traffic will flow between the local network on a class B range. Is it possible to exclude this range from accounting on the radius system and only do accounting for any other ip address (to only bill actual internet traffic) ? Thanks NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: <http://www.nmmu.ac.za/disclaimer/email.htm>> NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: http://www.nmmu.ac.za/disclaimer/email.htm

3 2

Called-Station-ID and Cisco AP's
by Walter Reynolds 07 Oct '06

07 Oct '06

I am just starting looking into this, but it seems that the Called-Station-ID being logged from my Cisco AP's is off: What I see in the log is the following: Called-Station-Id = "0017.0f8c.25c1" However, the cisco itself shows something slightly different: Mac Address 0017.0f8c.25c0 As you can see, the last digit is off. This is not the only one. Another example.... Called-Station-Id = "0013.6078.7661" MAC Address 00:13:60:78:76:60 The only other system I have on the system (Bluesocket) does not have this discrepancy. I have searched through the archives, but trying to limit search by Called-Station-Id and cisco does not help a lot. Have others seen/noticed this before? If so any pointers to information on it? If not, can anyone else look and see if they are having a similar issue? Here is the information on AP Cisco Aironet 1200 IOS Firmware: 12.3(8)JA2 Using FreeRadius 1.1.2 The only conf file that even mentioned called station ID (that I am using) is radiusd.conf. Here is the subsection #attr_rewrite sanecallerid { # attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" # searchin = packet # searchfor = "[+ ]" # replacewith = "" # ignore_case = no # new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended # to the original string # append = no #} As it is commented out I do not see that it could be the issue. If you want any conf files let me know, I just did not want to clog up the message with lots of conf info that is not useful. Thanks to all. -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

5 9

Can Simultaneous-Use be used with EAP-TLS?
by Jason Wittlin-Cohen 07 Oct '06

07 Oct '06

I am using EAP-TLS for authentication so I have no use for a backend db to check username/password credentials. However, I would still like to prevent simultaneous logins with the same certificate. Is this possible without having an sql database? I have "Simultaneous-Users := 1" set in the "users" configuration file but it doesn't seem to do anything. Clients are being checked against this line in "users" DEFAULT Simultaneous-Use :=1

1 0