- Freeradius-Users - lists.freeradius.org

OpenSSL vulnerability may affect FreeRADIUS
by Alan DeKok 22 Sep '06

22 Sep '06

http://www.openssl.org/news/secadv_20060905.txt From my preliminary reading, this may only affect people using EAP-TLS. PEAP and EAP-TTLS do not validate certificates on the server side, so they may not be vulnerable. Still, it's probably worth upgrading OpenSSL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

automated response
by Olaf Becker 22 Sep '06

22 Sep '06

I am not in the office until 4th of Octorber 2006 and have limited access to my e-mails. Thank you for your understanding that your e-mail will be answered after my return to the office. This e-mail will not be forwarded. Kind regards Olaf Becker

1 0

Hiding Passwords in Debug Output
by Garber, Neal 22 Sep '06

22 Sep '06

I understand that it is sometimes useful to display the plain-text password in the debug output; however, I consider this a security exposure. I'd like to see a configuration option (e.g., debug_show_passwords or something similar) with a default of no, that when set to false/no would write "********" instead of a plain-text password in debug output. Currently, modules rlm_ldap, rlm_pap, and perhaps others write the plain-text password in debug output. Your thoughts? Neal

3 2

EAP-Problem
by Florian Prester 22 Sep '06

22 Sep '06

Hi, firstly, we are using Freeradius for all kind of authentications - and It works very good!! -> Good Job to all of you. But, lately we have some EAP-Problems mostly with windows-clients. If a user authenticated correctly, after some time he gets disconnected and tries to reauthenticate, but it fails - see Log. Also I have some questions about eap at all. How should it work correctly. because I see up to 10 Authentication-Requests until the client is authenticated correctly. For example the client wants to do EAP-PEAP (Windows-client), but the radius says EAP-NAK: rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 231 modcall: leaving group authenticate (returns handled) for request 231 Sending Access-Challenge ... Finished request 231 What does it mean? Can I tune the process? Thank you all for your answers! Best regards FLorian Prester Log: rad_recv: Access-Request packet from host 131.188.4.190:20000, id=35, length=202 NAS-Port-Id = "2059/1" Calling-Station-Id = "00-15-00-01-C0-D1" Called-Station-Id = "00-0B-0E-15-3D-80:FAU-STAFF" Service-Type = Framed-User User-Name = "unrz06" State = 0x... EAP-Message = 0x... NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Trapeze" NAS-IP-Address = 131.188.4.190 Message-Authenticator = 0x... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 228 modcall[authorize]: module "preprocess" returns ok for request 228 modcall[authorize]: module "chap" returns noop for request 228 modcall[authorize]: module "mschap" returns noop for request 228 rlm_eap: EAP packet type response id 14 length 53 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 228 users: Matched entry DEFAULT at line 12 modcall[authorize]: module "files" returns ok for request 228 rlm_ldap: - authorize modcall[authorize]: module "ldap" returns ok for request 228 modcall[authorize]: module "perl" returns ok for request 228 modcall: leaving group authorize (returns updated) for request 228 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 228 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 228 modcall: leaving group authenticate (returns reject) for request 228 auth: Failed to validate the user. Login incorrect: [unrz06] (from client QRA-MX port 0 cli 00-15-00-01-C0-D1) Sending Access-Reject of id 35 to 131.188.4.190 port 20000 EAP-Message = 0x040e0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 228 -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 3

Performance
by Jory Privett 22 Sep '06

22 Sep '06

I am getting ready to switch my Radius servers over to FreeRadius and I would like to get some performance help. I know that FreeRadius can authenticate users from a MySQL database, from Linux users, and other options. For a performance and ease of maintenance which is recommended and why? Jory Privett WCCS

2 1

Problem configuration eap-tls
by listas 22 Sep '06

22 Sep '06

Hello!I'm OrgacK and this is my first post. I'm try to configure my own radius server for my house but before a lot of attempts I haven't got it. I always obtain same error: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1897] Unknown module "eap". radiusd.conf[1844] Failed to parse authenticate section. I think about the CA, server certificates and client certificates are created correctly. I don't know what i can do, have somebody any idea? PD: Sorry I'm Spanish and my English isn't very good. Greeting

4 6

Default radiusd.conf and Auth-Type LDAP comment
by Thibault Le Meur 22 Sep '06

22 Sep '06

Hi, This is just a comment on the default radiusd.conf provided information. In the authenticate section of the default radiusd.conf I can read about "Auth-Type LDAP": <quote> # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. </quote> While usually true, this assumption is a little confusing sometimes. Indeed, when EAP-TTLS uses PAP (not an EAP protocol I know) as its inside authentication protocol, a cleartext password is provided to Freeradius which is then able to use a simple ldap bind exchange to authenticate the user. Could we replace with something like that <quote> # Note that this means "check plain-text password against # the ldap database", which means that most EAP types won't work # as they do not supply a plain-text password (unless you use a # composite EAP scheme with and inner cleartext-enabled protocol # such as EAP-TTLS/PAP) </quote> But this is a little tricky... Or more simply: <quote> # Note that this means "check plain-text password against # the ldap database", which means that most EAP types won't work # as they do not supply a plain-text password # (an exception beeing EAP-TTLS with inner PAP authentication) </quote> The second one could be less confusing for people trying to setup EAP-TTLS/PAP on ldap directories but of course this is not a big deal... Thibault

3 7

Re: MSCHAP and encripted passwd
by ivandal＠tiscali.it 22 Sep '06

22 Sep '06

Hi, > PAP!!!!! I have read that it is possibile make it with NT-passwd hash. > It is true? And how it is possible? you put the NT-Passwd hash into the LDAP as password field entry alan Ok, but how can I convert passwd from clear text to NT-Passwd format? Thanks Naviga e telefona senza limiti con Tiscali Scopri le promozioni Tiscali adsl: navighi e telefoni senza canone Telecom http://abbonati.tiscali.it/adsl/

2 1

SMUX with FreeRadius
by Kshitij Korde 22 Sep '06

22 Sep '06

Hi I have integrated free radius server with NET-SNMP for monitoring radius server. Now the NET-SNMP daemon is detecting radius server. If I run radius server in debug mode I get following debug messages. Module: Instantiated radutmp (radutmp) main: smux_password = "verysecret" main: snmp_write_access = no inside oid_compare inside smux_connect SMUX connect try 1 inside smux_oid_dump SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret inside smux_oid_dump SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 inside smux_oid_dump SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. I may be asking some silly question since I don't have any idea how SMUX works. What are the functionalities provided by SMUX peer with respect to SNMP MODULE? Is there any mechanism where in we can send trap signal if radius server goes down? ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

MS Vista RC1 and Freeradius 802.1x
by Dourty, Brian R. (IATS) 22 Sep '06

22 Sep '06

We are having some difficulties getting MS Vista RC1 build (5600) to work with our Freeradius server using 802.1x. Has anyone been able to get this to work? Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

4 5