- Freeradius-Users - lists.freeradius.org

MSCHAP and encripted passwd
by ivandal＠tiscali.it 22 Sep '06

22 Sep '06

Hi, I have a big problem with Radius and Ldap. There is a way to use MSCHAP v2 with the password stored in LDAP in some encripted manners? (md5, crypto...) In the client authentication software I cannot use pap/ttls, so Radius receive finally from the client unencripted passwd and have to compare with the passwd encrypted on Ldap. I cannote use PAP!!!!! I have read that it is possibile make it with NT-passwd hash. It is true? And how it is possible? Thanks Ivan Naviga e telefona senza limiti con Tiscali Scopri le promozioni Tiscali adsl: navighi e telefoni senza canone Telecom http://abbonati.tiscali.it/adsl/

2 1

Re: Radius installation
by anyuru francis 22 Sep '06

22 Sep '06

Hello, Am installing freeRadius with Mysql5 and dialup admin with a freebsd 5.4 box well done most of the configs but dialup wont show the frame on the right in browser when I load it on the webserver Any help will be highly appreciated Kind Regards Francis

2 1

Users submitted password
by Michael Gale 21 Sep '06

21 Sep '06

Hello, Should I be able to read the User-Password attribute in the authorize section ? I tried printing out RAD_REQUEST{'User-Password'} but it is blank ... -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 2

rlm_ldap and 'unencrypted' connections
by Thibault Le Meur 21 Sep '06

21 Sep '06

ine doc/rlm_ldap I've read: <quote> # identity: DN under which LDAP searches are done password: pasword # which authenticate this DN default: anonymous bind, no password # required NOTE: searches are done now over unencrypted connection! </quote> I'm especially concerned about the 'searches are done now over unencrypted connection!' sentence. Does this mean that even if I use "start_tls = yes", searches will be performed unencrypted ? If yes, isn't the following procedure a way to enforce encryption on searches ? * do not use "start_tls = yes" * use "port = 636" and/or "tls_mode = yes" * have your ldap server reply only to port 636 in ldaps. Thanks in advance, Thibault

1 0

Freeradius Suse distro
by LeRoy DeVries 21 Sep '06

21 Sep '06

Does the latest version (1.1.3) have the experimental modules that you had to compile with in the old version 1.03

3 5

RE: MS Vista RC1 and Freeradius 802.1x
by David Mitton 21 Sep '06

21 Sep '06

Be aware that the EAP subsystem in Vista has been totally re-architected. There are new APIs and legacy module support. Anything could go wrong. Dave. > ----- Original Message ----- > From: "Dourty, Brian R. (IATS)" <DourtyB(a)missouri.edu> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: RE: MS Vista RC1 and Freeradius 802.1x > Date: Thu, 21 Sep 2006 10:59:48 -0500 > > > I haven't spent a lot of time debugging the problem yet, but out of the > box Vista doesn't work with our 802.1x/PEAP/MSChapV2 config we have been > using successfully on WinXP. > > Brian Dourty > >

1 0

What kind of error in client-cert using EAP?
by Alexandros Gougousoudis 21 Sep '06

21 Sep '06

Hi, I have trouble with one XP-SP2 client, using a certificate to make 802.1x Auth over EAP-TLS. The cert is a machine cert. On the serverside I get this (using -X -A) in authenticate: modcall: entering group authenticate for request 33 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ef8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 33 modcall: leaving group authenticate (returns handled) for request 33 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0125040a0dc00000100e1[...] Which indicates that there is a problem in the client-cert. Can it be more detailed? I exported the cert and the key now 4 times in different manners (as p12, as der) and the errors is still there. Extended attribute is also included. The funny thing is, that I already have 5 XP machines running in my network, doing an EAP-TLS auth over the switch. It means also that in my authorize section (Auth-Type := EAP) I can get a Access-Accept Message. On the server I get the Access-Requests, create a Access-Challenge and thats all. Theres nothing coming back from the client. Please help Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

5 11

PEAP and domain logon
by Christoffer Dahl Petersen 21 Sep '06

21 Sep '06

Hi! I have followed this excellent tutorial: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf and it works perfect!! I have checked the option "automatically use my windows logon name and password..." on my XP Clients, but only users who has been logged in before can log in again, because of their cached credentials. To me is the "chicken or the egg" dilemma, does anyone have a solution for this issue? Thanks, Christoffer

2 1

Freeradius + Cisco VoIP
by Geoffrey Cauchi 21 Sep '06

21 Sep '06

Hi I'm using free radius 1.1.3, with postgres on fedora core 5. I am trying to authenticate a user's request coming in from a Cisco VoIP gateway. The radius server accepts the request, and sends an accept to the gateway, but since it is VoIP, it is expecting h323 AV Pairs. Can anyone provide a sample config of the AV Pairs required by a cisco VoIP gateway to accept a user? Thanks Gef

3 6

freeradius stops with hostapd
by Michał Prochaczek 21 Sep '06

21 Sep '06

Hi I am trying to set freeradius +hostapd on Debian I have installed freeradius from .deb testing package and than from .tar (1.1.3) In init.d freeradius starts first and than hostapd is started. Immediately after hostapd is started freeradius disappears from process list. I have tested running freeradius manually and than starting hostapd. Result is the same. Changing starting order makes survive freeradius few minutes probably until first request is send from hostapd. The only message I got in log file is: Tue Sep 19 21:53:26 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:53:26 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:53:26 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:53:26 2006 : Info: Ready to process requests. Tue Sep 19 21:55:30 2006 : Error: WARNING: Unresponsive child (id 3073981360) for request 0 Or another version: Tue Sep 19 21:58:59 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:58:59 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:58:59 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:58:59 2006 : Info: Ready to process requests. Tue Sep 19 21:59:58 2006 : Error: Discarding duplicate request from client localhost:1029 - ID: 0 due to unfinished request 0 in freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1:1036, id=1, length=79 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 127.0.0.1 NAS-Identifier = "localhost" Called-Station-Id = "00-04-47-50-1A-1F:test" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 I would be greateful for any help. Michal

2 1