- Freeradius-Users - lists.freeradius.org

Freeradius Suse distro
by LeRoy DeVries 21 Sep '06

21 Sep '06

Does the latest version (1.1.3) have the experimental modules that you had to compile with in the old version 1.03

3 5

RE: MS Vista RC1 and Freeradius 802.1x
by David Mitton 21 Sep '06

21 Sep '06

Be aware that the EAP subsystem in Vista has been totally re-architected. There are new APIs and legacy module support. Anything could go wrong. Dave. > ----- Original Message ----- > From: "Dourty, Brian R. (IATS)" <DourtyB(a)missouri.edu> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: RE: MS Vista RC1 and Freeradius 802.1x > Date: Thu, 21 Sep 2006 10:59:48 -0500 > > > I haven't spent a lot of time debugging the problem yet, but out of the > box Vista doesn't work with our 802.1x/PEAP/MSChapV2 config we have been > using successfully on WinXP. > > Brian Dourty > >

1 0

What kind of error in client-cert using EAP?
by Alexandros Gougousoudis 21 Sep '06

21 Sep '06

Hi, I have trouble with one XP-SP2 client, using a certificate to make 802.1x Auth over EAP-TLS. The cert is a machine cert. On the serverside I get this (using -X -A) in authenticate: modcall: entering group authenticate for request 33 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ef8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 33 modcall: leaving group authenticate (returns handled) for request 33 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0125040a0dc00000100e1[...] Which indicates that there is a problem in the client-cert. Can it be more detailed? I exported the cert and the key now 4 times in different manners (as p12, as der) and the errors is still there. Extended attribute is also included. The funny thing is, that I already have 5 XP machines running in my network, doing an EAP-TLS auth over the switch. It means also that in my authorize section (Auth-Type := EAP) I can get a Access-Accept Message. On the server I get the Access-Requests, create a Access-Challenge and thats all. Theres nothing coming back from the client. Please help Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

5 11

PEAP and domain logon
by Christoffer Dahl Petersen 21 Sep '06

21 Sep '06

Hi! I have followed this excellent tutorial: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf and it works perfect!! I have checked the option "automatically use my windows logon name and password..." on my XP Clients, but only users who has been logged in before can log in again, because of their cached credentials. To me is the "chicken or the egg" dilemma, does anyone have a solution for this issue? Thanks, Christoffer

2 1

Freeradius + Cisco VoIP
by Geoffrey Cauchi 21 Sep '06

21 Sep '06

Hi I'm using free radius 1.1.3, with postgres on fedora core 5. I am trying to authenticate a user's request coming in from a Cisco VoIP gateway. The radius server accepts the request, and sends an accept to the gateway, but since it is VoIP, it is expecting h323 AV Pairs. Can anyone provide a sample config of the AV Pairs required by a cisco VoIP gateway to accept a user? Thanks Gef

3 6

freeradius stops with hostapd
by Michał Prochaczek 21 Sep '06

21 Sep '06

Hi I am trying to set freeradius +hostapd on Debian I have installed freeradius from .deb testing package and than from .tar (1.1.3) In init.d freeradius starts first and than hostapd is started. Immediately after hostapd is started freeradius disappears from process list. I have tested running freeradius manually and than starting hostapd. Result is the same. Changing starting order makes survive freeradius few minutes probably until first request is send from hostapd. The only message I got in log file is: Tue Sep 19 21:53:26 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:53:26 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:53:26 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:53:26 2006 : Info: Ready to process requests. Tue Sep 19 21:55:30 2006 : Error: WARNING: Unresponsive child (id 3073981360) for request 0 Or another version: Tue Sep 19 21:58:59 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:58:59 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:58:59 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:58:59 2006 : Info: Ready to process requests. Tue Sep 19 21:59:58 2006 : Error: Discarding duplicate request from client localhost:1029 - ID: 0 due to unfinished request 0 in freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1:1036, id=1, length=79 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 127.0.0.1 NAS-Identifier = "localhost" Called-Station-Id = "00-04-47-50-1A-1F:test" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 I would be greateful for any help. Michal

2 1

How to get FreeRadius 2.0.0 pre version???
by 나종현 21 Sep '06

21 Sep '06

2 1

Radius dies, on certificate verification
by Robert Myers 21 Sep '06

21 Sep '06

I'm wondering if anyone else has seen this. My setup is as follows, Seimens controller doing .1x auth, EAP-TLS Both requests are from different users, and what I have now, is set max_requests_per_server to 300 Doesn't seem to have helped, as radwatch is reporting that another radiusd died.... Could this simply be an error with the specific certificates? I haven't looked at it long enough to determine if the same two or three requests are killing radiusd... I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1 modcall[authorize]: module "sql" returns notfound for request 14091 modcall: leaving group authorize (returns updated) for request 14091 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14091 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler *** glibc detected *** free(): invalid pointer: 0x0b415350 *** Aborted I had thought that perhaps this was an error with openssl , so I recompiled, with 0.9.8 openssl on gentoo, radiusd 1.1.1-r1 and now I get this. modcall[authorize]: module "sql" returns notfound for request 13856 modcall: leaving group authorize (returns updated) for request 13856 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13856 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0297], Certificate Segmentation fault

3 5

DOCUMENTATION
by Abel Monzon 21 Sep '06

21 Sep '06

Hello, some time is so hard to understand the mean of everything, but I can't find the mean and why is so important, example: The doc toll about how config NAS, Proxy, etc, but I can't understand what is that and why I must config that...Please... exist any reference? Thanks any way...

2 1

Re: sqlippool not working
by Guilherme Franco 21 Sep '06

21 Sep '06

Thanks, that's ok now. I removed the block as you said and now it shows the queries. I had added those block earlier because I've seen this configuration from another post as a working sqlippool configuration... Now, if netmask does not exist, nor range-start - range-stop, how can I specify that in radippool? Please remember that I'm using Oracle and it does not have "inet" like postgres, so I've created the tables like this: CREATE TABLE radippool ( id INT PRIMARY KEY, pool_name VARCHAR(30) NOT NULL, framedipaddress VARCHAR(30) NOT NULL, nasipaddress VARCHAR(30) NOT NULL, nas_port INT NOT NULL, calling_station_id VARCHAR(30) NOT NULL, expiry_time timestamp(0) NOT NULL, username VARCHAR(100) ); CREATE INDEX radippool_poolname_ipaadr ON radippool (pool_name, framedipaddress); CREATE INDEX radippool_poolname_expire ON radippool (pool_name, expiry_time); CREATE INDEX radippool_nasipaddr_port ON radippool (nas_ip_address, nas_port); CREATE INDEX radippool_nasipaddr_calling ON radippool (nas_ip_address, calling_station_id); CREATE SEQUENCE radippool_seq START WITH 1 INCREMENT BY 1; CREATE OR REPLACE TRIGGER radippool_serialnumber BEFORE INSERT OR UPDATE OF id ON radippool FOR EACH ROW BEGIN if ( :new.id = 0 or :new.id is null ) then SELECT radippool_seq.nextval into :new.id from dual; end if; END; / How can I use this, please? Sorry for bothering about everything, but everytime I have a question, I first search through the entire freeradius maillist, man pages, docs as well as thoroughly in google. The problem is that usually I don't find much information about those things, so I come back here to ask. Thanks a lot! On 9/20/06, Tuyan Ozipek <tuyan(a)suntel.com.tr> wrote: > On Wed, 2006-09-20 at 14:14 -0300, Guilherme Franco wrote: > > Hello, > > > > Unfortunately, even with freeradius-snapshot-20060920.tar.gz and > > using the ./configure --with-modules="rlm_sqlippool" option, the > > module did not install. > > > > I needed again, to compile it manuallyThe following is in my radiusd.conf: > > > > $INCLUDE ${confdir}/sqlippool.conf > > get rid of this block, since there is no need for > range,netmask,cache-size,override,timeout... > in sqlipoool.. > --------------------------------------------------- > sqlippool foo { > > range-start = 192.168.1.1 > range-stop = 192.168.3.254 > > netmask = 255.255.255.0 > cache-size = 800 > override = no > maximum-timeout = 0 > } > ---------------------------------------------------- > > you are missing the first pools trace in the messages and > all youre seeing is the misconfiguration on the second sqlippool > instance.. > just keep the $INCLUDE directive, and remove the rest.. > there is already an ippool configured in the sqlippool.conf file.. > > > Cheers > > Tuyan > > > > freeradius-snapshot-20060920/src/modules/rlm_sqlippool/ > > > > And then, the same problem persists: > > > > Module: Loaded SQL IP Pool > > sqlippool: sql-instance-name = "sql" > > sqlippool: lease-duration = 86400 > > sqlippool: pool-name = "" > > sqlippool: allocate-begin = "BEGIN" > > sqlippool: allocate-clear = "" > > sqlippool: allocate-find = "" > > sqlippool: allocate-update = "" > > sqlippool: allocate-commit = "COMMIT" > > sqlippool: allocate-rollback = "ROLLBACK" > > sqlippool: start-begin = "BEGIN" > > sqlippool: start-update = "" > > sqlippool: start-commit = "COMMIT" > > sqlippool: start-rollback = "ROLLBACK" > > sqlippool: alive-begin = "BEGIN" > > sqlippool: alive-update = "" > > sqlippool: alive-commit = "COMMIT" > > sqlippool: alive-rollback = "ROLLBACK" > > sqlippool: stop-begin = "BEGIN" > > sqlippool: stop-clear = "" > > sqlippool: stop-commit = "COMMIT" > > sqlippool: stop-rollback = "ROLLBACK" > > sqlippool: on-begin = "BEGIN" > > sqlippool: on-clear = "" > > sqlippool: on-commit = "COMMIT" > > sqlippool: on-rollback = "ROLLBACK" > > sqlippool: off-begin = "BEGIN" > > sqlippool: off-clear = "" > > sqlippool: off-commit = "COMMIT" > > sqlippool: off-rollback = "ROLLBACK" > > rlm_sqlippool: the 'allocate-clear' statement must be set. > > > > The following is in my radiusd.conf: > > > > $INCLUDE ${confdir}/sqlippool.conf > > > > sqlippool foo { > > > > range-start = 192.168.1.1 > > range-stop = 192.168.3.254 > > > > netmask = 255.255.255.0 > > cache-size = 800 > > override = no > > maximum-timeout = 0 > > } > > > > ------------------------ > > > > I didn't modified my sqlippool.conf, so it's the same as > > sqlipool.conf,v 1.3 2006/09/13 12:49:37 pnixon Exp $ > > > > What can it be? > > > > Also, what values should I populate in radippool table? > > > > PS. Some things left: > > IN configure.in (rlm_sql_oracle) > > checking for oci.h... configure: WARNING: PETER XXXXXXXXXXXXXXXX1. > > > > IN oracle-dialup.conf > > # Optional Query - pnixon > > #accounting_stop_query =3D > > > > Another issue: with oracle instant_client_10_2, rlm_sql_oracle would > > not find it's libs, even when the required paths are configured. The > > only way that I managed to install it was copying the whole oracle > > folder to the freeradius server. I know that simply a matter of > > changing the 10.1.0.3 version and something to the new one in > > configure.in of rlm_sql_oracle, but I was in a rush: > > > > # Look for Oracle10g "Instant Client" installed from RPM > > if test "x$ORACLE_INCLUDE" = "x"; then > > old_CFLAGS="$CFLAGS" > > > > AC_MSG_WARN([PETER XXXXXXXXXXXXXXXX1.]) > > FR_LOCATE_DIR(oracle_include_dir,oci.h) > > for try in /usr/include/oracle/10.1.0.3/ > > > > THANK YOU! > > > > > > On 9/20/06, Peter Nixon <listuser(a)peternixon.net> wrote: > > > On Wed 20 Sep 2006 05:49, Guilherme Franco wrote: > > > > I need to thank you again and congratulate you guys for such a great > > > > support. > > > > > > You're welcome. Thanks for helping us make FreeRADIUS better :-) > > > > > > > Question: Even with freeradius-snapshot-20060920.tar.gz I will need to > > > > use ./configure --with-modules="rlm_sqlippool"? > > > > > > Yes. This is because the module is sill considered experimental and is > > > therefore not enabled by default. > > > > > > > If all works well, I assume that in radcheck table, the users need to > > > > have "Pool-Name := test_pool" right? > > > > > > Yes. You need to tell FreeRADIUS which pool (if any) to use for that user. > > > With sqlippool there is effectively no limit on the number of pools you may > > > have configured (Only limit is disk space on your SQL server and IP space on > > > your network) > > > > > > Cheers > > > > > > -- > > > > > > Peter Nixon > > > http://www.peternixon.net/ > > > PGP Key: http://www.peternixon.net/public.asc > > > > > > > > > - > > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > > > -- > Tuyan Ozipek <tuyan(a)suntel.com.tr> > >

2 3