- Freeradius-Users - lists.freeradius.org

Help required in gathering information regarding EAP protocols.
by muralidhar.gangaraju＠wipro.com 19 Aug '06

19 Aug '06

Hi, Could any body help me to know where can I get a detailed operation info about EAP-TLS, EAP-TTLS:MD5, EAP-TTLS:MSCHAPV2 and EAP-PEAP other than RFCs. Can I get in the internet any sequence flow diagrams with each step explained in detail for all the EAP protocols. It would be very helpful for me if any body of u could send me any docs which u already possess and u feel are very good. Thanks in advance. Cheers and Regards, G MURALIDHAR RAJU, The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 2

doubt in Radius and openser fro accounting...
by raviprakash sunkara 19 Aug '06

19 Aug '06

Hi Users, For Me, in Openser + radius Authorize and Acthentication is Succeed Very Good and Nice, But When some to Account, I'm little sucking here When Uac1 dials to Uac2 , ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ radacctID | AcctSessionID | AcctuniqueID | UserName | AcctStartTime | ActStopTime | calledID | callingID | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1 12h34yy 2334juuw45 Uac1 13:10:00 00:00:00 Uac2 uac1 2 12h34yy ko34ji899 Uac2 13:11:11 13:11:11 Uac1 Uac2 --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- In accountting with openser + radius in should insert only one insert for every call made . But I think it insert only two records only. and AcctuniqueD should me same for each call makes then only the AcctStopTime will properly ..... in openser... -------------------- loose record----------------------------------- if(method=="BYE" || method=="CANCEL") { acc_rad_request("Stop"); unforce_rtp_proxy(); } ---------------------------- record route section------------ if( method=="INVITE" || method=="ACK") { acc_rad_request("Start"); forcr_rtp_proxy(); } plz help me in that .. sorry in my english ....... -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1

Reply Access-Accept message in TTLS-MSCHAPV2
by sumi thra 19 Aug '06

19 Aug '06

Hi All, I am using freeradius-1.1.1, The access-accept packet does not send any VSA or session timeout when the authentication is TTLS-MSCHPAV2. Please let me know if there is any patch for this or the configuration issue. But the same configuration with other methods are sending the reply message properly. Awaiting for your reply. Thanks.

1 0

Apple announces FreeRADIUS in Mac OSX Leopard
by Alan DeKok 18 Aug '06

18 Aug '06

http://www.apple.com/server/macosx/leopard/more.html What they don't say on that page is that FreeRADIUS is the server of choice. This means that in 2007, there will probably be 10's of 1000's of additional installations of FreeRADIUS. Once Leopard comes out, I think I'll update the main web page to say that FreeRADIUS is the #1 RADIUS server on the planet. I'm not sure of any other server with an install base of 100k individual sites... Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 11

More documentation on Auth-Type
by Alan DeKok 18 Aug '06

18 Aug '06

http://deployingradius.com/documents/configuration/auth_type.html Many web sites contain all sorts of recommendations about Auth-Type. This one is correct. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 17

Regarding using strcmp instead of memcmp
by Ravi S M 18 Aug '06

18 Aug '06

Hi this is where the error is occurring in UMR & ABR in the following files, While running with purify. Command-line: radiusd -X UMR: Uninitialized memory read (3 times) This is occurring while in: memcmp [rtlib.o] cf_expand_variables [conffile.c:369] p += strlen(p); ptr = end + 1; => } else if (memcmp(ptr, "$ENV{", 5) == 0) { char *env; ptr += 5; cf_section_read [conffile.c:785] /* * Handle variable substitution via ${foo} */ => value = cf_expand_variables(cf, lineno, cs, buf, buf3); if (!value) { cf_section_free(&cs); return NULL; conf_read [conffile.c:834] return NULL; } => if(parent) { cs = cf_section_read(conffile, &lineno, fp, NULL, NULL, parent); } else { cs = cf_section_read(conffile, &lineno, fp, NULL, NULL, NULL); read_radius_conf_file [mainconfig.c:1145] radlog(L_ERR|L_CONS, "radius_dir : %s",radius_dir); if ((cs = conf_read(NULL, 0, buffer, NULL)) == NULL) { => return NULL; } /* read_mainconfig [mainconfig.c:1190] /* First read radiusd.conf */ DEBUG2("reread_config: reading radiusd.conf"); if ((cs = read_radius_conf_file()) == NULL) { => if (debug_flag || (radlog_dir == NULL)) { radlog(L_ERR|L_CONS, "Errors reading radiusd.conf"); } else { Reading 5 bytes from 0xffbe51d0 on the stack (1 byte at 0xffbe51d4 uninit). Address 0xffbe51d0 is 68 bytes past start of local variable "cs" in function cf_section_read. And the ABR error as below ABR: Array bounds read This is occurring while in: memcmp [rtlib.o] rad_respond [radiusd.c:1744] pairfind(request->packet->vps, PW_PASSWORD)); reprocess = 1; } => if (strcmp(mainconfig.do_nospace_user, "after") == 0) { rad_rmspace_pair(request, request->username); reprocess = 1; } main [radiusd.c:1502] } } else #endif => rad_respond(request, fun); } /* loop over listening sockets*/ #ifdef WITH_SNMP _start [crt1.o] Reading 6 bytes from 0xc5c20 in the heap (3 bytes at 0xc5c23 illegal). Address 0xc5c20 is at the beginning of a malloc'd block of 3 bytes. This block was allocated from: malloc [rtlib.o] strdup [libc.so.1] cf_section_parse [conffile.c:527] cs->name1, variables[i].name, value ? value : "(null)"); => *q = value ? strdup(value) : NULL; break; case PW_TYPE_IPADDR: read_radius_conf_file [mainconfig.c:1153] * radiusd.conf, the other configuration files exist. */ cf_section_parse(cs, NULL, server_config); Thanks & Regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

Regarding memory leaks
by Ravi S M 18 Aug '06

18 Aug '06

Hi I am using free radius code in that I have changed the log file for using my own log file. So if I run ./radiusd -X it works fine i.e. -> without any memory leaks And also if I run ./radiusd -> it is not generating memory leaks. But if I run ./radiusd -l "path/log" -> it is giving memory leaks So after all these if I run again ./radiusd -> it is giving memory leaks All the above I have compiled with purifier . So what might be the problem, please give some useful comments on this. Thanks & Regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

user specific settings in users file overwritten by DEFAULT settings?
by Drew Weaver 18 Aug '06

18 Aug '06

I have a user specified in my users file like this: isdn Auth-Type = System Service-Type = Framed, Framed-Protocol = MPP, Framed-Routing = None, Ascend-Maximum-Time = 18000, Ascend-Idle-Limit = 900, Ascend-Assign-IP-Pool = 0, Ascend-Maximum-Channels = 2, Fall-Through = "1" Then at the bottom of the file I have: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Ascend-Maximum-Time = 18000, Idle-Timeout = 900 When I authenticate as this user, I see: Thu Aug 17 13:18:26 2006 : Debug: users: Matched isdn at 21 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 133 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 135 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 140 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authorize]: module "files" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authorize returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: rad_check_password: Found Auth-Type System Thu Aug 17 13:18:26 2006 : Debug: auth: type "System" Thu Aug 17 13:18:26 2006 : Debug: Processing the authenticate section of radiusd.conf Thu Aug 17 13:18:26 2006 : Debug: modcall: entering group authenticate for request 5 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: HASH: user isdn found in hashtable bucket 59493 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authenticate]: module "unix" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authenticate returns ok for request 5 Thu Aug 17 13:18:26 2006 : Auth: Login OK: [isdn/8293] (from client 192.168.0.3 port 1060 cli 6143677963) Sending Access-Accept of id 2 to 192.168.0.3:7010 Service-Type = Framed-User Framed-Routing = None Ascend-Maximum-Time = 18000 Ascend-Idle-Limit = 900 Ascend-Assign-IP-Pool = 0 Ascend-Maximum-Channels = 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Idle-Timeout = 900 Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry? Thanks, Andrew

3 5

no debugging output after reread of configs in 1.1.2
by Norbert Wegener 18 Aug '06

18 Aug '06

I am using freeradius 1.1.2. Having it run with radiusd -AX shows the expected output. A kill -1 `pidof radiusd` lets it reread its configuration ... proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 here the kill: read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms and that's it. Authentication still works, but no debugging output is displayed. Norbert Wegener

2 1

OR-type authentication
by Héctor Alberto Ortiz Barrón 18 Aug '06

18 Aug '06

My radiusd.conf file ... modules { mschap certificate_userpass { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } mschap winlogon { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{winlogon:NT-Domain} --username=%{winlogon:User-Name} --challenge=%{winlogon:Challenge:-00} --nt-response=%{winlogon:NT-Response:-00}" } $INCLUDE ${confdir}/eap.conf $INCLUDE ${confdir}/sql.conf ... instantiate { exec certificate_userpass winlogon } ... authorize { redundant { sql winlogon certificate_userpass } eap } ... authenticate { Auth-Type MS-CHAP { redundant { certificate_userpass winlogon } } eap } ... Using this configuration, I am able to connect to the network using a certificate on the client computer or providing a user name and password which are checked against the mysql database, but I can't authenticate against the AD. If I comment out the part regarding sql from the authorize section and do like this in the authenticate section (inverse order): authenticate { Auth-Type MS-CHAP { redundant { winlogon certificate } } eap } I can now authenticate against the AD and using certificates, but not using the database. Question: What changes do I require in order to be able to grant access taking into account the three methods? Thanks for your assistance Cheers Héctor

2 1