- Freeradius-Users - lists.freeradius.org

Error: TLS_accept:error in SSLv3 read client certificate A
by Özgür Kaya 08 Aug '06

08 Aug '06

Hi everyone I have freradius server on debian linux. The server gave such error two days ago Tue Aug 8 09:29:19 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Tue Aug 8 09:29:20 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Tue Aug 8 09:29:40 2006 : Info: rlm_eap_tls: Length Included Tue Aug 8 09:29:40 2006 : Error: TLS_accept:error in SSLv3 read client certificate A What is the problem Please help me

2 1

Re: Missing Attributes
by Graham Beneke 08 Aug '06

08 Aug '06

Alan DeKok wrote: > Graham Beneke <graham(a)apolix.co.za> wrote: > >>> Add it... where? >>> >>> >> The chillispot daemon is not locking the user out once their transfer >> limit has been reached... >> > > Huh? You said you added the dictionary, and I asked where. > > Your answer makes no sense, other than as a statement unrelated to > my question. > sorry - missunderstood the question... was refering to 'it' from the origonal text... I added the dictionary file in the /etc/freeradius/ directory and then added a $include into 'dictionary' Also tried 'cut-n-pasting' the contents of the additional dictionary to 'dictionary' and that also made no differnence. >>> Did you tell the server to send the attributes in the reply? >>> >>> >> Ok so how do i go about doing that? >> > > See the "users" file. > Correct me if I am wrong - but 'users' is not parsed when i'm using a MySQL backend? Pretty sure I disabled it in my setup.

2 2

Access to wiki?
by John Horne 08 Aug '06

08 Aug '06

Hello, Is there a problem with the freeradius wiki (http://wiki.freeradius.org)? I am trying to sort out a problem and came across a reference to the wiki page. However my browser just sits there when trying to access the page. I can resolve the DNS name and ping it; just not access it. Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

3 2

EAP-TTLS + LDAP + PAP with encrypted password
by wekz 07 Aug '06

07 Aug '06

Hi all, I've been trying to get over this configuration but without any success. I'm using freeradius-1.1.1. First I had this working with eap-tls and peap for authentication and ldap for authorization, it was working quite well. As I have to integrate this configuration with an ldap that has encrypted passwords I decide to change authtype to pap over eap-ttls after watching Protocol and Password Compatibility in Alan's site. The authorization part of ldap does the following: A user will be authorized to use remote access if he is in the ldap and depending on the access policy defined if he belongs to a white or blacklist. After being authorized within the authorize section the user find these lines: users_branch eap user-branch is the users file I use that has entries by the form (and nothing else ): DEFAULT ldap11-Ldap-Group == Local Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-Id=Local, Fall-Through = No This, as I said, was working right. Now the only things I've added to radiusd.conf is modules { ( I've commented any other type like chap, mschap, peap, leap... only the onse listed here are set ) ldap-modules-stuff pap { encryption_scheme = sha1 } eap { default_eap_type = ttls ... gtc { auth_type = PAP # I've test without configuring gtc too and setting default_eap_type in ttls to md5 and commenting it out } tls { my old configuration that works } ttls { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } } } authorize { ... ldap stuff user_branch eap } authenticate { Auth-Type PAP { pap } eap } Then in the logs I can see that ( I don't put them because they are nearly endless ): The user is authorized and the password is got from the ldap (rlm_ldap: Adding userPassword as User-Password, value {sha}rur+4yJuecpmc8vxS/8wAyAMNHM= & op=21) ......... rad_check_password: Found Auth-Type EAP auth: type "EAP" ........... The eap-ttls tunnel is ok .......... And after matching the group Local in my users-file: auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Access-reject When I try this with clear-text passwords it works quite well but I don't know if it is working the way I want or not (with pap), because neither with encrypted nor with clear-text I can't see in the logs a reference to rlm_pap or gtc... I imagine I'm doing something wrong but can't figure out what it is. I've googled on the internet and in the mailing list but I don't make any progress with what I've found. So any comments are welcome Thanks

2 3

Web page for setting up the server for the first time
by Alan DeKok 07 Aug '06

07 Aug '06

http://deployingradius.com/documents/configuration/setup.html The page has two simple rules for getting the server to do what you want. It *doesn't* get into details of what modules to touch or how they work. Instead, it describes higher-level processes that help you along the way, and ensure you reach your goal. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 2

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 07 Aug '06

07 Aug '06

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" ### identity = "cn=Directory Manager" ### password = 1223 ### basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes ### } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

sql.conf
by fvt3 07 Aug '06

07 Aug '06

Question, How do you convert the SQL-User-Name sent to upper case? I have my mac address store in upper case but the client is sending its mac address in lower case. I'm trying to edit the sql.conf file but not successful. Username = '%{SQL-User-Name}' Thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 5

a question about settings for EAP-TLS authentication
by Yan Cai 07 Aug '06

07 Aug '06

Hi, All, I am a graduate student in University of Massachusetts Amherst. Now I am trying to set up a wireless environment with FreeRadius to realize secured access with EAP-TLS. I've generated the necessary CA files by openssl and done all necessary settings in FreeRadius. For more detailed operations and settings, please refer to the list below. Operations and Settings on openssl and freeradius, 1, installed openssl-0.9.7-stable-SNAP-20060731, which is downloaded from www.openssl.org. 2, completed the necessary settings in openssl, which is locaed in /usr/local/openssl/ssl. 3, installed freeradius-1.1.0, which is download from www.freeradius.org. 4, modified some settings in CA.all, which is located in /usr/src/802/radius/freeradius-1.1.0/scripts, and run it to generated the CA certificates for server, client as well as root. 5, added a NAS entry in clients.conf. 6, added a user entry in users. 7, started the radius server with the command "./radiusd -X" normally. 8, with default settings in radius.conf, star freeradius successfully, and it can accept the authentication-request from Windows XP client and return the authentication-accept message. This authentication request should belong to EAP-MD5, and the radius server could respond it correctly by default-settings. ---- the operations below are for realization of EAP-TLS ---- 9, copied the newly generated certificates files to the place so that the freeradius could find them. In my case, I moved them to /usr/local/radius/etc/raddb/certs as well as its subfolder /demoCA. 10, added a new user entry in users, which includes only the username attribute because it is said that EAP-TLS would automatically identify its password and other attributes from somewhere. 11, modified the default auth type to 'tls' in eap.conf. 12, uncommented all scripts related to EAP-TLS authentication in eap.conf, including modification of path to the certificate files in /usr/local/radius/etc/raddb/certs as well as ./demoCA. 13, tried to start the radius server with the command "./radiusd -X", but the error message below was returned always. **** log from terminal of linux where freeradius is running **** rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain Segmentation fault **** the end of log **** Now I worried that there is something wrong in the cert-srv.pem. I will appreciate all of you so much if anyone can help me take a look at these certificate files. I attached all of configuration files in the freeradius folder. Please refer to them if needed. Looking forward to your reply. Thanks a lot, Best wishes, Yan

3 3

Stripping User-Names with Regular Expressions
by Richard Cotrina 07 Aug '06

07 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi : I am trying to strip some sort of prefixes out of the usernames using regular expressions in the hints file with no success in some cases. I have two scenarios with prefixes, where usernames can be received in the following form : Case 1. KNOWN_PREFIX/user(a)mydomain.com Case 2. KNOWN_PREFIX/RANDOM_STRING/user(a)mydomain.com In any of those cases, the username must be stripped, and only user(a)mydomain.com must be processed for AAA. I am using the "hints" file with an entry with a regular expression like : DEFAULT User-Name =~ "^(KNOWN_PREFIX/(.*/)?)+(.*(a)mydomain\.com)$" User-Name := "%{3}", Hint = "Stripped User-Name" The problem I'm having is that entry only works in case username comes with a form like case 2, I mean when username comes like "KNOWN_PREFIX/RANDOM_STRING/user(a)mydomain.com", the regexp works very well. But, when usernames comes as shown in Case 1 (KNOWN_PREFIX/user(a)mydomain.com) it gets a match in the hints, but username referred as %{3} gets a void value ( shown in the debug as ' ' ). It seems as if the conditional group "(.*/)?" in the regexp is causing something wrong in the next group reference but I'm not sure. Is this kind of regexp (the conditional one) supported in freeradius ?. Any ideas of what could be wrong ? Thanks in advance for any help. Best Regards Richard Cotrina -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQA/AwUBRNeVmSQekFb/3FIhEQKYrACgvwUuyHg8wbacV3WePMMDOiRDdi8AoNyF JALaPXu58nrqskI/XLV2hp26 =Y3nH -----END PGP SIGNATURE-----

1 0

Need help on PHP and Radius
by raviprakash sunkara 07 Aug '06

07 Aug '06

Hi Guys... I need to integrate php and raadius... Actually i want to create the own user interface on OPENSER..... That on PHP 5 is having the radis integration . So i need it... Now , I'm using the Radius in openser for " AAA " purpose only... Now I need to develop web interface for my application with radius... plz help me.... on this............. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1