- Freeradius-Users - lists.freeradius.org

error unknown host, but it is configured in clients.conf
by Greg Hartung 12 Jul '06

12 Jul '06

Hi, new guy here... I can't get a Juniper NAS to authenticate to FreeRadius. The first thing I tried was a radtest of the local host (against /etc/passwd), which worked: root@host:/home $ radtest username password 127.0.0.1:1812 1812 testing123 Sending Access-Request of id 122 to 127.0.0.1 port 1812 User-Name = "username" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=122, length=20 And then I tried munging the password to make sure it got rejected, which it did. root@host:/home $ radtest username wrong-password 127.0.0.1:1812 1812 testing123 Sending Access-Request of id 126 to 127.0.0.1 port 1812 User-Name = "username" User-Password = "wrong-password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=126, length=20 So then I tried it from the NAS and I get [root@aaa1 radius]# more radius.log Mon Jul 10 16:22:15 2006 : Info: Using deprecated naslist file. Support for thi s will go away soon. Mon Jul 10 16:22:15 2006 : Info: rlm_exec: Wait=yes but no output defined. Did y ou mean output=none? Mon Jul 10 16:22:15 2006 : Info: Ready to process requests. Tue Jul 11 09:25:29 2006 : Info: Reloading configuration files. Tue Jul 11 09:25:29 2006 : Info: Using deprecated naslist file. Support for thi s will go away soon. Tue Jul 11 09:25:29 2006 : Info: rlm_exec: Wait=yes but no output defined. Did y ou mean output=none? Tue Jul 11 09:25:29 2006 : Info: Ready to process requests. Wed Jul 12 15:29:05 2006 : Error: Ignoring request from unknown client 10.1.10.1 :12000 And [root@aaa1 raddb]# /usr/local/sbin/radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.1.10.1:12004, id=183, length=69 Ignoring request from unknown client 10.1.10.1:12004 rad_recv: Access-Request packet from host 10.1.10.1:12004, id=184, length=69 Ignoring request from unknown client 10.1.10.1:12004 Clients.conf has the following appended to the included file: client 10.1.10.1 { secret = password shortname = aaa } And I've tried both stop/start and kill 1 'cat the pid file' So... what am I doing wrong? Thanks! Greg

2 1

EAP-TTLS/PAP -> LDAP for WPA2
by John Allman 12 Jul '06

12 Jul '06

Hi All, Quite new to radius and struggling to get my head around things so forgive me if my assumptions are wrong. I appear to have the setup working but i'm concerned it's not doing what it think it is. I don't think the authentication requests are actually going over an encrypted channel. I'm using freeradius-1.1.2 on a freebsd server and i've compiled it against openldap-2.3.24 which all went well. I'm attempting to set up secure wireless with WPA2 using our ldap directory for authentication. We have a replica of our directory running on the freeradius server. Originally i had hoped to use some sort of web-redirect-to-an-authentication-page system like you sometimes see in hotels but i can't find anything about that (any information welcome). After reading around, the best form of authentication i can see would be eap-ttls with pap as the inner protocol. I believe (from comments in the radiusd.conf file) that i wouldn't be able to use md5 with ldap. Now, i've set it up in a way that appears to be mostly right and i *can* authenticate with my username/password in ldap but doing a tcpdump on the radius server worries me. I can see my username passed in the clear in the packets so i'm concerned it's not using tls at all. I told the wireless client to use ttls so i can't understand what's going on. The following is a summary of the main changes i made from the radiusd.conf and eap.conf files. If i dont mention an attribute it's because i didn't change it from the default setting: radiusd.conf: modules { ldap { server = "localhost" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap } } authorize { eap ldap } authenticate { Auth-Type PAP { pap } eap Auth-Type LDAP { ldap } } eap.conf: eap { default_eap_type = ttls tls { private_key_file = ${raddbdir}/certs/radius_key.pem certificate_file = ${raddbdir}/certs/radius_cert.pem CA_file = ${raddbdir}/certs/cacert.pem random_file = ${raddbdir}/certs/random } ttls { default_eap_type = md5 } } Now i know that default_eap_type setting looks wrong but i don't know what i *should* have there. On the server in /var/log/radiusd.log i see the following: Wed Jul 5 16:10:32 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jul 5 16:10:32 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Jul 5 16:10:32 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) I based my certificate generation on the instructions at: http://homepage.mac.com/andreaswolf/public/wpaeap.html including using the xpextensions mentioned there. I generated my random file using dd and /dev/urandom. I am a little lost and don't know what is best practice. Any advice would be appreciated. I've tried googling but haven't found a good guide that matches our setup.I can, of course, give more information if needed. Thanks, John Allman

4 12

freeradius with mac address authentication
by Carlos Rosero 12 Jul '06

12 Jul '06

Hi, I am new in this, I am looking for a tutorial that let me know how to configure freeradius with mac address authentication. Thanks, Carlos Rosero S. www.uaa.edu 787-834-9595 x2203 <mailto:crosero@uaa.edu> crosero(a)uaa.edu -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 3

Freeradius-1.1.1 with CRL configuration
by sumi thra 12 Jul '06

12 Jul '06

Hi All, I want to configure the CRL in freeradius-1.1.1 version. Followed the procedures given in the config file, but the result is not as expected. The configuration in eap.conf are, 1) Copy CA certificates and CRLs to same directory. I appended the crl into CA file 2) Execute 'c_rehash <CA certs&CRLs Directory>'. Is it necessary? But i did this too 3) Add 'CA_path=<CA certs&CRLs directory>' 4) enable the crl check check_crl = yes 5) Restart radiusd CRL says that the client certificate is revoked. But, the user is still able to get authenticated by the radius server. Please let me know if i am missing any configuration. Thanks for your kind help in advance.

2 1

FreeRadius/jRadius with Ericsson GGSN
by Adrian Heath 12 Jul '06

12 Jul '06

Trying to use FreeRadius (with jradius) to authenticate GPRS connections over a private APN with Vodafone UK based on a common userid/password but validating the MSISDN number (caller-id/mobile phone number) against a PostgreSQL. Installed an evaluation version of SteelBelt Radius (Vodafone's recommended solution) and their test connection worked. Configured FreeRadius to return same attributes and Vodafone's test connection failed although FreeRadius sent back an accepted authentication. The default SBR configuration file replaces something in the Class attribute included in the response with the User-Name attribute value. How do I configure FreedRadius to do the same? SBR returns Class attribute that starts 'SBR2 CL' and then binary characters. The User-Name attribute is included somewhere in the rest of the string as changing the length of the User-Name in the request varies the length of the Class response by the same number of characters. The NAS is an Ericsson GGSN. Any suggestions welcome Adrian Heath TrackTrans

2 1

eap: Module instantiation failed
by Alexey Plutakhin 12 Jul '06

12 Jul '06

Hello! I'm trying to use 802.1x according http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html#confradius . But when I start radiusd -X, it write out next message: ..... tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 68047:error:0200100E:system library:fopen:Bad address:bss_file.c:349:fopen('','r') 68047:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: 68047:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:720: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. All conf files are same with HOWTO. I tryed to reinstall radius and openssl, but it didn't help. Anybody knows, how to resolve problem?

2 1

Re: Error: WARNING: Unresponsive child
by Farhan Karim 12 Jul '06

12 Jul '06

still waiting for the answer... On 7/11/06, Farhan Karim <farhan.karim(a)gmail.com> wrote: > > > Thanks for the response. > > INFRANET, is a portal based customer management and billing system for IP > and telecommunications service providers. it provides many functionality. > > well coming back to problem, i have a little question with me, that is > there a way in free radius server to acknowledge the request with OK to the > infranet radius server as soon as it receives packet from it, so that the > infranet radius server that is forwarding packets to the freeradius server > does not get stuck (queue overloaded) due to some problem arising in > freeradius server. (again informing that the free radius server is acting as > proxy server in b/w infranet radius server and jradius server). > > infranet radius server ----> (forwarding packets) < ---- > freeradius > server -----> JRadius Server. > > > thanks, > > > > > On 7/10/06, Alan DeKok <aland(a)nitros9.org> wrote: > > > > Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > > > I believe it's the new and very very stupid name for a Juniper > > > (Funk-based?) > > > > Yes. Juniper bought Funk. > > > > > product that checks your AV definitions are up to date > > > before letting you through the firewall using either 802.1x or > > > eap-over-udp maybe? > > > > Like NAC. Which is a little odd from a security perspective. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > >

2 1

an infamous LDAP-FreeRadius question
by Matt Ashfield 12 Jul '06

12 Jul '06

Hi All, I know this has been discussed at length on this list, but it's kinda confusing reading through the archive and making sense of all the threaded discussions. What I didn't see (and I apologize if it's there) is if anyone has a HowTo or something similar on how to configure Freeradius for authentication against LDAP (not active directory) which has usernames and password stored on it in cleartext. Presumably I'd be using PEAP for this. If anyone has this or can give a hand offline from this mailing list, that would be much appreciated. Thanks Matt mda(a)unb.ca

7 12

attr_rewrite question
by Norbert Wegener 12 Jul '06

12 Jul '06

I am using FreeRADIUS Version 1.1.0 on a Suse10.1 system and want to rewrite the User-name in that way, that all ":" in that name are dropped, before fr looks into the users file. In analogy to sanecallerid in radiusd.conf I setup attr_rewrite saneusername { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "[:]" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be appended to the original string append = no } Running radtest 12:34:567890123 1234567890123 lnxt2 0 maxen Sending Access-Request of id 114 to 149.246.222.70 port 1812 User-Name = "12:34:567890123" User-Password = "1234567890123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 149.246.222.70:1812, id=114, length=20 radiusd -AX shows: ... Ready to process requests. rad_recv: Access-Request packet from host 149.246.133.44:32791, id=46, length=66 User-Name = "12:34:567890123" User-Password = "1234567890123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 What am I doing wrong? Thanks Norbert Wegener

1 1

rlm_perl issue...
by Nikola Pavkovic 12 Jul '06

12 Jul '06

Hi all, I'm expiriencing strange behaviour of rlm_perl module causing freeradius be unable to start. Here is the output of `freeradius -X` (running on Debian Sarge i386, freeradius version 1.1.2): # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/root/bin/mymodule.pm" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Can't load '/usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl/5.8/XSLoader.pm line 68. at /usr/lib/perl/5.8/Data/Dumper.pm line 27 Compilation failed in require at /root/bin/mymodule.pm line 30. BEGIN failed--compilation aborted at /root/bin/mymodule.pm line 30. rlm_perl: perl_parse failed: /root/bin/mymodule.pm not found or has syntax errors. radiusd.conf[540]: perl: Module instantiation failed. radiusd.conf[1747] Unknown module "perl". radiusd.conf[1746] Failed to parse authenticate section. If I comment out the "use Data::Dumper;" line, freeradius starts ok, but then it does not send any attributes back to the Cisco AS5300, but only Access-Accept (or Access-Reject). Are there any ideas where could be the problem with loading the Data::Dumper module (since I assume that not sending the attributes back is caused by commenting out the "use Data::Dumper;" line)? Thanks in advance. Sincerely, Nikola Pavkovic

2 2