- Freeradius-Users - lists.freeradius.org

Check DN in rlm_perl
by Michal Prochazka 12 Apr '06

12 Apr '06

Hi, I'm using Freeradius 1.1.0. Is there some possibility to check the DN of client certificate within rlm_perl module when using EAP-TLS? I don't want allow access to all users which have right certificate. I'd like to check the DN by the perl script towards the file which contains allowed DNs. Thanks for suggestions. Regards, Michal -- Michal Prochazka // michalp(a)ics.muni.cz Supercomputing Center Brno Institute of Computer Science Masaryk University Botanicka 68a, 60200 Brno, CZ CESNET z.s.p.o. Zikova 4, 16200 Praha 6, CZ

2 1

RE: How do I set up simple AD integration?
by King, Michael 12 Apr '06

12 Apr '06

Wed Apr 12 13:21:06 2006 : Error: TLS_accept:error in SSLv3 read client cert ificate A Wed Apr 12 13:21:07 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Apr 12 13:21:07 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client localhost port 0) Wed Apr 12 13:21:07 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client 192.168.5 0.45 port 26 cli 0012f0311af1) AFAIK there is no certificate A on the client (or supplicant) so the error message is probably correct but is it a problem in security terms? The Semi-Offical answer (from Alan) is to just ignore it.

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of Josh Howlett > Sent: 12 April 2006 11:48 > To: FreeRadius users mailing list > Subject: Re: How do I set up simple AD integration? > > > Burton, Steven wrote: > > > >> -----Original Message----- > >> From: > >> freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > >> ists.freer > >> adius.org > >> [mailto:freeradius-users-bounces+sburton=shepherd-construction > >> .co.uk@lis > >> ts.freeradius.org]On Behalf Of Alan DeKok > >> Sent: 11 April 2006 16:28 > >> To: FreeRadius users mailing list > >> Subject: Re: How do I set up simple AD integration? > >> > >> > >> "Burton, Steven" <sburton(a)shepherd-construction.co.uk> wrote: > >>> This stanza is a enclosed with the mschap section, still > >> nothing ventured.... > >>> I changed the line and unfolded it and ran radiusd -X. The first > >>> request didn't match anything usefull and was rejected by > System. I > >>> tried again but ticked the box 'CHAP' on NTRadPing and got the > >>> output: > >> You can't do CHAP to MS AD. It's impossible. > >> > >> Alan DeKok. > > > > My bad! I'd been staring at mschap all day and I saw chap > and thought mschap. > > I still hope to get 802.1x working with FR before I'm told > to stop wasting time and buy something :-) but after two and > a half days (on and off) I'm no closer. > > Steve, > > I strongly suggest you start off doing PEAP against the 'users' file, > and once that's working get the domain stuff working. > > It sounds to me like you're trying to do too much at once, > and too many > things are broken for you to know where to start! > > Once you've got PEAP working against the 'users' file, create > a machine > account in the AD for the RADIUS server (using the Samba > tools) and then > use the ntlm_auth program (that comes with Samba) to test standard > authentication. > > Once you've got that far, it's just a matter of configuring > FreeRADIUS > to use ntlm_auth. But you can worry about that later :-) > > This isn't difficult, it's largely a matter of making sure you do the > right steps in the right order... > > best regards, josh. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Well, IT'S WORKING!! Thank you all for your help, advice and support. Alas, I didn't backup the files last night so I'm not sure exactly what I did to make it work but I can now see it authenticating and then the connection is made. I have set it to put user names in the log and I hope to have it write accounting logs soon. More worryingly, I'm seeing this error message in radiusd.log: Wed Apr 12 13:20:48 2006 : Info: rlm_exec: Wait=yes but no output defined. Did y ou mean output=none? Wed Apr 12 13:20:48 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Apr 12 13:20:48 2006 : Info: Ready to process requests. Wed Apr 12 13:21:06 2006 : Error: TLS_accept:error in SSLv3 read client cert ificate A Wed Apr 12 13:21:06 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Apr 12 13:21:06 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client localhost port 0) Wed Apr 12 13:21:06 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client 192.168.5 0.45 port 26 cli 0012f0311af1) Wed Apr 12 13:21:06 2006 : Error: TLS_accept:error in SSLv3 read client cert ificate A Wed Apr 12 13:21:07 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Apr 12 13:21:07 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client localhost port 0) Wed Apr 12 13:21:07 2006 : Auth: Login OK: [DOMAIN\\USERNAME] (from client 192.168.5 0.45 port 26 cli 0012f0311af1) AFAIK there is no certificate A on the client (or supplicant) so the error message is probably correct but is it a problem in security terms? ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

-----Original Message----- From: freeradius-users-bounces+sburton=shepherd-construction.co.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+sburton=shepherd-construction.co.uk@lists.freeradius.org]On Behalf Of Stephen Walsh Sent: 12 April 2006 14:34 To: freeradius-users(a)lists.freeradius.org Subject: RE: How do I set up simple AD integration? From: "Burton, Steven" <sburton(a)shepherd-construction.co.uk> >I'd seen that. What I was trying to do (unsuccessfully 'cos I'm ignorant) was to try to find out what triggers ntlm_auth to run. Is there something in another file that sets this up? Your authorise and authenticate sections define what modules are called. Ergo, if you don't have a LDAP call in both, it doesn't do the authorise (can the user dial up?) or authenicate (are the credentials right). I've got a sanitised set on config I can send you, you don't need to do all that "nt_hack" skull hackery, mine is working pretty much OK out of the box with 2 config changes. Stephen Walsh ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

Accessing REQUEST structure data outside FreeRADIUS module
by Nicolas Castel 12 Apr '06

12 Apr '06

Hello and thanks for replies I'm using FreeRADIUS v1.1.0. I'm developping some modules and I try to access auth_req structure (REQUEST) data from an external function (out of my module) and it fails. All works fine when accessing this data from the module itself but when i call an external function with the address of REQUEST, it doesn't work. Code which works /***********************************************************************/ static int wcp_lt_vms_authorize(void *pt_instance, REQUEST *pt_request) { VALUE_PAIR *lpt_value_pair = NULL; ... if ((lpt_value_pair = pairfind(pt_request->packet->vps, PW_USER_NAME)) == NULL ) { WCP_DEBUG("User-Name not found !"); } else { WCP_DEBUG("RADIUS attribute name %s, value: [%s]", lpt_value_pair->name, lpt_value_pair->strvalue); } ... } /***********************************************************************/ This works fine, when the server receive a request Tue Apr 11 16:05:03 2006 : wcp_lt_vms_authorize: RADIUS attribute name User-Name, value: [330001] The problem comes when doing the same thing but by calling a function. /***********************************************************************/ static int wcp_lt_vms_authorize(void *pt_instance, REQUEST *pt_request) { ... lib_com_filter_traffic(pt_request); ... } /***********************************************************************/ and in anotherfile, lib_com.c int lib_com_filter_traffic(REQUEST *pt_request) { VALUE_PAIR *lpt_value_pair = NULL; ... if ((lpt_value_pair = pairfind(pt_request->packet->vps, PW_USER_NAME)) == NULL ) { WCP_DEBUG("User-Name not found !"); } else { WCP_DEBUG("RADIUS attribute name %s, value: [%s]", lpt_value_pair->name, lpt_value_pair->strvalue); } /***********************************************************************/ This doesn't work. when receiving one request, FreeRADIUS takes a lot of processor time and then the server crashes. Tue Apr 11 17:00:30 2006 : Error: WARNING: Unresponsive child (id 3) for request 0 I don't understand why all works when accessing REQUEST data inside the module and not in the lib function. It's like the lib can't accessed to this memory. Any help would be appreciated.

2 4

RE: How do I set up simple AD integration?
by Stephen Walsh 12 Apr '06

12 Apr '06

1 0

[FreeRADIUS (EAP-TLS)] Server does not start.
by freeradius＠gmx.de 12 Apr '06

12 Apr '06

I need some help in configuring the radius server.It would be great if one of you could guide me to the solution. Here are my system details. (its a 1und1 Virtual Server) SUSE 9.3 FreeRADIUS 1.1.1 und openssl-0.9.7e-3 I have created a CA and Certficates using openssl. The names of these files are masterkey.pem and master_cert.pem respectively. They are kept in the /usr/local/etc/raddb/masterkeys directory. I took the following steps. Created CA with the following: /usr/share/ssl/misc/CA.sh -newca Signing request with: openssl req -new -nodes -keyout masterkey.pem -out masterreq.pem Sign: openssl ca -out master_cert.pem -infiles ./masterreq.pem eap.conf: tls{ ... certificate_file und private_key_file = ${raddbdir}/masterkeys/master_cert.pem CA_file = ${raddbdir}/masterkeys/cacert.pem ... } But after following the above standard procedure, i cannot start my radius server and its not clear to me what could be the actuall problem.Here are the last few lines of my error messages that i get when i start the server. rlm_eap_tls: Loading the certificate file as a chain rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. -- Analog-/ISDN-Nutzer sparen mit GMX SmartSurfer bis zu 70%! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

1 0

Help, Chap problem
by fjlagos＠vtr.net 12 Apr '06

12 Apr '06

Hello: I have this problem, i get this message in the log: "Tue Apr 11 14:43:18 2006 : Auth: Login incorrect (rlm_chap: Clear text password not available): [adexus/<CHAP-Password>] (from client 3com port 268443649 cli 0010-a484-6e7a)" I set the users file as follow: adexus Auth-Type := CHAP, User-Password == "adexus" i configure the windows 2000 802.1x client how: EAP type: MD5 challenge Any idea Saludos Francisco Lagos

2 1

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

> -----Original Message----- > From: Stephen Walsh [mailto:S.Walsh@signadou.acu.edu.au] > Sent: 12 April 2006 00:41 > To: Burton, Steven > Subject: Re: How do I set up simple AD integration? > > > > > > > Hi Steve > > I've just completed an AD implementation of FreeRadius across two AD > domains, One AD2003 in Native mode, and one AD2000 in mixed > mode. If you'd > like any hints or tips, feel free to email me and I'll do > what i can to > help. > > Stephen Walsh > s.walsh(a)signadou.acu.edu.au Stephen, thanks for your kind offer of help. What I'm trying to achieve is to get 802.1x authentication working with FreeRadius passing off authentication to a Win2003 (Win 2000 mixed mode, soon to be 2003 native) DC. When the user tried to connect to the network I can see his domain\username in the output of radiusd -A -X which (I think) suggests that the supplicant and client are setup correctly. There seems to be no attempt by the RADIUS server to contact a DC. I don't want to take too much of your time but would it be possible for you to send me any (suitably sanitized) configuration files you have customized ? If this is unacceptable I'll send you details of what I've done so far. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

different gateway for different users
by Felice.pizzurro 12 Apr '06

12 Apr '06

Hi, I have freeradius AAA server with mysql. I have 3 gateway, is possible to assign (statically at this time) different gataway at different users? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: America, Africa, Australia, Asia...con Email Phone Card chiami ovunque spendendo meno di una telefonata interurbana Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2688&d=20060412

1 0