- Freeradius-Users - lists.freeradius.org

We need help
by Sam Sein Muan Tie 31 Mar '06

31 Mar '06

dear all, we, well shoudnt say we, i got stucked to this project of building a radius server for stopping some user NFS mount from MAC/IP spoofing on linux . We are hoping for wired dot1.x for radius server. [root@radius-server raddb]# rpm -qa |grep freeradius freeradius-mysql-1.0.4-1.FC4.1 freeradius-1.0.4-1.FC4.1 freeradius-postgresql-1.0.4-1.FC4.1 freeradius-unixODBC-1.0.4-1.FC4.1 we have a cisco 2950 switch running linux's freeradius, the clients will be linux box and windows box i actually got it to work before on Redhat Linux Enterprise 3 but then it doenst work anymore .. i m using a certificate to authenticate to radius server, eap/ttls Got it to work before then copy the config to different server, it doenst work anymore. I m using pk12 for windows keys, i also got the pk12 to work on linux's xsupplicant. [root@radius-server raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/raddb" main: libdir = "/usr/local/lib" main: radacctdir = "/etc/raddb" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = yes main: log_stripped_names = yes main: log_file = "/var/log/raddb/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/raddb/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/etc/raddb/certs" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/masterkeys/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/masterkeys/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/masterkeys/cacert.pem" tls: private_key_password = "******" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/etc/raddb/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 130.95.x.25:1812, id=6, length=147 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501686f73742f4353534520436c69656e74 Message-Authenticator = 0xe66215ebe693583af7e7a74ffef7d4cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 0 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 6 to 130.95.x.25:1812 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x468e8ff532b828abe82e074e9954e6fc Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.95.x.25:1812, id=7, length=224 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 State = 0x468e8ff532b828abe82e074e9954e6fc EAP-Message = 0x020100500d800000004616030100410100003d0301442c9afc9dea1262e7e0a4de122b8f69 c8a00c354a7c7b670e3991cbb65396c500001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x63a3a87e538a38b1ef9782fd0f6cb826 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02cb], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a9], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 7 to 130.95.x.25:1812 EAP-Message = 0x010203d70d80000003cd160301004a020000460301442c9accea2351dd63f780655aaa8056 5a0f88362ecfadcc5fb500a4a21c70212042be4fa4618018294a134f8019f92b218025b2e45c eeae8604cff81ad1312ea100040016030102cb0b0002c70002c40002c1308202bd30820226a0 03020102020101300d06092a864886f70d0101040500308197310b3009060355040613024155 310b3009060355040813025741310e300c060355040713055045525448310c300a060355040a 1303555741310d300b060355040b130443535345312630240603550403131d7261646975732d 7365727665722e637373652e7577612e6564752e617531263024 EAP-Message = 0x06092a864886f70d0109011617737570706f727440637373652e7577612e6564752e617530 1e170d3036303333303037353832385a170d3037303333303037353832385a308197310b3009 060355040613024155310b3009060355040813025741310e300c060355040713055045525448 310c300a060355040a1303555741310d300b060355040b130443535345312630240603550403 131d7261646975732d7365727665722e637373652e7577612e6564752e61753126302406092a 864886f70d0109011617737570706f727440637373652e7577612e6564752e617530819f300d 06092a864886f70d010101050003818d00308189028181009eed EAP-Message = 0x0d14ac1f27a76de23f02b065887b6e10f8122a3516a023db9bf070de3782f2979c674ce799 6ffa4a49c8d0dbd29a49a1e534da62ba535b8d245262e18852192fbb376464776f8e3f3afe23 c2e8d432bd00f73281b296293da081080d58901a9d3daacac45ec8e83be3485044054d8b1444 5751cf5c497523c0f322d14b7f0203010001a317301530130603551d25040c300a06082b0601 0505070301300d06092a864886f70d010104050003818100d5d6082cabbbe853812b0395b4f0 b589ff7e7bd6e2be72f7d5684027a4fb9354a293c3a2963f77689b1bb55c7d39c8d6d85f18d5 fba53bb6f47299c5d4c3cca09d2bf5ac7b1d6c23469f4b586829 EAP-Message = 0xbe08cd401b76724fb6c95da6ea38d1207711de4241c30db480d766dbea06c9549bccb10e77 c9841f4249e021c71b23ac21ff16030100a90d0000a1020102009c009a308197310b30090603 55040613024155310b3009060355040813025741310e300c060355040713055045525448310c 300a060355040a1303555741310d300b060355040b130443535345312630240603550403131d 7261646975732d7365727665722e637373652e7577612e6564752e61753126302406092a8648 86f70d0109011617737570706f727440637373652e7577612e6564752e61750e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbea1a78423928831b0f8befbe6e01f2b Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.95.x.25:1812, id=8, length=150 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 State = 0xbea1a78423928831b0f8befbe6e01f2b EAP-Message = 0x020200060d00 Message-Authenticator = 0x9c6a5c72722c135212a282ae89f03a58 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 8 to 130.95.x.25:1812 EAP-Message = 0x0103000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29148f4232b7bd94658abe9cb6bd0933 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 6 with timestamp 442c9acc Cleaning up request 1 ID 7 with timestamp 442c9acc Cleaning up request 2 ID 8 with timestamp 442c9acc Nothing to do. Sleeping until we see a request. Many thanks in advance Sam Tie

2 1

Freeradius log
by fvt3 31 Mar '06

31 Mar '06

Hi, I'm getting this error in my log, Error: rlm_sql: The 'op' field for attribute 'password = ' is NULL, or non-existent. Wed Mar 29 11:43:34 2006 : Error: rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect. Wed Mar 29 11:43:39 2006 : Error: Invalid operator for item Password: reverting to '==' Anyone know what it is and how to resolve it ? I'm still able to authenticate while the log is giving me this error message ... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

openssl/des.h error
by Christoforos Ntantogian 31 Mar '06

31 Mar '06

Hello, I was trying to install freeradius 1.0.1 but i failed. The x99.h file contains the line : include<openssl/des.h> and unfortunately there is no such a file and the compilation stops with error. I have suse linux 7.2 and it has openssl.exe but i cant find anywhere the des.h file. Note that the new freeradius 1.1.0 and 1.1.1 doesnt include the x99.h file neither its folder that contains it (rlm_x99_token) and i managed to install these newer versions. However, i have to install the older version. Any suggestions... Thank you chris

2 1

Problem with FreeRadius EAP/TLS and 3com OfficeConnect Wireless AP
by Eugenio Pasquariello 31 Mar '06

31 Mar '06

Hi, we have installed freeradius in conjunction with a 3com OfficeConnect Wireless AP, with WPA encryption. Our system is a Slackware Linux with kernel ver. 2.4.28. The 3Com OfficeConnect Wireless 11g Access Point model is 3CRWE454G72. We've installed the version 1.1.1 of Freeradius, and we used openssl to create the certificates for the server and the clients. We tried different configuration, read faq, discussion groups etc., but the system fails. The client start the EAP transaction, start TLS and receive the server certifcate, we have used WinXp as client and then WIN requests to the user the client certificate. After the choice of the certificate, the client remain blocked. Here we have posted the radius debug output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.254:3544, id=142, length=93 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x028e000c01526f626572746f Message-Authenticator = 0xb55a7cf8add654a3a2f627a983584a26 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 142 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 142 to 192.168.1.254 port 3544 EAP-Message = 0x018f00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd31f2f5f5f870497aa396155166ca8fa Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.254:3545, id=143, length=179 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xd31f2f5f5f870497aa396155166ca8fa EAP-Message = 0x028f00500d800000004616030100410100003d0301442baf2655b72d4ab025b2d05ef8360e73f8ab6bf8fae204c1d19927387adafc00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe91e302630229d5e42eab44b6622c911 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 143 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 027f], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 007f], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 143 to 192.168.1.254 port 3545 EAP-Message = 0x019003610d8000000357160301004a020000460301442b8e5b6233434e31e800ab8a715ae577fa51d24f619d7ae5319bda5caa03c220ad755d37d34c5c822ea79225b05c557391c03a273ebc10acaaab6c0dfa976b0b000400160301027f0b00027b00027800027530820271308201daa003020102020900aa4ba0044b60a2cb300d06092a864886f70d0101040500306e310b3009060355040613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e EAP-Message = 0x6974301e170d3036303332383038313430375a170d3037303332383038313430375a306e310b3009060355040613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e697430819f300d06092a864886f70d010101050003818d0030818902818100d0b8d6c7706f408c87fe35a34030d908520460b43cd34fdfde0566b9e75602f45f65b30846e8a7d5ca2ff3237fc916c2c40b726de40ca004ea68bf6d3d1f106ed4584ea7f5d80fcbca7379059323 EAP-Message = 0x9a1a72a34b33d5b0cec0624543558c46e2b216e16ce47770465d55dcd9500cf70eb59f4ba70c7da4d2a7dea55419e700aa0d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810046fb8261e93111d30d2b1f794ef922d114f67a16eaef27c054589d013b37de7508ddcc26580852bcdfdd688ebf664f4e5fa04d2e45686268e1585556c57d70bbb17255d7d0dee55e8cdf20dd86850c9cc8b3c08ace49e46728e13c71641b78e1e8ab24b88401d1e04e574a07b272692f8ae0290e9178c8507f65296f03418435160301007f0d00007702010200720070306e310b300906035504 EAP-Message = 0x0613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e69740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc317b1f0947b3868a6ce76d9107a6308 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.254:3546, id=144, length=105 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xc317b1f0947b3868a6ce76d9107a6308 EAP-Message = 0x029000060d00 Message-Authenticator = 0x80e0d9154111b75e2f24f084b9bd4d6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 144 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 144 to 192.168.1.254 port 3546 EAP-Message = 0x0191000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x75ac3a428d93b0ba22431963a01bd5fd Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 142 with timestamp 442b8e5b Cleaning up request 1 ID 143 with timestamp 442b8e5b Cleaning up request 2 ID 144 with timestamp 442b8e5b Nothing to do. Sleeping until we see a request. Have you some idea on how can we solve the problem? thanks for any support

2 2

multiple attribute instaces and radius variables (xlat)
by Andriy Gapon 31 Mar '06

31 Mar '06

FreeRAIUS documentation in 1.1.1 mentions a possibility of referencing specific AVPs in case of multiple instances of an attribute (%{Attr-Name[N]}). This is quite useful (and a nice addition!), but it doesn't seem to cover some situations (especially related to logging/accounting) where number of attribute instances is not known in advance. Is it possible to add something like %{Attr-Name[*]} that would expand to all values of an attribute and something like %{Attr-Name[#]} that would expand to number of attribute instances ? The toughest part of the above suggestion is which delimiter to use in case of [*] and if it is possible to make that delimiter configurable. -- Andriy Gapon

2 2

frontend for freeradius???
by Olaf Schäfer 31 Mar '06

31 Mar '06

@Guy Fraser Hi, I read that you've been working 'on some PHP functions to manage FreeRadius'. I'm goning to do some efforts in the same direction: extending dialup admin with managing abilities for ip-pools, simultaneous-use, rlm_counter etc. Especially I'm interested in your functions to acquire information from configuration files. best regards, Olaf

1 0

RE: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

Using the standard schema, no it doesn't. However adding an nshortname field on *check/*reply allows us to define either a shortname from the nas table, or a null to achieve this. I was however hoping there was a nicer way. Regardless, I appreciate the time :) Cheers, John -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 31 March 2006 04:03 To: FreeRadius users mailing list Subject: Re: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > This is a single username, but the return being selective based on NAS. > > For example: > > Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 I'm not sure that the SQL module supports this. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Re: PsionTeklogix 9150
by Magnus Willigens 31 Mar '06

31 Mar '06

tried to get it working with handhelds of seriestype 7035... they just do leap (cisco) but the first series of the basestations are build with orinocco cards. ==> so this does not work. with xp clients md5 worked fine. tried tls and peap: the authentification worked but it does not share ip (no static and no dhcp). i don't know what i did wrong. i read that the authentificator has to do a workaround for the transmitted eapol package because microsoft changes the first 2 bits of the haeder (????). with xsupplicant it worked quiet well, so there must be a option for the 9150... if you get it working i would be very pleased if you could inform me how to do it. the ap only provides tx changing for the 4 static wep-keys and changes it after a standard period of 60 sec i think. there is no dynamic rekeying possible. our ap was too old to get it working with radius. and because of the fact that this are ap's for industrial use it would be very expensive to buy about 15 new ones... :) > -----Ursprüngliche Nachricht----- > Von: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Gesendet: 30.03.06 00:32:37 > An: <freeradius-users(a)lists.freeradius.org> > Betreff: PsionTeklogix 9150 > Hello, > > i would like to use freeradius authentication for psionteklogix 9150, instead of local authentication. > > Has sombody an experience with such client? > > thks, daniel > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

I think you missed the question then. This is a single username, but the return being selective based on NAS. For example: Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 The radcheck would be at the wrong phase to do this. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 29 March 2006 18:56 To: FreeRadius users mailing list Subject: Re: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > Can you give me an example in SQL please of how I might implement it using this fashion? You put the attribute name, operator, and value into SQL. > Is it not just a case of if it passes radcheck, then it will respond with radreply? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

2 1

Freeradius Expiration Date
by Atkins, Dwane P 31 Mar '06

31 Mar '06

I have looked into the db_mysql.sql and found that their was start and stop dates in the radacct. If I can get freeradius to use the radcheck table, does this mean it will automatically see the radacct table and use input from this table as well? Thanks Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

4 3