- Freeradius-Users - lists.freeradius.org

How to export or install the certification to Windows XP pc
by Keithy 25 Mar '06

25 Mar '06

Hi, Can someone share with me on how to export or install the certification to Windows XP and MAC-apple from Freeradius server? Thanks, Timolthy For Win2kserver or Win2003 IAS, on WinXP system we can http://IP-Srv/certsrv and install the certification. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 25 Mar '06

25 Mar '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > We have made a small fix to the ldap-module (as seen in the > link to the > > mailing list archive). I don't know if this has been fixed > in 1.1.0. I > > once had a quick look at the ldap-module of 1.1.0, it > should be quite > > easy to test if it still fails. > > The password issue is also in FR 1.1.0. Thats weird. The bug is so easy to spot and should be trivial to fix. And I think it will affect many FR installations. -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 7

RE: Table radacct is empty
by Vincent MARGUERIE 25 Mar '06

25 Mar '06

Hi, There's some progression on this friday night !! After the connection was OK for my client, radacct table was always empty and it is always the same if I do not change the following : Rename "accounting_start_query" by "postauth_query" in my sql.conf. It means that "accounting_start_query" is not started. So, is there something to setup for this ? In other words....Why "postauth_query" starts and not "accounting_start_query" ? Be sure that sql is specified in the accounting section of my radiusd.conf....of course :-) Thanks a lot for your help..it will work ! Regards, Vincent

1 0

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

> > I read a post from a long time ago about putting the > > attribute (set to any value) in the response list, but that does not > > seem to work (unless I did it wrong): > > > > /etc/raddb/preproxy_users: > > > > DEFAULT > > Message-Authenticator = 1 > > You're adding it to the proxied packet. Read the docs. Right, because FreeRADIUS is acting as a proxy -- but it wasn't even a problem, so I didn't really need to put that in there. Correct me if I'm wrong, but EAP should be doing Message-Authenticator stuff without me needing to tell it to add the attribute, right? It seems to be doing just that. > > Anyway, I think I am running into a problem with not having this in the > > packets. I am proxying requests from my Windows XP SP2 supplicant to my > > Cisco 1310 AP > > That's not proxying. The supplicant doesn't do RADIUS. Yeah, I suppose I could have worded that a bit more technically accurate. The supplicant is sending the EAP requests to the Cisco, which is sending RADIUS stuff to the router running FreeRADIUS, which is proxying those RADIUS requests to the IAS machine. Sound right now? > > When the proxied reply (Access-Challenge) goes out of the router back > > towards the Cisco 1310 AP and the supplicant, the Cisco or the > > supplicant (can't tell which) is ignoring the reply and then sending a > > new request. > > That's most likely the "extended key" oid nonsense that Microsoft needs. Since you seem to know something about this, can you either: A) Explain what the "extended key oid nonsense" is? B) Point me to some place I can read about it? I appreciate your help. Thanks, Eliot Gable

2 1

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

It would seem that I have been able to answer my own question for this. After doing an Ethereal dump, I noticed that the Message-Authenticator is indeed set to a valid value. This means that is simply isn't displayed with a value (it gets printed before it is computed). I also figured out that the Cisco was dropping the authentication packets because it was sending to a .6.1 address (the virtual IP for that interface) and receiving the response from the .6.2 address (the primary IP for that interface). Doh! Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. -----Original Message----- From: freeradius-users-bounces+support8=greatlakes.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+support8=greatlakes.net@lists.freeradiu s.org] On Behalf Of Eliot, Wireless and Server Administrator, Great Lakes Internet Sent: Friday, March 24, 2006 3:54 PM To: freeradius-users(a)lists.freeradius.org Subject: Message-Authenticator Attribute Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1

Compilation errors with 1.0.5 (Solaris)
by Heiden, John 24 Mar '06

24 Mar '06

I am pretty sure I have seen this before, but after searching the archives, I can't find the solution. Anyway, under Solaris 9 (SPARC) I get the following during compilation: Making static dynamic in rlm_eap... make[6]: Entering directory `/home/jheiden/freeradius-1.0.5/src/modules/rlm_eap' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../include -I./libeap -c rlm_eap.c -o rlm_eap.o In file included from rlm_eap.c:26: rlm_eap.h:26:18: ltdl.h: No such file or directory In file included from rlm_eap.c:26: rlm_eap.h:36: error: parse error before "lt_dlhandle" rlm_eap.h:36: warning: no semicolon at end of struct or union rlm_eap.h:39: error: parse error before '}' token rlm_eap.h:39: warning: type defaults to `int' in declaration of `EAP_TYPES' rlm_eap.h:39: warning: data definition has no type or storage class rlm_eap.h:51: error: parse error before "EAP_TYPES" rlm_eap.h:51: warning: no semicolon at end of struct or union rlm_eap.h:66: error: parse error before '}' token rlm_eap.h:66: warning: type defaults to `int' in declaration of `rlm_eap_t' rlm_eap.h:66: warning: data definition has no type or storage class rlm_eap.h:70: error: parse error before '*' token rlm_eap.h:70: warning: function declaration isn't a prototype rlm_eap.h:71: error: parse error before '*' token rlm_eap.h:71: warning: function declaration isn't a prototype rlm_eap.h:72: error: parse error before '*' token rlm_eap.h:72: warning: function declaration isn't a prototype rlm_eap.h:75: error: parse error before '*' token rlm_eap.h:75: warning: function declaration isn't a prototype rlm_eap.h:79: error: parse error before '*' token rlm_eap.h:79: warning: function declaration isn't a prototype rlm_eap.h:89: error: parse error before '*' token rlm_eap.h:89: warning: function declaration isn't a prototype rlm_eap.h:90: error: parse error before '*' token rlm_eap.h:90: warning: function declaration isn't a prototype rlm_eap.h:91: error: parse error before '*' token rlm_eap.h:92: warning: function declaration isn't a prototype rlm_eap.c:33: error: parse error before ')' token rlm_eap.c:33: error: initializer element is not constant rlm_eap.c:33: error: (near initialization for `module_config[0].offset') rlm_eap.c:33: warning: missing initializer rlm_eap.c:33: warning: (near initialization for `module_config[0].offset') rlm_eap.c:33: error: initializer element is not constant rlm_eap.c:33: error: (near initialization for `module_config[0]') rlm_eap.c:35: error: parse error before ')' token rlm_eap.c:35: error: initializer element is not constant rlm_eap.c:35: error: (near initialization for `module_config[1].offset') rlm_eap.c:35: warning: missing initializer rlm_eap.c:35: warning: (near initialization for `module_config[1].offset') rlm_eap.c:35: error: initializer element is not constant rlm_eap.c:35: error: (near initialization for `module_config[1]') rlm_eap.c:37: error: parse error before ')' token rlm_eap.c:37: error: initializer element is not constant rlm_eap.c:37: error: (near initialization for `module_config[2].offset') rlm_eap.c:37: warning: missing initializer rlm_eap.c:37: warning: (near initialization for `module_config[2].offset') rlm_eap.c:37: error: initializer element is not constant rlm_eap.c:37: error: (near initialization for `module_config[2]') rlm_eap.c:39: error: parse error before ')' token rlm_eap.c:39: error: initializer element is not constant rlm_eap.c:39: error: (near initialization for `module_config[3].offset') rlm_eap.c:39: warning: missing initializer rlm_eap.c:39: warning: (near initialization for `module_config[3].offset') rlm_eap.c:39: error: initializer element is not constant rlm_eap.c:39: error: (near initialization for `module_config[3]') rlm_eap.c:41: error: initializer element is not constant rlm_eap.c:41: error: (near initialization for `module_config[4]') rlm_eap.c: In function `eap_detach': rlm_eap.c:55: error: `inst' undeclared (first use in this function) rlm_eap.c:55: error: (Each undeclared identifier is reported only once rlm_eap.c:55: error: for each function it appears in.) rlm_eap.c:58: error: parse error before ')' token rlm_eap.c:53: warning: unused parameter `instance' rlm_eap.c: At top level: rlm_eap.c:82: warning: declaration of `cs' shadows a global declaration rlm_eap.h:37: warning: shadowed declaration is here rlm_eap.c: In function `eap_instantiate': rlm_eap.c:87: error: `inst' undeclared (first use in this function) rlm_eap.c:89: error: parse error before ')' token rlm_eap.c: In function `eap_authenticate': rlm_eap.c:199: error: `inst' undeclared (first use in this function) rlm_eap.c:207: error: parse error before ')' token rlm_eap.c:197: warning: unused parameter `instance' rlm_eap.c: In function `eap_authorize': rlm_eap.c:428: error: `inst' undeclared (first use in this function) rlm_eap.c:432: error: parse error before ')' token rlm_eap.c:426: warning: unused parameter `instance' make[6]: *** [rlm_eap.o] Error 1 make[6]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules/rlm_eap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/jheiden/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/jheiden/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/jheiden/freeradius-1.0.5' make: *** [all] Error 2 Any suggestions/tips? Thanks much in advance! John

2 1

1.1.1 (and earlier): PREFIX/share is rwx------
by Stefan Winter 24 Mar '06

24 Mar '06

Hi, been trying to prepare my installation to use HUP. After getting the permissions in /etc/raddb right, I saw that $INSTALL_PREFIX/share is created with rwx------ root:root permissions (at least when using a non-default PREFIX during configure), and by default makes HUPing radiusd impossible when it runs as a different user. It is kinda against the idea of a "share" directory to be so restrictive. The docs won't be readable by everyone, and (worse) the dictionaries can't be re-read on a HUP. Of course I can change this after installing, but maybe the Makefiles should be more liberal in the first place to make that unnecessary. A rwxr-xr-x sounds better suited. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Clear text passwords
by Corey Burks 24 Mar '06

24 Mar '06

I have recently built up a freeradius server V1.1.0, I am new to freeradius, since we were using and old version of Navisradius. In Navisradius it would compare the crypt password strings and log the crypt sting verses the clear text password. Is it possible to have freeradius not log the clear text passwords, while still logging the auth request? Or have it log the crypt password strings instead? My radius server is binding to a Netscape LDAP server which is storing the passwords using UNIX crypt. Yet the radius server is logging the clear test password. Thank you for your help. Corey Detail log shows: Packet-Type = Access-Request Thu Mar 23 11:23:30 2006 User-Name = "cburks" User-Password = "abc123" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Client-IP-Address = 172.16.15.251 Debug output shows rad_recv: Access-Request packet from host 172.16.15.251:2264, id=1, length=70 User-Name = "cburks" User-Password = "abc123" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/172.16.15.251/detail ' rlm_detail: %A/%{Client-IP-Address}/detail expands to /usr/local/freeradius/var/ log/radius/radacct/172.16.15.251/detail modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cburks", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 234 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cburks radius_xlat: '(uid=cburks)' radius_xlat: 'ou=people,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap-master.oak.zhone.com:389, authentication 0 rlm_ldap: bind as cn=Directory Manager/secret to ldap-master.oak.zhone.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=zhone.com, with filter (uid=cburks) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cburks authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "cburks" with password "abc123" rlm_ldap: user DN: uid=CBurks,ou=People, o=zhone.com rlm_ldap: (re)connect to ldap-master.oak.zhone.com:389, authentication 1 rlm_ldap: bind as uid=CBurks,ou=People, o=zhone.com/abc123 to ldap-master.oak.zh one.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user cburks authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/172.16.15.251/reply- detail-20060323' rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/re ply-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/172.16 .15.251/reply-detail-20060323 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 1 to 172.16.15.251 port 2264 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

6 8

Movaz Dictionary
by David Mitchell 24 Mar '06

24 Mar '06

Greetings, does anybody know of a dictionary for Movaz equipment? Specifically, their docs refer the to attributes Movaz-Initial-CLI-Access-Level and Movaz-Max-CLI-Access-Level but don't provide the information needed to encode them as far as I can tell. I'll try working with their support staff more, but so far we haven't had any luck getting the needed information. If anybody here knows how I'd appreciate the help. Thanks. -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

1 0