- Freeradius-Users - lists.freeradius.org

SV: SV: Any Trusted CA problem
by Torkel Mathisen 23 Feb '06

23 Feb '06

Alan DeKok wrote: > "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > I don't use client certificates I think. Atleast I haven't installed any > > certificates on my clients. > > It looks like the client is sending one. > > > So how can I fix that? Just delete the client certificate from the > > radius server ? > > No, delete it from the client. I'm sorry, but I don't understand why this is the client certificate. The problem is that on my clients I have to uncheck the "Validate server certificate" option. Only when i uncheck that, the authentication with radius works. And the problem is that some drivers don't let you do that. Even if its set to "Any trusted CA" it doesn't work. There is a picture of that option here: (even though this is for EAP-TLS, which I'm not using): http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html (search for "Validate server certificate") Regards, Torkel

1 0

Help needed with MS-CHAP
by Charles Blake 23 Feb '06

23 Feb '06

Dear friends: I am trying to set up a freeradius-1.1.0 server for authenticating users using MS-CHAP passwords. I pretend to authenticate users against shadow. I am using the default radius.conf and users files. I have included the microsoft dictionary in radiusclient.conf file. radtest shows ok: # radtest mts mypassowrd localhost 0 testing123 Sending Access-Request of id 160 to 127.0.0.1 port 1812 User-Name = "mts" User-Password = "rfhs1229" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=160, length=20 But when I try to authenticate an user using MS-CHAP, I am getting this output: rad_recv: Access-Request packet from host 127.0.0.1:1027, id=5, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "mts" MS-CHAP-Challenge = 0x6b61b1ed954a289c0fa3aebedc329ac6 MS-CHAP2-Response = 0x8f0001684e1d34295e1232edb0682bd04e6e00000000000000002caaa9579823e00501812d3e2dce9225b7dd251c02e1fd89 Calling-Station-Id = "172.16.255.11" NAS-IP-Address = 192.168.181.254 NAS-Port = 0 Wed Feb 22 20:47:07 2006 : Debug: Processing the authorize section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group authorize for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "mschap" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No '@' in User-Name = "mts", looking up realm NULL Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No such realm "NULL" Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 152 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 171 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 183 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group authorize (returns ok) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rad_check_password: Found Auth-Type MS-CHAP Wed Feb 22 20:47:07 2006 : Debug: auth: type "MS-CHAP" Wed Feb 22 20:47:07 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group MS-CHAP for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Told to do MS-CHAPv2 for mts with NT-Password Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authenticate]: module "mschap" returns reject for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group MS-CHAP (returns reject) for request 0 Wed Feb 22 20:47:07 2006 : Debug: auth: Failed to validate the user. Wed Feb 22 20:47:07 2006 : Debug: Delaying request 0 for 1 seconds Wed Feb 22 20:47:07 2006 : Debug: Finished request 0 Wed Feb 22 20:47:07 2006 : Debug: Going to the next request Wed Feb 22 20:47:07 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:07 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:08 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:08 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:09 2006 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 5 to 127.0.0.1 port 1027 Wed Feb 22 20:47:09 2006 : Debug: Waking up in 4 seconds... Wed Feb 22 20:47:13 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:13 2006 : Debug: Cleaning up request 0 ID 5 with timestamp 43fd141b Wed Feb 22 20:47:13 2006 : Debug: Nothing to do. Sleeping until we see a request. What I am doing wrong? Thank you for your help, Charles

1 0

CA.all Execution Error!
by 艳华杨 23 Feb '06

23 Feb '06

Hi, everyone I installed FreeRADIUS and OpenSSL on my computer, then I want to create self-signed certificates using scripts CA.all in freeradius source package, but I got error like: Using Configuration from /usr/local/openssl/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 1653: error :02001002: system library: fopen: No such file or directory: bss_file.c:352:fopen ('./demoCA/serial', 'r') 1653: error: 20074002: BIO routines: FILE_CTRL:system lib: bss_file.c: 354: + openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-srv.p12 -clcerts -passin pass: whatever -passout pass: whatever No certificate matches private key + openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin pass: whatever -passout pass: whatever 1655: error: 0D07207B: asn1 encoding routines: ASN1_get_object:header too long: asn1_lib.c: 150: +openssl x509 -inform PEM -outform DER -in cert-srv.pem -out cert-srv.der unable to load certificate 1656:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting:TRUSTED CERTIFICATE So what's the problem? Is the CA.all self error? Anyone could help me? Thanks!! Helen --------------------------------- 雅虎1G免费邮箱百分百防垃圾信雅虎助手-搜索、杀毒、防骚扰

1 0

Cisco EAP/TLS not working
by Robert Myers 22 Feb '06

22 Feb '06

I'm having a problem with my Cisco 2950 and EAP/TLS...I've already configured this to work on my HP 5300, so I'd assume that everything on the freeradius end is proper... However I am receiving this from the debug log: rad_recv: Access-Request packet from host 192.168.2.161:1812, id=9, length=116 NAS-IP-Address = 192.168.2.161 NAS-Port = 50012 NAS-Port-Type = Ethernet User-Name = "client" Called-Station-Id = "00-09-7C-3E-92-0C" Calling-Station-Id = "00-11-11-64-A1-E6" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x Message-Authenticator = 0x21afff7782222d4fa2ead6e802a75517 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: Got EAP_START message modcall[authorize]: module "eap" returns handled for request 0 modcall: group authorize returns handled for request 0 Sending Access-Challenge of id 9 to 192.168.2.161:1812 EAP-Message = 0x0101000501 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 9 with timestamp 43fc4990 Nothing to do. Sleeping until we see a request. Then this from the switch: 000043: *Mar 1 01:16:24: %DOT1X-5-ERR_INVALID_AAA_ATTR: Got invalid AAA attribute settings from RADIUS server My question is, for anyone who has set this up, what must I do in the Cisco world to make this work? -Bob

2 1

FreeRADIUS Log formats
by Will Urbanski 22 Feb '06

22 Feb '06

Hello, I am fairly new to FreeRADIUS and I am looking for some documentation on the format of the log produced by the FreeRADIUS daemon. I have checked the website and the wiki but have not been able to come up with much. google also returned little. I am looking for at least an overview of the logs that can be generated by FreeRADIUS as I hope to write a reporting tool to assist in processing these logs. Any information you could share would be greatly appreciated. Thanks, Will

2 1

hints processing for Accounting-On / Off packets?
by Stefan Winter 22 Feb '06

22 Feb '06

Hello, on my system I noticed that Accounting-On/Off packets don't seem to get the same treatment as other accoutning packets. The situation is as follows: - FreeRADIUS 1.0.5 - "hints" file tags packets according to the rule: DEFAULT Client-IP-Address == 158.64.A.B, Acct-Type := LuxDSL-COPS RESTENA-Service-Type := LuxDSL-COPS-Logging - RESTENA-Service-Type is a dictionary-defined VSA - a detail instance logs packets according to that RESTENA-Service-Type, the stanza is: detail { detailfile = ${radacctdir}/%Y%m%d/%{RESTENA-Service-Type}-service/detail detailperm = 0600 } Now what happens is that all normal accounting packets from 158.64.A.B (of course A and B are integers) get logged correctly; excerpt from today's detail in /var/log/radius/radacct/20060213/LuxDSL-COPS-Logging-service/detail Mon Feb 13 00:00:00 2006 Acct-Status-Type = Stop Acct-Delay-Time = 1056177 Acct-Input-Octets = 1075686 Acct-Input-Gigawords = 0 Acct-Input-Packets = 11792 Acct-Output-Octets = 28370647 Acct-Output-Gigawords = 0 Acct-Output-Packets = 20519 Acct-Session-Time = 4422 Acct-Terminate-Cause = Lost-Carrier User-Name = "134331891" Acct-Session-Id = "Res_START:134331891:1138724602258:21722" Framed-IP-Address = 158.64.X.Y NAS-Identifier = "SAE.UMC2" NAS-Port-Id = "restena@ptras03 ATM 2/0.517:10.481" NAS-Port = 537526753 NAS-IP-Address = 192.168.1.3 Acct-Multi-Session-Id = "erx atm 2/0.517:10.481:0030496306" Event-Timestamp = "Jan 31 2006 18:37:04 CET" Client-IP-Address = 158.64.A.B RESTENA-Service-Type := "LuxDSL-COPS-Logging" Timestamp = 1139785200 This shows that using hints for tagging the packet works as it is supposed to. But when an Accounting-On/Off packet arrives from the same IP, it does _not_ get tagged from the hints file, i.e. it lands in a file /var/log/radius/radacct/20060213/-service/detail, %{RESTENA-Service-Type} expands to nothing and the packet itself also doesn't contain a trace of a newly-set attribute, see the content of that detail file: Mon Feb 13 00:36:38 2006 Acct-Status-Type = Accounting-On Acct-Delay-Time = 978868 NAS-Identifier = "SAE.umc5 restena@ptras06" NAS-IP-Address = 192.168.1.5 Event-Timestamp = "Feb 1 2006 16:42:09 CET" Acct-Session-Id = "restena@ptras06" Client-IP-Address = 158.64.A.B Timestamp = 1139787398 (In case you wonder about those large Acct-Delay-Time values: we are currently doing a log replay with radrelay from that 158.64.A.B server.) Now I wonder why these packets aren't tagged by hints, even though they have the same Client-IP-Address as normal packets and normal packets _do_ get tagged. Anyone a clue? Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 9

on the right track?
by mbjohn＠duke.edu 22 Feb '06

22 Feb '06

Hello all! I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered. Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....). As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things. We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min). Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere? Thanks for your help! Brian

2 1

SV: Any Trusted CA problem
by Torkel Mathisen 22 Feb '06

22 Feb '06

Alan DeKok wrote: > "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > Anyway, here is the debug log and as you can see I get an unknown CA > > error. However I got all certs in the correct location on the > > freeradius server. > > The issue isn't the server certificates. > Ok. > > rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA > > TLS_accept:failed in SSLv3 read client certificate A ... > > The client certificate isn't signed by any CA that the RADIUS server > knows about. > > The solution is to not use client certificates for PEAP. Or, to > ensure that the CA cert that the server has is the one you used to > sign the client certs. I don't use client certificates I think. Atleast I haven't installed any certificates on my clients. So how can I fix that? Just delete the client certificate from the radius server ? Regards, Torkel

2 1

RE: NTLM
by Gilmour, Scott 22 Feb '06

22 Feb '06

Thanks for the info Thanks, Scott Gilmour Software Engineer ENET, & ENSRT Enterasys Networks Phone: 978-684-1236 Email:sgilmour@enterasys.com www: http://www.enterasys.com -----Original Message----- From: freeradius-users-bounces+sgilmour=enterasys.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+sgilmour=enterasys.com@lists.freeradius .org] On Behalf Of Phil Mayers Sent: Wednesday, February 22, 2006 8:56 AM To: FreeRadius users mailing list Subject: Re: NTLM Gilmour, Scott wrote: > I read that you need to setup ntlm_auth to get Machine Authentication to > work with Active Directory. > > How do I properly set up ntlm_auth to do this? Download Samba, ensuring it is 3.0.21rc1 or later which includes the patch Alan talks about. Compile and install samba. Read the samba documentation. Configure your Samba server. Ensure winbindd and nmbd are running. Join the AD domain. Ensure samba is working ("wbinfo -D DOMAIN", "wbinfo -a username%pass" are good basic tests) Install FreeRadius, make sure it is 1.1.0 which will strip the machine name "host/name.domain.com" to "name". Make the following changes to the default config: 1. radiusd.conf: uncomment the "ntlm_auth" line in the "mschap" module, adjusting the "/path/to/ntlm_auth" to a real value, and setting the --username argument to "%{mschap:User-Name}" 2. eap.conf: set "default_eap_type" to "peap", uncomment the "peap" section lower down, That's it. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using multiple auth methods, ports
by Geoff Silver 21 Feb '06

21 Feb '06

I've got (what I believe is) an interesting engineering problem to solve. I'm going to oversimplify our problem a bit, so for simplicity sake, we use "Auth-Type := Local" right now with a username and password. We're deploying a new certificate-based method now, and I want to figure out the best way to intergrate the two methods. The problem is that the NAS (Cisco 3000) does the certificate authentication, but then queries radiusd server for *authorization* only. Essentially with doing certificate-based authentication, the NAS sends: User-Name = "geoff" User-Password = "geoff" NAS-Port = 1016 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "10.1.2.99" Calling-Station-Id = "10.0.33.224" Tunnel-Client-Endpoint:0 = "10.0.33.224" NAS-IP-Address = 10.0.32.138 NAS-Port-Type = Virtual whereas when it's doing regular authentication, it sends the same thing as above, except User-Password = "mysecretpassword". There are no configuration options in the NAS to either restrict the NAS-Port that gets used (ie. cert auth would use ports 1-1000 and regular auth would use 1001-2000), nor is there a way to *apply* a realm to a request (only to strip the realm from the request, which doesn't help me). The only thing the NAS can do that is "helpful" is send cert auth requests to a different UDP port than regular auth requests. To do the first method, I can use 'Auth-Type := Local' and just set the User-Password attribute to the User-Name, or I can use 'Auth-Type := Accept'. Either works just fine, since the NAS is only requesting authorization (ie. is this user in the users file for our NAS). However, because the password it sends is the username, I can't just put two entries in the users file, since anyone doing the "old-style" username/password auth could just enter their username as their password and get access (or more appropriately, joe hacker could user someone's username as that user's password to get unauthorized access). The same NAS is used for both certificate and password auth, so I can't restrict access via the NAS. Also, the same attributes are sent for regular authentication, so I can't differentiate. As mentioned above, I *can* force the NAS to use a different UDP port based on the auth method (ie. certificate auth goes to port 1812 while old-stlye auth goes to port 1645), but I can't tell if there's a way to get radiusd to listen on multiple UDP ports, or if there's a way to determine which UDP port was used in the connection when doing auth (I noticed a Packet-Src-Port attribute in the freeradius.internal dictionary, but I can't tell if there's a way I can use that in the users file). I'm hoping someone might have some insight into the above paragraph. "You'll need to add that" is reasonable insight, so long as that's my only answer - I'm just hoping I can avoid doing that. Thanks!

3 5