- Freeradius-Users - lists.freeradius.org

Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP?
by Armin Krämer 10 Jan '06

10 Jan '06

Sorry, forgotte to attach the files... Okay, i tested on and found an difference. I attach 2 Files. One is the output with an normal Client-Certificate the other with an Certifikate with the OID 1.3.6.1.4.1.311.17.2. In both cases the Certifikate is rejected with Error in Certifikate A. The Client Certifikate ist tested as Client-Certifikate and works when installed as an normal Account Certifikate. Sems like the mistake is at the Certifikate itself??? When i generated the Special Machine Certifikate i changed out the normal OID against the other one described above. Or may i have to add OID as a second OID to the certifikate? Thanks for helping. :-) -----Ursprüngliche Nachricht----- Von: j.cluzel(a)online.fr [mailto:j.cluzel@online.fr] Gesendet: Freitag, 6. Januar 2006 21:11 An: Kraemer.Armin(a)web.de Betreff: Re: Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP? Hello, - login as local administrateur - start mmc.exe - add certificate / computer account / local computer (note sure for names, my XP is french, so I translate) - Then, in the tree, select root certification autority/Certificates - Right click, All tasks/Import - select your "root.der" - Then, in the tree, select Personnal/Certificates - Right click, All tasks/Import - select your "machine.p12" - enter your "private key" - close mmc - set AuthMode to "2" in registry - in computer panel/Network connection/wireless connection - tab "Association" WPA & TKIP - tab "Auth" check "Authenticate as computer..." - tab "Auth"/Properties check "Validate serveur certificate" and select your certificate in the list, !!! Be aware, in "property", you add to check "Connexion to these servers", but let it uncheck for testing - Pray... ;-) Hope it helps. FYI, it works for me. Regards, Jeremy

2 2

MySQL settings causing FreeRADIUS to segfault
by radius＠smartfoxsoftware.com 10 Jan '06

10 Jan '06

Hello again, I got the DialupAdmin/SQL problem fixed (Thanks) but now I'm running into a problem with FreeRADIUS. I've tried following several different guides I've found on the net for setting up FreeRADIUS and MySQL and each time, I get the same results. Whenever, I enable anything regarding SQL in radiusd.conf and start up radiusd in debug mode (radiusd -X), FreeRADIUS segfaults. If I start the program with -x, I get the same results however when I start up radiusd without any options (radiusd, by itself), the program starts fine. Could this be a configuration issue in FreeRADIUS or something messed up with my Ubuntu install? We've tried authenticating when FreeRADIUS is started without command-line options and it does not accept the information in the MySQL database inputed via Dialupadmin. If needed, I can post my config files. I figured I'd wait to see if it was needed before doing so. Thanks

2 1

Re: how to compile freeradius without ssl
by Sean 10 Jan '06

10 Jan '06

Hi, If you are using FreeRadius to manage WiFi hotspots with Chillispot I have a PHP login script that works without SSL. Email me if you want a copy. Regards, Sean Bracken http://swarmhotspots.com

1 0

how to compile freeradius without ssl
by Alvaro Quiñones 10 Jan '06

10 Jan '06

Hi I want to compile freeradius without ssl, i tried with ./configure --disable-ssl ./configure --disable-openssl ./configure --without-ssl ./configure --without-openssl however always i see checking for regex.h... yes checking for openssl/ssl.h... no checking for off_t... yes how can i compile without support ssl Thanks Alvaro

2 1

RE: Cisco to FreeRadius to AD-LDAP authentication
by Dickson, John 10 Jan '06

10 Jan '06

>> My question is, how do I get an "Accept" from the request and is there >> a way around the basedn naming conventions that will alllow FreeRadius >> to work with Windowz? > > The issue here isn't with basedn naming conventions. It's that you haven't set up FreeRADIUS to ask AD about authenticating the user.? > > If the users log in with clear-text passwords, my suggestion is to set up rlm_smb, and point it to the domain controller. That will let FreeRADIUs use >AD for authentication. > > Alan DeKok. I made some changes to the radiusd.conf to exclude what I thought was not needed and have much joy. The localhost client test is accepted. With regard to the basedn naming convention I will explain my problem. Users created in AD with a first name and last name have a "cn=radius test" and the actual logon credentials are in "sAMAccountName=radtest". This presents a problem when a querry is passed. In the text below I have broken the "cn=" First and Last name entry by adding a backslash to the tail of the first name. The actual user account that was querried has a logon of "radtest" and not "radius test". Basically it is creating it's "distinguishedName" within the record, from one of two different places depending how the account was creted. Is there a way to work around this issue? Here is an "ldapsearch result" for 2 separate users The actual account logon credential is the "sAMAccountName" 111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111 # radius test, Users, xxxx1.xxxx1.edu dn: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu objectClass: user cn: radius test sn: test givenName: radius distinguishedName: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu displayName: radius test name: radius test logonCount: 0 sAMAccountName: radtest sAMAccountType: 805306368 userPrincipalName: radtest(a)xxxx1.xxxx2.edu objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=xxxx1,DC=xxxx2,DC=edu 222222222222222222222222222222222222222222222222222222222222222222222222 22222222222222222222222 # testing, Users, xxxx1.xxxx2.edu dn: CN=testing,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu objectClass: user cn: testing givenName: testing distinguishedName: CN=testing,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu displayName: testing name: testing logonCount: 0 sAMAccountName: testing sAMAccountType: 805306368 userPrincipalName: testing(a)xxxx1.xxxx2.edu objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=xxxx1,DC=xxxx2,DC=edu ************************************************************************ *************************************** Here is the output from the localhost requesting "radtest on logon radtest" and the debug from the FreeRADIUS: [john@magellan ~]$ radtest radius\ test Passw0rd localhost 0 testing123 Sending Access-Request of id 62 to 10.1.1.27:1812 User-Name = "radius test" User-Password = "Passw0rd" NAS-IP-Address = localhost.xxxx1.xxxx2.edu NAS-Port = 0 rad_recv: Access-Accept packet from host 10.1.1.27:1812, id=62, length=20 And the debug.... Waking up in 31 seconds... Thread 5 got semaphore Thread 5 handling request 34, (7 handled so far) User-Name = "radius test" User-Password = "Passw0rd" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 34 modcall[authorize]: module "preprocess" returns ok for request 34 modcall[authorize]: module "mschap" returns noop for request 34 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 34 rlm_ldap: - authorize rlm_ldap: performing user authorization for radius test radius_xlat: '(cn=radius test)' radius_xlat: 'ou=Users,dc=xxxx1,dc=xxxx2,dc=EDU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Users,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=radius test) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user radius test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 34 modcall: group authorize returns ok for request 34 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 34 rlm_ldap: - authenticate rlm_ldap: login attempt by "radius test" with password "Passw0rd" rlm_ldap: user DN: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication 1 rlm_ldap: bind as CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu/Passw0rd to xxxx1.xxxx2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user radius test authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 34 modcall: group Auth-Type returns ok for request 34 Sending Access-Accept of id 62 to 10.1.1.27:32858 Finished request 34 Going to the next request Thread 5 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 34 ID 62 with timestamp 43c3bea7 Nothing to do. Sleeping until we see a request.

1 0

Freeradius 1.1.0 & Mysql 5.x
by Chadwick Sorrell 10 Jan '06

10 Jan '06

Hello, I am trying to get freeradius 1.1.0 up with mysql 5.0 and it is giving me trouble. radiusd -X shows that the sql connection is established but radiusd doesn't limit the connections based on num_sql_socks and it continues to connect until my mysql hits its max connections. At that point it begins this... rlm_sql ((null)): Attempting to connect rlm_sql_mysql #299 rlm_sql_mysql: Starting connect to MySQL server for #299 rlm_sql ((null)): Connected new DB handle, #299 rlm_sql ((null)): starting 300 rlm_sql ((null)): Attempting to connect rlm_sql_mysql #300 rlm_sql_mysql: Starting connect to MySQL server for #300 rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@localhost :radius rlm_sql_mysql: Mysql error 'Too many connections' rlm_sql ((null)): Failed to connect DB handle #300 rlm_sql ((null)): starting 301 rlm_sql ((null)): starting 302 rlm_sql ((null)): starting 303 rlm_sql ((null)): starting 304 and it continues until i Ctrl-C it Anyone have any ideas? Thanks, Chad

3 5

problems with CHAP authentication
by Przemysław Backiel 10 Jan '06

10 Jan '06

Hello, I have big problem with CHAP in Freeradius. I tried versions 1.0.2 and 1.0.5 and I heve the same error. While I'm loging using Rasppoe I have errors in freeradius debug: rad_recv: Access-Request packet from host 127.0.0.1:2294, id=219, length=88 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" CHAP-Password = 0x4cffb4ccb24a90a9c115c4827aa8748301 Calling-Station-Id = "00:13:D4:EB:68:01" NAS-IP-Address = 194.88.154.12 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Using clear text password rtest for user test authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. my user file look just like this: test Auth-Type = Local, Password == "rtest" Framed-Protocol = PPP, Framed-IP-Address = 10.0.0.22 in radiusclient i write localhost and secret i use rp-pppoe-server 3.7 but in 3.5 I have got the same errors where is the error? what I have to change? -- Z powazaniem Przemyslaw Backiel

1 0

EAP-TLS and accounting are incompatible
by Marcos González 10 Jan '06

10 Jan '06

Hello, my name is Marcos, I wrote to this list some weeks ago. My problem was the freeradius accounting was working only for "session time" but "input-octets" and "output-octets" attributes weren't being sent by the NAS to the freeradius server. I was using EAP-TLS authentication. The NAS is a Cisco Aironet 1200, it's a WiFi network. Freeradius runs on a Fedora Core4, and it's version 1.0.4. Trying everything, I finally deactivated authentication. Let the network open... and then "input-octets" and "output-octets" started to come included in the accounting packages from the NAS! Now I'll try other EAP methods, but don't think EAP-TLS preventing the packet tracking from working to be normal. I'm doing something worng? It's a Cisco IOS bug? Thanks in advance.

1 0

Cisco to FreeRadius to AD-LDAP authentication
by Dickson, John 09 Jan '06

09 Jan '06

I have tried and nearly completely succeeded in authentication and authorization. The user is identified in LDAP just not provided access (rad_recv: Access-Reject packet from host 10.1.1.27:1812, id=121, length=20). Another issue I have is with the user login. In Windowz, a new user is created by providing the First name, middle initial and last name which is not their "User logon name". These credentials are distributed within AD-LDAP in the "CN=" fields using spaces to break the name. If this is not exactly how the "User logon name" is installed then radius request rejects authentication. An example would be: User Tom Thumb Logon tthumb CN=Tom Thumb sAMAccountName=radtest So when a request of the database occurrs using ldap lookup with "cn=tthumb" it fails and I do not know if there is another way around this but using sAMAccountName doesn't work either. I am hopeful that I am missing something. My question is, how do I get an "Accept" from the request and is there a way around the basedn naming conventions that will alllow FreeRadius to work with Windowz? Below is user "testing" with a logon of "testing". rlm_ldap: - authorize rlm_ldap: performing user authorization for testing radius_xlat: '(cn=testing)' radius_xlat: 'ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication 0 rlm_ldap: bind as superuser(a)xxxx1.xxxx2.edu/password <mailto:superuser@xxxx1.xxxx2.edu/password> to xxxx1.xxxx2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=testing) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32803, id=121, length=59 Sending Access-Reject of id 121 to 10.1.1.27:32803 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 121 with timestamp 43c2d99f Nothing to do. Sleeping until we see a request.

2 1

What is this "group authentication"?
by Gary Algier 09 Jan '06

09 Jan '06

Hi: I am trying to use the WinXP supplied supplicant and I am getting: modcall: group authenticate returns invalid for request 41 Can someone give me a hint as to what this means? When I use the WinXP bulitin supplicant in "Automatically use my Windows login..." mode, Freeradius fails with the group authentication message. If I uncheck that and type a login and password (but not a domain), it works fine. It never does any sort of group check. If I supply a domain, it does the group check (and fails). When does it check groups? What is it checking? I am using Freeradius 1.0.5, Sun's DS (with Samba attributes loaded), and WinXP SP2. BTW: I am stripping the hostname when doing the user lookups in LDAP using this: filter = "(&(objectclass=person)(uid=%{exec:/etc/ulcmit/raddb/nodomain %{User-Name}}))" where "nodomain" strips the domain portion. My LDAP lookups work fine. -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

2 4