- Freeradius-Users - lists.freeradius.org

Interesting EAP-TLS condition, any insights?
by Timothy J. Miller 03 Jan '06

03 Jan '06

This is a neat one. EAP-TLS is working just fine between an XP supplicant, a Cisco AP1200 WAP running 12.3(4)JA, and FreeRADIUS 1.0.1 (plus a patch to allow multiple root CAs for EAP-TLS trust). Client certificates are on smartcards, and the AP has a reauthentication timer set, with the intent that clients will be kicked off the WLAN (eventually) when the card is removed (since without the card reauthentication can't complete). Only it doesn't seem to work that way. What appears to happen is this: The authentication starts but never completes, since the client can't complete the TLS handshake without the smartcard inserted (and PIN entered). FreeRADIUS blocks at the "Requiring client certificate" step, as I would expect. However, the AP holds the authentication pending but *leaves the client fully connected*. This means that as long as an incomplete reauthentication is pending, a previously-authenticated client remains online. Not the effect I was looking for. The Cisco AP has an optional setting for RADIUS timeout, but this only seems to apply for the initial packet; since the RADIUS server responded to the initial access-request, that timeout doesn't apply. I tried ramping down max_request_time and setting delete_blocked_requests to yes, but it didn't have any effect; FreeRADIUS never sends an access-reject. There appear to be no controls on XP to force a complete deauthentication after a timeout that I can find. Will porting forward to current rev address this, or does anyone else have an insight? -- Tim

3 6

RE: wireless - freeradius - MS ldap
by Alhagie Puye 03 Jan '06

03 Jan '06

Where is the rest of the debug output from the radius server? That portion would be more helpful in trying to determine the problem... Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 3, 2006 9:03 AM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > >OK. In the radius.conf under module configuration I have "ldap" > >information pointing to the LDAP server and the authentication fails. > >First I run: > > /usr/local/sbin/radiusd -X -A > >With: > > > >[root@magellan john]# /usr/local/sbin/radiusd -X -A > >Starting - reading configuration files ... > >reread_config: reading radiusd.conf > >Config: including file: /etc/raddb/clients.conf > >Config: including file: /etc/raddb/snmp.conf > >Config: including file: /etc/raddb/eap.conf > >Config: including file: /etc/raddb/sql.conf > > main: prefix = "/usr" > > main: localstatedir = "/var" > > main: logdir = "/var/log/radius" > > main: libdir = "/usr/lib" > > main: radacctdir = "/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = no > > main: log_file = "/var/log/radius/radius.log" > > main: log_auth = no > > main: log_auth_badpass = no > > main: log_auth_goodpass = no > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > main: user = "nobody" > > main: group = "nobody" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/sbin/checkrad" > > main: proxy_requests = yes > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > >read_config_files: reading dictionary > >read_config_files: reading naslist > >Using deprecated naslist file. Support for this will go away soon. > >read_config_files: reading clients > >read_config_files: reading realms > >radiusd: entering modules setup > >Module: Library search path is /usr/lib > >Module: Loaded exec > > exec: wait = yes > > exec: program = "(null)" > > exec: input_pairs = "request" > > exec: output_pairs = "(null)" > > exec: packet_type = "(null)" > >rlm_exec: Wait=yes but no output defined. Did you mean output=none? > >Module: Instantiated exec (exec) > >Module: Loaded expr > >Module: Instantiated expr (expr) > >Module: Loaded LDAP > > ldap: server = "ssotest.mccsso.mccneb.edu" > > ldap: port = 389 > > ldap: net_timeout = 1 > > ldap: timeout = 4 > > ldap: timelimit = 3 > > ldap: identity = "dmadmin1"" > > ldap: tls_mode = no > > ldap: start_tls = no > > ldap: tls_cacertfile = "(null)" > > ldap: tls_cacertdir = "(null)" > > ldap: tls_certfile = "(null)" > > ldap: tls_keyfile = "(null)" > > ldap: tls_randfile = "(null)" > > ldap: tls_require_cert = "allow" > > ldap: password = "rDkf@mh" > > ldap: basedn = "ou=Metro users,dc=mccsso,dc=mccneb,dc=edu" > > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > ldap: base_filter = "(objectclass=radiusprofile)" > > ldap: default_profile = "(null)" > > ldap: profile_attribute = "(null)" > > ldap: password_header = "(null)" > > ldap: password_attribute = "(null)" > > ldap: access_attr = "dialupAccess" > > ldap: groupname_attribute = "cn" > > ldap: groupmembership_filter = > >"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obj > >ectClass=Gr > >oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > ldap: groupmembership_attribute = "(null)" > > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > > ldap: ldap_debug = 0 > > ldap: ldap_connections_number = 5 > > ldap: compare_check_items = no > > ldap: access_attr_used_for_allow = yes > > ldap: do_xlat = yes > >rlm_ldap: Registering ldap_groupcmp for Ldap-Group > >rlm_ldap: Registering ldap_xlat with xlat_name ldap > >rlm_ldap: reading ldap<->radius mappings from file > >/etc/raddb/ldap.attrmap > >rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > >rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > >rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > >rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS > >Simultaneous-Use > >rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS > >Called-Station-Id > >rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS > >Calling-Station-Id > >rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > >rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password > >rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > >rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > >rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > >rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > >rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS > >Framed-IP-Address > >rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS > >Framed-IP-Netmask > >rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > >rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > >rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > >rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > >rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS > >Framed-Compression > >rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > >rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > >rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > >rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > >rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > >rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS > >Framed-IPX-Network > >rlm_ldap: LDAP radiusClass mapped to RADIUS Class > >rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > >rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > >rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS > >Termination-Action > >rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS > >Login-LAT-Service > >rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > >rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > >rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > >Framed-AppleTalk-Link > >rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > >Framed-AppleTalk-Network > >rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > >Framed-AppleTalk-Zone > >rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > >rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > >conns: 0x8d5c4d0 > >Module: Instantiated ldap (ldap) > >Module: Loaded preprocess > > preprocess: huntgroups = "/etc/raddb/huntgroups" > > preprocess: hints = "/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > >Module: Instantiated preprocess (preprocess) > >Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > >Client-IP-Address, NAS-Port" > >Module: Instantiated acct_unique (acct_unique) > >Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > realm: ignore_default = no > > realm: ignore_null = no > >Module: Instantiated realm (suffix) > >Module: Loaded files > > files: usersfile = "/etc/raddb/users" > > files: acctusersfile = "/etc/raddb/acct_users" > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > files: compat = "no" > >Module: Instantiated files (files) > >Module: Loaded detail > > detail: detailfile = > >"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > >Module: Instantiated detail (detail) > >Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "/etc/shadow" > > unix: group = "(null)" > > unix: radwtmp = "/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > >Module: Instantiated unix (unix) > >Module: Loaded radutmp > > radutmp: filename = "/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > >Module: Instantiated radutmp (radutmp) > >Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > eap: ignore_unknown_eap_types = no > > eap: cisco_accounting_username_bug = no > >rlm_eap: Loaded and initialized type md5 > >rlm_eap: Loaded and initialized type leap > > gtc: challenge = "Password: " > > gtc: auth_type = "PAP" > >rlm_eap: Loaded and initialized type gtc > > mschapv2: with_ntdomain_hack = no > >rlm_eap: Loaded and initialized type mschapv2 > >Module: Instantiated eap (eap) > >Listening on authentication *:1812 > >Listening on accounting *:1813 > >Ready to process requests. > > > > radtest radtest Passw0rd name.domain.edu 1 testing123 > > > >Sending Access-Request of id 116 to 10.1.1.27:1812 > > User-Name = "radtest" > > User-Password = "Passw0rd" > > NAS-IP-Address = name.domain.edu > > NAS-Port = > > > >-----Original Message----- > >From: > >freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org > >[mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.f > >reeradius.o > >rg] On Behalf Of Alan DeKok > >Sent: Monday, January 02, 2006 4:56 PM > >To: FreeRadius users mailing list > >Subject: Re: wireless - freeradius - MS ldap > > > >"Dickson, John" <JDickson2(a)mccneb.edu> wrote: > >> I am looking for a little direction configuring a > >Freeradius server > >> that will authenticate wireless clients from Cisco to MS LDAP. > >> > >> 1.Wireless - 2.Cisco - 3.Radius - 4.Windows LDAP > >> > >> Looking to see if someone has already done this. > > > > Lots of people. See radiusd.conf. Look for "windows domain". > > > > Alan DeKok. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: Freeradius probleming help me
by Alhagie Puye 03 Jan '06

03 Jan '06

Which port is your Dlink switch sending radius packet to? Most "new" devices use 1812 instead of 1645. Please investigate that first... If the Dlink is sending to port 1812, then just make sure you have "port = 0" in the radiusd.conf file. This will take care of that problem. Both devices have to be talking through the same port. Hope that helps. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Kai Geek > >Sent: January 3, 2006 12:10 AM > >To: freeradius-users(a)lists.freeradius.org > >Subject: Freeradius probleming help me > > > >Hello, > > > >root@kaigeek:/etc/raddb# radiusd -p 1645 > >Ignoring deprecated command-line option -pTue Jan 3 > >10:06:51 2006 : Info: Starting - reading configuration files ... > > > >why problem on radiusd ? > > > >root@kaigeek:/etc/raddb# radiusd -X > >Starting - reading configuration files ... > >reread_config: reading radiusd.conf > >Config: including file: /etc/raddb/clients.conf > >Config: including file: /etc/raddb/eap.conf > >Config: including file: /etc/raddb/sql.conf > > main: prefix = "/usr/local" > > main: localstatedir = "/var" > > main: logdir = "/var/log/radius" > > main: libdir = "/usr/local/lib" > > main: radacctdir = "/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 1645 > > main: allow_core_dumps = no > > main: log_stripped_names = no > > main: log_file = "/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = no > > main: log_auth_goodpass = no > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > main: bind_address = 10.0.0.6 IP address [10.0.0.6] > > main: user = "root" > > main: group = "(null)" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/local/sbin/checkrad" > > main: proxy_requests = yes > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > >read_config_files: reading dictionary > >read_config_files: reading naslist > >Using deprecated naslist file. Support for this will go away soon. > >read_config_files: reading clients > >read_config_files: reading realms > >radiusd: entering modules setup > >Module: Library search path is /usr/local/lib > >Module: Loaded exec > > exec: wait = yes > > exec: program = "(null)" > > exec: input_pairs = "request" > > exec: output_pairs = "(null)" > > exec: packet_type = "(null)" > >rlm_exec: Wait=yes but no output defined. Did you mean output=none? > >Module: Instantiated exec (exec) > >Module: Loaded expr > >Module: Instantiated expr (expr) > >Module: Loaded PAP > > pap: encryption_scheme = "crypt" > >Module: Instantiated pap (pap) > >Module: Loaded CHAP > >Module: Instantiated chap (chap) > >Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: with_ntdomain_hack = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > mschap: ntlm_auth = "(null)" > >Module: Instantiated mschap (mschap) > >Module: Loaded DIGEST > >Module: Instantiated digest (digest) > >Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > >Module: Instantiated unix (unix) > >Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > eap: ignore_unknown_eap_types = no > > eap: cisco_accounting_username_bug = no > >rlm_eap: Loaded and initialized type md5 > >rlm_eap: Loaded and initialized type leap > > gtc: challenge = "Password: " > > gtc: auth_type = "PAP" > >rlm_eap: Loaded and initialized type gtc > > mschapv2: with_ntdomain_hack = no > >rlm_eap: Loaded and initialized type mschapv2 > >Module: Instantiated eap (eap) > >Module: Loaded detail > > detail: detailfile = > >"/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > >Module: Instantiated detail (auth_log) > >Module: Loaded attr_filter > > attr_filter: attrsfile = "/etc/raddb/attrs" > > rlm_attr_filter: Authorize method will be deprecated. > >Module: Instantiated attr_filter (attr_filter) > >Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > realm: ignore_default = no > > realm: ignore_null = no > >Module: Instantiated realm (suffix) > >Module: Loaded files > > files: usersfile = "/etc/raddb/users" > > files: acctusersfile = "/etc/raddb/acct_users" > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > files: compat = "no" > >Module: Instantiated files (files) > >Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, > >NAS-IP-Address, Client-IP-Address, NAS-Port" > >Module: Instantiated acct_unique (acct_unique) > > detail: detailfile = > >"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > >Module: Instantiated detail (detail) > >Module: Loaded radutmp > > radutmp: filename = "/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > >Module: Instantiated radutmp (radutmp) > >Listening on authentication 10.0.0.6:1645 > >Listening on accounting 10.0.0.6:1646 > >Listening on proxy 10.0.0.6:1647 > >Ready to process requests. > > > > > > > >#vi users > >steve Auth-Type := System > > Service-Type = Shell-User, > > Login-Service = Telnet, > > Login-IP-Host = 0.0.0.0, > > Login-TCP-Port = Telnet > > > >#vi clients.conf > >client 10.0.0.250 { > > secret = 250 > > shortname = switch > > nastype = dlink > >} > > > > > > > >i am not authentication radius server and dlink switch. > >what is problem ? > > > >#pico /etc/services > ># IMPORTANT NOTE: Ports 1645/1646 are the traditional radius > >ports used by > ># many vendors without obtaining official IANA assignment. > >The official > ># assignment is now ports 1812/1813 and users are encouraged > >to migrate > ># when possible to these new ports. > >radius 1645/udp #RADIUS authentication protocol (old) > >radacct 1646/udp #RADIUS accounting protocol (old) > > > > > > > >help me please... > > > >+-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > >Version: GnuPG v1.4.2 (GNU/Linux) > > .-. .-. _ > > : : : : :_; > > .-' : .--. : `-. .-. .--. ,-.,-. > >' .; :' '_.'' .; :: :' .; ; : ,. : > >`.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > > >Kai "Ozgur" Geek > >Network Engineer > >PGP ID: B1B63B6E > >+-+-+-+ END PGP SIGNATURE +-+-+-+ > > > > > >-- > >_______________________________________________ > >Check out the latest SMS services @ http://www.linuxmail.org > >This allows you to send and receive SMS through your mailbox. > > > >Powered by Outblaze > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Nas emulator under linux
by Marco Spiga 03 Jan '06

03 Jan '06

Hello!! Where I can find a linux-based nas authenticator in order to simulate vary types of authentications? Thanks Marco -- !!!!! Messaggio da Marco !!!!!

1 0

RE: Peap mschapv2 proxy early termination of EAP
by Andy Goy 03 Jan '06

03 Jan '06

> -----Original Message----- > From: Andy Goy > Sent: Friday, December 30, 2005 1:34 PM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: Peap mschapv2 proxy early termination of EAP > > Hi Alan Thanks for the reply Andy Goy <Andy.Goy(a)kcom.com> wrote: > I have added 2 lines to the users file > > DEFAULT FreeRADIUS-Proxied-To !* 127.0.0.1, Proxy-To-Realm := LOCAL, > Auth-Type = EAP (line 167) > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := wifi > (line 168) The first line is unnecessary. Delete it. Alan DeKok. Without the first line the request goes straight out as EAP-MSCHAPv2 to the proxy server. With a lot more digging in the lists, I found a number of comments regarding my problem Don't include a realm for the initial (outer) realm and make an the inner realm that contains the proxy server settings as unique Write a common detail file and use radrelay to proxy accounting (also questions asking how to just get the realm variable) to select the correct proxy server for accounting This improved things, but the real solution was to include a ream for the outer pointing to LOCAL, and point the inner to the correct proxy server This then provides the %Realm variable to write a detail-combined file for each realm (using suffix) Two radrelays send accounting to the correct servers Thanks for all your comments in the lists Its a wonderful piece of software/work The following config works a treat for me, I just need to purchase/install a real signed certificate now !! I hope it's correct and maybe helps someone Regards Andy To proxy peap EAP mschap-v2 to a proxy server that only supports mschapv2 (and send accounting) Users logging in using username@wifi and username@isp2 users DEFAULT User-Name =~ "@wifi$", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-wifi Fall-Through = Yes DEFAULT User-Name =~ "@isp2$", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-isp2 Fall-Through = Yes radiusd.conf Detail{ detailfile = ${radacctdir}/%{Realm}/detail-combined detailperm = 0600 } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random # Check the Certificate Revocation List # check_crl = yes # check } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no use_tunneled_reply = yes copy_request_to_tunnel = yes } mschapv2 { } } Proxy.conf realm wifi { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm inner-wifi { type = radius authhost = xxxxxxxxxx:1645 accthost = xxxxxxxxxx:1646 secret = wifisecret nostrip } realm isp2 { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm inner-isp2 { type = radius authhost = xxxxxxxx:1812 accthost = xxxxxxxx:1813 secret = isp2secret nostrip } Radrelay command for wifi realm radrelay -a (your accounting dir/radacct/wifi -d /etc/raddb -r (address of wifi proxy:port) -s wifisecret detail-combined Radrelay command for isp2 realm /radacct/isp2 (address of isp2 proxy:port) The content of this e-mail and any attachment is private and may be legally privileged. If you are not the intended recipient, any use, disclosure, copying or forwarding of this e-mail and/or its attachments is unauthorised. If you have received this e-mail in error please notify the sender by e- mail and delete this message and any attachments immediately from this system. Kingston Communications (HULL) PLC is a public limited company incorporated in England and Wales with registration number 02150618 and whose registered office is at 37 Carr Lane, Hull HU1 3RE

1 0

authorize and authenticate methods ina custom module
by Susana Macias 03 Jan '06

03 Jan '06

Hy all, I have started working with the RADIUS protocol (and with FreeRadius in particular) three weeks ago. Congratulations for the product, it is really powerful! Now I want to develop a custom module. I have been reading some documents (module_interface, configurable_failover, the rlm_example skeleton...) but I have a pair of doubts. When a module is loaded, its init() method is called. After the init() method, the instantiate() method is called. The detcah() method is called when the server is being shut down, and afterwards the destroy() method. But, when are the authorize() and authenticate() methods called? Is it necessary to include in the radiusd.conf the name of the instance (of the new module created) in the authorize section in order to call its authorize() method? Sorry if these questions are already answered or are stupid, but I am doing my best to understand FreeRadius Best regards, Susana Pd: sorry if my english is not enough good. I will try to explain me better if you request me :-) --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

Freeradius probleming help me
by Kai Geek 03 Jan '06

03 Jan '06

Hello, root@kaigeek:/etc/raddb# radiusd -p 1645 Ignoring deprecated command-line option -pTue Jan 3 10:06:51 2006 : Info: Starting - reading configuration files ... why problem on radiusd ? root@kaigeek:/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.6 IP address [10.0.0.6] main: user = "root" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.0.6:1645 Listening on accounting 10.0.0.6:1646 Listening on proxy 10.0.0.6:1647 Ready to process requests. #vi users steve Auth-Type := System Service-Type = Shell-User, Login-Service = Telnet, Login-IP-Host = 0.0.0.0, Login-TCP-Port = Telnet #vi clients.conf client 10.0.0.250 { secret = 250 shortname = switch nastype = dlink } i am not authentication radius server and dlink switch. what is problem ? #pico /etc/services # IMPORTANT NOTE: Ports 1645/1646 are the traditional radius ports used by # many vendors without obtaining official IANA assignment. The official # assignment is now ports 1812/1813 and users are encouraged to migrate # when possible to these new ports. radius 1645/udp #RADIUS authentication protocol (old) radacct 1646/udp #RADIUS accounting protocol (old) help me please... +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

freeradius-1.0.5 compilation error (library -lz not found)
by K Pang 03 Jan '06

03 Jan '06

Hi All, Happy New Year to all of you! i encounterd some compilation errors when compiling freeradius-1.0.5 on solaris 8. below is the errors. /usr/local/src/freeradius-1.0.5-pi/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/local/ssl/include -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include \ -I/usr/local/mysql/include -I/usr/local/src/freeradius-1.0.5-pi/libltdl -o rlm_sql_mysql.la -rpath /usr/local/radius5/lib sql_mysql.lo -L/usr/local/mysql/lib/mysql -lmysqlclient -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz rm -fr .libs/rlm_sql_mysql.la .libs/rlm_sql_mysql.* .libs/rlm_sql_mysql-1.0.5.* /usr/ccs/bin/ld -G -h rlm_sql_mysql-1.0.5.so -o .libs/rlm_sql_mysql-1.0.5.so sql_mysql.lo -R/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/local/BerkeleyDB.4.2 -L/usr/local/mysql/lib/mysql /usr/local/mysql/lib/mysql/libmysqlclient.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lc ld: fatal: library -lz: not found ld: fatal: library -lz: not found ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-1.0.5.so make[10]: *** [rlm_sql_mysql.la] Error 1 make[10]: Leaving directory `/usr/local/src/freeradius-1.0.5-pi/src/modules/rlm_sql/drivers/rlm_sql_mysql' what's 'library -lz not found'? i've no idea what's this library. is it caused by missing of certain packages? if so, which package should i install? pls advise. thanks in advance! Rgds, Pang

2 1

freeradius-1.0.5 compilation error (library -lz not found)
by K Pang 03 Jan '06

03 Jan '06

Hi All, Happy New Year to all of you! i encounterd some compilation errors when compiling freeradius-1.0.5 on solaris 8. below is the errors. /usr/local/src/freeradius-1.0.5-pi/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/local/ssl/include -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include \ -I/usr/local/mysql/include -I/usr/local/src/freeradius-1.0.5-pi/libltdl -o rlm_sql_mysql.la -rpath /usr/local/radius5/lib sql_mysql.lo -L/usr/local/mysql/lib/mysql -lmysqlclient -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz rm -fr .libs/rlm_sql_mysql.la .libs/rlm_sql_mysql.* .libs/rlm_sql_mysql-1.0.5.* /usr/ccs/bin/ld -G -h rlm_sql_mysql-1.0.5.so -o .libs/rlm_sql_mysql-1.0.5.so sql_mysql.lo -R/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/local/BerkeleyDB.4.2 -L/usr/local/mysql/lib/mysql /usr/local/mysql/lib/mysql/libmysqlclient.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lc ld: fatal: library -lz: not found ld: fatal: library -lz: not found ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-1.0.5.so make[10]: *** [rlm_sql_mysql.la] Error 1 make[10]: Leaving directory `/usr/local/src/freeradius-1.0.5-pi/src/modules/rlm_sql/drivers/rlm_sql_mysql' what's 'library -lz not found'? i've no idea what's this library. is it caused by missing of certain packages? if so, which package should i install? pls advise. thanks in advance! Rgds, Pang

2 1

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 5:57 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems "Alhagie Puye" <APuye(a)datawave.com> wrote: > Here is exactly what my eap.conf file looks like (I have removed every = > line that is commented) ... > tls { ... > peap { > default_eap_type =3D mschapv2 > } <sigh> So you didn't just uncomment the "peap" section. You edited & re-arranged it. Your edits broke it. Yes, I did....the re-arranging part was completely unintentional. My apologies... :-( There's a simple solution: read the stock "eap.conf" again. Follow it's layout. It WORKS. Yes, you are absolutely right. It DOES work. Thanks for all your help!!!! Alhagie This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0