- Freeradius-Users - lists.freeradius.org

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alhagie Puye Sent: Mon 1/2/2006 3:43 PM To: FreeRadius users mailing list Subject: RE: FreeRADIUS with PEAP problems ________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 2:28 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems Ok, I found what the problem is....thanks to Zoltan. The last "}" should have been before the "peap" section. I had accidentally placed the "peap" section inside the "tls" section. I have changed the eap.conf file to look like this now and it works fine. eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } peap { default_eap_type = mschapv2 } mschapv2 { } } Thanks everybody that give me a hand. Alhagie. Thanks Alan for the reply. The "peap" section was already uncommented. Here is exactly what my eap.conf file looks like (I have removed every line that is commented) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random peap { default_eap_type = mschapv2 } mschapv2 { } } } Thanks, Alhagie. "Alhagie Puye" <APuye(a)datawave.com> wrote: > rlm_eap: Loaded and initialized type tls > rlm_eap: No such sub-type for default EAP type peap Try reading eap.conf, and uncommenting the "peap" section. I'm not sure how to make that error message more descriptive, or update the comments in eap.conf so that people will *read* them. Alan DEKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request. This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 2:28 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems Thanks Alan for the reply. The "peap" section was already uncommented. Here is exactly what my eap.conf file looks like (I have removed every line that is commented) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random peap { default_eap_type = mschapv2 } mschapv2 { } } } Thanks, Alhagie. "Alhagie Puye" <APuye(a)datawave.com> wrote: > rlm_eap: Loaded and initialized type tls > rlm_eap: No such sub-type for default EAP type peap Try reading eap.conf, and uncommenting the "peap" section. I'm not sure how to make that error message more descriptive, or update the comments in eap.conf so that people will *read* them. Alan DEKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

wireless - freeradius - MS ldap
by Dickson, John 02 Jan '06

02 Jan '06

I am looking for a little direction configuring a Freeradius server that will authenticate wireless clients from Cisco to MS LDAP. 1.Wireless - 2.Cisco - 3.Radius - 4.Windows LDAP Looking to see if someone has already done this. John

2 1

freeRADIUS + openLDAP
by Carlo Prestopino 02 Jan '06

02 Jan '06

Hi all, I'm trying to develop a prepaid solution for Wi-Fi users based on freeRADIUS+openLDAP. Hotspot gateway, working as NAS, is Mikrotik (www.mikrotik.com).Does anybody have links to already developed (and working) projects that uses the same architecture? Main problem is: how to let freeRADIUS know that user's usage limit expired? Regards, Carlo

2 1

FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

Hello all, I am trying to configure FreeRADIUS with PEAP support. Here are my specs: OS: FreeBSD 5.4 OpenSSL: version 0.9.7d FreeRADIUS: 1.0.5 I have tested the configuration with EAP/TLS and it works just fine however, when I change "default_eap_type = tls" to "default_eap_type = peap" in the eap.conf file, I'm getting.... Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "XXXXXXXX" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: No such sub-type for default EAP type peap Bus error (core dumped) bash-2.05b# I have found this article from 2004 (http://lists.freeradius.org/pipermail/freeradius-users/2004-October/036 946.html). I'm not sure if this applies to me. Any help is greatly appreciated Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 2

FreeRadius and Openldap authentication
by rwakim＠mind-techno.fr 02 Jan '06

02 Jan '06

Hello, I'm pretty new to ldap and radius, I try to put and 802.x authentication but I have difficulties setting it up correctly. Here is my problem: When I start the radtest binary: radtest "test" "supersecret" localhost 2 testing123 Here is the result: Sending Access-Request of id 45 to 127.0.0.1:1812 User-Name = "test" User-Password = "supersecret" NAS-IP-Address = lavoisier NAS-Port = 2 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=45, length=20 Here is the log on the radius server (Started with radiusd -X): rad_recv: Access-Request packet from host 127.0.0.1:61292, id=50, length=56 User-Name = "test" User-Password = "supersecret" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 78 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'dc=fr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=fr, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by radiusFilterId rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value Enterasys:version=1:policy=Enterprise User & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns ok for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 3 modcall: group authenticate returns fail for request 3 auth: Failed to validate the user. Login incorrect: [test] (from client localhost port 2) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 50 to 127.0.0.1:61292 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 50 with timestamp 43b8f992 Nothing to do. Sleeping until we see a request. For the moment I have one box running Openldap on a debian/SPARC and one box running Freeradius on a FreeBSD 5.3/SPARC The LDAP user info: dn: cn=test,ou=users, dc=fr userPassword:: e1NIQX1jTWc1Y3dTazFuUEdMZW56UUw5UEdpV1pHSVU9 ou: ou=mind-techno,dc=fr objectClass: top objectClass: person objectClass: pilotPerson objectClass: radiusProfile janetMailbox: test(a)mind-techno.fr sn: test cn: test The SLDAPD conf file: access to dn="cn=.*,dc=fr" attr=userPassword by dn="cn=admin,dc=fr" write by anonymous auth by self write by * none The RADIUS radiusd.conf file: ldap { server = "galilee.mind-techno.fr" identity = "cn=emanager,dc=fr" password = "XXXXXXXXXXXXXX" basedn = "dc=fr" filter = "(uid=%u)" # base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "radiusFilterId" dictionary_mapping = ${raddbdir}/ldap.attrmap #authtype = ldap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authenticate { # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap } # # Allow EAP authentication. eap } The RADIUS users file: DEFAULT Auth-Type := EAP Fall-Through = 1 # Reply-Message = "LDAP" I must admit I'm pretty lost in all this, And that any help will be nice. I would be grateful if you had a how-to or tutorial on how to build a easy and working 802.x authentication with a Radius/LDAP system. Best regards, -- M. Robert Wakim Mind Technologies 24 rue Victor Hugo 94220 Charenton-Le-Pont FRANCE tel : +33 (0)1 41 79 09 40 Fax : +33 (0)1 43 68 80 32 Email : rwakim(a)mind-techno.fr web : http://www.mind-techno.fr

5 4

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

I went ahead and recompiled from source and also used the --disable-shared options. It is not core-dumping but PEAP is still failing though Here is a complete debug output as you requested: freebsd# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "orion.puyenet.com" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=administrator,ou=users,dc=ad,dc=puyenet,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "DC=ad,DC=puyenet,DC=com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "M4a8ccarthy6" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x80b3780 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "XXXXXXXXX" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: No such sub-type for default EAP type peap radiusd.conf[9]: eap: Module instantiation failed. freebsd# Thanks, Alhagie. ________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Zoltan A. Ori Sent: Mon 1/2/2006 8:38 AM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems On Monday 02 January 2006 07:34, Alhagie Puye wrote: > > >Do you have > > > > > > peap { > > > default_eap_type = mschapv2 > > > } > > > > > >in your eap.conf? > > Yes, I do. And, was MSCHAP instantiated? A complete debug output might help since the problem may begin elsewhere and only manifest itself as an error when dependencies are required. Zoltan Ori - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Zoltan A. Ori > >Sent: January 2, 2006 3:58 AM > >To: FreeRadius users mailing list > >Subject: Re: FreeRADIUS with PEAP problems > > > >On Monday 02 January 2006 06:32, Alhagie Puye wrote: > > > >> rlm_eap: Loaded and initialized type tls > >> rlm_eap: No such sub-type for default EAP type peap Bus > >error (core > >> dumped) bash-2.05b# > >> > > > >Do you have > > > > peap { > > default_eap_type = mschapv2 > > } > > > >in your eap.conf? Yes, I do. > > > > > >Zoltan Ori > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 2

cant compile version 1.05 on red hat as 3
by alfonso 02 Jan '06

02 Jan '06

I get invalid option when compiling mysl, were can I modify Making static in rlm_sql_mysql... gmake[10]: Cambiando a directorio `/root/freer/freeradius-1.0.5/src/sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_K _GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align - -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations - s -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/u ql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector uffer-size=4 -m32 -march=i386 -mtune=pentium4 -fasynchronous-unwin U_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-al -I/root/freer/freeradius-1.0.5/libltdl -c sql_mysql.c -o sql_mysq cc1: opci├│n `tune=pentium4' invílida cc1: opci├│n `--fstack-protector' no reconocida cc1: opci├│n `--fwrapv' no reconocida cc1: el par├ímetro `ssp-buffer-size' es inv├ílido gmake[10]: *** [sql_mysql.o] Error 1 Un saludo, Alfonso Guerendiain oliver

2 1

Peap mschapv2 proxy early termination of EAP
by Andy Goy 02 Jan '06

02 Jan '06

Hi Alan I have a number of XP and Windows 2K wifi clients to Proxim AP700 AP's using FreeRADIUS on Fedora C4 These use eap peap mschapv2 The system works well on ver 1.0.2 using usernames/passwords in the users file or by configuring LDAP and using a LDAP database, and logs to mysql I now need to authenticate by proxy to a legacy SteelBelted radius server capable of PAP,CHAP and MSCHAPv2 but not able to support EAP I configured the proxy.conf for the realm wifi (with nostrip) and I can communicate with the legacy server, it sends back a reject due to not supporting EAP I therefore need to terminate EAP on Freeradius and pass on the MSchapv2 to the proxy server Having read all I can on early termination of EAP I added the LOCAL realm realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } I have added 2 lines to the users file DEFAULT FreeRADIUS-Proxied-To !* 127.0.0.1, Proxy-To-Realm := LOCAL, Auth-Type = EAP (line 167) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := wifi (line 168) The first line (at line 167) causes the proxy to be cancelled and the eap is handled locally, it gets to the mschapv2 part matched (at line 168) It appears as if its going to send the request to wifi, with no EAP, then it stops. The AP then retries the request, with the same result. This seems to be due to WARNING: Cancelling proxy to Realm LOCAL, as the realm is local rather than proxying only the mschapv2 to wifi I have upgraded to v 1.0.5 I still get the same results Authorise and accounting in radiusd.conf has EAP and mschap Is it possible ? I have researched from your site as much as possible before asking, Am I missing a configuration option? Your help would be much appreciated, Thanks Andy. eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random include_length = yes # check_crl = yes # check_cert_cn = %{User-Name} } # peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } mschapv2 { } } Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.24.2.10:6001, id=40, length=154 User-Name = "andygoy@wifi" NAS-IP-Address = 172.24.2.10 Called-Station-Id = "00-20-a6-56-3a-4a:XXHOTSPOTFC1" Calling-Station-Id = "00-13-ce-0e-f5-c6" NAS-Identifier = "XX-HOTSPOT-1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202001101616e6479676f794077696669 Message-Authenticator = 0x206d804b1c31514e5743b1c03efdfcaf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/etc/var/log/radius/radacct/172.24.2.10/auth-detail-20051230' rlm_detail: /etc/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /etc/var/log/radius/radacct/172.24.2.10/auth-detail-20051230 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "wifi" for User-Name = "andygoy@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user andygoy to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm wifi. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched entry DEFAULT at line 167 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 WARNING: Cancelling proxy to Realm LOCAL, as the realm is local Sending Access-Challenge of id 40 to 172.24.2.10 port 6001 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0b7df43e9fc35a77966d3c95bb99a754 Finished request 0 Going to the next request etc etc----------------------------------------------------------------------- rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to andygoy@wifi PEAP: Adding old state with 0e aa Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/etc/var/log/radius/radacct/127.0.0.1/auth-detail-20051230' rlm_detail: /etc/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /etc/var/log/radius/radacct/127.0.0.1/auth-detail-20051230 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 rlm_realm: Looking up realm "wifi" for User-Name = "andygoy@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user andygoy to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 6 rlm_eap: Request is supposed to be proxied to Realm wifi. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 users: Matched entry DEFAULT at line 168 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 PEAP: Calling authenticate in order to initiate tunneled EAP session. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Not-EAP proxy set. Not composing EAP modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Tunneled authentication will be proxied to wifi PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Tunneled session will be proxied. Not doing EAP. modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 WARNING: Cancelling proxy to Realm LOCAL, as the realm is local Finished request 6 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 172.24.2.10:6001, id=46, length=249 The content of this e-mail and any attachment is private and may be legally privileged. If you are not the intended recipient, any use, disclosure, copying or forwarding of this e-mail and/or its attachments is unauthorised. If you have received this e-mail in error please notify the sender by e- mail and delete this message and any attachments immediately from this system. Kingston Communications (HULL) PLC is a public limited company incorporated in England and Wales with registration number 02150618 and whose registered office is at 37 Carr Lane, Hull HU1 3RE

2 1