- Freeradius-Users - lists.freeradius.org

i need help to auth by using mac address in freeradius
by kdr akm 19 Oct '05

19 Oct '05

hi i made a pppoe-server with freeradius and i success to make it without mysql all going fine but i need to get authentication by mac address to my users ( username and password and mac address ) i need help guys thanks in advanced --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

1 0

specific realm accounting
by Chuck 19 Oct '05

19 Oct '05

Is there a way to have only 2 particular realms get entered into our local accounting database? We proxy for 34 realms and presently all their data as well as our 2 local auth realms are being posted into accounting which makes our accounting database really huge. I want to pass any accounting data I receive on to the downstream realms without keeping a record of it locally. I only want our 2 local domains to be in the accounting table. As long as all info we receive is passed along, we hae no need or desire to maintain data on any of our proxied realms other than the auth lines in radius.log. Is there a way to do this? We use mysql but soon will be converting to postgresql. -- Chuck

2 1

OT: Freeradius and Redback SMS 1800
by Dominik Sennfelder 19 Oct '05

19 Oct '05

Hello We are using Freeradius with two Redback SMS 1800 Authorizing and accounting works with mysql. Is it possible to log the IP-Address at the beginging of the accounting? I know that the readback is the device which has to be configured but perhaps sombody had a similar problem. Greets Dominik

2 1

Is rlm_perl a viable solution for production environments yet?
by Tim O'Donovan 18 Oct '05

18 Oct '05

Hi, I'm considering writing some Perl for use with the rlm_perl module, but before I do I need to know whether the module is ready for use in a production environment. Has anyone had any experience (both positive and negative) with rlm_perl, performance wise, that they could share with me to help my decision? Thanks. Kind regards, Tim O'Donovan

2 2

Ippool mysql....again :)
by Mark Novitzkas 18 Oct '05

18 Oct '05

Hi all Finally have ippool working but it seems my setting are messed-up somewhere Radiusd.conf ------------- ippool main_pool { range-start = x.x.x.x range-stop = x.x.x.x netmask = 255.255.255.0 cache-size = 800 session-db = /home/radius/db.ippool ip-index = /home/radius/db.ipindex override = yes Radius Db ---------- Radcheck mysql> select * from radcheck; +----+----------+---------------+----+---------------------------------- --+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+---------------------------------- --+ | 1 | tester | Pool-Name | == | main_pool | I get an access-reject message when sending a radtest? radtest tester <pass> 127.0.0.1 0 <secret> Does radcheck need the Pool-Name attribute? Where do you place the password for user tester in the sql DB? Thanks guys Mark Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

1 0

dialup admin
by Madhvi Gokool 18 Oct '05

18 Oct '05

Hi Documentation of dialup admin says it works with a database. My current users file is plain text ( I manually add users and their attributes). can dialup admin be tweaked to work with this users file? Or is there a script that we can use to facilitate the administration of the users file. Regards Madhvi

2 1

Question on FreeRADIUS digest authentication with SIP proxy
by Cheng Zhang 18 Oct '05

18 Oct '05

I have setup SER to authenticate via FreeRADIUS with MSSQL DB. The SIP proxy (SER) use digest authentication to authenticate with FreeRADIUS server. This way the user's password is stored as cleartext in the database. I'd like to know is there a way to make such setup using hashed password (just MD5 or HA1)? I asked this question on SER's mailing list, but seems cleartext password is the only way to do digest authentication with FreeRADIUS. After reading through RFC2617 and draft-ietf-radext-digest-auth-04, seems to me that if Digest-Algorithm attribute in RADIUS packet is 'MD5-sess', there is a Digest-HA1 attribute might be useful for my purpose. Is there any options to tweak FreeRADIUS's digest authentication mode, something like 'auth_type' or 'encrypt_method' for MSCHAP or other authentication methods? Thanks.

2 4

Problem identify to RADIUS server (ssl problem?)
by X-Files 18 Oct '05

18 Oct '05

Hello, I used Slackware current, last version freeradios 1.0.5 download from official site ! openssl lasted 0.9.7i (14 Oct 2005) Eusso 54Mits WiFi configured to RADIUS. In my notebook I'm installed setificats ! Please. say, why i can't identify ? i see errors: 28782:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 28782:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: ------------------------ LOGS ------------------------ # ./radiusd -X -x -A Tue Oct 18 14:28:41 2005 : Info: Starting - reading configuration files ... Tue Oct 18 14:28:41 2005 : Debug: reread_config: reading radiusd.conf Tue Oct 18 14:28:41 2005 : Debug: Config: including file: /opt/freeradius/etc/raddb/eap.conf Tue Oct 18 14:28:41 2005 : Debug: Config: including file: /opt/freeradius/etc/raddb/clients.conf Tue Oct 18 14:28:41 2005 : Debug: main: prefix = "/opt/freeradius" Tue Oct 18 14:28:41 2005 : Debug: main: localstatedir = "/opt/freeradius/var" Tue Oct 18 14:28:41 2005 : Debug: main: logdir = "/opt/freeradius/var/log/radius" Tue Oct 18 14:28:41 2005 : Debug: main: libdir = "/opt/freeradius/lib" Tue Oct 18 14:28:41 2005 : Debug: main: radacctdir = "/opt/freeradius/var/log/radius/radacct" Tue Oct 18 14:28:41 2005 : Debug: main: hostname_lookups = no Tue Oct 18 14:28:41 2005 : Debug: main: max_request_time = 30 Tue Oct 18 14:28:41 2005 : Debug: main: cleanup_delay = 5 Tue Oct 18 14:28:41 2005 : Debug: main: max_requests = 256 Tue Oct 18 14:28:41 2005 : Debug: main: delete_blocked_requests = 0 Tue Oct 18 14:28:41 2005 : Debug: main: port = 1812 Tue Oct 18 14:28:41 2005 : Debug: main: allow_core_dumps = no Tue Oct 18 14:28:41 2005 : Debug: main: log_stripped_names = no Tue Oct 18 14:28:41 2005 : Debug: main: log_file = "/opt/freeradius/var/log/radius/radius.log" Tue Oct 18 14:28:41 2005 : Debug: main: log_auth = yes Tue Oct 18 14:28:41 2005 : Debug: main: log_auth_badpass = yes Tue Oct 18 14:28:41 2005 : Debug: main: log_auth_goodpass = yes Tue Oct 18 14:28:41 2005 : Debug: main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" Tue Oct 18 14:28:41 2005 : Debug: main: bind_address = 85.115.115.113 IP address [85.115.115.113] Tue Oct 18 14:28:41 2005 : Debug: main: user = "(null)" Tue Oct 18 14:28:41 2005 : Debug: main: group = "(null)" Tue Oct 18 14:28:41 2005 : Debug: main: usercollide = no Tue Oct 18 14:28:41 2005 : Debug: main: lower_user = "no" Tue Oct 18 14:28:41 2005 : Debug: main: lower_pass = "no" Tue Oct 18 14:28:41 2005 : Debug: main: nospace_user = "no" Tue Oct 18 14:28:41 2005 : Debug: main: nospace_pass = "no" Tue Oct 18 14:28:41 2005 : Debug: main: checkrad = "/opt/freeradius/sbin/checkrad" Tue Oct 18 14:28:41 2005 : Debug: main: proxy_requests = yes Tue Oct 18 14:28:41 2005 : Debug: main: debug_level = 0 Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading dictionary Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading naslist Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading clients Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading realms Tue Oct 18 14:28:41 2005 : Debug: radiusd: entering modules setup Tue Oct 18 14:28:41 2005 : Debug: Module: Library search path is /opt/freeradius/lib Tue Oct 18 14:28:41 2005 : Debug: Module: Loaded eap Tue Oct 18 14:28:41 2005 : Debug: eap: default_eap_type = "tls" Tue Oct 18 14:28:41 2005 : Debug: eap: timer_expire = 60 Tue Oct 18 14:28:41 2005 : Debug: eap: ignore_unknown_eap_types = no Tue Oct 18 14:28:41 2005 : Debug: eap: cisco_accounting_username_bug = no Tue Oct 18 14:28:41 2005 : Debug: tls: rsa_key_exchange = no Tue Oct 18 14:28:41 2005 : Debug: tls: dh_key_exchange = yes Tue Oct 18 14:28:41 2005 : Debug: tls: rsa_key_length = 512 Tue Oct 18 14:28:41 2005 : Debug: tls: dh_key_length = 512 Tue Oct 18 14:28:41 2005 : Debug: tls: verify_depth = 0 Tue Oct 18 14:28:41 2005 : Debug: tls: CA_path = "(null)" Tue Oct 18 14:28:41 2005 : Debug: tls: pem_file_type = yes Tue Oct 18 14:28:41 2005 : Debug: tls: private_key_file = "/opt/freeradius/etc/raddb/certs/cert-srv.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: certificate_file = "/opt/freeradius/etc/raddb/certs/cert-srv.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: CA_file = "/opt/freeradius/etc/raddb/certs/demoCA/cacert.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: private_key_password = "MiTsMiTs" Tue Oct 18 14:28:41 2005 : Debug: tls: dh_file = "/opt/freeradius/etc/raddb/certs/dh" Tue Oct 18 14:28:41 2005 : Debug: tls: random_file = "/opt/freeradius/etc/raddb/certs/random" Tue Oct 18 14:28:41 2005 : Debug: tls: fragment_size = 1750 Tue Oct 18 14:28:41 2005 : Debug: tls: include_length = yes Tue Oct 18 14:28:41 2005 : Debug: tls: check_crl = no Tue Oct 18 14:28:41 2005 : Debug: tls: check_cert_cn = "(null)" Tue Oct 18 14:28:41 2005 : Debug: rlm_eap: Loaded and initialized type tls Tue Oct 18 14:28:41 2005 : Debug: Module: Instantiated eap (eap) Tue Oct 18 14:28:41 2005 : Debug: Module: Loaded files Tue Oct 18 14:28:41 2005 : Debug: files: usersfile = "/opt/freeradius/etc/raddb/users" Tue Oct 18 14:28:41 2005 : Debug: files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" Tue Oct 18 14:28:41 2005 : Debug: files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" Tue Oct 18 14:28:41 2005 : Debug: files: compat = "no" Tue Oct 18 14:28:41 2005 : Debug: Module: Instantiated files (files) Tue Oct 18 14:28:41 2005 : Debug: Listening on authentication 85.115.115.113:1812 Tue Oct 18 14:28:41 2005 : Debug: Listening on accounting 85.115.115.113:1813 Tue Oct 18 14:28:41 2005 : Info: Ready to process requests. rad_recv: Access-Request packet from host 85.115.115.126:1210, id=28, length=127 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000b017866696c6573 Message-Authenticator = 0xc2afe42a29b0037598eb1b5ba068911b Tue Oct 18 14:28:46 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authorize for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP packet type response id 1 length 11 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Tue Oct 18 14:28:46 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "files" returns ok for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authorize returns updated for request 0 Tue Oct 18 14:28:46 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:46 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:46 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authenticate for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP Identity Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Requiring client certificate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Initiate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Start returned 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 28 to 85.115.115.126:1210 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3e9ec60d5408cd1564d08036adb3df4c Tue Oct 18 14:28:46 2005 : Debug: Finished request 0 Tue Oct 18 14:28:46 2005 : Debug: Going to the next request Tue Oct 18 14:28:46 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:46 2005 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 85.115.115.126:1210, id=29, length=234 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200640d800000005a16030100550100005103014354dc7947496ad6bd2e11fc8f3334cd6118487d106f7ae166094086b10064f300002a00160013000a0066000700050004006500640063006200610060001500120009001400110008000600030100 State = 0x3e9ec60d5408cd1564d08036adb3df4c Message-Authenticator = 0x9acdc44fddb5ede329d6d1e35240b814 Tue Oct 18 14:28:46 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authorize for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP packet type response id 2 length 100 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Tue Oct 18 14:28:46 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "files" returns ok for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authorize returns updated for request 1 Tue Oct 18 14:28:46 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:46 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:46 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authenticate for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: Request found, released from the list Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP/tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Authenticate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: processing TLS Tue Oct 18 14:28:46 2005 : Info: rlm_eap_tls: Length Included Tue Oct 18 14:28:46 2005 : Debug: eaptls_verify returned 11 Tue Oct 18 14:28:46 2005 : Info: (other): before/accept initialization Tue Oct 18 14:28:46 2005 : Info: TLS_accept: before/accept initialization Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0055], ClientHello Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 read client hello A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write server hello A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 02a5], Certificate Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write certificate A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write key exchange A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0094], CertificateRequest Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write certificate request A Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 flush data Tue Oct 18 14:28:46 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Tue Oct 18 14:28:46 2005 : Debug: In SSL Handshake Phase Tue Oct 18 14:28:46 2005 : Debug: In SSL Accept mode Tue Oct 18 14:28:46 2005 : Debug: eaptls_process returned 13 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 29 to 85.115.115.126:1210 EAP-Message = 0x010304ae0d80000004a4160301004a0200004603014354dc6edd1a127f8ee63dd5818274c765be0d6c006019007d1d3da17249aaf72075848d51ffe8f90c41f78c155dc32896f2e175ce6641318b7de2acbd5a936a0400160016030102a50b0002a100029e00029b3082029730820200a003020102020900cfbbada44c61e586300d06092a864886f70d0101040500308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f7 EAP-Message = 0x0d010901160f737570706f7274406d6974732e6c76301e170d3035313031383130343431355a170d3036313031383130343431355a308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f70d010901160f737570706f7274406d6974732e6c7630819f300d06092a864886f70d010101050003818d0030818902818100d043c9a33bcb41ab536a135cbf21098a91248421b68e3edec5c082920984342dd27a2414286543f8 EAP-Message = 0x0761e0310d5055e351c04ebb18933f2c61b4524bd1e1f863eef46ca559125114f95d5cb5156791a8e29e13c05576c00d6a9b934d162c9ecb94a53e82c7f491924e0ef7ca48807bb818af0ef92a589ba4493d07437ea383790203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181005b63b6c5ff71e9ff6c80ed02317daf4097d4e5d1d52ea6a45cf1e4c55a7e79d0ec2f06f735d9f4b842d7f469ea17bbe1b05d5352426640ac15b8a113c25d3b38ba778f7e69dd3f34e1f6d654fb8d514847f3bcb60b92519e8594d746aeb9c7136d107201117d1ec60559762cb692eefefcd31360 EAP-Message = 0x7bc60e1610ec12a27fe92840160301010d0c0001090040a0bd22533b11d66719392320d24519e2e652190ce32a75dcb0cb6c22576a72b006c16d1beb0f7d447e922d7ecc2c86939a96a9b4145eef7b5f0ba37c2e6f3a530001020040289235d19c03e8797207373e728123803f781286c180e93b37896937b4578ee2662ddca66c0c20f6fbc8aa4d960e1a2bfa8fc9120b90b4bb74fe58a44a4fbd7e0080546cf49766ae4ec05acd34ab89249e287670b6a67715dd09e4adb56f0d98882b66e23156e3cdf13c99e948b3f87ffc96106c6eaf74ed4b087e5e0fb6dbfd38a1807e5c49ea00a81436db955583597b5ea64bf3a234d4b0ff30f5f7bc331826 EAP-Message = 0x09485814c11ec24b6f8a0127e29cb22f7b9c6fdcbc4a7567ab816e8ced28df6a5516030100940d00008c040304010200850083308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f70d010901160f737570706f7274406d6974732e6c760e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x598ff6cbdb1f913f1266936371d5de34 Tue Oct 18 14:28:46 2005 : Debug: Finished request 1 Tue Oct 18 14:28:46 2005 : Debug: Going to the next request Tue Oct 18 14:28:46 2005 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 85.115.115.126:1210, id=30, length=151 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300110d800000000715030100020230 State = 0x598ff6cbdb1f913f1266936371d5de34 Message-Authenticator = 0x141800db4b3790043086b0c98d60fd21 Tue Oct 18 14:28:47 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:47 2005 : Debug: modcall: entering group authorize for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: EAP packet type response id 3 length 17 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Tue Oct 18 14:28:47 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authorize]: module "files" returns ok for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall: group authorize returns updated for request 2 Tue Oct 18 14:28:47 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:47 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:47 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:47 2005 : Debug: modcall: entering group authenticate for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: Request found, released from the list Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: EAP/tls Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: Authenticate Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: processing TLS Tue Oct 18 14:28:47 2005 : Info: rlm_eap_tls: Length Included Tue Oct 18 14:28:47 2005 : Debug: eaptls_verify returned 11 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca Tue Oct 18 14:28:47 2005 : Error: TLS Alert read:fatal:unknown CA Tue Oct 18 14:28:47 2005 : Error: TLS_accept:failed in SSLv3 read client certificate A 28782:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 28782:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: Tue Oct 18 14:28:47 2005 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Tue Oct 18 14:28:47 2005 : Debug: In SSL Handshake Phase Tue Oct 18 14:28:47 2005 : Debug: In SSL Accept mode Tue Oct 18 14:28:47 2005 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Tue Oct 18 14:28:47 2005 : Debug: eaptls_process returned 13 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: Freeing handler Tue Oct 18 14:28:47 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authenticate]: module "eap" returns reject for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall: group authenticate returns reject for request 2 Tue Oct 18 14:28:47 2005 : Debug: auth: Failed to validate the user. Tue Oct 18 14:28:47 2005 : Auth: Login incorrect: [xfiles/<no User-Password attribute>] (from client D-Link_DWL-2100AP port 0 cli 00-0E-35-A2-C7-50) Sending Access-Reject of id 30 to 85.115.115.126:1210 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Oct 18 14:28:47 2005 : Debug: Finished request 2 Tue Oct 18 14:28:47 2005 : Debug: Going to the next request Tue Oct 18 14:28:47 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:47 2005 : Debug: Waking up in 5 seconds... Tue Oct 18 14:28:52 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:52 2005 : Debug: Cleaning up request 0 ID 28 with timestamp 4354dc6e Tue Oct 18 14:28:52 2005 : Debug: Cleaning up request 1 ID 29 with timestamp 4354dc6e Tue Oct 18 14:28:52 2005 : Debug: Waking up in 1 seconds... Tue Oct 18 14:28:53 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:53 2005 : Debug: Cleaning up request 2 ID 30 with timestamp 4354dc6f Tue Oct 18 14:28:53 2005 : Debug: Nothing to do. Sleeping until we see a request.

1 0

eap/tls and central users file
by Norbert Wegener 17 Oct '05

17 Oct '05

We use freeradius for eap/tls authentication, where freeradius accepts every certificate from a certain ca, as long as it is nor revoked. For this only a minimal users file is neccessary to assign some attributes to users via a DEFAULT entry. This works so far without problems. If we want to allow only certificates with well known CNs to be accepted, we would have to add them to the users file and add a DEFAULT with type reject. Would it be possible, that fr only validates the certificates and proxies the CN as username to a central fr, that has the complete user db? If so, how could it be achieved? Norbert Wegener

2 2

How to dump core on crash?
by Martin Pauly 17 Oct '05

17 Oct '05

Hi, the stability problems I had posted a week ago are occuring again, and I also got at least one more occurrence of the ominous assertion faileure in modcall.c Sow I would like to provide Alan with a core dump/bt, but I couldn't manage to produce one. Here's what I have tried so far: - enable coredumps in /etc/freeradius.conf (logfile confirms it) - make /etc/freeradius writable for the freerad group - change login shell of user freerad to /bin/bash for a test, login and make a 'sleep 1000' crash by sending a SIGSEGV -- this produces a core file, so ulimits should be o.k. - Look under /proc/<freerad-pid>/cwd to figure out the current working directory of the main freerad process, it's always '/'. So where should I expect to find a core dump? Thanks, Martin

2 4