- Freeradius-Users - lists.freeradius.org

Question on FreeRADIUS digest authentication with SIP proxy
by Cheng Zhang 18 Oct '05

18 Oct '05

I have setup SER to authenticate via FreeRADIUS with MSSQL DB. The SIP proxy (SER) use digest authentication to authenticate with FreeRADIUS server. This way the user's password is stored as cleartext in the database. I'd like to know is there a way to make such setup using hashed password (just MD5 or HA1)? I asked this question on SER's mailing list, but seems cleartext password is the only way to do digest authentication with FreeRADIUS. After reading through RFC2617 and draft-ietf-radext-digest-auth-04, seems to me that if Digest-Algorithm attribute in RADIUS packet is 'MD5-sess', there is a Digest-HA1 attribute might be useful for my purpose. Is there any options to tweak FreeRADIUS's digest authentication mode, something like 'auth_type' or 'encrypt_method' for MSCHAP or other authentication methods? Thanks.

2 4

Problem identify to RADIUS server (ssl problem?)
by X-Files 18 Oct '05

18 Oct '05

Hello, I used Slackware current, last version freeradios 1.0.5 download from official site ! openssl lasted 0.9.7i (14 Oct 2005) Eusso 54Mits WiFi configured to RADIUS. In my notebook I'm installed setificats ! Please. say, why i can't identify ? i see errors: 28782:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 28782:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: ------------------------ LOGS ------------------------ # ./radiusd -X -x -A Tue Oct 18 14:28:41 2005 : Info: Starting - reading configuration files ... Tue Oct 18 14:28:41 2005 : Debug: reread_config: reading radiusd.conf Tue Oct 18 14:28:41 2005 : Debug: Config: including file: /opt/freeradius/etc/raddb/eap.conf Tue Oct 18 14:28:41 2005 : Debug: Config: including file: /opt/freeradius/etc/raddb/clients.conf Tue Oct 18 14:28:41 2005 : Debug: main: prefix = "/opt/freeradius" Tue Oct 18 14:28:41 2005 : Debug: main: localstatedir = "/opt/freeradius/var" Tue Oct 18 14:28:41 2005 : Debug: main: logdir = "/opt/freeradius/var/log/radius" Tue Oct 18 14:28:41 2005 : Debug: main: libdir = "/opt/freeradius/lib" Tue Oct 18 14:28:41 2005 : Debug: main: radacctdir = "/opt/freeradius/var/log/radius/radacct" Tue Oct 18 14:28:41 2005 : Debug: main: hostname_lookups = no Tue Oct 18 14:28:41 2005 : Debug: main: max_request_time = 30 Tue Oct 18 14:28:41 2005 : Debug: main: cleanup_delay = 5 Tue Oct 18 14:28:41 2005 : Debug: main: max_requests = 256 Tue Oct 18 14:28:41 2005 : Debug: main: delete_blocked_requests = 0 Tue Oct 18 14:28:41 2005 : Debug: main: port = 1812 Tue Oct 18 14:28:41 2005 : Debug: main: allow_core_dumps = no Tue Oct 18 14:28:41 2005 : Debug: main: log_stripped_names = no Tue Oct 18 14:28:41 2005 : Debug: main: log_file = "/opt/freeradius/var/log/radius/radius.log" Tue Oct 18 14:28:41 2005 : Debug: main: log_auth = yes Tue Oct 18 14:28:41 2005 : Debug: main: log_auth_badpass = yes Tue Oct 18 14:28:41 2005 : Debug: main: log_auth_goodpass = yes Tue Oct 18 14:28:41 2005 : Debug: main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" Tue Oct 18 14:28:41 2005 : Debug: main: bind_address = 85.115.115.113 IP address [85.115.115.113] Tue Oct 18 14:28:41 2005 : Debug: main: user = "(null)" Tue Oct 18 14:28:41 2005 : Debug: main: group = "(null)" Tue Oct 18 14:28:41 2005 : Debug: main: usercollide = no Tue Oct 18 14:28:41 2005 : Debug: main: lower_user = "no" Tue Oct 18 14:28:41 2005 : Debug: main: lower_pass = "no" Tue Oct 18 14:28:41 2005 : Debug: main: nospace_user = "no" Tue Oct 18 14:28:41 2005 : Debug: main: nospace_pass = "no" Tue Oct 18 14:28:41 2005 : Debug: main: checkrad = "/opt/freeradius/sbin/checkrad" Tue Oct 18 14:28:41 2005 : Debug: main: proxy_requests = yes Tue Oct 18 14:28:41 2005 : Debug: main: debug_level = 0 Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading dictionary Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading naslist Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading clients Tue Oct 18 14:28:41 2005 : Debug: read_config_files: reading realms Tue Oct 18 14:28:41 2005 : Debug: radiusd: entering modules setup Tue Oct 18 14:28:41 2005 : Debug: Module: Library search path is /opt/freeradius/lib Tue Oct 18 14:28:41 2005 : Debug: Module: Loaded eap Tue Oct 18 14:28:41 2005 : Debug: eap: default_eap_type = "tls" Tue Oct 18 14:28:41 2005 : Debug: eap: timer_expire = 60 Tue Oct 18 14:28:41 2005 : Debug: eap: ignore_unknown_eap_types = no Tue Oct 18 14:28:41 2005 : Debug: eap: cisco_accounting_username_bug = no Tue Oct 18 14:28:41 2005 : Debug: tls: rsa_key_exchange = no Tue Oct 18 14:28:41 2005 : Debug: tls: dh_key_exchange = yes Tue Oct 18 14:28:41 2005 : Debug: tls: rsa_key_length = 512 Tue Oct 18 14:28:41 2005 : Debug: tls: dh_key_length = 512 Tue Oct 18 14:28:41 2005 : Debug: tls: verify_depth = 0 Tue Oct 18 14:28:41 2005 : Debug: tls: CA_path = "(null)" Tue Oct 18 14:28:41 2005 : Debug: tls: pem_file_type = yes Tue Oct 18 14:28:41 2005 : Debug: tls: private_key_file = "/opt/freeradius/etc/raddb/certs/cert-srv.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: certificate_file = "/opt/freeradius/etc/raddb/certs/cert-srv.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: CA_file = "/opt/freeradius/etc/raddb/certs/demoCA/cacert.pem" Tue Oct 18 14:28:41 2005 : Debug: tls: private_key_password = "MiTsMiTs" Tue Oct 18 14:28:41 2005 : Debug: tls: dh_file = "/opt/freeradius/etc/raddb/certs/dh" Tue Oct 18 14:28:41 2005 : Debug: tls: random_file = "/opt/freeradius/etc/raddb/certs/random" Tue Oct 18 14:28:41 2005 : Debug: tls: fragment_size = 1750 Tue Oct 18 14:28:41 2005 : Debug: tls: include_length = yes Tue Oct 18 14:28:41 2005 : Debug: tls: check_crl = no Tue Oct 18 14:28:41 2005 : Debug: tls: check_cert_cn = "(null)" Tue Oct 18 14:28:41 2005 : Debug: rlm_eap: Loaded and initialized type tls Tue Oct 18 14:28:41 2005 : Debug: Module: Instantiated eap (eap) Tue Oct 18 14:28:41 2005 : Debug: Module: Loaded files Tue Oct 18 14:28:41 2005 : Debug: files: usersfile = "/opt/freeradius/etc/raddb/users" Tue Oct 18 14:28:41 2005 : Debug: files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" Tue Oct 18 14:28:41 2005 : Debug: files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" Tue Oct 18 14:28:41 2005 : Debug: files: compat = "no" Tue Oct 18 14:28:41 2005 : Debug: Module: Instantiated files (files) Tue Oct 18 14:28:41 2005 : Debug: Listening on authentication 85.115.115.113:1812 Tue Oct 18 14:28:41 2005 : Debug: Listening on accounting 85.115.115.113:1813 Tue Oct 18 14:28:41 2005 : Info: Ready to process requests. rad_recv: Access-Request packet from host 85.115.115.126:1210, id=28, length=127 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000b017866696c6573 Message-Authenticator = 0xc2afe42a29b0037598eb1b5ba068911b Tue Oct 18 14:28:46 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authorize for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP packet type response id 1 length 11 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Tue Oct 18 14:28:46 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "files" returns ok for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authorize returns updated for request 0 Tue Oct 18 14:28:46 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:46 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:46 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authenticate for request 0 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP Identity Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Requiring client certificate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Initiate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Start returned 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 28 to 85.115.115.126:1210 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3e9ec60d5408cd1564d08036adb3df4c Tue Oct 18 14:28:46 2005 : Debug: Finished request 0 Tue Oct 18 14:28:46 2005 : Debug: Going to the next request Tue Oct 18 14:28:46 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:46 2005 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 85.115.115.126:1210, id=29, length=234 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200640d800000005a16030100550100005103014354dc7947496ad6bd2e11fc8f3334cd6118487d106f7ae166094086b10064f300002a00160013000a0066000700050004006500640063006200610060001500120009001400110008000600030100 State = 0x3e9ec60d5408cd1564d08036adb3df4c Message-Authenticator = 0x9acdc44fddb5ede329d6d1e35240b814 Tue Oct 18 14:28:46 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authorize for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP packet type response id 2 length 100 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Tue Oct 18 14:28:46 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authorize]: module "files" returns ok for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authorize returns updated for request 1 Tue Oct 18 14:28:46 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:46 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:46 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:46 2005 : Debug: modcall: entering group authenticate for request 1 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: Request found, released from the list Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: EAP/tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: Authenticate Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: processing TLS Tue Oct 18 14:28:46 2005 : Info: rlm_eap_tls: Length Included Tue Oct 18 14:28:46 2005 : Debug: eaptls_verify returned 11 Tue Oct 18 14:28:46 2005 : Info: (other): before/accept initialization Tue Oct 18 14:28:46 2005 : Info: TLS_accept: before/accept initialization Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0055], ClientHello Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 read client hello A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write server hello A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 02a5], Certificate Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write certificate A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write key exchange A Tue Oct 18 14:28:46 2005 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0094], CertificateRequest Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 write certificate request A Tue Oct 18 14:28:46 2005 : Info: TLS_accept: SSLv3 flush data Tue Oct 18 14:28:46 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Tue Oct 18 14:28:46 2005 : Debug: In SSL Handshake Phase Tue Oct 18 14:28:46 2005 : Debug: In SSL Accept mode Tue Oct 18 14:28:46 2005 : Debug: eaptls_process returned 13 Tue Oct 18 14:28:46 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Tue Oct 18 14:28:46 2005 : Debug: modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 29 to 85.115.115.126:1210 EAP-Message = 0x010304ae0d80000004a4160301004a0200004603014354dc6edd1a127f8ee63dd5818274c765be0d6c006019007d1d3da17249aaf72075848d51ffe8f90c41f78c155dc32896f2e175ce6641318b7de2acbd5a936a0400160016030102a50b0002a100029e00029b3082029730820200a003020102020900cfbbada44c61e586300d06092a864886f70d0101040500308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f7 EAP-Message = 0x0d010901160f737570706f7274406d6974732e6c76301e170d3035313031383130343431355a170d3036313031383130343431355a308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f70d010901160f737570706f7274406d6974732e6c7630819f300d06092a864886f70d010101050003818d0030818902818100d043c9a33bcb41ab536a135cbf21098a91248421b68e3edec5c082920984342dd27a2414286543f8 EAP-Message = 0x0761e0310d5055e351c04ebb18933f2c61b4524bd1e1f863eef46ca559125114f95d5cb5156791a8e29e13c05576c00d6a9b934d162c9ecb94a53e82c7f491924e0ef7ca48807bb818af0ef92a589ba4493d07437ea383790203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181005b63b6c5ff71e9ff6c80ed02317daf4097d4e5d1d52ea6a45cf1e4c55a7e79d0ec2f06f735d9f4b842d7f469ea17bbe1b05d5352426640ac15b8a113c25d3b38ba778f7e69dd3f34e1f6d654fb8d514847f3bcb60b92519e8594d746aeb9c7136d107201117d1ec60559762cb692eefefcd31360 EAP-Message = 0x7bc60e1610ec12a27fe92840160301010d0c0001090040a0bd22533b11d66719392320d24519e2e652190ce32a75dcb0cb6c22576a72b006c16d1beb0f7d447e922d7ecc2c86939a96a9b4145eef7b5f0ba37c2e6f3a530001020040289235d19c03e8797207373e728123803f781286c180e93b37896937b4578ee2662ddca66c0c20f6fbc8aa4d960e1a2bfa8fc9120b90b4bb74fe58a44a4fbd7e0080546cf49766ae4ec05acd34ab89249e287670b6a67715dd09e4adb56f0d98882b66e23156e3cdf13c99e948b3f87ffc96106c6eaf74ed4b087e5e0fb6dbfd38a1807e5c49ea00a81436db955583597b5ea64bf3a234d4b0ff30f5f7bc331826 EAP-Message = 0x09485814c11ec24b6f8a0127e29cb22f7b9c6fdcbc4a7567ab816e8ced28df6a5516030100940d00008c040304010200850083308180310b3009060355040613024c56310f300d060355040813064c6174766961310d300b060355040713045269676131143012060355040a130b534941204d695473204c56310c300a060355040b1303495350310d300b060355040313044d695473311e301c06092a864886f70d010901160f737570706f7274406d6974732e6c760e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x598ff6cbdb1f913f1266936371d5de34 Tue Oct 18 14:28:46 2005 : Debug: Finished request 1 Tue Oct 18 14:28:46 2005 : Debug: Going to the next request Tue Oct 18 14:28:46 2005 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 85.115.115.126:1210, id=30, length=151 User-Name = "xfiles" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-03-2F-1F-99-96" Calling-Station-Id = "00-0E-35-A2-C7-50" NAS-Identifier = "Home" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300110d800000000715030100020230 State = 0x598ff6cbdb1f913f1266936371d5de34 Message-Authenticator = 0x141800db4b3790043086b0c98d60fd21 Tue Oct 18 14:28:47 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 18 14:28:47 2005 : Debug: modcall: entering group authorize for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: EAP packet type response id 3 length 17 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authorize]: module "eap" returns updated for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Tue Oct 18 14:28:47 2005 : Debug: users: Matched entry xfiles at line 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authorize]: module "files" returns ok for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall: group authorize returns updated for request 2 Tue Oct 18 14:28:47 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 18 14:28:47 2005 : Debug: auth: type "EAP" Tue Oct 18 14:28:47 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 18 14:28:47 2005 : Debug: modcall: entering group authenticate for request 2 Tue Oct 18 14:28:47 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: Request found, released from the list Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: EAP/tls Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: processing type tls Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: Authenticate Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: processing TLS Tue Oct 18 14:28:47 2005 : Info: rlm_eap_tls: Length Included Tue Oct 18 14:28:47 2005 : Debug: eaptls_verify returned 11 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca Tue Oct 18 14:28:47 2005 : Error: TLS Alert read:fatal:unknown CA Tue Oct 18 14:28:47 2005 : Error: TLS_accept:failed in SSLv3 read client certificate A 28782:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 28782:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: Tue Oct 18 14:28:47 2005 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Tue Oct 18 14:28:47 2005 : Debug: In SSL Handshake Phase Tue Oct 18 14:28:47 2005 : Debug: In SSL Accept mode Tue Oct 18 14:28:47 2005 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Tue Oct 18 14:28:47 2005 : Debug: eaptls_process returned 13 Tue Oct 18 14:28:47 2005 : Debug: rlm_eap: Freeing handler Tue Oct 18 14:28:47 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall[authenticate]: module "eap" returns reject for request 2 Tue Oct 18 14:28:47 2005 : Debug: modcall: group authenticate returns reject for request 2 Tue Oct 18 14:28:47 2005 : Debug: auth: Failed to validate the user. Tue Oct 18 14:28:47 2005 : Auth: Login incorrect: [xfiles/<no User-Password attribute>] (from client D-Link_DWL-2100AP port 0 cli 00-0E-35-A2-C7-50) Sending Access-Reject of id 30 to 85.115.115.126:1210 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Oct 18 14:28:47 2005 : Debug: Finished request 2 Tue Oct 18 14:28:47 2005 : Debug: Going to the next request Tue Oct 18 14:28:47 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:47 2005 : Debug: Waking up in 5 seconds... Tue Oct 18 14:28:52 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:52 2005 : Debug: Cleaning up request 0 ID 28 with timestamp 4354dc6e Tue Oct 18 14:28:52 2005 : Debug: Cleaning up request 1 ID 29 with timestamp 4354dc6e Tue Oct 18 14:28:52 2005 : Debug: Waking up in 1 seconds... Tue Oct 18 14:28:53 2005 : Debug: --- Walking the entire request list --- Tue Oct 18 14:28:53 2005 : Debug: Cleaning up request 2 ID 30 with timestamp 4354dc6f Tue Oct 18 14:28:53 2005 : Debug: Nothing to do. Sleeping until we see a request.

1 0

eap/tls and central users file
by Norbert Wegener 17 Oct '05

17 Oct '05

We use freeradius for eap/tls authentication, where freeradius accepts every certificate from a certain ca, as long as it is nor revoked. For this only a minimal users file is neccessary to assign some attributes to users via a DEFAULT entry. This works so far without problems. If we want to allow only certificates with well known CNs to be accepted, we would have to add them to the users file and add a DEFAULT with type reject. Would it be possible, that fr only validates the certificates and proxies the CN as username to a central fr, that has the complete user db? If so, how could it be achieved? Norbert Wegener

2 2

How to dump core on crash?
by Martin Pauly 17 Oct '05

17 Oct '05

Hi, the stability problems I had posted a week ago are occuring again, and I also got at least one more occurrence of the ominous assertion faileure in modcall.c Sow I would like to provide Alan with a core dump/bt, but I couldn't manage to produce one. Here's what I have tried so far: - enable coredumps in /etc/freeradius.conf (logfile confirms it) - make /etc/freeradius writable for the freerad group - change login shell of user freerad to /bin/bash for a test, login and make a 'sleep 1000' crash by sending a SIGSEGV -- this produces a core file, so ulimits should be o.k. - Look under /proc/<freerad-pid>/cwd to figure out the current working directory of the main freerad process, it's always '/'. So where should I expect to find a core dump? Thanks, Martin

2 4

"How freeradius compile with g++"
by Manoj Patel 17 Oct '05

17 Oct '05

Hello, Does anyone know how I could compile freeradius in C++ using g++ instead of gcc ? I am not very familiar with the underlying configure mechanism , all i know is to type 'configure' an then 'make' ... I would make chane in Make.inc file where CC= g++ insted of CC= gcc then i got so many error like in radiusd.h file , there r operator is declare as variable , but it is key word in g++? so how can i make freeradius with g++? thanks manoj + 91 - 9881403519

2 4

Not-really-a-bug issue with rlm_unix and maybe other modules
by Martin.Ward＠uk.neceur.com 17 Oct '05

17 Oct '05

Hi, I had a problem with the Radius server where I was using the rlm_unix module to authenticate users against the passwd and shadow files, but even when the correct login and password was being used the user was not being authenticated. There was nothing reported in the log files at all apart from "Authentication refused". After much digging around and scrabbling through the source code I eventually found out that the permissions on the /etc/shadow file were incorrect. The permissions were 0400 with a group ownership of "sys" instead of being 0440 with a group ownership of "shadow" (or any other group of which the freerad user was a member), Changing the permissions and group membership fixed the problem. To make other people's lives easier I would like to request an update to the rlm_unix module to report a permissions error, or simply to report the output of strerror() to the log file, when such file errors occur. In the rlm_unix source file files are opened using the code: function_name(function defs) { FILE *file = fopen(fname, "ro"); struct passwd *pwd = NULL; if(file == NULL) return NULL; ... I would suggest replacing the last line above with: if(file == NULL) {radlog(L_ERR, strerror(errno)); return NULL; } or whatever equivalent is required. I don't know about the portability of the strerror() function though, nor of all the details required when calling the radlog function. |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

2 1

unsubscribe
by Dudley Atkinson 17 Oct '05

17 Oct '05

Unsubscribe > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of freeradius-users-request(a)lists.freeradius.org > Sent: Monday, October 17, 2005 5:11 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 6, Issue 58 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more > specific than "Re: Contents of Freeradius-Users digest..." >

1 0

How to authenticate 3com switch and cisco switch at the same time.
by 陈锐 17 Oct '05

17 Oct '05

hello, I am a newbie of freeradius. these days, we are planning to implement radius server for aaa. Our NAS devices are 3com SuperStack 4400/4900 and cisco 2950/3725/1721. we encounter a problem. I have been installed freeradius on debian successfully. We have four guys to administrative our network device they are aaa,bbb,ccc,ddd. first of all, aaa and bbb are admin, ccc and ddd are helpdesk. admin should be granted the read/write privilege of the net device helpdesk should only be granted the read privilege. I divided them into four group within linux system. 3com_admin, 3com_monitor, cisco_admin, cisco_monitor aaa and bbb belongs to 3com_admin and cisco_admin ccc and ddd belongs to 3com_monitor and cisco_monitor the /etc/freeradius/users config: DEFAULT Group == "3com_admin", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 3, DEFAULT Group == "3com_monitor", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 1, this config work fine for me. and now, I added another two groups, so the /etc/freeradius/users look like this: DEFAULT Group == "cisco_admin", Auth-Type := System Login-Service = Telnet, Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT Group == "cisco_monitor", Auth-Type :=System Login-Service = Telnet, Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=5" DEFAULT Group == "3com_admin", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 3 DEFAULT Group == "3com_monitor", Auth-Type := System Login-Service = Telnet, 3Com-User-Access-Level = 1 The problem occured. When I login cisco switch with "aaa", it works, but when I use "aaa" to login 3com's switch, it failed. because of the reply message were come from the first DEFAULT segment attributes. that is: Sending Access-Accept of id 22 to 192.168.100.20:2049 Login-Service = Telnet Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" so, 3com switch can not parse the cisco-avpair, then failed. the following is freeradius -X ..... radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.20:2049, id=22, length=87 User-Name = "aaa" User-Password = "aaa" NAS-Port-Type = Virtual NAS-IP-Address = 192.168.100.20 Service-Type = Administrative-User Framed-MTU = 1024 Message-Authenticator = 0xe52d4010d86eb2cb0f00fefaa251006c rad_rmspace_pair: User-Password now 'aaa' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 75 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Sending Access-Accept of id 22 to 192.168.100.20:2049 Login-Service = Telnet Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 7 seconds... ..... any suggestion will be welcome. thanks in advance.

1 0

Logging - auth failure reason
by james 17 Oct '05

17 Oct '05

I'm having trouble with logging: I am trying to expose the reason authentication failed to a script called via mod_exec I tried using Module-Failure-Message but it appears to be blank, even though running -X shows what I am trying to get out. i'm using radiusd version 1.0.5 from source. Thanks for your help, James

1 0

radwho
by Madhvi Gokool 17 Oct '05

17 Oct '05

Hello When first testing the freeradius server, radwho still showed users as connected when infact they had disconnected. radwho with no users dialled in is as follows :- terrabackup# radwho Login Name What TTY When From Location jumbort jumbort PPP S16 Mon 18:51 10.5.0.10 10.5.5.4 steve steve PPP S242 Tue 16:38 10.5.0.2 10.5.1.37 I managed to have the server up and running properly but the above entries are causing problems when I restrict Simultaneous use for user steve. What should I do to remove those entries.? Kind Regards Madhvi

2 2