- Freeradius-Users - lists.freeradius.org

Please helpme is Urgent
by alfonso celestino 30 Sep '05

30 Sep '05

Hi! I find this problem, freeradius was working perfectly whith EAP-PEAP, but suddenly wireless users could not access to wireless network. The log from NAS when the access is success: Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> station up <00:0e:9b:d3:71:b1> update station bssid to 00:0b:86:a5:d5:a0 (#users 1) Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> setting the encryption key type <00:0e:9b:d3:71:b1> Set the UKey type to Dyanmic TKIP Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> selected server moctezuma2 for method=802.1x; user=academico1, essid=RIU, domain=<> when the problem happened was: Sep 30 12:40:10 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <WARN> RADIUS server moctezuma2-zzz.zzz.zzz.zzz-1812 timeout for client=00:04:23:99:bb:09 auth=802.1x also I attach de radius.log file. The radiusd process always was up. When I restarted the radiusd process, the access to wireless network started to work perfectly again. What was the problem? Thanks in advance Alfonso Celestino ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Authentication fails every once and awhile and CRL question
by Jason Carr 30 Sep '05

30 Sep '05

This only happens every once and awhile, not sure why. Here's a log file of the authentication. Not one specific supplicant fails, but this one happens to be OS X 10.3. Others include SP2. Any reason or should I blame this on the client? Also I'm reloading radiusd with kill -HUP pid every 15 minutes to load a CRL, is that really required or can I get away with not reloading it? Here's an auth fail. Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:04 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS First Fragment of the message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: More fragments to follow Fri Sep 30 11:57:04 2005 : Info: (other): SSL negotiation finished successfully Fri Sep 30 11:57:35 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:35 2005 : Error: TLS_accept:error in SSLv3 read client hello C Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Auth: Login incorrect: [wpa-tester.wv.cc.cmu.edu/<no User-Password attribute>] (from client access-points port 360 cli xxxx.xxxx.xxxx

1 0

EAP-PEAP-MSCHAPv2: use_tunneled_reply = yes
by Bjarni Hardarson 30 Sep '05

30 Sep '05

Hi all, I'm using FreeRADIUS with Cisco 1200 Series Access points for dynamic VLAN assignment. When i set use_tunneled_reply = yes for PEAP i get an Access-Challenge with the correct attributes but the final Access-Accept has no attributes and the User-Name is the anonymous one from the outer tunnel. This username is then used by the AP for accounting. Is this by design or is my configuration wrong? Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 24 modcall: group authenticate returns ok for request 24 PEAP: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x818f508 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 24 modcall: group authenticate returns handled for request 24 Sending Access-Challenge of id 8 to 127.0.0.1:33229 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 EAP-Message = 0x010900501900170301002079fdf7026cf88ffd8c978e4fb62290b4d4f4a1596c767f557ada bdaf51b7437d17030100209a1de8e9b88b4654d03b0754d4f5a04887b57b329c94a6494ef84d 2bf74f294c State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Finished request 24 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33229, id=9, length=205 User-Name = "anon" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "00-00-00-00-00-02" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209005019001703010020f8f585176e2220ba00055d66cd73494a9539cce8d52da81ff067 f5835fd4de1117030100207461f938bb9af8c154f926ab2eb5653392cb1ebb02782ac58c3b6c ca8566fbdd State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Message-Authenticator = 0x830975610af464574e583a2a9240068d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 25 modcall[authorize]: module "preprocess" returns ok for request 25 radius_xlat: '/var/log/radiusd/radiusd-20050930' rlm_detail: /var/log/radiusd/radiusd-%Y%m%d expands to /var/log/radiusd/radiusd-20050930 modcall[authorize]: module "auth_log" returns ok for request 25 modcall[authorize]: module "chap" returns noop for request 25 modcall[authorize]: module "mschap" returns noop for request 25 rlm_realm: No '@' in User-Name = "anon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 25 rlm_eap: EAP packet type response id 9 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 25 modcall[authorize]: module "files" returns notfound for request 25 modcall: group authorize returns updated for request 25 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 25 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 25 modcall: group authenticate returns ok for request 25 Sending Access-Accept of id 9 to 127.0.0.1:33229 MS-MPPE-Recv-Key = 0x73f9e4f3cc50836d0d52db55ddceb6afb7fea6e50313380873101fe245e6532d MS-MPPE-Send-Key = 0xcbf30f484d74cc947dcd0ea4fb49f7d94adb6be677e23d4edae3a22d136ad3b9 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anon" Finished request 25 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 0 with timestamp 433d25b6 Cleaning up request 17 ID 1 with timestamp 433d25b6 Cleaning up request 18 ID 2 with timestamp 433d25b6 Cleaning up request 19 ID 3 with timestamp 433d25b6 Cleaning up request 20 ID 4 with timestamp 433d25b6 Cleaning up request 21 ID 5 with timestamp 433d25b6 Cleaning up request 22 ID 6 with timestamp 433d25b6 Cleaning up request 23 ID 7 with timestamp 433d25b6 Cleaning up request 24 ID 8 with timestamp 433d25b6 Cleaning up request 25 ID 9 with timestamp 433d25b6 Nothing to do. Sleeping until we see a request. --------------------------------------------------- When i use TTLS everything works perfectly. If i set use_tunneled_reply = no for TTLS the outer tunnel identity is used in the Access-Accept and no attributes are returned. Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 TTLS: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler TTLS: Freeing handler for user radtes modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 Sending Access-Accept of id 7 to 127.0.0.1:33227 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 MS-MPPE-Recv-Key = 0xf250fa51ea382aef2f2ea5ebaab8596fa822cf6788ccd2782fe2e7df98cd06aa MS-MPPE-Send-Key = 0xca164c1041c8b439c99b13505ba04aaf48cabf6802df8c92738a2c12349b4be2 EAP-Message = 0x03070004 Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 433d1f58 Cleaning up request 1 ID 1 with timestamp 433d1f58 Cleaning up request 2 ID 2 with timestamp 433d1f58 Cleaning up request 3 ID 3 with timestamp 433d1f58 Cleaning up request 4 ID 4 with timestamp 433d1f58 Cleaning up request 5 ID 5 with timestamp 433d1f58 Cleaning up request 6 ID 6 with timestamp 433d1f58 Cleaning up request 7 ID 7 with timestamp 433d1f58 Nothing to do. Sleeping until we see a request. raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = ******** private_key_file = ${raddbdir}/certs/srv_key.pem certificate_file = ${raddbdir}/certs/srv_cert.pem CA_file = ${raddbdir}/certs/demoCA/prv.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } } raddb/users DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes DEFAULT Huntgroup-name == "LAN", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := LAN DEFAULT Huntgroup-name == "AIR", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := AIR

2 2

Re: Expose RADIUS packet's identifier
by James J J Hooper 30 Sep '05

30 Sep '05

> > ATTRIBUTE Packet-Authentication-Vector 1088 octets > > Alan DeKok. can't get it to work: radius -X says: WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Packet-Authentication-Vector} in radiusd.conf: exec logit { wait = yes input_pairs = request output_pairs = none program = "/etc/raddb/bin/logit.sh %{Packet-Authentication-Vector}" } logit called in authorize. Thanks in advance for any help you can give, James.

2 1

MSCHAPv2, MySQL, Freeradius
by Dan Russell 30 Sep '05

30 Sep '05

Hi, Is there a way in which I can have encrypted passwords in the mysql database and use MSCHAPv2 to authenticate users? If I used a third party tool like mkntpwd to create NT Hashes, could I put premade hashes in the database and use them to authenticate or would rlm_mschap encrypt the password attribute anyway? Thanks in advance for any help you can offer, Daniel Russell Lead Technician In-House IT Services PH (03) 50210044 FX (03) 50210066

2 1

RE: Proxy of accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

Thanks nick. However when I proxy the message, the message-authenticator field has an <INVAILID TOKEN> (see trace below). Why is this Sending Accounting-Request of id 1 to 10.113.46.170:1813 Acct-Status-Type = Start Service-Type = Framed-User Called-Station-Id = "vlive" Framed-Protocol = GPRS-PDP-Context Framed-Protocol = GPRS-PDP-Context Acct-Delay-Time = 5 Calling-Station-Id = "27829800729" NAS-Identifier = "GMC-GGSN0-13-2" Acct-Session-Id = "20050529" User-Name = "27829800729" User-Name = "27829800729" NAS-Port = 6000 NAS-Port-Type = Virtual NAS-IP-Address = 10.111.14.46 Message-Authenticator <INVALID-TOKEN> 0x00000000000000000000000000000000 Proxy-State = 0x30 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

Re: SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 30 Sep '05

30 Sep '05

>Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: >> Thank you Alan, but now I have a new problem. I have been reading the >> src/modules/rlm_eap/ to understand my problem but I don't find the >> issue. In TLS establishment, the public key in the server.cert is 128 >> bytes length. I generate a random string of 46 bytes and the protocol >> version (TLS 1.0 (0x03, 0x01)) and I use the SSL function >> RSA_public_encrypt() with server's public key to encrypt the >> PreMasterSecret. As a result I get a 128 length string. As I send this >> data to the server, I get a "tls rsa encrypted length is wrong: >> s3_srvr.c: 1450:" > I have no idea what the problem is, sorry. >Alan DeKok. Can you please tell me the client's exchange packet form the server is attempting? How is it calculated? Or, can you show me a typical byte suite from this message? (I hope you understand me) Tank you. Juan Daniel MORENO

2 1

RE: Proxy accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

But doesn't this mean there has to be a realm in the username eg name@realm1 The problem is the user-name attribute does not contain a realm. Is it still possible to proxy the accounting start and stop messages originating from as certain NAS-IP-ADDRESS. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 29 September 2005 06:22 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 5, Issue 98 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Proxy of Accounting Requests (Ashwin Gobind) 2. Re: Proxy of Accounting Requests (Nicolas Baradakis) 3. RE: Proxy of Accounting Requests (Jonathan De Graeve) 4. Re: LDAP and groups (Dusty Doris) 5. Re: LDAP and groups (Kenneth Grady) 6. Re: SSL3_GET_CLIENT_KEY_EXCHANGE (Juan Daniel Moreno) 7. (no subject) (msah(a)otitelecom.bj) 8. Postgresql+freeradius configuration (msah(a)otitelecom.bj) ---------------------------------------------------------------------- Message: 1 Date: Thu, 29 Sep 2005 12:18:37 +0200 From: "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> Subject: Proxy of Accounting Requests To: <freeradius-users(a)lists.freeradius.org> Message-ID: <753BF83740BB6C48BF8A15B5C61C88470BB847D7(a)zamdc02100.vodacom.corp> Content-Type: text/plain; charset="us-ascii" Good day. I am using freeradius 1.05 I want to proxy accounting requests originating from certain hosts to another server, how can I do this. Also I am using Jradius to handle accounting request. But this certain request I don't want JRadius to handle, but freeradius just to proxy it. Here is an example of the request Thanks Acct-Session-Id = C42EA2A31F96530 Framed-Protocol = GPRS-PDP-Context Called-Station-Id = vlive Calling-Station-Id = 27829800529 Framed-IP-Address = 10.19.128.6 3GPP-IMSI = 655019800002252 3GPP-Charging-ID = 33121584 3GPP-PDP-Type = 0 3GPP-GGSN-Address = 196.46.162.163 3GPP-IMSI-MCC-MNC = 65501 3GPP-GGSN-MCC-MNC = 65501 3GPP-NSAPI = 5 3GPP-Selection-Mode = 0 3GPP-Charging-Gateway-Address = 10.25.0.10 3GPP-GPRS-Negotiated-QoS-profile = 99-23931F9396979774FB0808 3GPP-SGSN-Address = 196.6.254.49 User-Name = 27829800529 Cisco-AVPair = connect-progress=Call Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual Cisco-NAS-Port = GGSN NAS-Port = 60000 Class = [Binary Data] Service-Type = Framed-User NAS-IP-Address = 10.31.1.122 NAS-Identifier = GMC-GGSN0-12-2 Acct-Delay-Time = 0 Client-IP-Address = 10.113.60.6 Acct-Unique-Session-Id = b30a3d4d494c8a87 "This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx " ------------------------------ Message: 2 Date: Thu, 29 Sep 2005 13:55:16 +0200 From: Nicolas Baradakis <nbk(a)sitadelle.com> Subject: Re: Proxy of Accounting Requests To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929115516.GA2365(a)asuka.tech.sitadelle.com> Content-Type: text/plain; charset=us-ascii Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis ------------------------------ Message: 3 Date: Thu, 29 Sep 2005 15:56:33 +0200 From: "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> Subject: RE: Proxy of Accounting Requests To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <FFA36DAA4D9D62438D6DD1947C631316073263(a)exchangesrv.imz.be> Content-Type: text/plain; charset="us-ascii" Can you also do this in SQL? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Nicolas Baradakis Verzonden: donderdag 29 september 2005 13:55 Aan: FreeRadius users mailing list Onderwerp: Re: Proxy of Accounting Requests Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Thu, 29 Sep 2005 10:06:30 -0400 (EDT) From: Dusty Doris <freeradius(a)mail.doris.cc> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929100414.M98082(a)mail.doris.name> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" ... > > Any other way ? > I chose to do groups per user with radiusgroupname attribute, which is in the ldap_howto. However, you don't have to do it that way. Try reading radiusd.conf in the ldap section under the default groupmembership_filter. Or reading doc/rlm_ldap. If you are trying that and not having success, then post your debug output. ------------------------------ Message: 5 Date: Thu, 29 Sep 2005 08:11:27 -0600 From: Kenneth Grady <klg(a)lanl.gov> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1128003087.27966.29.camel(a)grady.lanl.gov> Content-Type: text/plain ldapsearch -x cn=my_group # # filter: cn=my_group # requesting: ALL # # my_group, group, lanl, gov dn: cn=my_group,ou=group,dc=lanl,dc=gov objectClass: groupOfNames cn: my_group member: employeeNumber=0067,ou=people,dc=lanl,dc=gov member: employeeNumber=0068,ou=people,dc=lanl,dc=gov ... ---------------------------------- radiusd.conf (file) ...modules ldap My-group_Users { server = "ldap" net_timeout = 1 timeout = 3 timelimit = 4 ldap_connections_number = 5 basedn = "dc=lanl,dc=gov" #access_attr = "employeeNumber" filter = "(&(cn=my-group)(member=employeeNumber=%{Stripped-User-Name:-%{User-Name }},ou=people,dc=lanl,dc=gov))" start_tls = no groupname_attribute = cn groupmembership_filter = "" groupmembership_attribute = my_group dictionary_mapping = ${raddbdir}/ldap.attrmap compare_check_items = yes access_attr_used_for_allow = yes } ... authorize Autz-Type MY-GROUP { redundant { My-group_Users notfound = reject } } ---------------------------------- users (file) ... DEFAULT NAS-IP-Address =~ "^123.123", Autz-Type := MY-GROUP There's probably a better way, but this worked for what I wanted. On Thu, 2005-09-29 at 03:10, Jean-Francois Gobin wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" > ... > > Any other way ? > > Regards, > Jean-Francois Gobin > > - ---------- > Jean-Francois Gobin - Administrateur gobinjf.be > http://www.gobinjf.be mailto:gobin@gobinjf.be > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (FreeBSD) > Comment: Made with pgp4pine 1.76 > > iD8DBQFDO6+pkkg3QInH2uURAkoTAJ9CiiYoljx0B2zP/tInkSG4TwiwIgCbBWft > g16kNx6wUzO1va189DJmHRA= > =kTQn > -----END PGP SIGNATURE----- > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 6 Date: Thu, 29 Sep 2005 16:22:12 +0200 From: Juan Daniel Moreno <juanitomoreno(a)gmail.com> Subject: Re: SSL3_GET_CLIENT_KEY_EXCHANGE To: freeradius-users(a)lists.freeradius.org Message-ID: <2e33d53305092907226e2de3a4(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 > > The protocol specification describes this. The implementation in > src/modules/rlm_eap/ contains diagrams of the packets it expects to > receive. > > Alan DeKok. > > Thank you Alan, but now I have a new problem. I have been reading the src/modules/rlm_eap/ to understand my problem but I don't find the issue. In TLS establishment, the public key in the server.cert is 128 bytes length. I generate a random string of 46 bytes and the protocol version (TLS 1.0 (0x03, 0x01)) and I use the SSL function RSA_public_encrypt() with server's public key to encrypt the PreMasterSecret. As a result I get a 128 length string. As I send this data to the server, I get a "tls rsa encrypted length is wrong: s3_srvr.c: 1450:" Can anybody please tell me where can be my problem? Here is my code for exemple. void Client_Key_Exchange (SSLData *ClientSSLData, unsigned short *length, char *HandshakeMessages, unsigned short *length_Hndshk, char *buff) { char *PreMasterSecret = (char*) _MEMORY_Allocate (58 , true); char *EncryptedPreMasterSecret = (char*) _MEMORY_Allocate (128, true); char *temp = (char*) _MEMORY_Allocate (58 , true); unsigned char *tmpCert = _MEMORY_Allocate (ClientSSLData->certificate_len + 128, true); _RANDOM_MakeCharString (temp, 46); PreMasterSecret [0] = 0x03; PreMasterSecret [1] = 0x01; for (register int i = 0; i<46; i++) { PreMasterSecret[i+2] = temp [i]; ClientSSLData->PreMasterSecret[i] = PreMasterSecret[i]; } for (i = 0; i < ClientSSLData->certificate_len; i++) tmpCert[i] =(unsigned char) ClientSSLData->certificate[i]; //----- OpenSSL Functions ----- RSA *server_public_key; X509 *cert = X509_new (); EVP_PKEY *evp = EVP_PKEY_new (); X509 *err = d2i_X509 (&cert, (unsigned char**) &tmpCert, (ClientSSLData->certificate_len) ); //----- d2i_509 Function retrives tmpCert pointer advanced the number of bytes read ----- tmpCert = tmpCert - (ClientSSLData->certificate_len); //----- We get the public key from the Server certificate ----- evp = X509_get_pubkey(cert); server_public_key = (RSA *) evp->pkey.ptr; int rsasize = RSA_size(server_public_key); //----- We get the PreMasterSecret encrypted ----- int Encrypted_len = RSA_public_encrypt(48, (BYTE*) PreMasterSecret, (unsigned char*)EncryptedPreMasterSecret, server_public_key, RSA_PKCS1_PADDING); ClientSSLData->bufferSSL[(*length)++] = 0x16; // Handshake Message ClientSSLData->bufferSSL[(*length)++] = 0x03; // Version ClientSSLData->bufferSSL[(*length)++] = 0x01; // Version ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) % 256; // Length ClientSSLData->bufferSSL[(*length)++] = 0x10; // Client key exchange ClientSSLData->bufferSSL[(*length)++] = 0x00; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) % 256; // Length //----- Public key exchange ----- for (i = 0; i < Encrypted_len; i++) { buff[i] = EncryptedPreMasterSecret[i]; HandshakeMessages[(*length_Hndshk)++] = EncryptedPreMasterSecret[i]; } free (PreMasterSecret); free (EncryptedPreMasterSecret); free (temp); free (tmpCert); } Thank you for your help. Juan Daniel MORENO ------------------------------ Message: 7 Date: Thu, 29 Sep 2005 16:59:00 +0100 From: msah(a)otitelecom.bj Subject: (no subject) Cc: freeradius-users(a)lists.freeradius.org Message-ID: <20050929165900.j5qtkf92v5cso808(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ Message: 8 Date: Thu, 29 Sep 2005 17:00:47 +0100 From: msah(a)otitelecom.bj Subject: Postgresql+freeradius configuration To: freeradius-users(a)lists.freeradius.org Message-ID: <20050929170047.yclw6uck1huss8g0(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 98 *********************************************** �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

radiusd TLS error
by Riccardo Veraldi 30 Sep '05

30 Sep '05

Hello, my users authenticate with EAP-TLS and everything is working fine, but I Always have errors like this in hte log file Fri Sep 30 10:45:33 2005 : Error: TLS_accept:error in SSLv3 read client certificate A what could it be related to ? thanks Rick

1 0

Unexpected Accounting Response
by Giuseppe 30 Sep '05

30 Sep '05

Hi. I'm configuring the radius server so that no duplicate Calling-Station-Id values are found in the DB I'm logging to (Oracle), which is the only destination I'm logging onto (not even "detail"). The quickest way I thought of was to add a unique index to the RADACCT table so that any Accounting Start for a Calling-Station-Id already present in the DB would fail. Indeed I can see through the server log (started with -X) that the INSERT statement fails because it attempts to violate the unique constraint: ------ rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated ------ However, just a few lines below I see: ------ modcall[accounting]: module "sql" returns ok for request 0 ------ which probably is the root cause of unexpected (to me): ------ Sending Accounting-Response of id 241 to XXX.XXX.XXX.XXX:33863 ------ This Accounting Response is unexpected to me because RFC 2866 says: "If the RADIUS accounting server is unable to successfully record the accounting packet it MUST NOT send an Accounting-Response acknowledgment to the client". Any help ? Thanks in advance Giuseppe P.S. Here there's the whole log section related to the request processing that raises the above issue: --------- rad_recv: Accounting-Request packet from host XXX.XXX.XXX.XX:33863, id=241, length=92 User-Name = "testuser" User-Password = "\001\272O\257UN\214\307\245\333%\261 <\020d" Acct-Status-Type = Start Calling-Station-Id = "393480000000" Framed-IP-Address = XXX.XXX.XXX.XX Acct-Session-Id = "c16a444a16927797" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = XXX.XXX.XXX.XXX,NAS-IP-Address = XXX.XXX.XXX.XXX,Acct-Session-Id = "c16a444a16927797",User-Name = "testuser"' rlm_acct_unique: Acct-Unique-Session-ID = "aecc66663df0011c". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: group preacct returns ok for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0')' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated radius_xlat: '' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 0 modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 241 to XXX.XXX.XXX.XX:33863 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 241 with timestamp 433b0133 Nothing to do. Sleeping until we see a request. -------------

2 2