- Freeradius-Users - lists.freeradius.org

Freeradius + EAP-TLS + DHCP = not working. Help!
by AIbarra＠mex.boehringer-ingelheim.com 30 Sep '05

30 Sep '05

I have the same problem do you have any solution? Saludos Alberto Ibarrarán G. Information Technology Boehringer Ingelheim Promeco (52) 55 56 29 8300 ext. 8631

2 1

how to config radiusclient!
by zhangshuai 30 Sep '05

30 Sep '05

Dear all, I wish to use softphone X-lite on SER and radius in db_mode. When I installed both freeradius 1.0.4 and radiusclient 0.4.3 on the same server which ser 0.8.14 has installed on, I could log in X-lite through radius authorization. And now I want radiusclient (on server A) to send the request to a remote radius server (on server B) to realize authorization. I have changed those config files: /usr/local/etc/radiusclient/servers, /usr/local/etc/radiusclient/radiusclient.conf and /usr/local/etc/raddb/clients.conf as the document (http://www.iptel.org/ser/doc/ser_radius/ser_radius.html#AEN193) did. Then I test the radius server as the above document said on server A: radclient -f digest server B auth testing123 and I received expected replied message from server B. But when I log in x-lite (UA), there are error messages: Sep 29 17:11:06 localhost ser[4408]: rc_ip_hostname: couldn't look up host by addr: DA61FC29 Sep 29 17:11:06 localhost ser[4408]: rc_send_server: no reply from RADIUS server unknown:1812 And the number "DA61FC29" is exactly the hexadecimal value of the ip address of radius server. How come? Did I mis-config anything? Many thanks for your reply! Shuai http://www.goldentek.biz

1 0

PEAP and ntlm_auth
by Dick 29 Sep '05

29 Sep '05

Hi all, I've got a small problem with FreeRadius, I'm trying to forward NTLM authentication to a NT domain by using ntlm_auth but the %{Stripped-User-Name} is empty. I've enabled ntdomain in authorize { } and preacct { }, but it doesn't seem to translate "%{User-name}" as "NTCORP01\\USER" to "%{Stripped-User-Name}" as"USER". When I use "ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=USER" it works (but only for USER ;-)). with_ntdomain_hack in preprocess { } it breaks PEAP (as mentioned earlier on this list). Should I create a wrapper script for ntlm_auth (to strip the %{User-name}) as a workaround or can I use another FreeRadius trick? Thanks, Dick

1 0

setting password from an application
by Nagaraj Venkatapuram 29 Sep '05

29 Sep '05

All, I am having a problem setting password from the http application. It is getting reset to NULL inside pam_authenticate somehow. The only place I can see password is set to NULL is in the function *void _pam_sanitize(pam_handle_t *pamh)* in pam_misc.c file. I've also commented out the invocation of _pam_sanitize from pam api. Also I have syslog trace in the *pam_sanitize *function. However, for some reason I am losing the password inside pam_authenticate inspite of all the changes and also I don't see any trace from the function *pam_sanitize. *If anybody has any idea about this, please reply. retval = pam_start("http", auth_userpass, &conv, &pamh); syslog(LOG_INFO, "before pam_set_item..........................\n"); pam_set_item(pamh, PAM_AUTHTOK, pwd); if (retval == PAM_SUCCESS) { retval = pam_authenticate(pamh, 0); /* is user really user? */ } else { syslog(LOG_INFO, "--Not authenticated - pam start failed\n"); } /* This is where we have been authorized or not. */ if (retval == PAM_SUCCESS) { syslog(LOG_INFO, "Authentication successful for %s from %s\n", auth_userpass, req->remote_ip_addr); strncpy(req->user, auth_userpass, 15); req->user[15] = '\0'; if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */ pamh = NULL; syslog(LOG_ERR, "http: failed to release pam authenticator\n"); } return 1; } Thanks, N

1 0

Freeradius + oracle
by chabral - 29 Sep '05

29 Sep '05

Hi, Is it possible to install and run freeradius on an Oracle App Server?. The database server is another server located at another local network. Is it possible to achieve this configuration? Which are the requirements of freeradius for compiling with oracle support? Can I download the code and compile it in the app server? I'll really appreciate your advice. Best regards, -- chabral

1 0

How can i tell which version of freeradius i'm running?
by Linda Pagillo 29 Sep '05

29 Sep '05

Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

3 2

Re: SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 29 Sep '05

29 Sep '05

> > The protocol specification describes this. The implementation in > src/modules/rlm_eap/ contains diagrams of the packets it expects to > receive. > > Alan DeKok. > > Thank you Alan, but now I have a new problem. I have been reading the src/modules/rlm_eap/ to understand my problem but I don't find the issue. In TLS establishment, the public key in the server.cert is 128 bytes length. I generate a random string of 46 bytes and the protocol version (TLS 1.0 (0x03, 0x01)) and I use the SSL function RSA_public_encrypt() with server's public key to encrypt the PreMasterSecret. As a result I get a 128 length string. As I send this data to the server, I get a "tls rsa encrypted length is wrong: s3_srvr.c: 1450:" Can anybody please tell me where can be my problem? Here is my code for exemple. void Client_Key_Exchange (SSLData *ClientSSLData, unsigned short *length, char *HandshakeMessages, unsigned short *length_Hndshk, char *buff) { char *PreMasterSecret = (char*) _MEMORY_Allocate (58 , true); char *EncryptedPreMasterSecret = (char*) _MEMORY_Allocate (128, true); char *temp = (char*) _MEMORY_Allocate (58 , true); unsigned char *tmpCert = _MEMORY_Allocate (ClientSSLData->certificate_len + 128, true); _RANDOM_MakeCharString (temp, 46); PreMasterSecret [0] = 0x03; PreMasterSecret [1] = 0x01; for (register int i = 0; i<46; i++) { PreMasterSecret[i+2] = temp [i]; ClientSSLData->PreMasterSecret[i] = PreMasterSecret[i]; } for (i = 0; i < ClientSSLData->certificate_len; i++) tmpCert[i] =(unsigned char) ClientSSLData->certificate[i]; //----- OpenSSL Functions ----- RSA *server_public_key; X509 *cert = X509_new (); EVP_PKEY *evp = EVP_PKEY_new (); X509 *err = d2i_X509 (&cert, (unsigned char**) &tmpCert, (ClientSSLData->certificate_len) ); //----- d2i_509 Function retrives tmpCert pointer advanced the number of bytes read ----- tmpCert = tmpCert - (ClientSSLData->certificate_len); //----- We get the public key from the Server certificate ----- evp = X509_get_pubkey(cert); server_public_key = (RSA *) evp->pkey.ptr; int rsasize = RSA_size(server_public_key); //----- We get the PreMasterSecret encrypted ----- int Encrypted_len = RSA_public_encrypt(48, (BYTE*) PreMasterSecret, (unsigned char*)EncryptedPreMasterSecret, server_public_key, RSA_PKCS1_PADDING); ClientSSLData->bufferSSL[(*length)++] = 0x16; // Handshake Message ClientSSLData->bufferSSL[(*length)++] = 0x03; // Version ClientSSLData->bufferSSL[(*length)++] = 0x01; // Version ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) % 256; // Length ClientSSLData->bufferSSL[(*length)++] = 0x10; // Client key exchange ClientSSLData->bufferSSL[(*length)++] = 0x00; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) % 256; // Length //----- Public key exchange ----- for (i = 0; i < Encrypted_len; i++) { buff[i] = EncryptedPreMasterSecret[i]; HandshakeMessages[(*length_Hndshk)++] = EncryptedPreMasterSecret[i]; } free (PreMasterSecret); free (EncryptedPreMasterSecret); free (temp); free (tmpCert); } Thank you for your help. Juan Daniel MORENO

2 1

My server is up and running. Thanks to all who helped
by Linda Pagillo 29 Sep '05

29 Sep '05

Hi Guys: I finally got Freeradius upgraded to the most current version. Thanks to all who helped. Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

1 0

Postgresql+freeradius configuration
by msah＠otitelecom.bj 29 Sep '05

29 Sep '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance.

1 0

(no subject)
by msah＠otitelecom.bj 29 Sep '05

29 Sep '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance.

1 0