- Freeradius-Users - lists.freeradius.org

working rlm_perl example
by ricklim＠telus.net 02 Oct '05

02 Oct '05

Hi there, does anyone have a working example of rlm_perl authenticating a user???? I have tried the example.pl and it still gives me a access-reject message. TIA

2 1

installing problem on Debian
by Ciolo_-^DusT^-_WebMaster 02 Oct '05

02 Oct '05

*** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! rm -fr .libs/rlm_perl.la .libs/rlm_perl.* .libs/rlm_perl-1.0.0-pre0.* gcc -shared rlm_perl.lo -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lpthread -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.0.0-pre0.so -o .libs/rlm_perl-1.0.0-pre0.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/root/freeradius-snapshot-20040517/src/modules/rlm_perl' make[5]: *** [common] Error 1 make[5]: Leaving directory `/root/freeradius-snapshot-20040517/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-snapshot-20040517/src/modules' make[3]: *** [common] Error 1 make[3]: Leaving directory `/root/freeradius-snapshot-20040517/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-snapshot-20040517/src' make[1]: *** [common] Error 1 make[1]: Leaving directory `/root/freeradius-snapshot-20040517' make: *** [all] Error 2 this is the error I have every time I try to "make" I install it with ./configure --with-experimental-modules and I have the same error with all the release I try... also with the lst one. thanks in advantage byez Polverni Davide

2 1

RE: Freeradius-Users Digest, Vol 5, Issue 91 [faked-from][heur] [sls]
by Dag Petersson 02 Oct '05

02 Oct '05

-----Original Message----- From: "freeradius-users-request(a)lists.freeradius.org"<freeradius-users-request(a)lists.freeradius.org> Sent: 05-09-28 19:06:04 To: "freeradius-users(a)lists.freeradius.org"<freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 5, Issue 91 [faked-from][heur] [sls] Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: AccountingReq message authenticator (Michael Lecuyer) 2. Re: Questions about upgrading Freeradius (Linda Pagillo) 3. Re: Expose RADIUS packet's identifier (Alan DeKok) 4. Re: Questions about upgrading Freeradius (Alan DeKok) 5. Re: Chap,LDAP and Passwords :) (Alan DeKok) 6. Re: Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend? (Alan DeKok) 7. Re: EAP-TLS reject if CN not in MySQL (Alan DeKok) 8. Re: Questions about upgrading Freeradius (Dusty Doris) 9. Re: Questions about upgrading Freeradius (Linda Pagillo) ---------------------------------------------------------------------- Message: 1 Date: Wed, 28 Sep 2005 10:48:42 -0400 From: Michael Lecuyer <mjl(a)theorem.com> Subject: Re: AccountingReq message authenticator To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <433AAD4A.305(a)theorem.com> Content-Type: text/plain; charset=windows-1252; format=flowed There is no way to generate a message authenticator in an Accounting-Request packet the usual way it's generated for an Access-Request. The accounting packet is signed by the client therefore there cannot be two signatures created for the entire the packet. By the very nature of creating signature the second signature will alter the packet's contents invalidating the first signature. The Message-Authenticator can be only one of two things. Either it's calculated as a hash of the attributes or it's a random number (like the Access-Request authenticator). From your information I suspect it's the former. You might try using the traditional MA calculation for the MA on just the attributes with an empty (zeroed) MA present and back patch the MA. If this works please let me know. Or, if someone has accounting packets generated with proper MA's please send them to me and I'll try some standard hashes. The MA is traditionally created as an MD5-HMAC of the shared secret and the entire packet's contents with an empty (16 byte) Message-Authenticator. For an accounting packet MA use just the attribute block instead of the entire packet try just the attributes with the empty MA. Ashwin Gobind wrote: > Hi. > > > > Is there anyway to generate a message authenticator for an accounting > request packet. At the moment I am using JRadius, I need to send an > accounting request message to another radius server. However after I > add the message authenticator and send to to another server, the other > server complains about “Invalid message authenticator” (Shared secret > is incorrect). > > > > Here is some code : > > //Proxy request to the wap gateway > > > DatagramSocket socket = new DatagramSocket(); > > > socket.setSoTimeout(5000); > > //Generate > authenticator > > > MessageDigest md5 = MessageDigest.getInstance("MD5"); > > > md5.reset(); > > md5.update((byte)req.getCode()); > > > md5.update((byte)req.getIdentifier()); > > int length = > req.getBytes().length; > > byte [] authenticator = > req.getAuthenticator(); > > byte [] attributeBytes = > req.getAttributeBytes(req.getAttributes(),0); > > for (int z=0; z > <authenticator.length ; z++ ) > > > RadiusLog.debug("Autenticator["+z+"] Before = " + authenticator[z]); > > > > > RadiusLog.debug("Autenticator Length: " + authenticator.length); > > RadiusLog.debug("Attributes > Length: " + attributeBytes.length); > > RadiusLog.debug("Paket > Length: " + length); > > > > String sharedSecret = > "testing123"; > > md5.update((byte)(length >> 8)); > > md5.update((byte)(length & > 0xff)); > > md5.update(authenticator, 0, > authenticator.length); > > md5.update(attributeBytes, > 0, attributeBytes.length); > > > md5.update(sharedSecret.getBytes()); > > > req.overwriteAttribute(AttributeFactory.newAttribute(AttributeDictionary.MESSAGE_AUTHENTICATOR, > authenticator)); > > > > > System.arraycopy(md5.digest(), 0, authenticator, 0, 16); > > “This e-mail is sent on the Terms and Conditions that can be accessed by > Clicking on this link http://www.vodacom.net/legal/email.aspx > <http://www.vodacom.net/legal/email.asp> " > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 2 Date: Wed, 28 Sep 2005 10:17:59 -0500 From: "Linda Pagillo" <linda(a)n2thenet.com> Subject: Re: Questions about upgrading Freeradius To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <009301c5c43f$cffd60c0$2902a8c0(a)com.tnaccess.com> Content-Type: text/plain; charset="iso-8859-1" Thanks for your reply. Is it really this much work to do a simple upgrade? Is there a shortcut? ----- Original Message ----- From: "Dusty Doris" <freeradius(a)mail.doris.cc> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 28, 2005 9:58 AM Subject: Re: Questions about upgrading Freeradius > On Wed, 28 Sep 2005, Linda Pagillo wrote: > > > Hi everyone: > > > > I have been using Freeradius v.0.9.3 for over a year and i wish to > > upgrade to the latest version. Can anyone give me detailed instructions > > on how to do this? I use Freeradius in a prodcution enviroment and i > > can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a > > ./configure, make and make install like i did the first time? If yes, > > won't that overwrite all of my current config files? Thanks! > > > > First, I would recommend setting up a lab machine (you can do it on your > workstation if you need to) to test that your configs work correctly with > the new version. Its probably backward compatible, but I wouldn't just > blindly upgrade on production and hope for the best. > > Then you could compile freeradius with --prefix. This will put all > configurations, binaries, etc.. into a certain directory. For example: > > ./configure --prefix=/usr/local/freeradius1.0.5 > make > make install > > When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change > your files to make it work like it did in testing. Shutdown the current > radius version and start up the new one with > /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, > modify your startup scripts to point to the new version instead of the > old. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 3 Date: Wed, 28 Sep 2005 11:23:31 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Expose RADIUS packet's identifier To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928152332.0133B16CC1(a)mail.nitros9.org> Josh Howlett <josh.howlett(a)bristol.ac.uk> wrote: > Does anyone know if the server can expose a RADIUS packet's identifier, > for example through mod_exec? Or, is this limited to RADIUS attributes only? ATTRIBUTE Packet-Authentication-Vector 1088 octets It *could* have been somewhere in the documentation, but... Alan DeKok. ------------------------------ Message: 4 Date: Wed, 28 Sep 2005 12:08:13 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Questions about upgrading Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928160813.115C916CC1(a)mail.nitros9.org> "Linda Pagillo" <linda(a)n2thenet.com> wrote: > Thanks for your reply. Is it really this much work to do a simple upgrade? > Is there a shortcut? Not really. Doing the upgrade slowly is less work than doing it quickly, and then having your RADIUS server down because you missed something. Alan DeKok. ------------------------------ Message: 5 Date: Wed, 28 Sep 2005 12:09:11 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Chap,LDAP and Passwords :) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928160911.41F2616CC1(a)mail.nitros9.org> liz <liz(a)unixgrrl.net> wrote: > However, if I turn on CHAP based authentication I get a message from > the radius server that USER-PASSWORD is a required attribute. You set Auth-Type := LDAP. Don't do that. LDAP doesn't understand CHAP. > I am going to try another radius plugin I found today on > sourcegforge to try and narrow it down. That's not necessary. Alan DeKok. ------------------------------ Message: 6 Date: Wed, 28 Sep 2005 12:12:56 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928161256.3095E16CC1(a)mail.nitros9.org> Martin Pauly <pauly(a)hrz.uni-marburg.de> wrote: > We do have perfomance problems with our LDAP backend, > so this sound reasonable, but could this cause the server to crash? Yes. If all of the threads are blocked forever, waiting for the DB to return data, then the queue of requests grows without bounds. At some point, the server says "I'm not making progress, and I can't recover from this", and kills itself. Since the server is *already* effectively dead at that point, it makes no difference to your network. The solution is to fix the database so that it doesn't kill the server. Alan DeKok. ------------------------------ Message: 7 Date: Wed, 28 Sep 2005 12:14:05 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: EAP-TLS reject if CN not in MySQL To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928161405.5BBA516E0B(a)mail.nitros9.org> "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> wrote: > imply a group that changes the default ACTIONs to something like > > fail = 1 > everythingelse = return > > Tried in config: > > everythingelse = return > > radiusd.conf[1637] Unknown module rcode 'everythingelse'. It was NOT meant to be taken literally. > Any ideas? Read doc/configurable_failover, and type in all the other return codes by hand. Alan DeKok. ------------------------------ Message: 8 Date: Wed, 28 Sep 2005 12:48:09 -0400 (EDT) From: Dusty Doris <freeradius(a)mail.doris.cc> Subject: Re: Questions about upgrading Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928124746.N93079(a)mail.doris.name> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed You consider that much work? I wish I had your job! :) On Wed, 28 Sep 2005, Linda Pagillo wrote: > Thanks for your reply. Is it really this much work to do a simple upgrade? > Is there a shortcut? > ----- Original Message ----- > From: "Dusty Doris" <freeradius(a)mail.doris.cc> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, September 28, 2005 9:58 AM > Subject: Re: Questions about upgrading Freeradius > > >> On Wed, 28 Sep 2005, Linda Pagillo wrote: >> >>> Hi everyone: >>> >>> I have been using Freeradius v.0.9.3 for over a year and i wish to >>> upgrade to the latest version. Can anyone give me detailed instructions >>> on how to do this? I use Freeradius in a prodcution enviroment and i >>> can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a >>> ./configure, make and make install like i did the first time? If yes, >>> won't that overwrite all of my current config files? Thanks! >>> >> >> First, I would recommend setting up a lab machine (you can do it on your >> workstation if you need to) to test that your configs work correctly with >> the new version. Its probably backward compatible, but I wouldn't just >> blindly upgrade on production and hope for the best. >> >> Then you could compile freeradius with --prefix. This will put all >> configurations, binaries, etc.. into a certain directory. For example: >> >> ./configure --prefix=/usr/local/freeradius1.0.5 >> make >> make install >> >> When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change >> your files to make it work like it did in testing. Shutdown the current >> radius version and start up the new one with >> /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, >> modify your startup scripts to point to the new version instead of the >> old. >> >> >> - >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 9 Date: Wed, 28 Sep 2005 11:58:04 -0500 From: "Linda Pagillo" <linda(a)n2thenet.com> Subject: Re: Questions about upgrading Freeradius To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <00b901c5c44d$cb1f9e20$2902a8c0(a)com.tnaccess.com> Content-Type: text/plain; charset="iso-8859-1" I wish you had my job too because i'm about fed up with this crap.. Anyway, thanks for the reply, i'll do it. ----- Original Message ----- From: "Dusty Doris" <freeradius(a)mail.doris.cc> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 28, 2005 11:48 AM Subject: Re: Questions about upgrading Freeradius > You consider that much work? I wish I had your job! > > :) > > On Wed, 28 Sep 2005, Linda Pagillo wrote: > > > Thanks for your reply. Is it really this much work to do a simple upgrade? > > Is there a shortcut? > > ----- Original Message ----- > > From: "Dusty Doris" <freeradius(a)mail.doris.cc> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Sent: Wednesday, September 28, 2005 9:58 AM > > Subject: Re: Questions about upgrading Freeradius > > > > > >> On Wed, 28 Sep 2005, Linda Pagillo wrote: > >> > >>> Hi everyone: > >>> > >>> I have been using Freeradius v.0.9.3 for over a year and i wish to > >>> upgrade to the latest version. Can anyone give me detailed instructions > >>> on how to do this? I use Freeradius in a prodcution enviroment and i > >>> can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a > >>> ./configure, make and make install like i did the first time? If yes, > >>> won't that overwrite all of my current config files? Thanks! > >>> > >> > >> First, I would recommend setting up a lab machine (you can do it on your > >> workstation if you need to) to test that your configs work correctly with > >> the new version. Its probably backward compatible, but I wouldn't just > >> blindly upgrade on production and hope for the best. > >> > >> Then you could compile freeradius with --prefix. This will put all > >> configurations, binaries, etc.. into a certain directory. For example: > >> > >> ./configure --prefix=/usr/local/freeradius1.0.5 > >> make > >> make install > >> > >> When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change > >> your files to make it work like it did in testing. Shutdown the current > >> radius version and start up the new one with > >> /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, > >> modify your startup scripts to point to the new version instead of the > >> old. > >> > >> > >> - > >> List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > >> > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 91 ***********************************************

1 0

Freeradius - Where to start and where to get the righ answer
by Gunther 01 Oct '05

01 Oct '05

After using FR 1.0.5 for testing for a while with a FR+MySQL configuration, I found out the hard way that documentation is not a pet project of FR. The only up-to-date documentation I found so far is reading the source code for hours, days, weeks ... There are lots of features I could not find anywhere in any kind of documentation, but in the source code, e.g. positional parameters for the SQL nas table. Or you can use the IP or domain name within the nas table for the 'nasname'. What happens to dynamic DNS addresses? etc.... Anyhow, it is a nice piece of software, working most of the times very well! Additional guidance, a wiki or ... could be extremely helpful for the project ... maybe it even exists somewhere. I found my way around, but I am kind of stuck when it comes to the accounting records. Sometimes I simply do not get a stoptime and therefore the session is supposed to be still online. I can then take maybe the idle time, add it to the last startime and see if it makes 'sense'. I had 4+ records with empty starttime for a nas. All I like to do for instance ... - User got 24h (or other time period) allocated - When session ends an updated record for the next session time could be generated - When user logs in again, the remaining session time will be granted But what happens when radacct does not get the stoptime for the last session? Anyhow, is there anything, anywhere (up-to-date) where I can find further information? Going through ever source file is quite a time consuming act. Anyhow, Open Source is best ... I can apply changes without requesting a license change ;-) And where can you directly communicate with the developers ... Thanks! G.

4 5

Freeradius and NFS
by Wulf Kaiser 01 Oct '05

01 Oct '05

Hi, after several problems, i managed it to install Freeradius on our NFS Server (running Solaris 9). The NFS Server exports a part of his '/usr/local' - including freeradius - to our main LDAP Server and to the Failover Machine. Starting Freeradius on the main LDAP Server works - it authenticates our WLAN and VPN Users. But now i want it running on both directory servers to have a real Failover for Freeradius, too. So i modified the startscript (also exported via NFS on both machines) and added: RAD_CONF=$RADDBDIR/`/usr/bin/uname -n`_radiusd.conf RAD_PID=$rundir/`/usr/bin/uname -n`_radius.pid I have also copied the radiusd.conf to ldap_radiusd.conf and ldapFailover_radiusd.conf and modified both to call machine specific log and pid files. Recently, i have done the same with the Apache Web Server, and it works with the following lines in the start section of apachectl: $HTTPD -k $ARGV -f $HTTPD_CONF But how do i tell the radiusd to read another conf than the original radiusd.conf? Whatever i tried, the output was root@ldap<80> /etc/init.d/radius.server start -n Starting FreeRADIUS: Sat Oct 1 12:30:52 2005 : Info: Starting - reading configuration files ... Sat Oct 1 12:30:52 2005 : Error: Unable to open file "/usr/local/freeradius/etc/radiusd.conf": No such file or directory Sat Oct 1 12:30:52 2005 : Error: Errors reading radiusd.conf The uname works, here are some debug outputs: Reading configuration from /usr/local/freeradius/etc/ldap_radiusd.conf... Generating PID in /usr/local/freeradius/var/run/radiusd/ldap_radius.pid... Any Ideas or tipps? mit freundlichem Gruss, Wulf Kaiser IT Services Web Development | Database Administration Webmaster www.mpimf-heidelberg.mpg.de Zentrale Hard- und Softwarebeschaffung Max-Planck-Institut für medizinische Forschung Jahnstrasse 29 69120 Heidelberg Fon +49 6221 486560 Fax +49 6221 486561 Mobil +49 172 6235901

2 1

Please helpme is Urgent
by alfonso celestino 30 Sep '05

30 Sep '05

Hi! I find this problem, freeradius was working perfectly whith EAP-PEAP, but suddenly wireless users could not access to wireless network. The log from NAS when the access is success: Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> station up <00:0e:9b:d3:71:b1> update station bssid to 00:0b:86:a5:d5:a0 (#users 1) Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> setting the encryption key type <00:0e:9b:d3:71:b1> Set the UKey type to Dyanmic TKIP Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> selected server moctezuma2 for method=802.1x; user=academico1, essid=RIU, domain=<> when the problem happened was: Sep 30 12:40:10 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <WARN> RADIUS server moctezuma2-zzz.zzz.zzz.zzz-1812 timeout for client=00:04:23:99:bb:09 auth=802.1x also I attach de radius.log file. The radiusd process always was up. When I restarted the radiusd process, the access to wireless network started to work perfectly again. What was the problem? Thanks in advance Alfonso Celestino ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Authentication fails every once and awhile and CRL question
by Jason Carr 30 Sep '05

30 Sep '05

This only happens every once and awhile, not sure why. Here's a log file of the authentication. Not one specific supplicant fails, but this one happens to be OS X 10.3. Others include SP2. Any reason or should I blame this on the client? Also I'm reloading radiusd with kill -HUP pid every 15 minutes to load a CRL, is that really required or can I get away with not reloading it? Here's an auth fail. Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:04 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS First Fragment of the message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: More fragments to follow Fri Sep 30 11:57:04 2005 : Info: (other): SSL negotiation finished successfully Fri Sep 30 11:57:35 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:35 2005 : Error: TLS_accept:error in SSLv3 read client hello C Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Auth: Login incorrect: [wpa-tester.wv.cc.cmu.edu/<no User-Password attribute>] (from client access-points port 360 cli xxxx.xxxx.xxxx

1 0

EAP-PEAP-MSCHAPv2: use_tunneled_reply = yes
by Bjarni Hardarson 30 Sep '05

30 Sep '05

Hi all, I'm using FreeRADIUS with Cisco 1200 Series Access points for dynamic VLAN assignment. When i set use_tunneled_reply = yes for PEAP i get an Access-Challenge with the correct attributes but the final Access-Accept has no attributes and the User-Name is the anonymous one from the outer tunnel. This username is then used by the AP for accounting. Is this by design or is my configuration wrong? Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 24 modcall: group authenticate returns ok for request 24 PEAP: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x818f508 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 24 modcall: group authenticate returns handled for request 24 Sending Access-Challenge of id 8 to 127.0.0.1:33229 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 EAP-Message = 0x010900501900170301002079fdf7026cf88ffd8c978e4fb62290b4d4f4a1596c767f557ada bdaf51b7437d17030100209a1de8e9b88b4654d03b0754d4f5a04887b57b329c94a6494ef84d 2bf74f294c State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Finished request 24 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33229, id=9, length=205 User-Name = "anon" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "00-00-00-00-00-02" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209005019001703010020f8f585176e2220ba00055d66cd73494a9539cce8d52da81ff067 f5835fd4de1117030100207461f938bb9af8c154f926ab2eb5653392cb1ebb02782ac58c3b6c ca8566fbdd State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Message-Authenticator = 0x830975610af464574e583a2a9240068d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 25 modcall[authorize]: module "preprocess" returns ok for request 25 radius_xlat: '/var/log/radiusd/radiusd-20050930' rlm_detail: /var/log/radiusd/radiusd-%Y%m%d expands to /var/log/radiusd/radiusd-20050930 modcall[authorize]: module "auth_log" returns ok for request 25 modcall[authorize]: module "chap" returns noop for request 25 modcall[authorize]: module "mschap" returns noop for request 25 rlm_realm: No '@' in User-Name = "anon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 25 rlm_eap: EAP packet type response id 9 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 25 modcall[authorize]: module "files" returns notfound for request 25 modcall: group authorize returns updated for request 25 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 25 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 25 modcall: group authenticate returns ok for request 25 Sending Access-Accept of id 9 to 127.0.0.1:33229 MS-MPPE-Recv-Key = 0x73f9e4f3cc50836d0d52db55ddceb6afb7fea6e50313380873101fe245e6532d MS-MPPE-Send-Key = 0xcbf30f484d74cc947dcd0ea4fb49f7d94adb6be677e23d4edae3a22d136ad3b9 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anon" Finished request 25 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 0 with timestamp 433d25b6 Cleaning up request 17 ID 1 with timestamp 433d25b6 Cleaning up request 18 ID 2 with timestamp 433d25b6 Cleaning up request 19 ID 3 with timestamp 433d25b6 Cleaning up request 20 ID 4 with timestamp 433d25b6 Cleaning up request 21 ID 5 with timestamp 433d25b6 Cleaning up request 22 ID 6 with timestamp 433d25b6 Cleaning up request 23 ID 7 with timestamp 433d25b6 Cleaning up request 24 ID 8 with timestamp 433d25b6 Cleaning up request 25 ID 9 with timestamp 433d25b6 Nothing to do. Sleeping until we see a request. --------------------------------------------------- When i use TTLS everything works perfectly. If i set use_tunneled_reply = no for TTLS the outer tunnel identity is used in the Access-Accept and no attributes are returned. Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 TTLS: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler TTLS: Freeing handler for user radtes modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 Sending Access-Accept of id 7 to 127.0.0.1:33227 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 MS-MPPE-Recv-Key = 0xf250fa51ea382aef2f2ea5ebaab8596fa822cf6788ccd2782fe2e7df98cd06aa MS-MPPE-Send-Key = 0xca164c1041c8b439c99b13505ba04aaf48cabf6802df8c92738a2c12349b4be2 EAP-Message = 0x03070004 Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 433d1f58 Cleaning up request 1 ID 1 with timestamp 433d1f58 Cleaning up request 2 ID 2 with timestamp 433d1f58 Cleaning up request 3 ID 3 with timestamp 433d1f58 Cleaning up request 4 ID 4 with timestamp 433d1f58 Cleaning up request 5 ID 5 with timestamp 433d1f58 Cleaning up request 6 ID 6 with timestamp 433d1f58 Cleaning up request 7 ID 7 with timestamp 433d1f58 Nothing to do. Sleeping until we see a request. raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = ******** private_key_file = ${raddbdir}/certs/srv_key.pem certificate_file = ${raddbdir}/certs/srv_cert.pem CA_file = ${raddbdir}/certs/demoCA/prv.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } } raddb/users DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes DEFAULT Huntgroup-name == "LAN", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := LAN DEFAULT Huntgroup-name == "AIR", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := AIR

2 2

Re: Expose RADIUS packet's identifier
by James J J Hooper 30 Sep '05

30 Sep '05

> > ATTRIBUTE Packet-Authentication-Vector 1088 octets > > Alan DeKok. can't get it to work: radius -X says: WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Packet-Authentication-Vector} in radiusd.conf: exec logit { wait = yes input_pairs = request output_pairs = none program = "/etc/raddb/bin/logit.sh %{Packet-Authentication-Vector}" } logit called in authorize. Thanks in advance for any help you can give, James.

2 1

MSCHAPv2, MySQL, Freeradius
by Dan Russell 30 Sep '05

30 Sep '05

Hi, Is there a way in which I can have encrypted passwords in the mysql database and use MSCHAPv2 to authenticate users? If I used a third party tool like mkntpwd to create NT Hashes, could I put premade hashes in the database and use them to authenticate or would rlm_mschap encrypt the password attribute anyway? Thanks in advance for any help you can offer, Daniel Russell Lead Technician In-House IT Services PH (03) 50210044 FX (03) 50210066

2 1