- Freeradius-Users - lists.freeradius.org

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 09 Sep '05

09 Sep '05

Ok, the hole day i tried to get it to work but this time when i install the certificate as a machine zertifikate the radius authentifikation log ends up with this log below. The Certificates where generated with openssl and all works fine as User certificates but not as computer zertificate. I set the Registry Patch which was diescribed in the mailing list to a value of 2. If anyone konws why this doesnt work please mail me. rad_recv: Access-Request packet from host 10.40.0.254:1024, id=125, length=120 NAS-IP-Address = 10.40.0.254 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x75b32a36b118137416c352ac114ec00c NAS-Port = 8 Framed-MTU = 1490 User-Name = "host/Client5" Calling-Station-Id = "00-10-5A-F7-F0-BA" EAP-Message = 0x02ff001101686f73742f436c69656e7435 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/Client5", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 255 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 181 users: Matched entry DEFAULT at line 200 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 125 to 10.40.0.254:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010000060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3409168c713d79e19e09bf2f2ab092c9 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 125 with timestamp 430c8459 Nothing to do. Sleeping until we see a request. FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 24.08.05 09:52:57: At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

8 15

Ascend-Data-Filter replies sent, but something amiss
by Justin M. Parker 09 Sep '05

09 Sep '05

Greetings. I've got freeradius (radiusd: FreeRADIUS Version 1.0.2, for host , built on Sep 7 2005 at 14:10:37) running, and authenticating well. My user names, passwords, and nas's are stored in a MySQL database. I have a user of name, say, "justin" belonging to group "dialin". The radgroupreply table has four rows of data like this: id GroupName Attribute op Value prio 1 dialin Ascend-Data-Filter += ip in forward est 0 2 dialin Ascend-Data-Filter += ip in forward dst ip x.x.x.x/32 0 3 dialin Ascend-Data-Filter += ip in drop tcp dstport = 25 0 4 dialin Ascend-Data-Filter += ip in forward 0 Here's what wvdial does with the Ascend-Data-Filters in place: --> WvDial: Internet dialer version 1.54.0 --> Initializing modem. --> Sending: ATZ ATZ OK --> Sending: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 OK --> Modem initialized. --> Sending: ATDT<number> --> Waiting for carrier. ATDT<number> CONNECT 50666 --> Carrier detected. Waiting for prompt. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) Remote Authentication server timeout. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) ** Bad Password <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> --> Don't know what to do! Starting pppd and hoping for the best. --> Starting pppd at Fri Sep 9 12:45:58 2005 --> pid of pppd: 11381 --> Using interface ppp0 --> Disconnecting at Fri Sep 9 12:46:02 2005 --> The PPP daemon has died: Authentication error. --> We failed to authenticate ourselves to the peer. --> Maybe bad account or password? (exit code = 19) --> man pppd explains pppd error codes in more detail. --> I guess that's it for now, exiting --> The PPP daemon has died. (exit code = 19) There's an awful lot of output from radius -X running while I attempt to auth, but here's something that sticks out: rlm_sql (sql): Released sql socket id: 5 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 67 to <ip:port> Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230382e31322e3136352e302f3234 Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 Ascend-Data-Filter += 0x697020696e20666f7277617264 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 67 with timestamp 4321cf66 Nothing to do. Sleeping until we see a request. As far as radiusd knows, I logged in. Removing my user from that dialin group (and thus not sending the group's replies) allows me to login as usual. Any ideas? Do those filter replies look right? they almost look like hex to me, not binary. I've tried X-Ascend-Data-Filter and Ascend-Data-Filter. Changing the op to := sends only the first of the four replies. In the attrs file, I've added the below line to my DEFAULT set: Ascend-Data-Filter =* ANY Any replies appreciated. -justin

1 1

CHAP Authentication But LDAP Authorization?
by Adam Tauno Williams 09 Sep '05

09 Sep '05

I have CHAP (PEAP) authentication working against my Samba PDC via ntlm_auth. I want to use that authentication but have users and their parameters from an LDAP DSA (that contains the SAM Samba is using). I see that a radius schema file is included and has an auxilliary objectclass. But I can't seem to find any informaiton on using LDAP for the user database but EAP/ntlm_auth for the authentication. Is this possible? -- Adam Tauno Williams - http://www.whitemice.org

1 0

Re: Not going past "Sending Access-Challenge"
by Adam Tauno Williams 09 Sep '05

09 Sep '05

Adam Tauno Williams <E-mail Protected> wrote: >> I'm trying to setup RADIUS/WPA authentication using PEAP as >> described in - >> http://www.ibiblio.org/pub/Linux/docs/HOWTO/8021X-HOWTO - but I >> never seem to get past the "Sending Access-Challenge" after I enter >> my username and password on the client. User is simply an entry in >> the users file with a clear text password. I've gone over the >> config several times, but nothing jumps out at me as an error >> message. Alan DeKok wrote: > The problem most likely is that the AP isn't seeing the response, or >it isn't liking the response. Check the IP addresses that the packet >use, via "tcpdump". Okay, I've etherealled the connection and I see an "Access-Request" from the WAP to the RADIUS server, then an "Access-Challenge" from the RADIUS serve to the WAP, and nothing else. What should the WAP's response to an "Access-Challenge" response be? The WAP is 192.168.1.42 and the RADIUS server is 192.168.1.47 No. Time Source Destination Protocol Info 8 0.839425 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=26, l=133) Frame 8 (175 bytes on wire, 175 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1a (26) Length: 133 Authenticator: 14E77EEE7405E31F02AB6A803EB478A1 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=15 t=EAP-Message(79) Last Segment[1] Length: 13 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 13 Type: Identity [RFC3748] (1) Identity (8 bytes): awilliam AVP: l=18 t=Message-Authenticator(80): 92C34CC691D9BC0D5B49F180B2F4EA59 Length: 16 Message-Authenticator: 92C34CC691D9BC0D5B49F180B2F4EA59 No. Time Source Destination Protocol Info 15 0.842887 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=26, l=83) Frame 15 (125 bytes on wire, 125 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1a (26) Length: 83 Authenticator: DE3DC989610D986213D85EF526EA47BD Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 2 Length: 6 Type: PEAP [Palekar] (25) Flags(0x20): Start PEAP version 0 AVP: l=18 t=Message-Authenticator(80): 36719CCCEE09502EA6C644C5EEC62B87 Length: 16 Message-Authenticator: 36719CCCEE09502EA6C644C5EEC62B87 AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A No. Time Source Destination Protocol Info 16 0.879314 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=27, l=218) Frame 16 (260 bytes on wire, 260 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1b (27) Length: 218 Authenticator: FBD53DBF46F4F69697F2427EDE5176A3 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=82 t=EAP-Message(79) Last Segment[1] Length: 80 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 80 Type: PEAP [Palekar] (25) Flags(0x80): Length PEAP version 0 Length: 70 Secure Socket Layer AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A AVP: l=18 t=Message-Authenticator(80): DF3CCA452EF2AF5D0CAA8EB46534127D Length: 16 Message-Authenticator: DF3CCA452EF2AF5D0CAA8EB46534127D No. Time Source Destination Protocol Info 23 0.885616 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=27, l=1119) Frame 23 (1161 bytes on wire, 1161 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1b (27) Length: 1119 Authenticator: 51DB666236DA04D0B72A4E99FAE73956 Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=24 t=EAP-Message(79) Last Segment[5] Length: 22 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 1034 Type: PEAP [Palekar] (25) Flags(0xC0): Length More PEAP version 0 Length: 3974 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): F4814C72EEE61CD5CEFC53B36B267D4C Length: 16 Message-Authenticator: F4814C72EEE61CD5CEFC53B36B267D4C AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 No. Time Source Destination Protocol Info 27 2.062088 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=28, l=144) Frame 27 (186 bytes on wire, 186 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1c (28) Length: 144 Authenticator: 77439BFA74CDEE8C8B73E043554916F0 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 6 Type: PEAP [Palekar] (25) Flags(0x0): PEAP version 0 AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 AVP: l=18 t=Message-Authenticator(80): 7A8DCF047F1B584608FE71A8EAB584AC Length: 16 Message-Authenticator: 7A8DCF047F1B584608FE71A8EAB584AC No. Time Source Destination Protocol Info 35 2.068415 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=28, l=1115) Frame 35 (1157 bytes on wire, 1157 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1c (28) Length: 1115 Authenticator: 2A5E1665347BA87046D857CAB331686F Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=20 t=EAP-Message(79) Last Segment[5] Length: 18 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1030 Type: PEAP [Palekar] (25) Flags(0x40): More PEAP version 0 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): 755BE6D63AA6F48DC661705F2EE3A5AD Length: 16 Message-Authenticator: 755BE6D63AA6F48DC661705F2EE3A5AD AVP: l=18 t=State(24): 6A14161A7B2A4D2A2B0EED6451D7555F Length: 16 State: 6A14161A7B2A4D2A2B0EED6451D7555F -- Adam Tauno Williams - http://www.whitemice.org

1 1

radius timeout
by Callis 09 Sep '05

09 Sep '05

Hi all I have freeradius-1.0.1-1 (with Petr Nixon's patch) running on FC-3 and using a postgresql backend to collect cisco AAA (stop only) records. My cisco IOS is 12.3(2)T2. I see a lot of radius timeout on my cisco router while the ping times is < 10ms and my radius timeout is set to 50. I even went further to connect the radius server and the router back to back with a cross cable and still have some timeouts. What could be wrong with my configs? Any help will be appreciated. Thank you.

3 3

Need to conditionally update user data in authentication process (mysql) - Clues?
by Mark Elkins 09 Sep '05

09 Sep '05

Hi I need to conditionally update some user data whilst in the authentication process - I'm looking for clues as how to do this. Background: I'm providing vouchers with a username and password on them. The first time the voucher details are used - I need to update that users details (change their group, add an expiry date - etc). All my users are in groups and its only users in a particular group that I want this to happen too... Everything is in MySQL. Sort of... pre_authorize_check = "UPDATE useracct SET groupname='newgroup', expireaccount='now() + 30 days' IF (SELECT groupname FROM useracct WHERE Username='%{Stripped-User-Name}' AND realm='%{Realm}' ) == 'voucher_group'; ie - If the person trying to login is a member of my 'voucher_group', make some changes to their SQL details first.... then authenticate them as normal... How would I do something like this? This process would only ever happen once to a user in the lifetime of their account, unlike repetitively logging in and using the service afterwards. ps - I also want to send them some welcoming e-mail at the same time and as their username@realm is actually their e-mail address .. the address is easy...but the process of doing so? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

About update of CRL
by Kouji Amemiya 09 Sep '05

09 Sep '05

Hi, all! I use FreeRADIUS-1.0.4 and OpenSSL on cygwin in Windows XP for EAP-TLS. I want to ask a question about the specification of FreeRADIUS. If CRL is updated, FreeRADIUS should be rebooted? When CRL was updated, I executed "c_rehash" command only. But the new CRL's information was not updated for FreeRADIUS. Or is there any other method? Please help me. Best regards, amemiya

1 0

listuser@peternixon.net
by Lee Bobby 09 Sep '05

09 Sep '05

thank u for your reply.I have resolved this problem. you are right.FreeRADIUS can't find the oracle library. by the way,are you familair with OID.w wanna keep in touch with u. my msn:bjldlee@hotmail.com bobby from beijing

1 0

Mixed-mode authentication enviornment
by Daniel Corbe 08 Sep '05

08 Sep '05

Hello, I have a FreeRADIUS server authenticating against an LDAP back-end. Some of my applications (such as my SIP proxy server) currently require DIGEST-MD5 authentication and others (such as my E-Mail server, and my Cisco routers) do not. Ideally I'd like everything to work harmoneously. Since the SIP server requires DIGEST authentication, the Auth-Type attribute is present and it is set to DIGEST which forces FreeRADIUS to attempt a digest authentication. Once this fails an Access-Reject packet is sent back to the RADIUS client Is there a way to configure FreeRADIUS so it first attempts a DIGEST authentication, and when that fails, we go ahead and attempt normal authentication? Thanks. -Daniel

2 15

RE: one question
by Guy Davies 08 Sep '05

08 Sep '05

Hi Richie, Simply look in the /usr/local/share/freeradius/dictionary file. It includes a load of $INCLUDE lines pointing to each of the dictionary.foo files. All you need to do is add $INCLUDE dictionary.fortinet to that file and make sure that the file dictionary.fortinet is in the correct format and is located in the same directory. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Richie Lee Sent: Thu 09/08/05 7:58 PM To: freeradius-users(a)lists.freeradius.org Subject: one question My company is a security vendor company(www.fortinet.com). How to add dictionary.fortinet to the server's list of vendor dictionaries in later freeradius version? Does anyone know it? _________________________________________________________________ Designer Mail isn't just fun to send, it's fun to receive. Use special stationery, fonts and colors. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0