- Freeradius-Users - lists.freeradius.org

PEAP issues
by allan.borman 26 Aug '05

26 Aug '05

Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end**********

2 1

Re: MySQL radacct not updated
by sean 26 Aug '05

26 Aug '05

Hi Thor, I'm just posting this to thank you for your help and let you know that it was appreciated and also to help anyone else with a similar problem to see the solution. In order to enable the accounting packets between Chilli and Radius I removed all of the pin holes in my ADSL modem and instead set up a NAT default server pointing to my Radius/WEB/Jabber/POP/SMTP/SMPP/Apache server. This allows all of the trafic arriving to the ADSL modem to pass through to the server and solved the problem. I not sure about the security of this fix so I'm setting up a firewall on the server. This will give me better control over the trafic than the ADSL modem did. Anyway once again thanks a million Thor you pointed me in the right direction and saved me another week with no sleep. Regards, Sean Bracken http://freetextworld.com http://topup.ie http://swarmhotspots.com

2 1

RE: PEAP issues
by Bill Carr 26 Aug '05

26 Aug '05

Remove the " Auth-Type Local" >From the guest account. Let freeradius figure out to do EAP on it's own. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of allan.borman Sent: Friday, August 26, 2005 12:32 PM To: FreeRadius users mailing list Subject: PEAP issues Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end********** - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

salt-encrypted VSAs?
by Bjørn Mork 26 Aug '05

26 Aug '05

Hello, I was hoping to send a few salt-encrypted VSAs to an ERX using FreeRADIUS Version 1.0.4, but I can't find any examples of how to do that. Is it possible, and if so, how? The format of the VSAs is documented on http://www.juniper.net/techpubs/software/erx/junose700/swconfig-broadband/h… My initial (far fetched) attempt was to modify dictionary.erx like this: VENDOR ERX 4874 BEGIN-VENDOR ERX ATTRIBUTE ERX-Virtual-Router-Name 1 string [..] ATTRIBUTE ERX-LI-Action 58 integer encrypt=1 ATTRIBUTE ERX-Med-Dev-Handle 59 string encrypt=1 ATTRIBUTE ERX-Med-Ip-Address 60 ipaddr encrypt=1 ATTRIBUTE ERX-Med-Port-Number 61 integer encrypt=1 END-VENDOR ERX [..] VALUE ERX-LI-Action off 0 VALUE ERX-LI-Action on 1 VALUE ERX-LI-Action noop 2 I also tried the other documented encrypt-values, with no success. As probably should be expected? The ERX seems to just ignore Access-Accept packets with any of these attributes. They are not even logged as received. Not much help there. Cisco has a bit better documentation with some examples (but not for FreeRADIUS) here: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/12… Does anyone have an idea of how to do this with FreeRADIUS? Bjørn

2 3

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 26 Aug '05

26 Aug '05

Thanks for the answert Alan, but what do you mean that it should be made more prominent in EAP-Conf? Could you give me detailed instructions how i can get this OID to my certificates? Armin FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 25.08.05 17:35:11: Ben Walding <ben.walding(a)gmail.com> wrote: > And then I stumbled on this > > http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html > > 1.3.6.1.4.1.311.17.2 > > After I started adding that OID to my machine certs, everything > started working wonderfully. That OID is added by the cert creation script in the "scripts" directory, but it should be made more prominent in eap.conf, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: FreeRadius-1.04 install seg faults after install (using EAP-TLS)
by Ben Dowling 25 Aug '05

25 Aug '05

I've loaded up radiusd into gdb and the bug looks the same as http://bugs.freeradius.org/show_bug.cgi?id=98. That page says the solution is to pass configure the --disable-shared flag, which I have done, yet the bug remains. Any help would be greatly appreciated, Ben Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 22174)] 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) (gdb) where #0 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 #1 0x08061404 in eaptype_load () #2 0x40489ad7 in eap_instantiate (cs=0x809f8d8, instance=0x814b0b8) at rlm_eap.c:134 #3 0x080575ff in find_module_instance () #4 0x0805874a in modcall () #5 0x080587b3 in compile_modsingle () #6 0x080579f4 in find_module_instance () #7 0x08057e75 in setup_modules () #8 0x0804ff76 in main () #9 0x40337e36 in __libc_start_main () from /lib/libc.so.6

2 4

lowercase before domain match in users file
by Tariq Rashid 25 Aug '05

25 Aug '05

hi - is it possible for freeradius to match the domains/realms for proxying purposes only (ie not rewrite the User-Name): in the users file: # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" can i enable a switch so that ABC.co.uk, aBc.Co.UK and so on are also matched? however, we don't want the User-Name to be rewritten as per to_lower in radiusd.conf tariq

2 1

FreeRadius-1.04 install seg faults after install (using EAP-TLS)
by Ben Dowling 25 Aug '05

25 Aug '05

Hi, I am having problems with freeradius 1.04 on debian. I previously installed the deb package, but later found out it doesn't support EAP-TLS, so had to build from source. I built it with the following command: ./configure --with-rlm_eap_tls --disable-shared && make && make install I have setup eap.conf and installed the required certificates. When starting radiusd it seems to get past loading the config and then seg faults. The output is below. Can anyone let me know what is causing the crash and how to get round it? Thanks in advance, Ben bratislava:/usr/local/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "TLS" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no Segmentation fault

1 0

FreeRADIUS 1.0.4: SEGMENTATION FAULT
by BugBuster 25 Aug '05

25 Aug '05

Hi all I'm facing a strange behaviour with Freeradius. The daemon starts and is able to authenticate accounts specified in the 'raddb/users' file. But if I uncomment the sql directive in the 'authorize' section (radius.conf), the deamon does not start: radius3:/usr/local/freeradius# radius3:/usr/local/freeradius# sbin/rc.radiusd start Starting FreeRADIUS:Tue Aug 23 17:54:52 2005 : Info: Starting - reading configuration files ... (I have to press ^C to stop the rc script) Running FreeRADIUS in debug mode (radiusd -sfxxyz -l stdout) I get the "Segmentation fault" message (more details is in .txt attachment). Background information - MySQL (v. 4.0.24): the mysql user 'radius' is able to connect to localhost' and has INSERT, SELECT, DELETE, UPDATE privileges - OS: Debian Linux 3.1 (sarge), kernel 2.6.8-2-686-smp - gcc -v: 3.3.5 - configuration command: ./configure --prefix=/usr/local/freeradius \ --with-logdir=/usr/local/freeradius/logs\ --with-radacctdir=/usr/local/freeradius/logs\ --with-raddbdir=/usr/local/freeradius/raddb --with-threads\ --with-ascend-binary \ --disable-shared \ --enable-developer - gdb radiusd: .. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1076783616 (LWP 9291)] 0x080902ce in lt_dlsym (handle=0x815afc8, symbol=0x8159928 "rlm_sql_mysql") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) - /etc/hosts: has entries for both 'localhost' and the Internet host name. - strace radiusd: See radtrace-1.txt Note the message open("/usr/local/freeradius/lib/rlm_sql_mysql.la", O_RDONLY) = -1 ENOENT (No such file or directory) In fact I can't find any 'rlm_sql_mysql.la' file. No change removing the '--disable-shared' option. I'm new to FreeRADIUS and so I suspect a misconfiguration. Thanks in advance. Ciao, Davide

4 10

FreeRadius EAP-TLS
by Hamid Salim 25 Aug '05

25 Aug '05

Hi all, I have the following setup that I am struggling to make it work; Fedora core 3 FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 Dell 802.11b/g cards for AP and supplicant Windows XP SP2 I have a 2 part question. 1.I recall reading on this forum that, Windows XP broke EAP-TLS, does this apply to SP2 also? 2. Would it make a difference if I have CVS verses non-CVS FreeRadius installed? Thanks Hamid.

2 1