- Freeradius-Users - lists.freeradius.org

RE: SSL Problem???
by DeYoung, Brandon 18 Aug '05

18 Aug '05

I manged to fix this. Something was whackinated in my certificate generation process. Followed howto here: http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html And all works well, even with XP SP2. ~Brandon -----Original Message----- From: DeYoung, Brandon Sent: Wednesday, August 17, 2005 12:38 PM To: 'FreeRadius users mailing list' Subject: RE: SSL Problem??? Thanks for the response Alan, My clients are WinXP SP2 boxes. I have several hundred of these which had been working fine for the last 6 months...until my server blew up. In fact I had more problems getting this setup to work with SP1 and made it a policy for everyone to put SP2 on before I would configure wireless for them. Any other thoughts/workarounds? ~Brandon -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jamie Crawford Sent: Wednesday, August 17, 2005 12:22 PM To: freeradius-users(a)lists.freeradius.org; aland(a)ox.org Subject: Re: SSL Problem??? In the statement "Odds are they're XP SP2 boxes, where MS broke EAP" what exactly is broken. Will XP SP2 not work with PEAP? thanks, jamie Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU >>> aland(a)ox.org 08/17/05 2:10 PM >>> "DeYoung, Brandon" <Brandon.DeYoung(a)am.sony.com> wrote: > I *believe* this snippet from my debug output shows the problem: > > ----snip----- > eaptls_process returned 3 > TLS_accept:error in SSLv3 read client certificate A > rlm_eap_peap: EAPTLS_SUCCESS > -----snip------ > > This would *seem* to indicate a problem with my certificate generation. No, because it returns success. SSL is looking for a client certificate, and PEAP doesn't need one. SSL is then "helpful", and prints out error messages. The rest of your debug log shows that the client just stops talking to the server. Odds are they're XP SP2 boxes, where MS broke EAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Hotspot snmp problem
by Robin 17 Aug '05

17 Aug '05

Hello, A couple of us at work have been playing with a hotspot controller (Internet Subscriber Server II ISS-4000) using freeradius and mysql for authentication. We are having problems with checkrad (totally to do with the AP not being nice). I'm not sure what is the best way to handle this. I can snmpwalk the device however the output does not appear to have information regarding logins. The manufacturer does not respond to queries so I'm hoping someone else may have worked with this device. Any help is appreciated, Robin

2 8

RE: SSL Problem???
by DeYoung, Brandon 17 Aug '05

17 Aug '05

Thanks for the response Alan, My clients are WinXP SP2 boxes. I have several hundred of these which had been working fine for the last 6 months...until my server blew up. In fact I had more problems getting this setup to work with SP1 and made it a policy for everyone to put SP2 on before I would configure wireless for them. Any other thoughts/workarounds? ~Brandon -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jamie Crawford Sent: Wednesday, August 17, 2005 12:22 PM To: freeradius-users(a)lists.freeradius.org; aland(a)ox.org Subject: Re: SSL Problem??? In the statement "Odds are they're XP SP2 boxes, where MS broke EAP" what exactly is broken. Will XP SP2 not work with PEAP? thanks, jamie Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU >>> aland(a)ox.org 08/17/05 2:10 PM >>> "DeYoung, Brandon" <Brandon.DeYoung(a)am.sony.com> wrote: > I *believe* this snippet from my debug output shows the problem: > > ----snip----- > eaptls_process returned 3 > TLS_accept:error in SSLv3 read client certificate A > rlm_eap_peap: EAPTLS_SUCCESS > -----snip------ > > This would *seem* to indicate a problem with my certificate generation. No, because it returns success. SSL is looking for a client certificate, and PEAP doesn't need one. SSL is then "helpful", and prints out error messages. The rest of your debug log shows that the client just stops talking to the server. Odds are they're XP SP2 boxes, where MS broke EAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: SSL Problem???
by Jamie Crawford 17 Aug '05

17 Aug '05

In the statement "Odds are they're XP SP2 boxes, where MS broke EAP" what exactly is broken. Will XP SP2 not work with PEAP? thanks, jamie Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU >>> aland(a)ox.org 08/17/05 2:10 PM >>> "DeYoung, Brandon" <Brandon.DeYoung(a)am.sony.com> wrote: > I *believe* this snippet from my debug output shows the problem: > > ----snip----- > eaptls_process returned 3 > TLS_accept:error in SSLv3 read client certificate A > rlm_eap_peap: EAPTLS_SUCCESS > -----snip------ > > This would *seem* to indicate a problem with my certificate generation. No, because it returns success. SSL is looking for a client certificate, and PEAP doesn't need one. SSL is then "helpful", and prints out error messages. The rest of your debug log shows that the client just stops talking to the server. Odds are they're XP SP2 boxes, where MS broke EAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

EAP-TTLS-MSCHAPV2. Failed to authenticate.
by Koos Beens 17 Aug '05

17 Aug '05

Hi, I am trying to authenticate users using eap/ttls and internal mschap-v2. Currently I haven't set any auth-type in the users, just a password. This because auth-type := EAP (which is sugested in quite a few howto's is appearantly wrong acccording to the list and the docs. It seems like I'm allmost there cause I get a certificate at the supplicant. (O well, looks like there's something working:) I've googled around but have not found a solution, I hope someone could give me a hint in the right direction. Thanks a lot for any help, Kozy. here are the last lines of freeradius' output: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "TestUser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 143 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry TestUser at line 206 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "TestUser" MS-CHAP-Challenge = 0x6440b13c0e6ad28c3b7dd0a235d1b4ac MS-CHAP2-Response = 0x7d000ecb95ad6821c49c069a52d75b4791670000000000000000b49eccb3efc33e4b06047b50518e4ea66fdf6da9b98c4261 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "TestUser" MS-CHAP-Challenge = 0x6440b13c0e8ad28a3b7dd0a235d1b4ac MS-CHAP2-Response = 0x7d000ecb95ad6821c49c069a52d75b7791670000000000000000b49eccb3efd33e8a06047b50518e4ea66fdf6da9b98c4261 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 192.168.0.30 Called-Station-Id = "002217d46891" Calling-Station-Id = "000d93ddf8f6" NAS-Identifier = "001227d44891" NAS-Port = 35 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 5 rlm_realm: No '@' in User-Name = "TestUser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched entry TestUser at line 206 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.0.4 port 1026 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 0 with timestamp 43026bef Nothing to do. Sleeping until we see a request.

2 2

SSL Problem???
by DeYoung, Brandon 17 Aug '05

17 Aug '05

Hello all, I have been successfully providing 802.1x authentication to my wireless users for approx six months. This was implemented using ntlm_auth, PEAP, and MSCHAPV2 (windows XP client) against an Active Directory backend. We had a power spike, which produced multiple simultaneous drive failures and there is little but corrupted data left on my server. I managed to retrieve my config files from backup, but had to do a clean install, recreate SSL certs, etc. I am using freeradius-1.0.0-5 on Suse 9.2 Pro. I *believe* this snippet from my debug output shows the problem: ----snip----- eaptls_process returned 3 TLS_accept:error in SSLv3 read client certificate A rlm_eap_peap: EAPTLS_SUCCESS -----snip------ This would *seem* to indicate a problem with my certificate generation. I've deleted and re-created my certs on both the server and the client 4 times now. I've tried giving the certs different names, thinking that they weren't deleted correctly from WinXP's mmc panel. I'm following this howto on cert creation: http://jeremy.austux.net/resources/network/eaptls.html I'm pretty sure that this is the same howto I followed last time and it, "just worked". I'm only about 95% sure that my certs are the problem. If someone could at least confirm that, it would help. If anyone can pinpoint my issue more precisely I would be eternally grateful, as I'm really in a bind right now. Any and all suggestions are most welcome. Thanks much! ~Brandon ***************************** **Exhaustive info below:***** ***************************** I have the following relevant software installed: samba-3.0.9-2.3 samba-winbind-3.0.9-2.3 openssl-0.9.7d-25 Here are a couple radtest outputs (note: the user here is local, not AD and obviously this is by-passing certificates). houston:/etc/raddb # radtest test testing localhost 43.191.108.31 SECRET Sending Access-Request of id 135 to 127.0.0.1:1812 User-Name = "test" User-Password = "testing" NAS-IP-Address = houston NAS-Port = 43 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=135, length=20 houston:/etc/raddb # houston:/etc/raddb # radtest test wrongpw localhost 43.191.108.31 SECRET Sending Access-Request of id 156 to 127.0.0.1:1812 User-Name = "test" User-Password = "wrongpw" NAS-IP-Address = houston NAS-Port = 43 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=156, length=20 houston:/etc/raddb # .....So that works as it should..... Here's an ntlm_auth output: houston:/etc/raddb # /usr/bin/ntlm_auth --username=deyoungb --domain=AM password: NT_STATUS_OK: Success (0x0) houston:/etc/raddb # ....that works too, but, Houston...we still have a problem..... here is a full debug output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=AM --username=%{Stripped-User-Name:-%{User-Name:-None}} --chall enge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "This has been sanitized" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 43.191.108.31:1645, id=36, length=139 User-Name = "deyoungb" Framed-MTU = 1400 Called-Station-Id = "0014.6a49.efd0" Calling-Station-Id = "000e.3562.498f" Service-Type = Login-User Message-Authenticator = 0x10d861f115dbb07d2b2c807ed6013e43 EAP-Message = 0x0202000d016465796f756e6762 NAS-Port-Type = Wireless-802.11 NAS-Port = 52618 NAS-IP-Address = 43.191.108.31 NAS-Identifier = "SDB5-3-ENG-G" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 36 to 43.191.108.31:1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb476e560b219ce685233a2a3dce96543 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 43.191.108.31:1645, id=37, length=224 User-Name = "deyoungb" Framed-MTU = 1400 Called-Station-Id = "0014.6a49.efd0" Calling-Station-Id = "000e.3562.498f" Service-Type = Login-User Message-Authenticator = 0xa82fd9208da8cfd5dbed5cc52d11b381 EAP-Message = 0x0203005019800000004616030100410100003d0301430367671bc00064cbb7578abf6c 264a8d6dc1249e2654915d4bd8b26395cad2 00001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 52618 State = 0xb476e560b219ce685233a2a3dce96543 NAS-IP-Address = 43.191.108.31 NAS-Identifier = "SDB5-3-ENG-G" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02c9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 37 to 43.191.108.31:1645 EAP-Message = 0x0104032c1900160301004a0200004603014303657d517ec9f755c72b45c7f0613e7b5a 8b6c14976b236eb6518cfee742e320cf6bc4 9299508610ad4c7bb13a2877938fd7a54e3cdd2d56de739fd81f99dbf500040016030102 c90b0002c50002c20002bf308202bb30820224a003020102020101300d 06092a864886f70d0101040500308196310b3009060355040613025553310b3009060355 040813024341311230100603550407130953616e20446965676f311930 17060355040a1310536f6e7920456c656374726f6e696373310c300a060355040b130349 544d3111300f060355040314084541505f536f6e79312a302806092a86 4886f70d01 EAP-Message = 0x0901161b6272616e646f6e2e6465796f756e6740616d2e736f6e792e636f6d301e170d 3035303831373135323131375a170d303630 3831373135323131375a308196310b3009060355040613025553310b3009060355040813 024341311230100603550407130953616e20446965676f311930170603 55040a1310536f6e7920456c656374726f6e696373310c300a060355040b130349544d31 11300f060355040314084541505f536f6e79312a302806092a864886f7 0d010901161b6272616e646f6e2e6465796f756e6740616d2e736f6e792e636f6d30819f 300d06092a864886f70d010101050003818d0030818902818100a04276 9934723dc7 EAP-Message = 0x5e3fd51b19b85c280fbe8df9cdca5d311e2b0418a52ce7382ac77ad00178fa63a553a0 3e39a1fff8e10ff5f41c5a41b20b8ef5600d 6fd72a5392c948a625e5d491338fc7f11c0b14a765d8f80412f37fcf3f0d93987882f3d4 588035c9a4ed9e9724e5c06c54bc02ccb412e5b4f688ce6feb323505f3 7f550203010001a317301530130603551d25040c300a06082b06010505070301300d0609 2a864886f70d0101040500038181004928c9b15407cb400ed3ad5b1b5e 6b0413ceb246e0023bb07c36575945118bee439e4b3b72554e2770e2a1500dbae20fc603 eb394c695b961bff8813b2369e64fecc9b1742a934eeda706b3b87d836 325555f1cb EAP-Message = 0x25399be1adcd2944c15b78169fbfbb9b15269e94c8882dc7b9e3e57fe36158f9445904 18b935c779a4d19d5416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3233e8ac062396376b95baab46ff3932 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 43.191.108.31:1645, id=38, length=150 User-Name = "deyoungb" Framed-MTU = 1400 Called-Station-Id = "0014.6a49.efd0" Calling-Station-Id = "000e.3562.498f" Service-Type = Login-User Message-Authenticator = 0xcd50d811b2bd62c6131965d2a98ec598 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 52618 State = 0x3233e8ac062396376b95baab46ff3932 NAS-IP-Address = 43.191.108.31 NAS-Identifier = "SDB5-3-ENG-G" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: No '\' in User-Name = "deyoungb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message eaptls_verify returned 3 eaptls_process returned 3 TLS_accept:error in SSLv3 read client certificate A rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 38 to 43.191.108.31:1645 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a59d5433efbf6567da0c6b9c10eab2e Finished request 2 Going to the next request Waking up in 6 seconds. Here is another snippet from debug output, when a local user tries to auth from XP, MSCHAP client. -----------snip-------------- Waking up in 6 seconds... rad_recv: Access-Request packet from host 43.191.108.31:1645, id=34, length=146 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0014.6a49.efd0" Calling-Station-Id = "000e.3562.498f" Service-Type = Login-User Message-Authenticator = 0xdc3a1578cac294fb244a5592d95b9a97 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 52567 State = 0x3233e8ac06239637866e7bccf095f26e NAS-IP-Address = 43.191.108.31 NAS-Identifier = "SDB5-3-ENG-G" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: No '\' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched test at 93 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message eaptls_verify returned 3 eaptls_process returned 3 TLS_accept:error in SSLv3 read client certificate A rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 34 to 43.191.108.31:1645 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a59d5433efbf6562cf7f44fe38cdae4 Finished request 2 Going to the next request Waking up in 6 seconds.. ---------snip---------------------- Here is a sanitized version of eap.conf (include file in radiusd.conf) ----------snip------------------ # $Id: eap.conf,v 1.4 2004/04/15 18:34:41 aland Exp $ eap { default_eap_type = peap # default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { private_key_password = "This has been sanitized" private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes # check_crl = yes # check_cert_cn = %{User-Name} } #ttls { # default_eap_type = md5 # copy_request_to_tunnel = no # use_tunneled_reply = no #} peap { default_eap_type = mschapv2 } mschapv2 { } } ------------------snip------------------------------------------- Here is the full radiusd.conf (coments removed for brevity) -----------------snip-------------------------------------- ## ## radiusd.conf -- FreeRADIUS server configuration file. ## ## http://www.freeradius.org/ ## $Id: radiusd.conf.in,v 1.188 2004/05/13 20:10:19 pnixon Exp $ ## prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * #bind_address = 43.191.104.39 # port: Allows you to bind FreeRADIUS to a specific port. # # The default port that most NAS boxes use is 1645, which is historical. # RFC 2138 defines 1812 to be the new port. Many new servers and # NAS boxes use 1812, which can create interoperability problems. # # The port is defined here to be 0 so that the server will pick up # the machine's local configuration for the radius port, as defined # in /etc/services. # port = 0 # If you comment out the "bind_address" and "port" configuration entries, # then it becomes possible to make the server accept only accounting, # or authentication packets. Previously, it always listened for both # types of packets, and it was impossible to make it listen for only # one type of packet. # #listen { # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) # ipaddr = * # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" # port = 0 # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # # type = auth #} hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no # Default is 'no' (don't lowercase values) # Valid values = "before" / "after" / "no" # lower_user = no lower_pass = no # Default is 'no' (don't remove spaces) # Valid values = "before" / "after" / "no" (explanation above) # nospace_user = no nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes with_ntdomain_hack = no # Be VERY careful when editing the following line! # ####ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Cha llenge:-00} --nt-response=%{mschap:NT-Response:-00}" ####ntlm_auth = "/usr/bin/ntlm_auth --domain=AM --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challeng e:-00} --nt-response=%{mschap:NT-Response:-00}" ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=AM --username=%{Stripped-User-Name:-%{User-Name:-None}} --challe nge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive pull # password_attribute = userPassword # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueName s)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # realm realmpercent { format = suffix realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } delimiter = "%" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } # detail auth_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # } # detail reply_log { # } # detail pre_proxy_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d # detailperm = 0600 # } # detail post_proxy_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d # detailperm = 0600 # } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess # auth_log # attr_filter chap mschap # digest # IPASS suffix ntdomain eap files # sql # etc_smbpasswd # ldap # daily # checkval } # Authentication. authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } # digest # pam unix # Auth-Type LDAP { # ldap # } eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique # IPASS suffix # ntdomain files } # # Accounting. Log the accounting data. # accounting { detail # daily unix radutmp # sradutmp # main_pool # sql # pgsql-voip } # Session database, used for checking Simultaneous-Use. Either the radutmp session { radutmp # sql } # Post-Authentication post-auth { # Get an address from the IP Pool. # main_pool # reply_log # sql # Post-Auth-Type REJECT { # insert-module-name-here # } } pre-proxy { # attr_rewrite # pre_proxy_log } post-proxy { # # post_proxy_log # attr_rewrite # attr_filter eap } --------------------snip-------------------------------------------- Here'a my users file: --------------------snip----------------- # http://www.freeradius.org/rfc/attributes.html #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." #test Auth-Type := MS-CHAP, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 43.191.0.0/16, # Framed-IP-Netmask = 255.255.0.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP #test Auth-Type = Local, Password = "wrongpw" #test User-Password == "testing", MS-CHAP-Use-NTLM-Auth = No test User-Password == "testing", MS-Chap-Use-NTLM-Auth := 0 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # On no match, the user is denied access. ---------snip--------------------------------- You are truly noble for reading this far. Thanks! ~Brandon Brandon S. DeYoung Network Administration Supervisor Sony Technology Center, San Diego brandon.deyoung(a)am.sony.com

2 1

Proxying Machine Authentications
by King, Michael 17 Aug '05

17 Aug '05

I currently have our wireless users authenticating to our Active Directory 2003 domain using PEAP and TTLS. We want to proxy our machine authentications off to something else that can authenticate them. Does anyone have any examples of how to do this? I know all the machine accounts show up on my NAS as host/machinename Whereas my users are : Domain\Username Or Username

2 1

LDAP attributes into freeradius
by Joe H 17 Aug '05

17 Aug '05

Here is my goal: I would like to assign an attribute to certain users in ldap and have freeradius look for that attribute to determine whether or not to reply back to the NAS device with an IP address pool name. The users with the attribute set would not have the Pool sent and the users without the attribute set would have the pool sent. Here is the rule that I have set for it in the users file: DEFAULT Huntgroup-Name == "dialup" Idle-Timeout = "1800", Fall-Through = Yes DEFAULT Huntgroup-Name == "dialup", No-Pool != "1" USR-Framed_IP_Address_Pool_Name = "POOL", Idle-Timeout := "120", Fall-Through = Yes dialup is the ldap module I have setup in the radiusd.conf file. Here is that entry: ldap dialup { server = "localhost" identity = "cn=Manager,dc=domain,dc=com" password = "*********************" basedn = "ou=Users,o=domain.com,dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap-dialup.attrmap ldap_connections_number = 288 groupname_attribute = gidNumber groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } The problem I'm seeing is that radius doesn't seem to use the value of No-Pool. I have it in the ldap-dialup.attrmap as: checkItem No-Pool radiusNoPool radiusNoPool is the ldap attribute with a value of 1. Where else do I need to add the new attribute No-Pool in order for freeradius to use it? Joe H. GWI Operations.

3 2

Debian 802.1x LDAP
by Cian Phillips 17 Aug '05

17 Aug '05

Greetings. I'm trying to get a Debian (stable) box set up to authenticate users for our Cisco Wireless Control Software via LDAP. I have tried the Debian package and can get LDAP running easily. When I try to get the eap/tls stuff working it gives me an error about missing libraries. rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory I have googled this and found some messages that suggest compiling from source and using the --shared-disabled flag at compile time but I've tried building from source and can't even get LDAP working.. each time I un-comment the ldap line from the radiusd.conf file and try to start using radiusd -x I get a segfault. Ideally I would like to stick with Debian as that is what my other production servers are but would be willing to use something else if it makes easier work of this process. If anyone has gotten Debian + 802.1x + LDAP working or even just 802.1x + LDAP I could really use some pointers if even just to tell me it is or isn't possible. Thanks in advance. Cian Phillips Cian Phillips Director Network & Systems California College of the Arts Phone: (510) 594-3745 Cell: (510) 719-0091 Fax: (510) 594-3758 email: cian(a)cca.edu

4 5

Require NAS dependant radius return attributes
by Ben Thompson 17 Aug '05

17 Aug '05

> Ben Thompson wrote: > > > The trouble is I need to assign different VLAN's to users depending > > which access point they connect from. What I would like to know is if it > > is possible to use Huntgroups to look up the VLAN id based on something > > like the IP address of the access point? > > You could test the variable "Client-IP-Address" in the users file. > > testuser Client-IP-Address == 10.0.0.1, Password := "azerty" > Tunnel-Private-Group-ID:1 := 1, > Fall-Through = Yes > > testuser Client-IP-Address == 10.0.0.2, Password := "azerty" > Tunnel-Private-Group-ID:1 := 2, > Fall-Through = Yes > > -- > Nicolas Baradakis Hi Thanks for that advice. I can see that I could end up with a very large users file using this method. Is there any limit on the size of the users file? In the near future we may have something like 800000 entries in there. Is this where you would normally look to use a database backend? Thanks Ben

2 3