- Freeradius-Users - lists.freeradius.org

EAP-TTLS and PEAP auth problem
by Gandalf the Gray 04 Jul '05

04 Jul '05

Hi, I'm new on this mailing list, please help me clearly. I need to build a Wireless-net based on Freeradius as authentication server, a Cisco aironet 1200 AP, and WPA with TKIP encryption. I need to use TTLS or PEAP, for they allow users to don't user their own certificates, to make connection a little bit easier. when I start my freeradius server, this is what I see: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Because of I'm novice, I think everything is OK. next, I provide my configuration file, everything together, and hope this will help! Thank you sooo much for your attention and help! See you And __________________________________ Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html

1 0

RE: Unable to install FreeRadius 1.0.4 [HELP PLEASE]
by Ross Tsolakidis 04 Jul '05

04 Jul '05

I think you need the mysql-dev libraries/packages. Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of TeemX Sent: Tuesday, 5 July 2005 2:34 AM To: freeradius-users(a)lists.freeradius.org Subject: Unable to install FreeRadius 1.0.4 [HELP PLEASE] Hi Guys & Gals, I am having problem on installing my FreeRadius Server Version 1.0.4. I am running at Linux RedHat 9. Errors message as below: gmake[10]: *** [sql_mysql.o] error 1 gmake[10]: leaving directory '/root/freeradius-1.0.4/src/modules/rim_sql/drivers/rlm_sql_mysql' all the way down to gmake[1]: *** [common] Error 1 gmake[1]: Leaving director '/root/freeradius-1.0.4' make: *** [all] Error 2 Could anyone help me on this, I am totally new to FreeRadius. Thanks. Jackie - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

strangeness with cisco_vsa_hack=yes ...
by Ilia Chipitsine 03 Jul '05

03 Jul '05

Dear Sirs, I'm running freeradius-1.0.4 for h323 accounting from Cisco AS5350. I turned cisco_vsa_hack to "yes", but according to detail (and pgsql-voip module) not all Cisco-VSA are decoded to normal AV pairs: (I replaced several fields with XXXX in order to hide IP addresses) Sat Jul 2 09:26:14 2005 Acct-Session-Id = "00039908" Calling-Station-Id = "73512287317" Called-Station-Id = "73512327225" Cisco-AVPair = "call-id=766F6970 6D726B74 A04FC642 7C760600" h323-setup-time = "09:26:08.476 BST Sat Jul 2 2005" h323-gw-id = "XXXXXXXXX" h323-conf-id = "D0236F56 EA0811D9 B31C9978 D534BC2D" h323-call-origin = "answer" h323-call-type = "VoIP" Cisco-AVPair = "h323-incoming-conf-id=D0236F56 EA0811D9 B31C9978 D534BC2D" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:73512327225" Acct-Input-Octets = 360 Acct-Output-Octets = 5556 Acct-Input-Packets = 67 Acct-Output-Packets = 195 Acct-Session-Time = 0 h323-connect-time = "09:26:14.670 BST Sat Jul 2 2005" h323-disconnect-time = "09:26:14.670 BST Sat Jul 2 2005" h323-disconnect-cause = "10" h323-remote-address = "XXXXXXXXX" Cisco-AVPair = "release-source=2" h323-voice-quality = "0" Cisco-AVPair = "remote-media-address=XXXXXXXXXXX" Cisco-AVPair = "out-trunkgroup-label=Chel" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:1,#:73512287317" User-Name = "mos-spa-gkp-1" Acct-Status-Type = Stop Service-Type = Login-User NAS-IP-Address = XXXXXXXXXXXX Acct-Delay-Time = 0 call-id = "766F6970 6D726B74 A04FC642 7C760600" h323-incoming-conf-id = "D0236F56 EA0811D9 B31C9978 D534BC2D" subscriber = "Unknown" session-protocol = "cisco" gw-rxd-cdn = "ton:0,npi:1,#:73512327225" Client-IP-Address = XXXXXXXXXXX Acct-Unique-Session-Id = "e8c1a697340192ad" Timestamp = 1120292774 as far as I can see, decoded fields: Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "h323-incoming-conf-id=D0236F56 EA0811D9 B31C9978 Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "call-id=766F6970 6D726B74 A04FC642 7C760600" not decoded fields: Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:73512327225" Cisco-AVPair = "release-source=2" Cisco-AVPair = "remote-media-address=XXXXXXXXXXX" Cisco-AVPair = "out-trunkgroup-label=Chel" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:1,#:73512287317" why does it decode just few fields ? what did I do wrong ? Cheers, Ilia Chipitsine

2 1

how to populate Postgresql base with users ?
by Leonardo B. Cuquejo (Arachnius) 02 Jul '05

02 Jul '05

Dear Sirs, I want to implement PPTP server (either mpd or poptop) with CHAP+MPPE authentication against freeradius. I've successfully configured freeradius+postgresql, but I'm lost in the database, I've no idea how to populate database. Can anyone provide me some dump for example ? (including sample user, sample password and sample parameters for connection) Thanks!

2 1

Current CVS logging issue
by Dinko Korunic 01 Jul '05

01 Jul '05

Hi. I believe that it might be a bug in current CVS. I've encountered an issue that FreeRADIUS does not log nor into files, nor into syslog, no matter what the configuration says [always dumps on stdout/stderr]. I've tried to track down the cause, and it might be this: arwen:~/work/cvs/radiusd-cvs/src/main# cvs diff -u mainconfig.c Index: mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.63 diff -u -r1.63 mainconfig.c --- mainconfig.c 26 May 2005 21:26:29 -0000 1.63 +++ mainconfig.c 20 Jun 2005 09:17:45 -0000 @@ -945,8 +945,8 @@ * * This really is a hack, but it works... */ - if ((debug_flag < 2) && - (mainconfig.radlog_dest != RADLOG_STDOUT)) { + if (debug_flag < 2) + { mainconfig.radlog_dest = lrad_str2int(str2dest, radlog_dest, RADLOG_NULL); if (mainconfig.radlog_dest == RADLOG_NULL) { fprintf(stderr, "radiusd: Error: Unknown log_destination %s\n", I believe that mainconfig.radlog_dest doesn't get initialised, since local radlog_dest is used: static char *radlog_dest = NULL; as well as: { "log_destination", PW_TYPE_STRING_PTR, -1, &radlog_dest, "files" }, That would mean that (mainconfig.radlog_dest != RADLOG_STDOUT) is obviously a bogus check, since it should check radlog_dest, rather than mainconfig.radlog_dest. -- NAME:Dinko.kreator.Korunic NOTE:Standard.disclaimer.applies URL:kreator.esa.fer.hr IRC:kre ICQ:16965294 PGP:0xea160d0b

2 2

Multiple realms: need help
by Normando Marcolongo 01 Jul '05

01 Jul '05

Hi! I would like to have freeradius behave like this: - realm 'alwaysok' would always accept authentication - realme 'checkthis' would always check against mysql Since now I'd have done this by telling freeradius to proxy one of the realms to another freeradius the would behave accordingly leaving the former to do the processing for the other realm. Is there a more elegant way of doing this? Thank you! Normando -- | Normando Marcolongo | Micso s.r.l. | | via Tiburtina, 318 | I-65128 Pescara, Italy| |tel/fax (+39)08554105 | mob. (+39)3386296362 |

2 1

Re: EAP problem
by Graham, Robert 01 Jul '05

01 Jul '05

>You _cannot_ read the unicodePwd attribute (where the actual passwd >lies) from AD. It can only be written to, and then only under certain >conditions (SSL/TLS connection, and if not written by an admin, then a >delete/add must be performed in the same operation). >This is why you should use ntlm_auth w/PEAP for AD auth. You could be >able to auth against LDAP (PAP) in a TTLS situation (not tried that yet, >so I don't know how it would work), but you will never retrieve the >unicodePwd attribute. >Hope this helps. OK. Back to the drawing board... I looked at my options regarding the authenitication method on the W2K client and noticed that I can also used Protected EAP (PEAP). So I switched the client to this. When I tried the authenitication again, this time I get: rlm_eap: Identity does not match User-Name, setting from EAP Identity I did more searches on this error, and tried several suggestions, from using the hints file: DEFAULT Prefix == "MEM\\", Strip-User-Name = Yes Hint = "MEM", Service-Type = Framed-User, Framed-Protocol = PPP I also ensured that use_with_nt_hack was set to "no" in the preprocessor section. I modified the proxy.conf file for the local domain: realm MEM { type = radius authhost = LOCAL accthost = LOCAL } and no matter what I do I still get this error... There was a post on the mailing list that mentioned that some patches were applied to freeradius in Nov 2004, I took a look at the freeradius version I was using on my Fedora Core 3 box and it shows: radiusd: FreeRADIUS Version 1.0.1, for host , built on Oct 6 2004 at 05:25:02 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I wonder if this is now my problem..... I have attached the debug output: rad_recv: Access-Request packet from host 172.16.5.71:1645, id=235, length=93 User-Name = "MEM\\RGraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.5.71 NAS-Port = 24 EAP-Message = 0x02000010014d454d5c5247726168616d Message-Authenticator = 0xeeeaea4ed86a064f533da57687432cb4 rad_lowerpair: User-Name now 'mem\rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 41 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.5.71/auth-detail-20050630' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.5.71/auth-detail-20050630 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mem-dc.mem-ins.com:389, authentication 0 rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/{secret} to mem-dc.mem-ins.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0

2 1

RFC Info
by Jeff Fern 01 Jul '05

01 Jul '05

Hello all, I am using freeRadius as a proxy server for requests, however instead of proxying with user@realm, I am using: DEFAULT User-Name =~ "12357.*", Proxy-To-Realm := "Realm" with a regular expression for the start of the username (there will be several of these lines). Can anyone advise me if (and where) the ability to do this is actually in the Radius RFC, and therefore must be supported by other Radius servers, or if it is an extra feature of freeRadius? Any info on this would be gratefully recieved, Regards, -Jeff Fern

2 1

dialup_admin problem
by Okka Radius 01 Jul '05

01 Jul '05

The problem is its not the sql server that's denying access but the config of the php and dialup_admin scripts that's not working. I can connect to the mysql database from anyother other method except via the web interface.

1 0

radiusprofile entry don't work
by Felice Pizzurro 01 Jul '05

01 Jul '05

hi all, excuse me for my bad english, I'm italian. i would to create a structure wich control the user's access on a WLAN by an auth-ldap. I have create a ldap directory witch basedn dc=unime,dc=it. now, like is write on the ldap_tutorial in the doc/ directory, i try to import this ldif file (modified for my interst). the authentication to be with the EAP-TLS protocol (it work fine) therefore I've deleted the sections of the passwords and for authentication. dn: dc=unime,dc=it objectClass: dcObject objectClass: organizationUnit ou: Unime.it Radius dc: unime dn: ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: radius dn: ou=profiles,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: profiles dn: ou=users,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: users dn: uid=WLAN,ou=profiles,ou=radius,dc=unime,dc=it objectclass: radiusprofile uid: WLAN radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=Felice,ou=users,ou=radius,dc=mydomain,dc=com objectclass: radiusProfile uid: Felice radiusGroupName: WLAN the entry with uid =WLAN don't work, this is the message returned is invalid syntax #0 approximately... I don't have my pc here. Anyone can help me? -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Migliaia di manuali e guide scaricabili su: Hacker, Reti, Webmaster, Windows e non solo...clicca qui Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3412&d=30-6

2 9