- Freeradius-Users - lists.freeradius.org

EAP MD5 authentication
by Sudha 21 Jun '05

21 Jun '05

Hi List.. I'm trying EAP MD5 authentication using free radius but since MD5 doesn't generate any keys, I'm getting an error message "Failed to generate key". Generally MD5 is used in the phase2 of TLS or PEAP and that is working fine. Is it possible to establish EAP MD5 authentication without using, TLS or PEAP. The information in the supplicant.conf file is as: network { ssid=valid session ID identity="user" password="test" key_mgmt=NONE eap=MD5 priority=1 } Do help me in this regard asap, thanks in advance.

2 1

Problem checkrad cisco ap1200
by ph b. 21 Jun '05

21 Jun '05

Hello, The script "checkrad" not run with my ap1200, when i test it i have : SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.XXX) SNMPv1_Session (remote host: "192.XXX.XXX.XXX" [192.XXX.XXX.XXX].161) community: "public" request ID: -662891836 PDU bufsize: 8000 bytes timeout: 2s retries : 5 backoff: 1) at /usr/sbin/checkrad line 221 checkrad: No SNMP answer from cisco checkrad: not found! I think it is a problem with the ap but i don't see what it is. The conf for the snmp on the ap is : access-list 111 permit tcp any any neq telnet snmp-server view dot11view ieee802dot11 included snmp-server community public view dot11view RO If i erase the view, i have the same problem. Furthermore, when i use the tool snmpge for the oid 1.3.6.1.4.1.9.2.9.2.1.18.XXX, it return me the same result : noSuchName. The ap use the IOS 12.3(2) And when i connect on the ap and do "show aaa user all", i can see the users name et other data. So the logins are stored on the ap but can i get them by SNMP or not ? how can i fnd the good OID ? Could you help me ? thanks ph

3 4

'authorize' module
by Edgars Klavinskis 21 Jun '05

21 Jun '05

still fighting with test configuration.. I have created two rlm_passwd modules. Afterwards, have put them under 'authorize' section one by one. Why the deamon is accepting the request depending only on the rlm_passwd file where User-Password is present and ignoring the one which should check NAS-IP-Address and Realm? My aim is to make it so that if the last mentioned returns "wrong", the whole request is wrong. Please assist me with ideas. Edgars

3 13

freeradius 1.0.2 compilation: problem with libtool
by manou 21 Jun '05

21 Jun '05

Hello all, I try to compile freeradius 1.0.2-4 (debian sarge's source) and I got the error message below: rbtree.c:265: warning: assignment discards qualifiers from pointer target type rbtree.c:278: warning: assignment discards qualifiers from pointer target type /usr/bin/libtool --mode=link ld \ -module -static -Wall -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS dict.o print.o radius.o valuepair.o token.o misc.o log.o filters.o missing.o md4.o md5.o sha1.o hmac.o hmacsha1.o snprintf.o isaac.o crypt.o udpfromto.o rbtree.o -o libradius.a libtool: link: unable to infer tagged configuration libtool: link: specify a tag with `--tag' make[5]: *** [libradius.a] Error 1 I tried to google but I could not find any issue. I found a related post in freeradius-users archive but it seems not been answered. So someone could tell me how to do? my libtool's version is 1.5.6-6. I can give other informations if necessary. Thanks in advance, Manou.

1 1

Re: problem with freeradius and ldaps (Active Directory)
by Roberto S. G. 21 Jun '05

21 Jun '05

Hi, I'd like to thank you, Jose and Alan, for your information, and share my solution with u all: I've finally installed stunnel in order to provide SSL to the connection with LDAPS. freeradius is configured to connect with LDAP locally, and stunnel takes this local connection and makes the SSL to the LDAPS server. It runs smoothly!. I was unable to make freeradius 1.0.1 or 1.0.0 to run with LDAPS... no way... (it seemed that it didn't manage correctly LDAPS). thanks. >From: Jose Tomas Ochayta <Jose.Ochayta(a)tirea.es> >Subject: Re: problem with freeradius and ldaps (Active Directory) >I'm using freeradius 1.0.2 with ldaps. I had the same problem (freeradius crash) due, >I think, to a bug in openldap or openssl libraries. >Now I have it working with stunnel to add the ssl layer. >Jose T. >>> Hi, >>> >>> I'm trying to configure freeradius (1.0.1) to use an ldaps server >>> (without start_tls, it's an Active Directory). >>> But I'm not able to obtain any response. In fact, the freeradius >>> crashes with just a: >>> >>> rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1074, id=88, >>> length=29 >>> Discarding duplicate request from client localhost:1074 - ID: 88 >>> >>> (client is localhost because I was using radclient, but remote >>> attempts show the same behaviour). >>> >>> Normal ldap against the same server is correct. For the ldaps >>> configuration I've added just: >>> port = 636 >>> tls_require_cert = "never" >>> >>> though even with the server certificate: >>> tls_certfile = ./certs/xxxx_cacert.pem >>> >>> the result is the same. >>> I don't know which is the problem exactly... >>> >>> Has anyone sucessfully configured freeradius against an Active >>> Directory with LDAPS? >>> Any ideas are apreciated. >>> >>> thanks. >>> >>> >>> - List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>>

1 0

RE: Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 21 Jun '05

21 Jun '05

OK, got it working. I removed the "Proxy-To-Realm" attribute, and set Auth-Type = ldap. I assume because I'm actually going against the local RADIUS server that I don't need to proxy. Wood for trees scenario. On upgrading, I'd love to but I run a supported SLES8 server, and it's already got a custom 0.9.3 install, as base is only 0.5 !!! in fact even SLES9 only has 0.9.3. Maybe I need a chat with SuSE/Novell and ask them to release updates to freeRADIUS on a more regular basis...... Thanks for the help. :-) Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: 20 June 2005 19:02 > To: FreeRadius users mailing list > Subject: Re: Multiple Authentication REALMS - I hope in Plain Text > > "Shepherd, Dave" <Dave.Shepherd(a)compass-group.co.uk> wrote: > > As I've now got it working for my standard config. > > Good. > > > However, I still seem to be getting the request marked as complete > > after the authorize section:- > ... > > This only occurs when I match the following in my users file: > > > > # NexUS RAS > > DEFAULT Called-Station-Id == "********", Proxy-To-Realm := "sloxldap" > > Fall-Through = No > > > > If I match on my other statements, the user authenticates as expected. > > Do you have proxying turned off? > > > I'm on version 0.9.3. > > Bleah. You should really upgrade. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Expiration - my experiences and a partial solution
by Tomas 'tt' krag 21 Jun '05

21 Jun '05

Hi, I spent a few days working on a freeradius solution in which I want to be able to create users whose logins expire 24 hours after their first login. Since I noticed that many people have been asking for similar things on this list, I thought I'd explain the solution I have ended up using. NOTE: This solution is far from perfect. First of all, it is a hack, and not too elegant, secondly it does not do exactly what it is supposed to do, but it works well enough for my purposes, and perhaps other people can use this as inspiration for an improved solution. WARNING: I am far from proficient at freeradius, having spent only the past week trying to get an understanding of how it works. This solution was hacked together from various comments and ideas on this mailing-list. So anything I say and do should be considered risky :-) What I wanted was to be able to create a number of users, printed on cards, that I could hand out to users at an event to let them access the network for 24 hours after the first time they logged in. i.e. if they log in at 15:31 on tuesday their account should expire at 15:31 on wednesday no matter how much time they have spent on-line. I am using chillispot and freeradius with mysql, all on one central gateway server, as this is a small setup with a limited number of users. I had understood from comments by Kostas Kalevras and Alan DeKok (thanks) that the way to do this in freeradius/mysql was to use a post-auth query that executed whenever a user has successfully logged into the system. In that post-auth query I would set an Attribute/Value pair "Expiration := 25 May 2005 15:31" or equivalent in the radcheck table of the database. Since I didn't want this to apply to all users (I like to keep a permanent login for myself), I needed some way to distinguish users that should be timed out from other users. I came up with the following hack. When I generate the usernames (using a adapted version of phpMyPrepaid http://www.jabali.net/~carl/?link=2) I add an Attribute called Expiration with a value well in the future. In this case "Expiration:='1 Jan 2005'". When a user logs in I check if there is an Expiration attribute with that particular value, and if so, I change the Date to exactly 24 hours from Now. I do this in sql.conf by adding the following query: postauth_query = "UPDATE ${authcheck_table} SET Value=DATE_FORMAT(DATE_ADD(NOW(),INTERVAL ${expire} HOUR),'%%e %%b %%Y % %T') WHERE UserName='%{SQL-User-Name}' AND Attribute='Expiration' AND Value='${expiration_dummy}'" At the top of the file, I have defined the following # Added by tkrag (support for Expiration) # The dummy expiration value used when creating new # users expiration_dummy = "1 Jan 2099" # How many hours an account lasts from first login expire = 24 This has the effect of changing the Expiration date only the first time a user logs in. Unfortunately as Joachim Bloche pointed out in a mail "Session-Timeout not set with pending Expiration" on this list, it seems that Freeradius does NOT set the "Session-Timeout" based on an Expiration date in the future. I have confirmed this behaviour using freeradius 1.0.1 (from the ubuntu package, but recompiled to support the rlm_sqlcounter module). This effectively means that a user who logs in at 13:30 on tuesday and logs in again at 13:29 on wednesday can then stay on-line after the Expiration time, but cannot log back in again after that time. In my situation I have handled this by also using an sqlcounter with an Attribute "Max-All-Session := 86400" which then limits the user to a total of 24 hours on-line. i.e. a user could login at 13:30 on tuesday and immediately log out, after which she could relogin at 13:29 on wednesaday and stay connected for another 24 hours until 13:29 on thursday. In my case this is not a deal-breaker, as we are not selling access, but mostly trying to protect ourselves against ongoing abuse of bandwidth, but in other scenarios it might not work well. If I read the documentation correctly the current CVS version of freeradius contains a new module called rlm_expiration which apparently moves the Expiration support into a separate module, and will hopefully support returning the correct Session-Timeout attribute. I hope this helps someone out there. Regards /tomas wire.less.dk

3 2

FreeRADIUS 1.0.4 has been released.
by Alan DeKok 20 Jun '05

20 Jun '05

Sorry for the delay. Announcement is on the web: http://www.freeradius.org/ Alan DeKok.

5 12

disconnections
by John Fawcett 20 Jun '05

20 Jun '05

I'm using freeradius 1.0.0 on suse 9.2 to authenticate wireless users from a US Robotics USR5450 Access Point via eap-ttls (with eap-md5) Although the connection is established it is disconnected after 4 minutes (sometimes 2 minutes or 6 minutes). I get entries like the following repeated every four minutes in the radius.log Mon Jun 20 00:37:59 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:37:59 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Jun 20 00:38:00 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Jun 20 00:38:02 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:02 2005 : Info: (other): SSL negotiation finished successfully Mon Jun 20 00:38:02 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:02 2005 : Info: rlm_eap_md5: Issuing Challenge Mon Jun 20 00:38:03 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:03 2005 : Auth: Login OK: [steve/<no User-Password attribute>] (from client localhost port 0 cli 00-0e-35-c7-e3-fe) Mon Jun 20 00:38:03 2005 : Auth: Login OK: [steve/<no User-Password attribute>] (from client usrobotics port 0 cli 00-0e-35-c7-e3-fe) Just a couple of more points: I don't think the TLS_accept: error is serious. I cannot explain why there are two Auth Logins one from the NAS and one from localhost. Any help appreciated. I somehow get the impression that I'm probably not passing back the right attributes to the NAS: for testing I'm using the users file: steve User-Password == "testing" Framed-IP-Address = 192.168.1.67, Framed-IP-Netmask = 255.255.255.0, Service-Type = Framed-User Thanks John

2 2

rlm_sqlcounter problem
by Carlos Martínez-Troncoso Cera 20 Jun '05

20 Jun '05

2 6