- Freeradius-Users - lists.freeradius.org

Re: help for using eap and TTLS
by Maurice.Bourguel 01 Jun '05

01 Jun '05

Hi, Thanks to David for you answer; Changing tls by ttls in the eap module don't change the rlm_eap message: rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned If I change tls par ttls in the tls module the mac OSX ask for accepting certificate and I obtain: client connected via TTLS in the 802.1X logging window. But I don't connect to my network. I don't understand what happens now. If I configure the en1 interface by hand (ifconfig en1 .., route add default .) I can connect. Does this problem know of anyone ? regards Maurice ---------------------- The used eap.conf file: ----------------------- eap { # MB tls default_eap_type = md5 default_eap_type = tls timer_expire = 60 # MB yes ignore_unknown_eap_types = no ignore_unknown_eap_types = yes cisco_accounting_username_bug = no #MD5# md5 { } # Cisco LEAP leap { } gtc { auth_type = PAP } ## EAP-TLS # decommente MB tls { # changing tls by ttls to obtain freeradisu to work default_eap_type = ttls # CA_path=${raddbdir}/certs private_key_password = whatever private_key_file=${raddbdir}/certs/euler.univ-mrs.fr.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file=${raddbdir}/certs/euler.univ-mrs.fr.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/root.pem # CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random # MB 1750 fragment_size = 1024 fragment_size = 1750 include_length = yes check_crl = yes } ttls { # default_eap_type = md5 # # allowed values: {no, yes} copy_request_to_tunnel = yes # MB yes # allowed values: {no, yes} use_tunneled_reply = yesa # MB yes } The radiusd debugging output ----------------------------- auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 HASH: user mbourguel found in hashtable bucket 32912 modcall[authenticate]: module "unix" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/XXXXX] (from client localhost port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/localhost/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/localhost/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/<no User-Password attribute>] (from client Radius port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/Wf-bast5/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/Wf-bast5/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 Sending Access-Accept of id 46 to 139.124.3.235:21645 Framed-MTU = 576 Service-Type = Framed-User Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x6eb67fa031a685d0f892bf8c7d9e03a08f177601494b571538707de605d56af4 MS-MPPE-Send-Key = 0x8899e08fbcfb4523c7c0eb7d734df9973e032b78cb594a7c2d405d5bcba45438 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mbourguel" Finished request 26 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Accounting-Request packet from host 139.124.3.235:21645, id=47, length=210 Acct-Session-Id = "0000000C" Called-Station-Id = "0012.dacb.b0c0" Calling-Station-Id = "0011.2420.94f9" Cisco-AVPair = "ssid=tsunami" Cisco-AVPair = "nas-location=unspecified" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS User-Name = "mbourguel" Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "265" NAS-Port = 265 Service-Type = Framed-User NAS-IP-Address = 139.124.3.235 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 27 modcall[preacct]: module "preprocess" returns noop for request 27 rlm_acct_unique: Hashing 'NAS-Port = 265,Client-IP-Address = Wf-bast5,NAS-IP-Address = 139.124.3.235,Acct-Session-Id = "0000000C",User-Name = "mbourguel"' rlm_acct_unique: Acct-Unique-Session-ID = "5c292ba8903fd30c". modcall[preacct]: module "acct_unique" returns ok for request 27 rlm_realm: No '@' in User-Name = "mbourguel", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 27 modcall[preacct]: module "files" returns noop for request 27 modcall: group preacct returns ok for request 27 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 27 radius_xlat: '/var/log/radius/radacct/Wf-bast5/detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/Wf-bast5/detail-20050601 modcall[accounting]: module "detail" returns ok for request 27 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'mbourguel' modcall[accounting]: module "radutmp" returns ok for request 27 modcall: group accounting returns ok for request 27 Sending Accounting-Response of id 47 to 139.124.3.235:21645 Finished request 27 Going to the next request Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 22 ID 42 with timestamp 429dc9aa Cleaning up request 23 ID 43 with timestamp 429dc9aa Cleaning up request 24 ID 44 with timestamp 429dc9aa Cleaning up request 25 ID 45 with timestamp 429dc9aa Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 26 ID 46 with timestamp 429dc9ae Cleaning up request 27 ID 47 with timestamp 429dc9ae Nothing to do. Sleeping until we see a request. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 HASH: user mbourguel found in hashtable bucket 32912 modcall[authenticate]: module "unix" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/XXXXXX] (from client localhost port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/localhost/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/localhost/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/<no User-Password attribute>] (from client Radius port 265 cli 0011.2420.94f9) *********************************************************** * e-mail : bourguel(a)cirm.univ-mrs.fr * ---------------------------------------------------------- * Maurice Bourguel + * * CIRM - MENRT-CNRS-SMF + * * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* *********************************************************** *http://www.cirm.univ-mrs.fr * ***********************************************************

2 1

help for using eap and TTLS
by Maurice.Bourguel 01 Jun '05

01 Jun '05

Hello all, I'm using freeradius-1.0.2 with AceesPoint Cisco ap1100; I'm using eap/ttls to authenticate users. I try to connect to with Xp clients or Mac osX clients; All go wrong. When using Mac OSX client and 802.1X setup ( authentification TTLS alone with PAP Authentication interne TTLS) Mac OSX client obtain the two certificates: authoritative and server. But it is not connecting. It loops on authentication process. Here is the trace from /usr/local/sbin/radiusd -X -A: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 127 to 139.124.3.235:21661 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37a760f21d2a0b8d0fdd492ccd5e7d17 Finished request 2 Going to the next request --- Walking the entire request list --- What means rlm_eap_tls: Requiring client certificate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 How should I fix this? Any help will be appreciated. I have configured freeradius and openssl using these articles: http://www.alphacore.net/spip/article.php3?id_article=45 http://www.alphacore.net/spip/article.php3?id_article=33 http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html Regards, Maurice *********************************************************** * e-mail : bourguel(a)cirm.univ-mrs.fr * ---------------------------------------------------------- * Maurice Bourguel + * * CIRM - MENRT-CNRS-SMF + * * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* *********************************************************** *http://www.cirm.univ-mrs.fr * ***********************************************************

2 1

rlm_passwd & realms
by Edgars 01 Jun '05

01 Jun '05

Hello, 1)can i make so that each separate proxy.conf realm uses different rlm_passwd file? At the moment it works in a simply way - using one passwd file. 2)Is it possible to separate Reply attributes from passwd file, i mean - passwd contains only username, but some other file (users(?)) is used for giving back reply attributes? Regards, Edgars

1 0

RE: Freeradius+mysql+error
by Abdul Lateef 01 Jun '05

01 Jun '05

Hello, Check your sql configuration in sql.conf in the following area # Connect info server = "yousqlip" login = "user" password = "pws" Abdul Lateef Kapilvastu Lumbini __________________________________ Discover Yahoo! Find restaurants, movies, travel and more fun for the weekend. Check it out! http://discover.yahoo.com/weekend.html

3 2

Re: Freeradius-Users Digest, Vol 2, Issue 3
by markcapelle＠pcmc.com 01 Jun '05

01 Jun '05

>Hello all! I would like to know if anyone has gotten freeradius to work >with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) >and want our wireless users to authenticate to the eDirectory box. I >changed the radiusd.config file at the ldap entry. Clients file has not >been touched. It seems that i may need to "extend the schema" on the >eDirectory box. Then include the supplied radiusxx.schema file in the >slapd.conf file. Any help will be appreciated. >Chris I had this running in my environment for about 2 years. You don't need any schema changes(that I can recall) and you don't need to do anything with slapd. Just configure freeradius to look at your eDir as a LDAP store. Search the archive lists, there should be plenty of examples there. Mark Capelle CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0

How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 01 Jun '05

01 Jun '05

Hello, I'm trying to set up a FreeRadius solution for a Windows2k AD environnment. The FreeRadius-server is already running right. I can authenticate a testuser with Auth-Type := EAP (username and password stored as cleartext in the users file) Now I want to use FreeRadius to check username/password from the Active Directory Server when a user logs onto the computer. I checked the list already. Some say to use ntlm_auth and winbind, others LDAP, then samba... but nobody is able to explain how to get it working. Is it really as complicated? ntlm_auth seems very simple, returnig 1 if user/pwd is alright and 0 when not. But how can I test this from the command line? Where do I specify the address of the AD-server? When running ntlm_auth -- usage there are too much parameters that are unknown to me. Thanks in advance for any help! Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 1

MySQL Authentication on Solaris
by Eva Kolega 01 Jun '05

01 Jun '05

Hello everybody. I have installed freeradius 1.0.1 on Solaris 9. However, it seems that I have a problem with MySQL Aythentication. As far as unix authentication is concearned everything seems to be working fine. I have installed MySQL 4.0.21 package, but radius complains about the modules used. I also ran ./configure with "with-mysql-include-dir=/usr/local/src/mysql-4.0.21/include" but nothing good happened. To be precise, there is no devel package for mysql 4.0.21, as this verison of mysql contains almost everything. Does anybody have a clue of how can I have MySQL authentication for RADIUS server on Solaris 9? Thanks in advance, Eva Kolega Network Operations Centre, Techonological Educational Institute of Athens

1 0

Configuring PHP functions to allow Dialup_admin to access ORACLE DB
by Jamal Taweel 01 Jun '05

01 Jun '05

Hello All, I am seeking for a way to configure functions.php3 to allow the dialup_admin to connect ORACLE DB instead of MySQL DB. If any one have an idea regarding this, I will appreciate his/her response. Thanks, Jamal ************************************************************************************* The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ************************************************************************************* PALTEL E-Safety System scanned this email and found NO viruses, vandals or malicious content. ************************************************************************************* Should you need any information or clarifications regarding this system, please do not hesitate to contact our team at the IP Dep. <esafety(a)paltel.net>. *************************************************************************************

1 0

I did it MYsql+freeradius+chillispot
by Rupak 01 Jun '05

01 Jun '05

Thank you very much to all the participants for helping me to successfully installing the server.i have now created users in my sql and it is authenticating successfully.Now in the current scenerao I am only able to give prepaid facility to my users I mean that in the section "Simeltaneous-Use" I give the required seconds. Now I want to know what is the "attribute" for the postpaid scheme. I mean that I wont define any sort of time limitations.But I want my customer's surfing time to be appended in mysql.How can this be done?. And can the Max-All-Session value be given in minutes/hour's. Thank you Rupak Shrestha

2 1

Freeradius+mysql+error
by rupak＠sns.com.np 01 Jun '05

01 Jun '05

Hello everybody. I have configured free radius yo work with my sql.my sql server is also running.I have configured sql.conf and freeradius.conf to work with free radius.But when i start radius in debugging mode then i find the following errors.What can be the error. [root@chillispot mysql]# /usr/local/freeradius/sbin/radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user: 'root@localhost' (Using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. and it does not authenticate any users.... Rupak

2 1