- Freeradius-Users - lists.freeradius.org

Certificate creation????
by Andreas Korber 01 Jun '05

01 Jun '05

Hi, What i am doing wrong? The creation of my certificates for EAP/TLS with CA.all or CA.certs always end with an message like this: ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:An optional company name []:Using configuration from /etc/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 3164:error:02001002:system library:fopen:No such file or directory:bss_file.c:276:fopen('./demoCA/serial','r') 3164:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: Failed to do sign certificate radius:/usr/local/etc/raddb/certs # So i looked for the serial file. But it dosn´t exist. I think because of an earlier message: CA certificate filename (or enter to create) unknown option -next_serial usage: x509 args -inform arg - input format - default PEM (one of DER, NET or PEM) -outform arg - output format - default PEM (one of DER, NET or PEM) -keyform arg - private key format - default PEM -CAform arg - CA format - default PEM -CAkeyform arg - CA key format - default PEM -in arg - input file - default stdin -out arg - output file - default stdout -passin arg - private key password source -serial - print serial number value -hash - print hash value -subject - print subject DN -issuer - print issuer DN -email - print email address(es) -startdate - notBefore field -enddate - notAfter field -purpose - print out certificate purposes -dates - both Before and After dates -modulus - print the RSA key modulus -pubkey - output the public key -fingerprint - print the certificate fingerprint -alias - output certificate alias -noout - no certificate output -ocspid - print OCSP hash values for the subject name and public key -trustout - output a "trusted" certificate -clrtrust - clear all trusted purposes -clrreject - clear all rejected purposes -addtrust arg - trust certificate for a given purpose -addreject arg - reject certificate for a given purpose -setalias arg - set certificate alias -days arg - How long till expiry of a signed certificate - def 30 days -checkend arg - check whether the cert expires in the next arg seconds exit 1 if so, 0 if not -signkey arg - self sign cert with arg -x509toreq - output a certification request object -req - input is a certificate request, sign and output. -CA arg - set the CA certificate, must be PEM format. -CAkey arg - set the CA key, must be PEM format missing, it is assumed to be in the CA file. -CAcreateserial - create serial number file if it does not exist -CAserial arg - serial file -set_serial - serial number to use -text - print the certificate in text form -C - print out C code forms -md2/-md5/-sha1/-mdc2 - digest to use -extfile - configuration file with X509V3 extensions to add -extensions - section from config file with X509V3 extensions to add -clrext - delete extensions before signing and input certificate -nameopt arg - various certificate name options -engine e - use engine e, possibly a hardware device. -certopt arg - various certificate text options Can anyone help me plaese??

3 2

Freeradius+mysql error
by Rupak 31 May '05

31 May '05

I configured freeradius it was working well.Now I wanted to make it work with my sql.My distro is redhat9 and I am using the version mysql-3.23.54a-11.rpm.Free radius was working and authenticating user.But after configuring the files to make it work with sql it is not working well.It gave me the following errors.I did exactly that was defined in the resources.Like in the forum section of chillispot.org .Tutorial was posted by barteki. And other sites as well. root@chillispot rlm_sql_mysql]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Could not link driver rlm_sql_mysql: file not found rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. Can any one point me to a correct lane. Thanking you

5 11

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

3 2

Format of Framed-IPv6-Prefix Attribute
by Seema Sirivara 31 May '05

31 May '05

Hi, Can anybody please let me know the usage format of Framed-IPv6-Prefix attribute. I need to use in a user file record, but radius does not seem to send out the correct address. The attribute is of type octets and hence I cannot specify the Prefix in standard IPv6 address format.. (Ex - 3001::1 etc) I am using FreeRADIUS Version 0.9.3. Thanks, /Seema __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Authenticating Active Directory users via LDAP
by Pete Flynt 31 May '05

31 May '05

Hello, My network environment looks like the following: WinXP client --- Cisco Switch --- FreeRadius Server --- DC(Active Directory) I am able to authenticate the WinXP client with the local users file and EAP. Now I want FreeRadius to lookup the user credentials in Active Directory. I configured the LDAP modules and I am able to access Active directory for username lookup but the authentication fails because of the password that cannot be supplied in cleartext. The problem is, that I must use EAP because of 802.1X between the switch and the WinXP client. How can I solve this issue? I have read somewhere about how to modify FreeRadius source code in order to get EAP working with AD. I would appreciate a simpler solution. Any suggestion? Here is some output of radiusd: rlm_ldap: - authorize rlm_ldap: performing user authorization for pete radius_xlat: '(sAMAccountName=pete)' radius_xlat: 'cn=Users, dc=testdc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Users, dc=testdc, with filter (sAMAccountName=pete) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user pete authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [pete] (from client 192.168.33.44 port 0 cli 00-11-43-5c-77-d6) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Regards, Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

radius + peap + wifi + mac os x
by Vittore Zen 31 May '05

31 May '05

Hi, I'm using freeradius (+mysql) in a wireless infrastructure with a dozen of linksys WAP54G access point (using AES). Authentication is PEAP with mschapv2. All go right when use Windows clients but no response using Mac Os X clients. Any ideas? Someone says me that MacOsX use a tunnel with md5 nor mschapv2. Note that is server starts with -X no authentication is required from MacOsX client. thanks in advance v.

3 2

Forwarding
by Maxim Hitrov 31 May '05

31 May '05

Hello I have a radius server that receives Access-Requests params from another Server (an application). Application sends an value under one param (Framed-IP-Address), but Radius server are configured to read this value in another param (Calling-Station-Id). So, i need to have something intermediate, that receives value of Framed-IP-Address and sends it to Radius server as Calling-Station-Id. Application and Radius server can't be configured to use the same value in the same request param! Can i use FreeRadius as intermadiate Radius that will change and forward Access-Requests params? Give me some examples, and what i need to read for doing this. Thank you --------------------------------- Do You Yahoo!? Yahoo! Small Business - Try our new Resources site!

2 1

Freeradius 1.0.2 crashes in startup due tls
by Mikko Saarinen 31 May '05

31 May '05

Hey, Not sure if this would belong to devel list, but still. I'm trying to test the PEAP support, but Freeradius 1.0.2 dies when it loads and configures the tls module. In older version 0.9.3 the tls works a-ok, but it has no peap support. Anyone have idea if this is a known problem and if there is version in which the peap runs. OpenSSL version: OpenSSL 0.9.7e 25 Oct 2004 Here is the log and stack from running radiusd -X under gdb: (gdb) run -X Starting program: /usr/local/sbin/radiusd -X (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 16384 (LWP 5377)] Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.50 IP address [192.168.1.50] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/foocerts/privkey.pem" tls: certificate_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: CA_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes rlm_eap_tls: conf N ctx stored rlm_eap: Loaded and initialized type tls Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 5377)] 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) bt #0 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 #1 0x402324c7 in eaptype_load (type=0xc, eap_type=12, cs=0xc) at eap.c:114 #2 0x40231aea in eap_instantiate (cs=0x80a7410, instance=0xc) at rlm_eap.c:134 #3 0x080558f3 in find_module_instance () #4 0x08056cd5 in modcall () #5 0x08056e32 in compile_modsingle () #6 0x08055dad in find_module_instance () #7 0x08056144 in setup_modules () #8 0x0804cea0 in main () (gdb) -- Mikko Saarinen mikko.saarinen(a)radionet.com

2 1

dynamic ip, shared secret
by glanzel＠gmx.de 31 May '05

31 May '05

Hello i want to allow nas's behind a flatrate to talk with my freeradius server. these nas's has dynamis ip's. has anybody an idea how i could deal with that. at the moment i have a client named 0.0.0.0/0 in the clients.conf file - but that means that every nas have the same shared secret. better ideas ? and could someone tell me if my suggestions about the shared secret are right. -> if using pap or chap shared secred is used to encrypt password when sending. -> if using peap or ttls shared secret is not used in the authentication process but for the sending of encryption key for further encryption of the connection between supplicant and radius at the end of the authentification session is that right ? greetings grischan -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse f�r Mail, Message, More +++

2 1

RE: upgrading freeRADIUS
by DELORT Stephane 31 May '05

31 May '05

Hello Vicky, Haven't you try to copy your config files and do the upgrade on a test system ? (create an exact replica on another machine and upgrade it) I think it would be useful to post an "howto to upgrade from xxx to yyy" once you've done it. regards, Stéphane -----Message d'origine----- De : freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]De la part de vicky Envoyé : mardi 31 mai 2005 11:31 À : FreeRadius users mailing list Objet : upgrading freeRADIUS Hi list subscribers, hi list admins, (again) I'm running a freeRADIUS server version 0.8.1 (I know it is ancient) and I want to upgrade it to the latest version available. I have been trying to find some kind of procedure to upgrading but with no success. Does anyone know how to (in a fairly simple way) safely upgrade? The safetyness is very crucial, I cant risk overwriting my old configuration. The old server is built with #configure --prefix=/opt/freeradius #make #su #make install Thanks to you all in advance and please notice that I'm not that of an expert on RADIUS... Keep up the good work! -- Vicky - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 5