- Freeradius-Users - lists.freeradius.org

TLS error
by marcos 15 Jan '15

15 Jan '15

Hi In other threat I commented about problems connecting and I discovered now this error TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation Im changing COMODO certificate, but I don't know where checks to find this CA. Suggestions? Thanks! -- For private content :-) Public key 0x0C05942A895BD10E FIngerprint 45B9 EC0B 58D5 B17C 8C37 95C3 0C05 942A 895B D10E

1 0

Re: Freeradius + Cisco WLC + Authorisation
by Sander Eerdekens 15 Jan '15

15 Jan '15

Hello, > > What settings to I need to include in /etc/raddb/users to allow the > > correct Authorisation level? > > ... > > we looked at using RADIUS but found that cisco still have more bias towards TACACS+ > so we use that for multi-grained access control to the WCS system (different tasks > available for different people on the web interface...not just a 'all admin' switch) We actually use radius for this. The Cisco-AVPairs we are using are: Cisco-AVPair += "Wireless-WCS:virtual-domain0=root", Cisco-AVPair += "Wireless-WCS:role0=Admin", Cisco-AVPair += "Wireless-WCS:task0=Users and Groups", Cisco-AVPair += "Wireless-WCS:task1=Audit Trails", Cisco-AVPair += "Wireless-WCS:task2=TACACS+ Servers", Cisco-AVPair += "Wireless-WCS:task3=RADIUS Servers", Cisco-AVPair += "Wireless-WCS:task4=Logging", Cisco-AVPair += "Wireless-WCS:task5=License Center", Cisco-AVPair += "Wireless-WCS:task6=Scheduled Tasks and Data Collection", Cisco-AVPair += "Wireless-WCS:task7=User Preferences", Cisco-AVPair += "Wireless-WCS:task8=System Settings", Cisco-AVPair += "Wireless-WCS:task9=View Alerts and Events", Cisco-AVPair += "Wireless-WCS:task10=Email Notification", Cisco-AVPair += "Wireless-WCS:task11=Delete and Clear Alerts", Cisco-AVPair += "Wireless-WCS:task12=Pick and Unpick Alerts", Cisco-AVPair += "Wireless-WCS:task13=Configure Controllers", Cisco-AVPair += "Wireless-WCS:task14=Configure Templates", Cisco-AVPair += "Wireless-WCS:task15=Configure Config Groups", Cisco-AVPair += "Wireless-WCS:task16=Configure Access Points", Cisco-AVPair += "Wireless-WCS:task17=Configure Access Point Templates", Cisco-AVPair += "Wireless-WCS:task18=Configure Choke Points", Cisco-AVPair += "Wireless-WCS:task19=Monitor Controllers", Cisco-AVPair += "Wireless-WCS:task20=Monitor Access Points", Cisco-AVPair += "Wireless-WCS:task21=Monitor Clients", Cisco-AVPair += "Wireless-WCS:task22=Monitor Tags", Cisco-AVPair += "Wireless-WCS:task23=Monitor Security", Cisco-AVPair += "Wireless-WCS:task24=Monitor Chokepoints", Cisco-AVPair += "Wireless-WCS:task25=Mesh Reports", Cisco-AVPair += "Wireless-WCS:task26=Client Reports", Cisco-AVPair += "Wireless-WCS:task27=Performance Reports", Cisco-AVPair += "Wireless-WCS:task28=Security Reports", Cisco-AVPair += "Wireless-WCS:task29=Location Server Management", Cisco-AVPair += "Wireless-WCS:task30=View Location Notifications", Cisco-AVPair += "Wireless-WCS:task31=Maps Read Only", Cisco-AVPair += "Wireless-WCS:task32=Maps Read Write", Cisco-AVPair += "Wireless-WCS:task33=Client Location", Cisco-AVPair += "Wireless-WCS:task34=Rogue Location", Cisco-AVPair += "Wireless-WCS:task35=Planning Mode", Cisco-AVPair += "Wireless-WCS:task36=Ack and Unack Alerts", Cisco-AVPair += "Wireless-WCS:task37=Migration Templates", Cisco-AVPair += "Wireless-WCS:task38=Configure Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task39=Monitor Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task40=Auto Provisioning", Cisco-AVPair += "Wireless-WCS:task41=Voice Audit Report", Cisco-AVPair += "Wireless-WCS:task42=Virtual Domain Management", Cisco-AVPair += "Wireless-WCS:task43=Scheduled Configuration Tasks", Cisco-AVPair += "Wireless-WCS:task44=Configure WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task45=Configure ACS View Servers", Cisco-AVPair += "Wireless-WCS:task46=Monitor WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task47=RRM Dashboard", Cisco-AVPair += "Wireless-WCS:task48=Config Audit Dashboard", Cisco-AVPair += "Wireless-WCS:task49=High Availability Configuration", Cisco-AVPair += "Wireless-WCS:task50=Health Monitor Details", Cisco-AVPair += "Wireless-WCS:task51=Configure WIPS Profiles", Cisco-AVPair += "Wireless-WCS:task52=Global SSID Groups", Cisco-AVPair += "Wireless-WCS:task53=Configure Lightweight Access Point Templates", Cisco-AVPair += "Wireless-WCS:task54=Configure Autonomous Access Point Templates", Cisco-AVPair += "Wireless-WCS:task55=Configure Ethernet Switch Ports", Cisco-AVPair += "Wireless-WCS:task56=Configure Ethernet Switches", Cisco-AVPair += "Wireless-WCS:task57=Device Reports", Cisco-AVPair += "Wireless-WCS:task58=Network Summary Reports", Cisco-AVPair += "Wireless-WCS:task59=Compliance Reports", Cisco-AVPair += "Wireless-WCS:task60=Report Launch Pad", Cisco-AVPair += "Wireless-WCS:task61=Run Reports List", Cisco-AVPair += "Wireless-WCS:task62=Saved Reports List", Cisco-AVPair += "Wireless-WCS:task63=Report Run History", Cisco-AVPair += "Wireless-WCS:task64=Ack and Unack Security Index Issues", Cisco-AVPair += "Wireless-WCS:task65=View Security Index Issues", Cisco-AVPair += "Wireless-WCS:task66=Monitor Media Streams", Cisco-AVPair += "Wireless-WCS:task67=Monitor Interferers", Cisco-AVPair += "Wireless-WCS:task68=Voice Diagnostics", Cisco-AVPair += "Wireless-WCS:task69=CleanAir Reports", Cisco-AVPair += "Wireless-WCS:task70=ContextAware Reports", Cisco-AVPair += "Wireless-WCS:task71=Automated Feedback", Cisco-AVPair += "Wireless-WCS:task72=TAC Case Attachment Tool", The role can be Admin or System Monitoring. Not sure where this came from as a collogue of mine wrote this config. Kind regards Sander Eerdekens

2 1

Authentication Problem
by Robert Graham 15 Jan '15

15 Jan '15

Im just about at the end of my rope... I have been searching and reading and reading, but cannot get this to work. I have a external ms sql database that has three columns only. member_id, HashedPassword, and Salt. I am trying to authenticate against this database. 1st question is: Do I have to use the schema that is inside freeradius, and if I do not, how do I get FR to auth without using all the tables that are preinstalled in the schema? Unfortunately I am not a sql database guy, im a network guy, and writing db is not my forte.. This is what I have but yet I know it is incorrect. I dont want to use any groups, it is strictly for someone to logon to our vpn and wireless connections. The passwords are stored in SHA-512 with Salt and unicoding. Is it even possible or am I wasting my time? I am running 3.0.6 of FR. These are the only columns in the database. recreating the database isnt likely to happen, having almost 19,000 rows in the table. authorize_check_query = "\ SELECT member_id, HashedPassword, Salt \ FROM ${dbo.vw_Main_table} \ WHERE UserName = '%{SQL-User-Name}'" Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

4 4

Accounting response with attributes
by Chandan Kumar 14 Jan '15

14 Jan '15

Hello All, I am using FreeRADIUS Version 3.0.4 on Linux (CentOS 6). I have a question regarding how can I force radius server to add all attribute information into accounting response message. The accounting section of my site-available/default if as below. accounting { detail unix -sql exec } I have customized the pam_radius_auth.so module to send Accounting request messages to include more attributes such as Acct-Terminate-Cause,Acct-Link-Count,Acc-authentic etc and expecting response from server with attribute [with reason code] at the end of the accounting [at the STOP message]. However, in all cases I am only getting response message with code,identifier,length=20 and response-authenticator. I am wondering is there any configuration parameter that I missing or it is not supported at all in this version of FreeRADIUS as RFC does not make it mandatory. Quoting RFC "A RADIUS Accounting-Response is not required to have any attributes in it." Thanks Chandan

3 10

EAP-TLS - TLS 1.0 Alert [length 0002], fatal internal_error
by PENZ Robert 14 Jan '15

14 Jan '15

Hi! We're running openssl-1.0.1e-30.el6_6.4.x86_64 and freeradius-2.1.12-6.el6.x86_64 on a RHEL6. We're using EAP-TLS with Windows clients and IP phones with no problems. Now we want to add MFD systems from Canon also as clients and we get following openssl error, while running free radius in debug mode. The error happens already on the second packet the radius server gets from the MFD. First Packet: Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=212, length=143 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0212001d016a776636383336352e6d66702e7469726f6c2e6c6f63616c NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet Message-Authenticator = 0x46be9f4cbce0fb5c68c67280b8ff5784 .... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP Identity Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Requiring client certificate Tue Jan 13 16:19:31 2015 : Info: [tls] Initiate Tue Jan 13 16:19:31 2015 : Info: [tls] Start returned 1 .... Sending Access-Challenge of id 212 to 10.15.132.2 port 39460 EAP-Message = 0x011300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xea9fd73aea8cdaa07914c31bfc979134 Second Packet: Tue Jan 13 16:19:31 2015 : Debug: Going to the next request Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=213, length=239 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0213006b0d8000000061160301005c01000058030154b537821306fa9c57603eb40ab2f22a9b3cdcc496fa91589413aa835503a4d400001e002f0035000400050009000a00030008c013c014c009c00a00330039001601000011000a00080006001700180019000b000100 NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet State = 0xea9fd73aea8cdaa07914c31bfc979134 Message-Authenticator = 0x2482cae69f6e75122c8a7fd7bbbf72a2 ....... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP packet type response id 19 length 107 Tue Jan 13 16:19:31 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Jan 13 16:19:31 2015 : Info: +++[eap] returns updated Tue Jan 13 16:19:31 2015 : Info: ++- else else returns updated Tue Jan 13 16:19:31 2015 : Info: Found Auth-Type = EAP Tue Jan 13 16:19:31 2015 : Info: # Executing group from file /etc/raddb//sites-enabled/default Tue Jan 13 16:19:31 2015 : Info: +- entering group EAP {...} Tue Jan 13 16:19:31 2015 : Info: [eap] Request found, released from the list Tue Jan 13 16:19:31 2015 : Info: [eap] EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Authenticate Tue Jan 13 16:19:31 2015 : Info: [tls] processing EAP-TLS Tue Jan 13 16:19:31 2015 : Debug: TLS Length 97 Tue Jan 13 16:19:31 2015 : Info: [tls] Length Included Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_verify returned 11 Tue Jan 13 16:19:31 2015 : Info: [tls] (other): before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] TLS_accept: before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 005c], ClientHello Tue Jan 13 16:19:31 2015 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal internal_error Tue Jan 13 16:19:31 2015 : Error: TLS Alert write:fatal:internal error Tue Jan 13 16:19:31 2015 : Error: TLS_accept: error in SSLv3 read client hello C Tue Jan 13 16:19:31 2015 : Error: rlm_eap: SSL error error:1408A0E3:SSL routines:SSL3_GET_CLIENT_HELLO:parse tlsext Tue Jan 13 16:19:31 2015 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Jan 13 16:19:31 2015 : Debug: TLS receive handshake failed during operation Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_process returned 4 Tue Jan 13 16:19:31 2015 : Info: [eap] Handler failed in EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] Failed in EAP select .... Sending Access-Reject of id 213 to 10.15.132.2 port 39460 EAP-Message = 0x04130004 Message-Authenticator = 0x00000000000000000000000000000000 Regards, Robert Penz

3 3

Freeradius + Cisco WLC + Authorisation
by mail＠moult.com.au 14 Jan '15

14 Jan '15

Hi there, Hoping someone might be able to help, with what should be a simple problem.. I have a Cisco vWLC that is set up to autheticate against a freeradius server.. At this stage I am just wanting to use it to authenticate & authorise administrative users, so that they can use the GUI.. The users can succesfully log on, however they are not getting the correct authorisation.. What settings to I need to include in /etc/raddb/users to allow the correct Authorisation level? I am guessing it is some sort of "cisco-avpair = ???" command.. just not sure which one.. Any help is greatly appreciated!! Thanks!

2 1

Help with Cisco-AVPairs
by Arran Cudbard-Bell 14 Jan '15

14 Jan '15

Changes in master mean that we can now represent them in the Cisco vendor dictionary, and convert all Cisco-AVPair attributes to internal, correctly typed ones. This makes proper comparisons, and access much easier. So if anyone has a complete or semi-complete list of all the Cisco-AVPair attributes please send them over so the Cisco dictionary can be updated. Next step is to modify foreach to work correctly, providing references to actual attributes, instead of stringifying them. This will allow automatic re-encoding of attributes for proxying and replies. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 4

3.0.6 rlm_eap_gtc: Unknown Auth-Type perl
by Nick Rogers 13 Jan '15

13 Jan '15

Hello, In previous freeradius 2.2.x versions, I've been able to change the Auth-Type to perl within the gtc module. For example... eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no gtc { challenge = "Password: " auth_type = perl } This allowed rlm_eap_gtc to pass the password to rlm_perl via the User-Password attribute. Now when trying to upgrade to 3.0.x, it seems that an auth_type of perl is no longer allowed. I am wondering if this is a bug or intentional change? Should I be changing Auth-Type within eap_gtc via some other means? For example... gtc { challenge = "Password: " auth_type = perl update control { Auth-Type := Perl } } Thank you. -Nick

2 3

Re: Question about radcheck sql!
by Haviaras Kostas 13 Jan '15

13 Jan '15

Thanks for your response! I will consider it!

5 16

Can radius send COA notification to host/process and port other than the one that caused the change in one of the entries (radius is using mysql)
by Sourabh Pandit 13 Jan '15

13 Jan '15

Good morning all, I am a beginner user of freeradius so please bear with me if my question is too basic, but please do point me in the right direction. I am using freeradius 2.1.12. For this example consider the following scenario Radius 1. radius server is running on IP 192.168.48.76. 2. radius is using mysql for authentication. 3. A user UserA is in the blocked list when we begin. 4. Process Proc1 is running on 192.168.48.54 5. Process Proc2 is running on 192.168.48.59, listening on port 20000 6. Proc1 and Proc2 do not know about each other at all. I mean they do not even know if another process even exists. I would appreciate if some one could tell me the following. 1. If process Proc1 wants to remove the UserA form the blocked list by sending a request to the radius server. 1. Can the radius server generate a COA message that goes to Proc2 on port 2000 and not to the Proc1? 2. Is radclient the vehicle to be used by Proc1 to initiate the change in the user group for User A in this case? 2. If the above is not possible, let's say the process Proc1 removes the user UserA from the blocked list by manipulating the sql table directly. 1. Can the radius server generate a COA message that goes to Proc2 on port 2000 and not to the Proc1? If it is possible, please point me in the right direction. Thanks SP

2 1