- Freeradius-Users - lists.freeradius.org

Ipad 7.0.4 EAP-TTLS PAP Problem
by Puzzel 02 Oct '14

02 Oct '14

Hi there, I've got some issue with ipad device. I have settings EAP-TTLS PAP with working fine certificate tested on Windows (7,8,8.1), Android etc. Certificate is from TERENA (Root AdTrust certificate). When i want to connect from ipad with 7.0.3(11B511) version of firmware i can't connect and in logs i have something like that: Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read client certificate A Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Oct 1 13:06:38 radius radiusd[8232]: SSL: SSL_read failed in a system call (-1), TLS session fails. Any other systems this certificate work fine. Tnx for reply Thomas

3 4

Re: VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

hi. I'm not using the free radius server and I cannot find information on enabling the client with this information. If this available? Also, I understand what you stating below. But my point is that if the client cannot recognize the VSA, should it not just skip over and process the rest. (ie including the Normal attributes) Instead it returns what is has without processing the code under / * Normal */ thanks. ----Original Message---- From: aland(a)deployingradius.com Date: 02-Oct-2014 14:18 To: "bmoyni01(a)vodafone.ie"<bmoyni01(a)vodafone.ie>, "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius.org> Subj: Re: VSA processing in avpair.c in the client : (unknown Vendor- Id) bmoyni01(a)vodafone.ie wrote: > The comment would suggest that we just log and move on, but there is a > return > and process recursively leg of code is not given a chance. It can't recurse into the VSA because it doesn't know what format the VSA is in. > So a couple of questions: > > 1/ is the return valid Yes. > 2/ how can the the client be enabled to understand the Vendor-Id 311 ( > MSFT) Add it to the dictionaries. Alan DeKok. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

Hi. I'm getting the following log: rc_avpair_gen: received VSA attribute with unknown Vendor-Id 311 Just looking at rc_avpair_gen() in avpair.c /* VSA */ if (attribute == PW_VENDOR_SPECIFIC) { if (attrlen < 4) { rc_log(LOG_ERR, "rc_avpair_gen: received VSA " "attribute with invalid length"); goto shithappens; } memcpy(&lvalue, ptr, 4); vendorpec = ntohl(lvalue); if (rc_dict_getvend(rh, vendorpec) == NULL) { /* Warn and skip over the unknown VSA */ rc_log(LOG_WARNING, "rc_avpair_gen: received VSA " "attribute with unknown Vendor-Id %d", vendorpec); return pair; } /* Process recursively */ return rc_avpair_gen(rh, pair, ptr + 4, attrlen - 4, vendorpec); } The comment would suggest that we just log and move on, but there is a return and process recursively leg of code is not given a chance. So a couple of questions: 1/ is the return valid 2/ how can the the client be enabled to understand the Vendor-Id 311 ( MSFT) Thanks. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

Problem with the sqlcounter!
by Haviaras Kostas 02 Oct '14

02 Oct '14

Hello, I have configure my FreeRadius to work with MySQL, I also add the sqlcounter to count the hours user after the first login. Here is my code: mods-enabled/sqlcounter: sqlcounter checkthetime { sql_module_instance = sql dialect = ${modules.sql.dialect} counter_name = All-Hours-Passed check_name = Max-Hours-Passed reply_name = Session-Timeout key = User-Name reset = never $INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf } checkthetime.conf: query = "\ SELECT HOUR(SEC_TO_TIME(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime))) \ FROM radacct \ WHERE UserName = '%{${key}}' LIMIT 1;" sites-available/default: authorize { .... sql checkthetime .... } I am getting this message from the debug mode: (0) WARNING: checkthetime : Couldn't find control attribute 'control:Max-Hours-Passed' I don't know if I have make any syntax error! Thanks for your attention and time!

3 2

Re: Ipad 7.0.4 EAP-TTLS PAP Problem
by Rui Ribeiro 02 Oct '14

02 Oct '14

Hi Thomas, Before I forget, please when talking about a problem, be sure to include the freeradius version. If in freeradius 3, be sure that in mods-enabled/eap you have commented ca_file and ca_path. I had the same problem in iOS, and I could *swear* it was that. Let me know if it helps. iOS and in particular iPhones are much more picky about this kind of stuff than other platforms. I could swear that for the intermediate certificates Terena is giving was the intermediate chain was not there before iOS 8.0. So I had to build a certificate with the complete chain for the RADIUS service. Regards, Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 1 > Date: Wed, 1 Oct 2014 13:33:36 +0200 > From: "Puzzel" <puzzel1982(a)gmail.com> > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Subject: Ipad 7.0.4 EAP-TTLS PAP Problem > Message-ID: <017701cfdd6b$8b6fe8c0$a24fba40$@com> > Content-Type: text/plain; charset="us-ascii" > > Hi there, > > > > I've got some issue with ipad device. > > I have settings EAP-TTLS PAP with working fine certificate tested on > Windows > (7,8,8.1), Android etc. > > Certificate is from TERENA (Root AdTrust certificate). > > When i want to connect from ipad with 7.0.3(11B511) version of firmware i > can't connect and in logs i have something like that: > > > > Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify > > Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read > client certificate A > > Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL > routines:SSL3_READ_BYTES:ssl handshake failure > > Oct 1 13:06:38 radius radiusd[8232]: SSL: SSL_read failed in a system call > (-1), TLS session fails. > > > > Any other systems this certificate work fine. > > > > Tnx for reply > > Thomas > > >

1 0

FreeRADIUS 3.0.4 terminates with "Error: Failed adding event handler for socket!"
by Stefan Paetow 01 Oct '14

01 Oct '14

Hi, By accident I just spotted this message in /var/log/radius/radius.log on a RHEL 6.5 box with FreeRADIUS 3.0.4 installed: Wed Oct 1 13:45:01 2014 : Error: Failed adding event handler for socket! After that, FR terminated. I've restarted it, but unfortunately I don't have any other information. Alan, Arran, under what conditions does that error occur? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 2

EAP-GTC & Yubikey
by cellkites＠hushmail.com 01 Oct '14

01 Oct '14

I've been attempting to integrate yubikeys with freeradius and have had great success with the included yubikey module authenticating against both stored aes keys and a private otp validation server. However I am now attempting to use them in conjunction with EAP-GTC and am slightly lost. Under the gtc section of the eap module config i see that a user password is returned from the connecting client and passed onto another module for authentication. Is it possible to then pass this to the yubikey module to extract the otp portion, authenticate the otp and then continue with PAP authentication using the users password? Is there another way i should be going about this?

3 4

Re: Help on Freeradius v3
by KAVYA PRABHAKAR 01 Oct '14

01 Oct '14

Hi, When I run radiusd -X command(FR v3.0.3), it throws me the following error, because of which services are not getting started. Refusing to start with libssl version OpenSSL 1.0.1f 6 Jan 2014 0x01000106f (1.0.1f-15) (in range 1.0.1-0 - 1.0.1f-15) I changed allow_vulnerable_openssl = yes in radiusd.conf file and ran radius in debug mode. Still error did not change. Could anybody guide me where I am going wrong. Thanks, Kavya

2 1

Re: Beginner help
by KAVYA PRABHAKAR 01 Oct '14

01 Oct '14

Hi, When I run radiusd -X command(FR v3.0.3), it throws me the following error, because of which services are not getting started. Refusing to start with libssl version OpenSSL 1.0.1f 6 Jan 2014 0x01000106f (1.0.1f-15) (in range 1.0.1-0 - 1.0.1f-15) I changed allow_vulnerable_openssl = yes in radiusd.conf file and ran radius in debug mode. Still error did not change. Thanks, Kavya

1 1

Re: Freeradius-Users Digest, Vol 114, Issue 1
by KAVYA PRABHAKAR 01 Oct '14

01 Oct '14

Hi, I am using freeradius v3.0.4 on ubuntu 14.04. I tried to send radius request using command "radtest test password localhost 0 testing123" I got no reply from server. When I checked for open ports I didnot see any ports opened for freeradius. What is the command to start freeradius services? I tried /etc/init/d/freeradius restart which did not work Thanks, Kavya On Wed, Oct 1, 2014 at 11:09 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Maximum username length > (Franks Andy (RLZ) IT Systems Engineer) > 2. Re: Maximum username length (Alan DeKok) > 3. Authentication and Authorization (Alex Gregory) > 4. Re: Authentication and Authorization (Nick Owen) > 5. Re: Authentication and Authorization (Alex Gregory) > 6. Re: Authentication and Authorization (Alan DeKok) > 7. EAP-GTC & Yubikey (cellkites(a)hushmail.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 30 Sep 2014 15:55:56 +0100 > From: "Franks Andy $RLZ$ IT Systems Engineer" > <Andy.Franks(a)sath.nhs.uk> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Maximum username length > Message-ID: <20140930145557.4FCC5448906(a)nhs-pd1e-esg106.ad1.nhs.net> > Content-Type: text/plain; charset="UTF-8" > > They should make a movie.. > > So you're suggesting I reprogram pfsense then? I'll have to inform the > boss it's going to take a bit longer! > > Anyway, point taken, I'll have to see what this entails. The string was > looking to be pretty long anyway. > :-) > > > > -----Original Message----- > From: freeradius-users-bounces+andy.franks= > sath.nhs.uk(a)lists.freeradius.org [mailto: > freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: 30 September 2014 14:03 > To: FreeRadius users mailing list > Subject: Re: Maximum username length > > Franks Andy (RLZ) IT Systems Engineer wrote: > > We?re going to attempt to pass a number of delimited variables > > through via the username field > > Dear god no. This is a *terrible* idea. It will cause global warming, > rickets, plagues, alien invasions, and help bring on the coming apocalypse. > > > and split them at the freeradius end, mostly to avoid rewriting the > > php in the captive portal to use more orthodox existing attributes. > > There's no good reason to push crap onto someone else. Your laziness > just makes life harder for everyone else. > > If you care about your users, *don't* do this. > > > Can someone confirm the maximum username field length? I can see in > > the RFCs that 63 is the recommended minimum nas length but there?s not > > much else I can see in there. > > A lot of equipment and systems won't handle more than 63 characters. > > This is a terrible, evil, disgusting idea. RADIUS is full of enough > crap already without people deliberately adding more. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > Message: 2 > Date: Tue, 30 Sep 2014 11:36:39 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Maximum username length > Message-ID: <542ACE07.9050601(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > Franks Andy (RLZ) IT Systems Engineer wrote: > > So you're suggesting I reprogram pfsense then? I'll have to inform the > boss it's going to take a bit longer! > > You can fix pfsense once, or thousands of administrators can curse > your name while they try to "fix" their RADIUS server so that it works > with a non-standard username. > > That's a lot of negative karma. > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Tue, 30 Sep 2014 19:18:20 +0000 > From: Alex Gregory <alex(a)c2company.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Authentication and Authorization > Message-ID: <7A1FE1A4-0B02-4D9E-AB1A-B80D64AF82D3(a)c2company.com> > Content-Type: text/plain; charset="us-ascii" > > Hello- > > If I have both LDAP and Proxy configured will FreeRadius use both? What I > am looking for is the FreeRadius server authorize a user in LDAP and if > that passes forward the user to the upstream OTP radius server (via > proxy.conf) for authentication. I believe its doing this now with the LDAP > module, just authenticating locally, rather than proxied. > > Is this possible? > > Thanks, > > Alex > > > > ------------------------------ > > Message: 4 > Date: Tue, 30 Sep 2014 17:02:20 -0400 > From: Nick Owen <owen.nick(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authentication and Authorization > Message-ID: > < > CAJC4Zap-F3xJHhJPXjx9vRZoC6-4EHOaafv4wummZpRTdGi9gQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Yes, see this tutorial: > > https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add… > . > Note that you login with the username and OTP. No ldap password is > needed. > > HTH, > > Nick > > On Tue, Sep 30, 2014 at 3:18 PM, Alex Gregory <alex(a)c2company.com> wrote: > > Hello- > > > > If I have both LDAP and Proxy configured will FreeRadius use both? What > I am looking for is the FreeRadius server authorize a user in LDAP and if > that passes forward the user to the upstream OTP radius server (via > proxy.conf) for authentication. I believe its doing this now with the LDAP > module, just authenticating locally, rather than proxied. > > > > Is this possible? > > > > Thanks, > > > > Alex > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > -- > -- > Nick Owen > WiKID Systems, Inc. > http://www.wikidsystems.com > Commercial/Open Source Two-Factor Authentication > > > ------------------------------ > > Message: 5 > Date: Tue, 30 Sep 2014 22:49:00 +0000 > From: Alex Gregory <alex(a)c2company.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authentication and Authorization > Message-ID: <BCBCCE17-2331-4F9E-B664-D66FF01473DA(a)c2company.com> > Content-Type: text/plain; charset="us-ascii" > > Thank you for the link. I have the OTP working on a test server now with > proxying. The problem is the hosted OTP server does not supply any group > or attribute information back yet like this Wikid server does. But I have > two different user groups for two different networks (Corp and Dev users) > that need to be differentiated. > > In production have two virtual radius servers each doing an LDAP lookup > into a different group. If a user tries to access the incorrect network > they are denied because they are not in that group. Works great. If I > alter the server to proxy the request with the LDAP module configured will > it handle things properly? > > Thanks, > > Alex > > > > On Sep 30, 2014, at 2:02 PM, Nick Owen <owen.nick(a)gmail.com> wrote: > > > Yes, see this tutorial: > > > https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add… > . > > Note that you login with the username and OTP. No ldap password is > > needed. > > > > HTH, > > > > Nick > > > > On Tue, Sep 30, 2014 at 3:18 PM, Alex Gregory <alex(a)c2company.com> > wrote: > >> Hello- > >> > >> If I have both LDAP and Proxy configured will FreeRadius use both? > What I am looking for is the FreeRadius server authorize a user in LDAP and > if that passes forward the user to the upstream OTP radius server (via > proxy.conf) for authentication. I believe its doing this now with the LDAP > module, just authenticating locally, rather than proxied. > >> > >> Is this possible? > >> > >> Thanks, > >> > >> Alex > >> > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > -- > > -- > > Nick Owen > > WiKID Systems, Inc. > > http://www.wikidsystems.com > > Commercial/Open Source Two-Factor Authentication > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 6 > Date: Tue, 30 Sep 2014 21:26:56 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authentication and Authorization > Message-ID: <542B5860.5010803(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alex Gregory wrote: > > Thank you for the link. I have the OTP working on a test server now > with proxying. The problem is the hosted OTP server does not supply any > group or attribute information back yet like this Wikid server does. > > There are no standard RADIUS attributes which carry that information. > If you need it, the OTP server may not even be able to send that > information in RADIUS. > > > But I have two different user groups for two different networks (Corp > and Dev users) that need to be differentiated. > > > > In production have two virtual radius servers each doing an LDAP lookup > into a different group. If a user tries to access the incorrect network > they are denied because they are not in that group. Works great. If I > alter the server to proxy the request with the LDAP module configured will > it handle things properly? > > LDAP lookups are completely independent of proxying. > > If configured correctly, it should work. > > Alan DeKok. > > > ------------------------------ > > Message: 7 > Date: Wed, 01 Oct 2014 13:39:23 +0800 > From: cellkites(a)hushmail.com > To: freeradius-users(a)lists.freeradius.org > Subject: EAP-GTC & Yubikey > Message-ID: <20141001053923.E3D29C0105(a)smtp.hushmail.com> > Content-Type: text/plain; charset="utf-8" > > I've been attempting to integrate yubikeys with freeradius and have > had great success with the included yubikey module authenticating > against both stored aes keys and a private otp validation server. > However I am now attempting to use them in conjunction with EAP-GTC > and am slightly lost. > > Under the gtc section of the eap module config i see that a user > password is returned from the connecting client and passed onto > another module for authentication. Is it possible to then pass this to > the yubikey module to extract the otp portion, authenticate the otp > and then continue with PAP authentication using the users password? > > Is there another way i should be going about this? >

1 0