- Freeradius-Users - lists.freeradius.org

Re: Wild Card GoDaddy cert
by Rui Ribeiro 27 May '14

27 May '14

Hi Ryan, As far as I remember, Windows does not support wildcard certificates. Regards > Message: 5 > Date: Fri, 23 May 2014 16:48:41 +0200 > From: Ryan De Kock <ryandekock1988(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Wild Card GoDaddy cert > Message-ID: > < > CANek+E1Fm+_zWfbcyz2Nuax+BXp2O7czOteSXoNq09xfi7p6JA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I have a wildcard cert from godaddy.com. > > I have tested the cert on Microsoft NPS & IAS and it works fine. > > I'm sure it will work in freeradius too, however I can't figure it out. > > I have godaddy.crt bundl.e.crt & godaddy.key. > > I have added these to freeradius however it does work. > > This is what windows does when I don't validate certificates > > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > TLS Length 37 > [peap] Length Included > [peap] eaptls_verify returned 11 > [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied > TLS Alert read:fatal:access denied > [peap] WARNING: No data inside of the tunnel. > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state ? > [peap] FAILED processing PEAP: Tunneled data is invalid. > [eap] Handler failed in EAP/peap > [eap] Failed in EAP select > ++[eap] returns invalid > Failed to authenticate the user. > } # server Cerebus > > This is a successfull auth on my linux client > > > > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state send tlv success > [peap] Received EAP-TLV response. > [peap] Success > [eap] Freeing handler > ++[eap] returns ok > > > tls { > > certdir = ${confdir}/certs > cadir = ${confdir}/certs > private_key_file = ${certdir}/godaddy.key > certificate_file = ${certdir}/godaddy.crt > dh_file = ${certdir}/dh > random_file = ${certdir}/random > } > > > So Im not sure if its got to do with no using the cert chain or what I'm > doing wrong but would appreciate any guidance >

4 4

1. RE: Subject: Package availability question (Mike Poole)
by Mike Poole 27 May '14

27 May '14

-----Original Message----- From: freeradius-users-bounces+mpoole=pavlovmedia.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mpoole=pavlovmedia.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Sunday, May 25, 2014 4:51 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 109, Issue 100 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Message: 1 Date: Sat, 24 May 2014 12:26:38 +0100 From: Rui Ribeiro <ruyrybeyro(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: RE: Subject: Package availability question (Mike Poole) Message-ID: <CAGnR_r9FXUQs26EEAPuEE1307GdGczEnd-CZ9yr+8HXVSSeryQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi, No, you arent. Wheezy here too. Build your own debs. aptitude install libssl-dev quilt libtool libltdl3-dev libpam0g-dev libmysqlclient-dev libgdbm-dev libldap2-dev libsasl2-dev libiodbc2-dev libkrb5-dev libperl-dev libpcap-dev python-dev libsnmp-dev libpq-dev debhelper git clone git://git.freeradius.org/freeradius-server.git cd freeradius-server git fetch origin v2.x.x:v2.x.x git checkout v2.x.x cd .. fakeroot dpkg-buildpackage -b -uc sudo dpkg --force-confold --force-confdef -i freeradius_2.2.*git_*.deb freeradius-common_2.2.*git_*.deb freeradius-ldap_2.2.*git_*.deb freeradius-mysql_2.2.*git_*.deb freeradius-utils_2.2.*git_*.deb libfreeradius2_2.2.*git_*.deb Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 Message: 1 > Date: Fri, 23 May 2014 19:06:41 +0000 > From: Mike Poole <mpoole(a)pavlovmedia.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Subject: Package availability question > Message-ID: > > <6712C775E82EB247807B5D7CCFBE940786B2358E(a)sula.pavlovmedia.corp> > Content-Type: text/plain; charset="us-ascii" > > Debian Wheezy would be greatly appreciated if possible. We are stuck > at > 2.1.12 unless we can get an enterprise change to Ubuntu. > > > >

1 0

Please test the new DHCP options encoder
by Arran Cudbard-Bell 27 May '14

27 May '14

Just a heads up, i've backported the new DHCP options encoder from master. If anyone is using DHCP with v3.0.x they may want to try it to make sure nothing is horribly and obviously broken. The original code was a bit poor on the bounds checking, and with sufficiently large DHCP packets the outbound packet buffer could of easily overflowed. There's a new %{dhcp:&<attrref>} xlat, which was added to allow tests to be written using the unittest framework. If anyone has some free time and is using the DHCP functionality of the server it'd be really useful if they could write some basic unit tests. The framework is very simple, and there are tons of examples in src/tests/keywords. They're all written in unlang, so if you can write policies in the server you can write unit tests :). Tests help everybody, they help you by ensuring the features you need work correctly between releases, and they help us and the rest of the community by keeping the general quality of the server high. Thanks. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Free radius : Increase debug log level
by Lakshmanji Chandrasekaran 27 May '14

27 May '14

Hi All, We are running FreeRADIUS Version 2.1.11 on Red Hat Enterprise Linux Server release 5.10 (Tikanga). We are looking to increase the debug log level to identify the free radius crashing and from the man page we could see the below options. -X Turn on full debugging. -x Turn on additional debugging. (-xx gives more debugging). But the above options are not providing more details of crash error. Is there any other options to increase the logging level (any command line or configuration file change to increase logging level ) ? Thanks in Advance. Regards, Lakshmanji

4 6

IBM AIX 7.1 install pam_radius-1.3.17 error
by Sam 林立山 27 May '14

27 May '14

Hello every one, I try install pam_radius-1.3.17 into IBM AIX 7.1 server. I install Linux tool first. When I make, have error: # make cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function 'talk_radius': pam_radius_auth.c:886:10: warning: passing argument 6 of 'nrecvfrom' from incompatible pointer type [enabled by default] 0, &saremote, &salen)) < 0) { ^ In file included from pam_radius_auth.h:8:0, from pam_radius_auth.c:65: /usr/include/sys/socket.h:552:9: note: expected 'socklen_t *' but argument is of type 'int *' ssize_t recvfrom(int, void *__restrict__, size_t, int, struct sockaddr *__restrict__, socklen_t *__restrict__); ^ pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1027:3: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type [enabled by default] retval = pam_get_item(pamh, PAM_CONV, (CONST void **) &conv); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:193:1: note: expected 'void **' but argument is of type 'const void **' pam_get_item( ^ pam_radius_auth.c:1030:3: warning: passing argument 2 of 'conv->conv' from incompatible pointer type [enabled by default] retval = conv->conv(1, msg, &resp,conv->appdata_ptr); ^ pam_radius_auth.c:1030:3: note: expected 'struct pam_message **' but argument is of type 'const struct pam_message **' pam_radius_auth.c: At top level: pam_radius_auth.c:1061:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1268:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1300:3: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type [enabled by default] retval = pam_get_user(pamh, &user, NULL); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:219:1: note: expected 'char **' but argument is of type 'const char **' pam_get_user( ^ pam_radius_auth.c:1321:5: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type [enabled by default] retval = pam_get_item(pamh, PAM_SERVICE, (CONST void **) &config.client_id); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:193:1: note: expected 'void **' but argument is of type 'const void **' pam_get_item( ^ pam_radius_auth.c:1288:7: warning: variable 'ctrl' set but not used [-Wunused-but-set-variable] int ctrl; ^ pam_radius_auth.c: At top level: pam_radius_auth.c:1369:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1376:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1387:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1616:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1014:12: warning: 'rad_converse' defined but not used [-Wunused-function] static int rad_converse(pam_handle_t *pamh, int msg_style, char *message, char **password) ^ pam_radius_auth.c:1283:1: warning: 'pam_private_session' defined but not used [-Wunused-function] pam_private_session(pam_handle_t *pamh, int flags, ^ make: 1254-004 The error code from the last command is 1. Stop. -- Sam ============================================================== Sam Lin 林立山 Acom Networks E-MAIL : sam(a)acom-networks.com OFFICE : +886.2.2313.1416 MOBILE : +886.930.895.633 ==============================================================

4 15

Intermittent access-reject even though password is correct
by Sachin Yadav 26 May '14

26 May '14

Hi, I am getting intermittent access-reject response from free-radius even though password was correct. User have to try again and this time user is allowed. Following are the debug logs for one such transaction - rad_recv: Access-Request packet from host 122.176.209.171 port 23328, id=41, length=321 ChilliSpot-Version = "1.3.0" User-Name = "aqua" CHAP-Challenge = 0x86b6482ac2204b1801b4705ca5d43722 CHAP-Password = 0x00662b9af994945519294eb931419a5e21 Service-Type = Login-User Acct-Session-Id = "5380389300000002" Framed-IP-Address = 192.168.182.3 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "60-FA-CD-D1-45-CE" Called-Station-Id = "C8-D3-A3-6C-F2-53" NAS-IP-Address = 192.168.182.1 NAS-Identifier = "moka_ug" WISPr-Location-ID = "isocc=,cc=,ac=,network=xxxxxxx" WISPr-Location-Name = "xxxx" WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Message-Authenticator = 0xe8d077bea1e4565958097834c2143975 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "aqua", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> aqua [sql] sql_set_user escaped user --> 'aqua' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'aqua' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'aqua' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'aqua' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'gartino_ug' ORDER BY id [sql] User found in group gartino_ug [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'gartino_ug' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "aqua" with CHAP password [chap] Using clear text password "mango" for user aqua authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aqua attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3601 for 1 seconds Going to the next request Waking up in 0.9 seconds. Can someone please help me understand what's going wrong? I am using coovachilli as a capative portal solution which automatically send these packets to radius server for AAA.

2 1

NAS-Port always the same
by Khapare Joshi 26 May '14

26 May '14

Hi, I am trying to use simualtaneous-use with radutmp file but cisco controller is always sending the same port to all devices and logs NAS-Port=1 for all devices in accounting detail file. Here is the typical log : Mon May 26 13:54:10 2014 User-Name = "anonymous(a)mwn.de" NAS-Port = 1 NAS-IP-Address = 192.168.1.1 Framed-IP-Address = 10.1.1.1 NAS-Identifier = "mytestNAS" Airespace-Wlan-Id = 300 Acct-Session-Id = "53833d09/b8:f6:b1:d1:cc:89/3584354" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=82d0a5f80004506053833d07" Acct-Authentic = RADIUS Event-Timestamp = "May 26 2014 13:54:10 GMT" Acct-Status-Type = Interim-Update Acct-Input-Octets = 274220 Acct-Input-Gigawords = 0 Acct-Output-Octets = 354276 Acct-Output-Gigawords = 0 Acct-Input-Packets = 2174 Acct-Output-Packets = 1529 Acct-Session-Time = 2681 Acct-Delay-Time = 0 Calling-Station-Id = "10.1.1.1" Called-Station-Id = "192.168.1.1" Cisco-AVPair = "nas-update=true" Acct-Unique-Session-Id = "df8c433d8fc2ee10" Realm = "DEFAULT" Timestamp = 1401112450 Request-Authenticator = Verified Can I not change that NAS-IP to actual wireless access point rather the controller IP address ? I tried changing /etc/raddb/acct_users file as : NAS-Identifier == "mytestNAS", NAS-IP-Address := "%{Framed-IP-Address:-%{NAS-IP-Address}}" but I still get the NAS-Port=1 for all the device. There must be users whose cisco wireless access points controlled by the controller - can someone point me ? Khapare

3 3

radiusd not installed in FreeRadius 3.0.3
by * 26 May '14

26 May '14

Hi, I have compiled and install the Debian package of FreeRadius 3.0.3. But radiusd is not installed. It is in my local FreeRadius 3.0.3 directory (freeradius-server-3.0.3/build/bin). Why is this? Jake He

3 2

FreeRADIUS v3.0.3 Fedora packages available
by Nikolai Kondrashov 26 May '14

26 May '14

Hi everyone, FreeRADIUS v3.0.3 packages are available for Fedora 20 [1]. Fedora users are welcome to test and leave karma feedback [2]. Apart from the changes noted in the upstream ChangeLog (installed with freeradius-doc), fixes for the following post-release issues were applied: * case-insensitive matching in compiled regular expressions not working, * upstream issue #634 "3.0.3 SIGSEGV on config parse", * upstream issue #635 "3.0.x - rlm_perl - strings are still escaped when passed to perl from FreeRADIUS", * upstream issue #639 "foreach may cause ABORT". Nick [1] https://admin.fedoraproject.org/updates/FEDORA-2014-6698/freeradius-3.0.3-1… [2] http://fedoraproject.org/wiki/How_to_test_updates

1 0

RE: Subject: Package availability question (Mike Poole)
by Rui Ribeiro 24 May '14

24 May '14

Hi, No, you arent. Wheezy here too. Build your own debs. aptitude install libssl-dev quilt libtool libltdl3-dev libpam0g-dev libmysqlclient-dev libgdbm-dev libldap2-dev libsasl2-dev libiodbc2-dev libkrb5-dev libperl-dev libpcap-dev python-dev libsnmp-dev libpq-dev debhelper git clone git://git.freeradius.org/freeradius-server.git cd freeradius-server git fetch origin v2.x.x:v2.x.x git checkout v2.x.x cd .. fakeroot dpkg-buildpackage -b -uc sudo dpkg --force-confold --force-confdef -i freeradius_2.2.*git_*.deb freeradius-common_2.2.*git_*.deb freeradius-ldap_2.2.*git_*.deb freeradius-mysql_2.2.*git_*.deb freeradius-utils_2.2.*git_*.deb libfreeradius2_2.2.*git_*.deb Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 Message: 1 > Date: Fri, 23 May 2014 19:06:41 +0000 > From: Mike Poole <mpoole(a)pavlovmedia.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Subject: Package availability question > Message-ID: > <6712C775E82EB247807B5D7CCFBE940786B2358E(a)sula.pavlovmedia.corp> > Content-Type: text/plain; charset="us-ascii" > > Debian Wheezy would be greatly appreciated if possible. We are stuck at > 2.1.12 unless we can get an enterprise change to Ubuntu. > > > >

1 0