- Freeradius-Users - lists.freeradius.org

Re: eapol_test for EAP testing
by Stefan Winter 08 Nov '13

08 Nov '13

Hi, replying to this on -users. This is not a development question. > [eap] EAP NAK > [eap] NAK asked for unsupported type EAP-TTLS > [eap] No common EAP types found. Reading this in your debug output would have helped. You did not configure FreeRADIUS for EAP-TTLS - but that's the only thing eapol_test was told to use. FR's default_eap_type is also EAP-MD5, which is not what you want. Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

1 0

Re: chain certificate problem
by Theral Mackey 07 Nov '13

07 Nov '13

>> Concatenate your root and intermediates and use those. Beware of using a cert dir and the CA path as if done incorrectly then >someone could authenticate just by having a cert signed with the same root CA as your RADIUS server >> >> alan >> >Thank you for your answer, but it doesn't work. I don't see where you can declarate this certificate. >There is field CAfile, but it is related to the authentication of the client (EAP-TLS). Furthermore, if I use this field with all the >certificates concatenated, freeradius complains it is not readable. > >My question is: is it a way to deal with a chain other than load the full chain in the client ? This is really more of a general SSL question. The client will need to be able to somehow follow the cert chain from the cert back through the intermediaries to the CA. The easiest way is to concat them all into one file, in order (shouldn't matter but some programs are picky). When doing a cert concat, make sure you *ONLY* concat the cert itself, not the text info that is in some certs. Remove anything that is not between the -----BEGIN CERTIFICATE------ and -----END CERTIFICATE----- lines (the BEGIN and END lines themselves DO need to be in the result though), openssl will sometimes dump the cert info as text above the BEGIN line. Your eap.conf should have CA_file and certificate_file set to tell radius which ones to use for eap. -T

1 0

can't find new custom module (shared library object file)
by Bill Schoolfield 07 Nov '13

07 Nov '13

I built a customized version of the rlm_detail module. It was compiled externally against a version of freeradius built from source. The version I'm using is 2.1.12 as this version matches that of the installed YUM package for centos 6.x. On another centos host (same version, 64 bit etc), I installed the packaged version of FR (via yum). Then I copied the rlm_billmax.so to /usr/lib64/freeradius, placed the billmax configure file in the modules directory and added the billmax directive to the default site file (accounting section) and yet freeradius fails to load/find the library file. I have checked the file permissions so that isn't it. What am I missing? Here is the last part of the radiusd -X log: > Wed Nov 6 21:04:26 2013 : Debug: Module: Linked to module rlm_acct_unique > Wed Nov 6 21:04:26 2013 : Debug: Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique > Wed Nov 6 21:04:26 2013 : Debug: acct_unique { > Wed Nov 6 21:04:26 2013 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" > Wed Nov 6 21:04:26 2013 : Debug: } > Wed Nov 6 21:04:26 2013 : Debug: (Loaded rlm_files, checking if it's valid) > Wed Nov 6 21:04:26 2013 : Debug: Module: Linked to module rlm_files > Wed Nov 6 21:04:26 2013 : Debug: Module: Instantiating module "files" from file /etc/raddb/modules/files > Wed Nov 6 21:04:26 2013 : Debug: files { > Wed Nov 6 21:04:26 2013 : Debug: usersfile = "/etc/raddb/users" > Wed Nov 6 21:04:26 2013 : Debug: acctusersfile = "/etc/raddb/acct_users" > Wed Nov 6 21:04:26 2013 : Debug: preproxy_usersfile = "/etc/raddb/preproxy_users" > Wed Nov 6 21:04:26 2013 : Debug: compat = "no" > Wed Nov 6 21:04:26 2013 : Debug: } > Wed Nov 6 21:04:26 2013 : Debug: Module: Checking accounting {...} for more modules to load > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/modules/billmax[7]: Failed to link to module 'rlm_billmax': file not found > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/sites-enabled/default[384]: Failed to load module "billmax". > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/sites-enabled/default[378]: Errors parsing accounting section. The file: > [root@ip-10-0-0-65 freeradius]# ls -l /usr/lib64/freeradius/rlm_billmax.so > -rwxr-xr-x 1 root root 20193 Nov 6 20:55 /usr/lib64/freeradius/rlm_billmax.so Bill

5 12

question about radsec and FR3
by Alex Sharaz 07 Nov '13

07 Nov '13

Hi, Quick question about setting up radsec and FR3. When I was playing with RADSEC and Radiator, a permanent link was established between two radsec endpoints ( had radsec/ipv4 -> Ubuntu VM out in the cloud and then radsec/ipv6 -> Radiator on OS X machine at home). Should FR do this as well, or does it just establish a connection whenever it needs one? Had some sort of success with radsecproxy and FR3 but then FR3 complained about exceeding max client connections (>16) Rgds Alex

3 4

mschap passchange in Freeradius 3
by Davide Garofalo 07 Nov '13

07 Nov '13

Hi all, passchange works very fine, but in windows 7, if the user inserts an incorrect password it will promped the message "password incorrect". At this point if the user insert the correct password, in the radius log i've always this error: 9) mschap : Program returned code (1): Logon failure (0xc000006d) (9) mschap : External script failed (9) ERROR: mschap : External script says: Logon failure (0xc000006d) (9) mschap : FAILED: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject (9) MSCHAP-Error: �E=691 R=1j? Could not parse new challenge from MS-CHAP-Error: 2 MSCHAP Failure -- *Davide Garofalo*

3 7

Realm
by Wederson Rodrigues 07 Nov '13

07 Nov '13

Hi guys, I need to release the authentication (no username and password) for certain realm (anything @ domain1 connect with any username and password. domain2 users continue normally. Is it possible? -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

1 0

DHCP from LDAP
by Zeus Panchenko 07 Nov '13

07 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, is there way to serve DHCP queries from an LDAP database? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlJ7ZGAACgkQr3jpPg/3oyp1eQCgjWs5GG2sZvlxmi030iDQUBrz TNkAn04HnDnfZuYnUixieYnENY87+gsq =Kffc -----END PGP SIGNATURE-----

2 1

Radclient COA - sending Cisco non-AVpair attributes
by Steve Schubert 06 Nov '13

06 Nov '13

Hi, I'm trying to do an account-logon to a cisco ISG (aka NAS). I've created a file to carry the attributes. The file looks like this.. User-Name += "jane" Service-Type = Outbound-User cisco-command-code=01 cisco-avpair = "ssg-account-info=S10.174.168.2:294", Here's the command I sent. Radclient x f /home/admin/coa_file 10.172.168.6:3799 coa testing123 The debug from radclient doesn't show any errors. It shows Cisco-Command-Code = "01" Here's the debug from the cisco router. Nov 6 22:40:03.489: RADIUS/DECODE: Reply-Message fragments, 13, total 13 bytes Nov 6 22:43:43.542: RADIUS: COA received from id 164 10.194.170.150:43374, CoA Request, len 84 Nov 6 22:43:43.542: RADIUS/ENCODE(00000000):Orig. component type = Invalid Nov 6 22:43:43.542: RADIUS/ENCODE: Skip encoding 0 length AAA attribute formatted-clid Nov 6 22:43:43.543: RADIUS(00000000): sending Nov 6 22:43:43.543: RADIUS(00000000): Send CoA Nack Response to 10.194.170.150:43374 id 164, len 120 Nov 6 22:43:43.543: RADIUS: authenticator 00 37 CB 5E 01 05 D8 08 - 3F 8F EA 3D 09 88 E4 8F Nov 6 22:43:43.543: RADIUS: User-Name [1] 6 "jane" Nov 6 22:43:43.543: RADIUS: Service-Type [6] 6 Outbound [5] Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 29 Nov 6 22:43:43.543: RADIUS: Cisco AVpair [1] 23 "service-type=Outbound" Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 10 Nov 6 22:43:43.543: RADIUS: ssg-command-code [252] 4 Nov 6 22:43:43.543: RADIUS: 30 31 [Unknown 01] Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 25 Nov 6 22:43:43.543: RADIUS: ssg-account-info [250] 19 "S10.174.168.2:294" Nov 6 22:43:43.543: RADIUS: Reply-Message [18] 18 Nov 6 22:43:43.543: RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] Nov 6 22:43:43.543: RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405] As you can see it's translating the command code from decimal to hex. How do I specify the command code to be hex? (I've tried 0x01 but again it converts the ascii to hex) Also, is there documentation that explains the syntax to be used in the attribute file? Thanks, Steve

2 1

radsqlrelay: can't it just give up sometimes?
by Stefan Winter 06 Nov '13

06 Nov '13

Hello, I keep having issues now and then with radsqlrelay. Sometimes we get some accounting records which miss attributes or come with too unexpected values - the resulting SQL queries then sometimes are bogus. My last instance of this generated in radsqlrelay: Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 radsqlrelay keeps being excited over the query in question *forever* and retries to eternity. The query doesn't get any better over time though - it just makes the whole relaying process come to a grinding halt. Can't radqlrelay be a bit more clever about this, like try three times, and if the query is consistently rejected, save it to a ".reject" file and move on? I can't be the only one who falls into this, am I? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

6 10

framed-compression error
by Ufuk Eskici 06 Nov '13

06 Nov '13

Hello, I am configuring "framed-compression = NONE" but still getting response from free radius as "Framed-Compression = Van-Jacobson-TCP-IP". Why radius is sending this even I configure the opposite?

2 5