- Freeradius-Users - lists.freeradius.org

Reject all calls from one or more Calling Station ID regardless of username or password
by Henrik Karlsson 21 Nov '12

21 Nov '12

Hi guys, I am a quite new user of the Free Radius Server and i have a problem. I have an old Dial In system. I want to reject all calls from one or more Calling Station ID regardless of username or password. I have tried to edit the user file like this USERNAME Calling-Station-Id == 404402704, Auth-Type := Reject The line a bow is based on the username and that is not what I want, I want that all users from Callingstation ID 404402704 shall be rejected. Have you guys got some suggestion how to solve my problem? /Henrik

2 1

EAP-TLS error: RSA_padding_check_PKCS1_type_1:block type is not 01
by Swaraj 21 Nov '12

21 Nov '12

>> I'm using Freeradius server2.1.12 on x86 fedora14. My client is using >> (armel ubuntu 10.04 lucid) IMX53 board. When I try connecting to radius >> server I am receiving the following errors. > The client is broken. It's not doing SSL correctly. > >> Do we require different certificates for arm boards, as I was able to >> run without any issues on x86 with same certificates. > Because it has different software. May I know, what is that different software? >> Tue Nov 20 16:48:05 2012 : Error: TLS Alert write:fatal:decrypt error >> Tue Nov 20 16:48:05 2012 : Error: TLS_accept: failed in SSLv3 read >> certificate verify B >> Tue Nov 20 16:48:05 2012 : Error: rlm_eap: SSL error error:0407006A:rsa >> routines:RSA_padding_check_PKCS1_type_1:block type is not 01 > You CANNOT fix this by poking FreeRADIUS. > >> I created certificates with the following commands: > This is NOT a certificate issue. Notice that the error is NOT > complaining about certificates. > > And why use your own commands to create certs? The scripts in > raddb/certs WORK. > > Alan DeKok. > Regards, Swaraj

1 0

Statistics on EAP methods widely used
by Panagiotis Georgopoulos 20 Nov '12

20 Nov '12

Hello all, I apologize for the "spam" but I thought that you would be able to give me a couple of pointers on the following. I am trying to find some statistics on what is the most commonly deployed/used EAP method using FreeRadius (or RADIUS in general). There are many claims that, for example, EAP-TLS and EAP-TTLS are most commonly used (and secure) but these are never backed up by any survey/references. Any pointers? Thanks a lot, Panos

6 19

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

Re: Received invalid reply digest from RADIUS server on FreeSwitch server
by Alan DeKok 20 Nov '12

20 Nov '12

Ankur - BillCall wrote: > I have setup FreeRADIUS server(Version:2.1.12 x86_64, Release : 4.el5_8, > Backend : MySQL ) and FreeSwitch server as SIP server (Both server are > on VM environment). Upgrade to 2.2.0. > Nov 20 15:49:29 FreeSwitch-BC-Test freeswitch: rc_check_reply: received > invalid reply digest from RADIUS server The shared secret is wrong. Or, freeswith is vroken. > Also using wireshark I am getting Access-Accept UDP package on FS but it > shows invalid reply digest. Then the shared secret is wrong. FreeRADIUS calculates the correct reply digest, if the shared secret is correct. Alan DeKok.

1 0

Received invalid reply digest from RADIUS server on FreeSwitch server
by Ankur - BillCall 20 Nov '12

20 Nov '12

Dear All, I have setup FreeRADIUS server(Version:2.1.12 x86_64, Release : 4.el5_8, Backend : MySQL ) and FreeSwitch server as SIP server (Both server are on VM environment). I am getting below error on FreeSwitch (it uses FreeRadius-Client library ) after handling approx 250 request. It will not taking more calls after approx 250 calls on FreeSwitch as it gives RADIUS Auth Failed in FS logs. Nov 20 15:49:29 FreeSwitch-BC-Test freeswitch: rc_check_reply: received invalid reply digest from RADIUS server Nov 20 15:49:33 FreeSwitch-BC-Test freeswitch: rc_send_server: no reply from RADIUS server radiusserver:1813, 192.168.15.111 Nov 20 15:49:33 FreeSwitch-BC-Test freeswitch: rc_check_reply: received invalid reply digest from RADIUS server In FS logs, I can see Access-Accept in reply for failed call on FS. Also using wireshark I am getting Access-Accept UDP package on FS but it shows invalid reply digest. Is it issue from FreeRADIUS-Client or FreeRADIUS or issue of mis-configuration? Please help. Thanks and Regards, Ankur Kalavadia Software Engineer <http://www.billcall.net/> Billcall Inc. <http://maps.google.com/maps?q=8002%2C+Kewgarden+Rd.%2CSuite+1040%2CKew+Gard en%2CNew+York+11415%2CUSA&hl=en> 8002, Kew Garden Rd. Suite 1040 Kew Garden, New York 11415 USA <http://www.linkedin.com/e/jsc/Bankai+Group/> We're hiring! Description: Description: Description: C:\Users\Bankim\Documents\linkedin_files\pic_plastic_slate_26x130.gif India No.: +91-8238002749 +91-9909428658 Email: <mailto:ankur.kalavadia@billcall.net> ankur.kalavadia(a)billcall.net SkyPe: ankur.billcall LinkedIn : in.linkedin.com/in/ankurkalavadia <http://www.billcall.net/> Description: Description: Description: C:\Users\Bankim\Documents\linkedin_files\bankai_group.jpg

1 0

EAP-TLS error: RSA_padding_check_PKCS1_type_1:block type is not 01
by Swaraj 20 Nov '12

20 Nov '12

Hi All, I'm using Freeradius server2.1.12 on x86 fedora14. My client is using (armel ubuntu 10.04 lucid) IMX53 board. When I try connecting to radius server I am receiving the following errors. Do we require different certificates for arm boards, as I was able to run without any issues on x86 with same certificates. openssl version is 0.98g (on arm board) openssl version is 1.0.0a-fips (on x86 free radius server 2.1.12) /*ERROR: ----------- */ rad_recv: Access-Request packet from host 10.0.0.70 port 2050, id=8, length=166 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Called-Station-Id = "68-7F-74-64-0A-AA:linksys" Calling-Station-Id = "00-23-A7-3B-29-2C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020300060d00 State = 0xba89e950b88ae454eff4b9964b6ca194 Message-Authenticator = 0x3f69e77da835e1450b33224899e816b2 Tue Nov 20 16:48:05 2012 : Info: # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf Tue Nov 20 16:48:05 2012 : Info: +- entering group authorize {...} Tue Nov 20 16:48:05 2012 : Info: ++[preprocess] returns ok Tue Nov 20 16:48:05 2012 : Info: ++[chap] returns noop Tue Nov 20 16:48:05 2012 : Info: ++[mschap] returns noop Tue Nov 20 16:48:05 2012 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Tue Nov 20 16:48:05 2012 : Info: [suffix] No such realm "NULL" Tue Nov 20 16:48:05 2012 : Info: ++[suffix] returns noop Tue Nov 20 16:48:05 2012 : Info: [eap] EAP packet type response id 3 length 6 Tue Nov 20 16:48:05 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns updated Tue Nov 20 16:48:05 2012 : Info: [files] users: Matched entry testuser at line 131 Tue Nov 20 16:48:05 2012 : Info: ++[files] returns ok Tue Nov 20 16:48:05 2012 : Info: Found Auth-Type = EAP Tue Nov 20 16:48:05 2012 : Info: # Executing group from file /usr/local/etc/raddb/radiusd.conf Tue Nov 20 16:48:05 2012 : Info: +- entering group authenticate {...} Tue Nov 20 16:48:05 2012 : Info: [eap] Request found, released from the list Tue Nov 20 16:48:05 2012 : Info: [eap] EAP/tls Tue Nov 20 16:48:05 2012 : Info: [eap] processing type tls Tue Nov 20 16:48:05 2012 : Info: [tls] Authenticate Tue Nov 20 16:48:05 2012 : Info: [tls] processing EAP-TLS Tue Nov 20 16:48:05 2012 : Info: [tls] Received TLS ACK Tue Nov 20 16:48:05 2012 : Info: [tls] ACK handshake fragment handler Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_verify returned 1 Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_process returned 13 Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.0.70 port 2050 EAP-Message = 0x0104020d0d80000005f9bd300c0603551d13040530030101ff301d0603551d0e04160414b3807b965fdd9f8fee8fca751d47bf2aebac11fd30818d0603551d230481853081828014b3807b965fdd9f8fee8fca751d47bf2aebac11fda15fa45d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161820900958dbc5fc22a1e39300d06092a864886f70d010104050003818100a8e4f602c2235087e8a8e93f610ce12e5e3e6a54103b1dccc56529aab99cc32649af EAP-Message = 0x88b6fb15bdb71452ca8657933581fd72e30615d551ba01f76475e2809c53ca6c798138de31621f62e3644e3f847199de6a1a00ce71c631e200b4cf2747a9714a7bb778fec35669dd1c63102371576fc66ec5bbdf2c9f4fd956782216a10b16030100ad0d0000a502010200a0003f303d310b3009060355040613026161310a30080603550408130161310a3008060355040a130161310a3008060355040b130161310a30080603550403130161005d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613 EAP-Message = 0x026161310a300806035504031301610e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xba89e950b98de454eff4b9964b6ca194 Tue Nov 20 16:48:05 2012 : Info: Finished request 8. Tue Nov 20 16:48:05 2012 : Debug: Going to the next request Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.5 seconds. rad_recv: Access-Request packet from host 10.0.0.70 port 2050, id=9, length=1287 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Called-Station-Id = "68-7F-74-64-0A-AA:linksys" Calling-Station-Id = "00-23-A7-3B-29-2C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0204045f0d0016030103030b0002ff0002fc0002f9308202f53082025ea003020102020900958dbc5fc22a1e39300d06092a864886f70d0101040500305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161301e170d3132313132303037323635345a170d3133313132303037323635345a305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161 EAP-Message = 0x310b3009060355040613026161310a3008060355040313016130819f300d06092a864886f70d010101050003818d0030818902818100c540ed9194e10dff976f8c5633f0a189b4fd92029fd865cb7d955134b15f837c2000b6a3637d3305d93c9bc78808b351d4639c51f4b4a4e10210fd9bb5b598af417e2eda12167a653844b7b84429ae3b60908553113a9c654ee2e4df1357c096e731713d5737f82a374c3ca853596e44504f907fea3920d343ca7904e7fef8190203010001a381c03081bd300c0603551d13040530030101ff301d0603551d0e04160414b3807b965fdd9f8fee8fca751d47bf2aebac11fd30818d0603551d2304818530818280 EAP-Message = 0x14b3807b965fdd9f8fee8fca751d47bf2aebac11fda15fa45d305b310a3008060355040a130161310a3008060355040b1301613110300e06092a864886f70d010901160161310a30080603550407130161310a30080603550408130161310b3009060355040613026161310a30080603550403130161820900958dbc5fc22a1e39300d06092a864886f70d010104050003818100a8e4f602c2235087e8a8e93f610ce12e5e3e6a54103b1dccc56529aab99cc32649af88b6fb15bdb71452ca8657933581fd72e30615d551ba01f76475e2809c53ca6c798138de31621f62e3644e3f847199de6a1a00ce71c631e200b4cf2747a9714a7bb778fec35669 EAP-Message = 0xdd1c63102371576fc66ec5bbdf2c9f4fd956782216a10b16030100861000008200808f6734075327889217defd03c1462e4298d446341f95825d3d31df536c87ed3aa4959c0e34841d5e733c27c4b106529a8c6dc2f0ae48b83d1c83c2bc57731bd41a0716eac597d5b6e7143ca8e7b1036c3d7d84463a80c575b3a37ad37053a389a8f30a94a395105a62b18ac8f263fbe48f8e050533c1f77fa8e2467c25a606e216030100860f00008200803d2ea04829dfd6dccbec15de9fdcae6f0fffb862e69a110d172eda2d8c69baaf4e4b9627f4c88abd8875e7d54b0eb8d66f597f290d1bf381c1ca0a2a7e8fb430a74fcaf0dae9b23537a41d1ab9bff2fb EAP-Message = 0x1849da1f7906027ca97729405b53eda8680767a719962059a67cd451dc8f1bd30d4cec89234ea9c408d13fb4c2c0c6bc1403010001011603010030b8b9b7a2f1fcb703eca33336508b26fa17344530ab8cc6f48edbf0210a6ddad56fcc0d9b9e7ebed01f532216f6dda1e7 State = 0xba89e950b98de454eff4b9964b6ca194 Message-Authenticator = 0x07338a39dd069d06794136bf8f63b62f Tue Nov 20 16:48:05 2012 : Info: # Executing section authorize from file /usr/local/etc/raddb/radiusd.conf Tue Nov 20 16:48:05 2012 : Info: +- entering group authorize {...} Tue Nov 20 16:48:05 2012 : Info: ++[preprocess] returns ok Tue Nov 20 16:48:05 2012 : Info: ++[chap] returns noop Tue Nov 20 16:48:05 2012 : Info: ++[mschap] returns noop Tue Nov 20 16:48:05 2012 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Tue Nov 20 16:48:05 2012 : Info: [suffix] No such realm "NULL" Tue Nov 20 16:48:05 2012 : Info: ++[suffix] returns noop Tue Nov 20 16:48:05 2012 : Info: [eap] EAP packet type response id 4 length 253 Tue Nov 20 16:48:05 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns updated Tue Nov 20 16:48:05 2012 : Info: [files] users: Matched entry testuser at line 131 Tue Nov 20 16:48:05 2012 : Info: ++[files] returns ok Tue Nov 20 16:48:05 2012 : Info: Found Auth-Type = EAP Tue Nov 20 16:48:05 2012 : Info: # Executing group from file /usr/local/etc/raddb/radiusd.conf Tue Nov 20 16:48:05 2012 : Info: +- entering group authenticate {...} Tue Nov 20 16:48:05 2012 : Info: [eap] Request found, released from the list Tue Nov 20 16:48:05 2012 : Info: [eap] EAP/tls Tue Nov 20 16:48:05 2012 : Info: [eap] processing type tls Tue Nov 20 16:48:05 2012 : Info: [tls] Authenticate Tue Nov 20 16:48:05 2012 : Info: [tls] processing EAP-TLS Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_verify returned 7 Tue Nov 20 16:48:05 2012 : Info: [tls] Done initial handshake Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0 Handshake [length 0303], Certificate Tue Nov 20 16:48:05 2012 : Info: [tls] chain-depth=0, Tue Nov 20 16:48:05 2012 : Info: [tls] error=0 Tue Nov 20 16:48:05 2012 : Info: [tls] --> User-Name = testuser Tue Nov 20 16:48:05 2012 : Info: [tls] --> BUF-Name = a Tue Nov 20 16:48:05 2012 : Info: [tls] --> subject = /O=a/OU=a/emailAddress=a/L=a/ST=a/C=aa/CN=a Tue Nov 20 16:48:05 2012 : Info: [tls] --> issuer = /O=a/OU=a/emailAddress=a/L=a/ST=a/C=aa/CN=a Tue Nov 20 16:48:05 2012 : Info: [tls] --> verify return:1 /*Tue Nov 20 16:48:05 2012 : Info: [tls] TLS_accept: SSLv3 read client certificate A Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Tue Nov 20 16:48:05 2012 : Info: [tls] TLS_accept: SSLv3 read client key exchange A Tue Nov 20 16:48:05 2012 : Info: [tls] <<< TLS 1.0 Handshake [length 0086], CertificateVerify Tue Nov 20 16:48:05 2012 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error Tue Nov 20 16:48:05 2012 : Error: TLS Alert write:fatal:decrypt error Tue Nov 20 16:48:05 2012 : Error: TLS_accept: failed in SSLv3 read certificate verify B Tue Nov 20 16:48:05 2012 : Error: rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01 Tue Nov 20 16:48:05 2012 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Tue Nov 20 16:48:05 2012 : Debug: TLS receive handshake failed during operation */Tue Nov 20 16:48:05 2012 : Info: [tls] eaptls_process returned 4 Tue Nov 20 16:48:05 2012 : Info: [eap] Handler failed in EAP/tls Tue Nov 20 16:48:05 2012 : Info: [eap] Failed in EAP select Tue Nov 20 16:48:05 2012 : Info: ++[eap] returns invalid Tue Nov 20 16:48:05 2012 : Info: Failed to authenticate the user. Tue Nov 20 16:48:05 2012 : Info: Delaying reject of request 9 for 1 seconds Tue Nov 20 16:48:05 2012 : Debug: Going to the next request Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.3 seconds. Tue Nov 20 16:48:05 2012 : Info: Cleaning up request 4 ID 4 with timestamp +1948 Tue Nov 20 16:48:05 2012 : Debug: Waking up in 0.6 seconds. Tue Nov 20 16:48:06 2012 : Info: Sending delayed reject for request 9 Sending Access-Reject of id 9 to 10.0.0.70 port 2050 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Nov 20 16:48:06 2012 : Debug: Waking up in 3.7 seconds. Tue Nov 20 16:48:10 2012 : Info: Cleaning up request 5 ID 5 with timestamp +1954 I created certificates with the following commands: -------------------------------------------------------------------- /* CA root */ */openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf /* /* Certificates Request */ /*openssl req -new -nodes -out redpine-req.pem -keyout private/redpine-key.pem -days 365 -config ./openssl.cnf */ /* Signing the certificates with ca root certificate generated in section CA root */ /*openssl ca -out redpine-cert.pem -days 365 -config ./openssl.cnf -infiles redpine-req.pem */ /Concatenating all certificates: * cat redpine-key.pem redpine-cert.pem cacert.pem > imx53.pem */Thanks & Regards, Swaraj /* */

3 3

Change Simultaneous-Use default value
by Dmitry Korzhevin 20 Nov '12

20 Nov '12

Hello, How to change default Simultaneous-Use "0" (default) value without using user groups? So, all current users and new, that will be created - will have for example 2 allowed connections? Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 1

Re: Statistics on EAP methods widely used
by Alan Buxey 20 Nov '12

20 Nov '12

From my own experience PEAP (aka PEAPv0/mschapv2) is the most common EAP method in use (probably due to it being supported in most clients and backend authentication systems) alan

3 2

Novice Question
by Tzvika Gelber 20 Nov '12

20 Nov '12

I got this Answer today about my mail and it's great Subject: Re: FreeRadius Novice problems Message-ID: <201211192148.49496.misch(a)schwartzkopff.org> Content-Type: text/plain; charset="utf-8" > Hello, > (...) > 1. How do I create users that have a specific vlan attached to them > (say user2 will always associate Vlan2 when connected), user1 is untagged > so it's vlan1, user2 is attached to vlan2 and so on and so on. Normally your assign the VLAN with the attributes Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-id = 2 This info will help me but I forgot to ask where do add this info? to /etc/freeradius/users ? what file do i need to edit to enable the Vlan support per username? The reason for my question is that when i added this info the users file the freeradius service could not start. Since this is a closed system that has no external access it's ok to share this info. alpha_lab@alpha-radius135:~$ sudo /etc/init.d/freeradius stop * Stopping FreeRADIUS daemon freeradius ...done. alpha_lab@alpha-radius135:~$ sudo nano /etc/freeradius/users radius1 Cleartext-Password := "radius1" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "1" # On no match, the user is denied access. alpha_lab@alpha-radius135:~$ alpha_lab@alpha-radius135:~$ alpha_lab@alpha-radius135:~$ alpha_lab@alpha-radius135:~$ *alpha_lab@alpha-radius135:~$ sudo /etc/init.d/freeradius start * Starting FreeRADIUS daemon freeradius ...fail! *alpha_lab@alpha-radius135:~$ alpha_lab@alpha-radius135:~$ when i remove the tunnel commands from the username i can restart the freeradius. Where do i error?? Thank you -- ____ Sometimes you just glow in the dark...

2 1