- Freeradius-Users - lists.freeradius.org

VMware View 5.1 smsotp authentication with multiple realms [WAS: Re: Yeah, it works !!]
by Thomas Glanzmann 28 Aug '12

28 Aug '12

Hello Joël, > jodan@otpradius:~/work/smsotpd$ ./pap_challenge_request.pl > Enter username: dsp1A00113 > Enter password: > server response type = Access-Challenge (11) > Enter otp: 89003 > server response type = Access-Accept (2) > Yeah, it works !! The step 1 is achieved :o) that is good to hear. > One more question, have you setup several realms? It will be my case, > and if you have some clues it must be a quick win. Yes, it will work with multiple realms. There is not much that you need to other than you need to use HINTS or any other way of rewriting in the radius server to rewrite the username to username@REALM. The REALM has to be written UPPERCASE otherwise it will not work. Once you have that achieved it will works if the radius server is able to resolve the ticket granting server for the REALM using DNS. You can use the following command to double check: apt-get install dnsutils dig _kerberos._udp.ww004.siemens.net srv # Exchange ww004.siemens.net with your REALM. In the DNS query the realm # can be lowercase because DNS is case insensitive. > So the test environnemnt is functional, and i will test it against > view 5.1 before the end of the week if my other tasks lets me quiet > ;o) Let me know. VMware View 5.1 has a bug in there you need to configure it with this option uncheck: Enforce 2-factor and Windows username matching. Otherwise if your username contains a backslash as in domain\username the View Client will not send the acces challenge reply. I opened a bugreport with VMware, they have accepted it but decided not to fix it. If you need help with VMware View let me know. Cheers, Thomas

1 0

Radius server failure
by Marko Eremija 28 Aug '12

28 Aug '12

Hi all! I had a problem with Radius server on Saturday, and after a lot of searching I have not found an appropriate answer on the Web. I will be submitting the log file that contains the problem that I have been working on. Aug 25 19:59:39 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 19:59:39 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 19:59:39 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:01:29 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:01:29 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:01:29 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:02:50 aai radiusd[12649]: Login incorrect (Home Server says so): [host/Lazar-PC] (from client cisco5508-L port 1 cli 00-22-5f-b8-c7-29) Aug 25 20:02:57 aai radiusd[12649]: Login incorrect (Home Server says so): [Lazar-PC\\Lazar] (from client cisco5508-L port 1 cli 00-22-5f-b8-c7-29) Aug 25 20:03:11 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:03:11 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:03:11 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:04:07 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:04:07 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:04:07 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:04:18 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:04:18 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:04:18 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:04:44 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:04:44 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:04:44 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:06:38 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:06:38 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:06:38 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:07:41 aai radiusd[12649]: Login OK: [rv070182d(a)etf.bg.ac.rs] (from client cisco5508-L port 1 cli 64-a7-69-b0-9a-bb) Aug 25 20:08:02 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:08:02 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:08:02 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:08:17 aai radiusd[12649]: Login OK: [anonymous(a)bfspc.bg.ac.rs] (from client cisco5508-L port 1 cli 60-d8-19-50-19-85) Aug 25 20:08:58 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:08:58 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:08:58 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:09:14 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:09:14 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:09:14 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:09:41 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:09:41 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:09:41 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:10:27 aai radiusd[12649]: Login OK: [anonimous(a)pharmacy.bg.ac.rs] (from client cisco5508-L port 1 cli 94-71-ac-51-f9-37) Aug 25 20:11:36 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:11:36 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:11:36 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:13:08 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:13:08 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:13:08 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:13:58 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:13:58 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:13:58 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:14:14 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:14:14 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:14:14 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:14:41 aai radiusd[12649]: TLS_accept: error in SSLv3 write finished A Aug 25 20:14:41 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:14:41 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:15:57 aai radiusd[12649]: Login OK: [mn11s2r(a)leeds.ac.uk] (from client cisco5508-R port 1 cli cc-08-e0-ab-fd-c7) Aug 25 20:16:01 aai radiusd[12649]: Login OK: [mn11s2r(a)leeds.ac.uk] (from client cisco5508-R port 1 cli cc-08-e0-ab-fd-c7) Aug 25 20:16:31 aai radiusd[12649]: TLS Alert write:fatal:decompression failure Aug 25 20:16:31 aai radiusd[12649]: rlm_eap: SSL error error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression Aug 25 20:16:31 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:18:07 aai radiusd[12649]: TLS Alert write:fatal:decompression failure Aug 25 20:18:07 aai radiusd[12649]: rlm_eap: SSL error error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression Aug 25 20:18:07 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:18:31 aai radiusd[12649]: Login OK: [ds100432d(a)etf.bg.ac.rs] (from client cisco5508-L port 1 cli a0-0b-ba-c7-9b-04) Aug 25 20:19:03 aai radiusd[12649]: rlm_eap: SSL error error:140D1041:SSL routines:TLS1_CHANGE_CIPHER_STATE:malloc failure Aug 25 20:19:03 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:19:17 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:19:17 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:19:44 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:19:44 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:21:37 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:21:37 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:23:05 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:23:05 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:24:00 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:24:00 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:24:15 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:24:15 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:24:43 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:24:43 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:24:45 aai radiusd[12649]: Login OK: [ds100432d(a)etf.bg.ac.rs] (from client cisco5508-L port 1 cli a0-0b-ba-c7-9b-04) Aug 25 20:26:02 aai radiusd[12649]: Login OK: [ds100432d(a)etf.bg.ac.rs] (from client cisco5508-L port 1 cli a0-0b-ba-c7-9b-04) Aug 25 20:26:36 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:26:36 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:27:41 aai radiusd[12649]: Login OK: [anonymous(a)bfspc.bg.ac.rs] (from client cisco5508-L port 1 cli c8-7b-5b-36-96-c7) Aug 25 20:27:54 aai radiusd[12649]: Login OK: [anonymous(a)bfspc.bg.ac.rs] (from client cisco5508-L port 1 cli 48-5d-60-d1-78-b3) Aug 25 20:28:08 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:28:08 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:28:59 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:28:59 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:29:13 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:29:13 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:29:40 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:29:40 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:31:32 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:31:32 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:33:11 aai radiusd[12649]: rlm_eap: SSL error error:140D108E:SSL routines:TLS1_CHANGE_CIPHER_STATE:compression library error Aug 25 20:33:11 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:34:11 aai radiusd[12649]: TLS_accept: error in before/accept initialization Aug 25 20:34:11 aai radiusd[12649]: rlm_eap: SSL error error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure Aug 25 20:34:11 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:34:38 aai radiusd[12649]: TLS_accept: error in before/accept initialization Aug 25 20:34:38 aai radiusd[12649]: rlm_eap: SSL error error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure Aug 25 20:34:38 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:35:59 aai radiusd[12649]: Login incorrect (Home Server says so): [host/Lazar-PC] (from client cisco5508-L port 1 cli 00-22-5f-b8-c7-29) Aug 25 20:36:06 aai radiusd[12649]: Login incorrect (Home Server says so): [Lazar-PC\\Lazar] (from client cisco5508-L port 1 cli 00-22-5f-b8-c7-29) Aug 25 20:36:33 aai radiusd[12649]: TLS_accept: error in before/accept initialization Aug 25 20:36:33 aai radiusd[12649]: rlm_eap: SSL error error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure Aug 25 20:36:33 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:38:07 aai radiusd[12649]: TLS_accept: error in before/accept initialization Aug 25 20:38:07 aai radiusd[12649]: rlm_eap: SSL error error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure Aug 25 20:38:07 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:39:02 aai radiusd[12649]: TLS_accept: error in before/accept initialization Aug 25 20:39:02 aai radiusd[12649]: rlm_eap: SSL error error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure Aug 25 20:39:02 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:39:17 aai radiusd[12649]: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Aug 25 20:39:17 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:39:44 aai radiusd[12649]: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Aug 25 20:39:44 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:41:37 aai radiusd[12649]: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Aug 25 20:41:37 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:42:34 aai radiusd[12649]: Login OK: [anonymous(a)bfspc.bg.ac.rs] (from client cisco5508-L port 1 cli 00-25-d3-63-af-a7) Aug 25 20:42:50 aai radiusd[12649]: Login OK: [anonymous(a)bfspc.bg.ac.rs] (from client cisco5508-L port 1 cli 48-5d-60-d1-78-b3) Aug 25 20:43:04 aai radiusd[12649]: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Aug 25 20:43:04 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. Aug 25 20:44:00 aai radiusd[12649]: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Aug 25 20:44:00 aai radiusd[12649]: SSL: SSL_read failed in a system call (-1), TLS session fails. One thing I noticed is that the server did accept connection requests during the time of the problem. I found some answers but just wanted to see If anyone else had the same problem. I read that it can be a memory allocation issue, but just wanted to confirm. Also, I would like to know what could be done to solve this problem? Thanks and best regards to all, Marko

2 2

brief window of opportunity to log in via windows
by Brian Gold 28 Aug '12

28 Aug '12

Hi all, I've got freeradius 2.1.10 running PEAP/MS-CHAP. Everything seems to be working fine, but we've noticed a bit of an issue with our Windows clients. It seems that after selecting our SSID for the first time, they are prompted for their username & password. Once those are entered they get a prompt to accept our certificate and then they are in. It seems though that they must enter their username & password fairly quickly. If they don't enter them within about 30 seconds, the connection times out and they have to start over again. Is there something on the radius end of things that I can do to adjust this timeout? Brian Gold System Administrator Bard College at Simon's Rock

2 1

Postpaid configuration for all
by Murat K 28 Aug '12

28 Aug '12

> Dear All, > > I have all my users postpaid. How can I configure freeradius that all of them are postpaid? I heard there is a centralbase parameter that should be postpaid but I could not find how to do it. > > Best regards, > Murat > > "May the Force be with you." > Han Solo (Star Wars)

3 5

Users on the multiple APs
by Dagia Dorjsuren 28 Aug '12

28 Aug '12

Hello, Does anyone know that how to configure the wifi chillispot users by each NAS? For example : There are "testuser" wifi chillispot user and three Wifi zones which are AP1, AP2 and AP3. That AP{1-2} are nas-identifier. AP1 has 10.10.10.1, AP2 has 10.10.10.2 and AP3 has 10.10.10.3 ip address. That "testuser" must be available for AP1 and AP2 wifi zones. But, that user must be unavailable for AP3 wifi zone. How will do it?

3 5

Reg: GGSN support NAS and Freeradius.
by Malla Reddy Sama 27 Aug '12

27 Aug '12

Dear, I need clearification on freeradius and NAS (Coovachilli) with GGSN. It is possible to connect the NAS and FR to GGSN, NAS contact the FR through GGSN and NAS in between the internet and GGSN. I have some doubt especially on whether GGSN supports Coovachilli or not..? Please clearifiy my doubt .. Thanks & Best Regards, Malla.

1 0

Re: Radius "MONITOR" option
by Alan Buxey 25 Aug '12

25 Aug '12

Ask them when they are going to implement status-server Alan

1 0

Radius "MONITOR" option
by Ethan Whitt 25 Aug '12

25 Aug '12

Hello, I am being asked by my server load balancing vendor to send a "MONITOR" health-check, which should respond with "MONITOR" back. Does anyone know if Free Radius supports this option/ability? Regards, Ethan

4 5

redundant load balancing and mschap
by McNutt, Justin M. 25 Aug '12

25 Aug '12

Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one listed in /etc/samba/smb.conf (which may be a coincidence). I set up several mschap instances like so: mschap mschap1 { ... ntlm_auth -s /etc/samba/radius.smb1.conf } mschap mschap2 { ... ntlm_auth -s /etc/samba/radius.smb2.conf } mschap mschap3 { ... ntlm_auth -s /etc/samba/radius.smb3.conf } I also disabled all PAP, CHAP, and references to "mschap" in all virtual servers listed in sites-enabled. There is currently no "mschap { ... }" section in modules/mschap. Added this to sites-enabled/campus-inner-tunnel where "mschap" was before: redundant-load-balance { mschap1 mschap2 mschap3 } Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2"). Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers. (1 and 3 aren't failing. They just aren't *tried*.) Am I going about this all the wrong way? Is this a known limitation in Samba? Is there something about ntlm_auth that always references /etc/samba/smb.conf, regardless of the -s option? Comments and criticisms welcome. --J

4 7

Re: non-blocking radius client
by Alan DeKok 24 Aug '12

24 Aug '12

al so wrote: > you will pay the price for sure.. Threats are rude. You've not only been banned from the list, but your threats are now on permanent record in the list archives. Anyone wanting to know who you really are just has to search for your email address. > On Fri, Aug 24, 2012 at 12:50 PM, al so <volkswak(a)gmail.com > <mailto:volkswak@gmail.com>> wrote: > > just go eat some shit > > > On Fri, Aug 24, 2012 at 12:49 PM, Alan DeKok > <aland(a)deployingradius.com <mailto:aland@deployingradius.com>> wrote: > > al so wrote: > > looks like you need to find some decent job.. > > Congratulations. You've been unsubscribed from the > freeradius-users > list. You've also been banned from every subscribing again. > > Alan DeKok. > > >

1 0