- Freeradius-Users - lists.freeradius.org

how to set h323-credit-amount
by Varun Agrawal 30 May '12

30 May '12

1 0

more EAP/TTLS trouble
by Steve Hopps 30 May '12

30 May '12

The only computer in our office which causes certificate errors is a Windows 7 machine. So I attempted to connect using EAP/TTLS and MSCHAPv2 using my linux machine and my Android phone. Now I get a different error. I also tried using PEAP on my Android phone, and received no certificate errors. What could the windows machine be doing different? Why does the machine even enter the picture when the authentication is between the Access Point and the server? Below is the portion of the log which shows the rejection, when using my Android phone, TTLS and MSCHAPv2 (that is what Windows uses isnt it?) Where I am confused is near the bottom, what is causing the rejection? ++[pam] returns invalid or [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid log follows---- server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 222 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = PAM # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} rlm_pam: Attribute "User-Password" is required for authentication. ++[pam] returns invalid Failed to authenticate the user. Login incorrect: [test] (from client -REMOVED- port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [test] (from client -REMOVED- port 0 cli B4-07-F9-F2-99-F6) Using Post-Auth-Type Reject

6 14

RE: more EAP/TTLS trouble
by Aman Arneja 30 May '12

30 May '12

Hi Steve Microsoft supports EAP TTLS in our upcoming is release of Windows 8 . That said PEAP MSChapv2 is as modern as an EAP TTLS and is a very widely and simply deployed method. I have personally used the freeradius peap mschapv2 pretty much out of the box. As far as the certificate error you saw earlier that was due to the nature of design of a modern secure authentication method which gave supported security feature like Server Certificate Validation enabled by default. If you just go through the net you will find tonnes of peap mschapv2 working eap.conf's and I suggest you compare yours to the ones available for the authentication to work. Also if you are looking for ttls only you can test with the beta of windows 8 and become one of our early adopters when it releases. Thanx and Regards Aman Arneja Sent from my Windows Phone ------------------------------ From: Steve Hopps Sent: 5/30/2012 6:23 PM To: FreeRadius users mailing list Subject: Re: more EAP/TTLS trouble We're trying to use an access point configured for wpa2 using freeradius to authenticate with openldap. For Android and Linux it works out of the box with eap/ttls and pap. So we used Pam cause it already works with ldap. I didn't know other encryption types wouldn't work with Pam. IPhones work with a custom config profile that's easily installed. However, our most significant hurdle is windows machines. Who would have guessed??? For some stupid reason Microsoft doesn't care about supporting all modern encryption standards. Making our staff pay for SecureW2 isn't an option and XSupplicant doesn't work reliably yet in 64bit Win7. So I'm back to trying to get mschapv2 working with peap. This seems impossible. On May 30, 2012 2:43 AM, "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: > On 05/29/2012 10:28 PM, Steve Hopps wrote: > > So I'm confused, what's the right way to handle this situation? >> > > What situation? > > What are you trying to do? > > Alan has already hinted at the issue, but basically see here: > > http://deployingradius.com/**documents/protocols/oracles.**html<http://deployingradius.com/documents/protocols/oracles.html> > > ...and here: > > http://deployingradius.com/**documents/protocols/**compatibility.html<http://deployingradius.com/documents/protocols/compatibility.html> > > Whatever protocol you are running within TTLS, it's not PAP therefore not > compatible with PAM-as-an-oracle. > > rlm_pam: Attribute "User-Password" is required for authentication. > ++[pam] returns invalid > > PAM is being forced (I think) here: > > [files] users: Matched entry DEFAULT at line 222 > > ...fix that line. Don't force PAM if you don't want or need it, and if you > want/need it, pick compatible authentication. > > The Proxy-To-Realm comments in the default config files might be out of > date; in general, obey what the debug says over ANY other advice, because > it's coming from the actual code. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/** > list/users.html <http://www.freeradius.org/list/users.html> >

1 0

FreeRadius autoreply the access chanllenge
by sam 30 May '12

30 May '12

I setup the pam_radius_auth.so in pam.d/sshd to verify the user using the remote Radius server. As the protocol, When used in an Access-Challenge, it MAY indicate a dialog message to prompt the user for a response. like following flow 1) server sends the access-challenge message with reply-message YOUR PASSWORD HAS EXPIRED. PLEASE ENTER THE NEW PASSWORD 2) client sedns back the access-Request message. 3) server sends another access-challenge message with reply-message PLEASE RE-ENTER THE NEW PASSWORD AGAIN FOR VERIFICATION 4) client sedns back the access-Request message again. I think the message flow is right, but at the point-2 and point-4, the prompt should be popped and ask us to input the passwd. However, our freeradius sends the access-Request automatically. Just checked the code, and not find the problem when doing access-chanllenge. the function rad_converse() calls pam_get_item(). I think it is only place to suspect, can this function pop the prompt? anyone encounter this problem? /* It's full challenge-response, we should have echo on */ retval = rad_converse(pamh, PAM_PROMPT_ECHO_OFF, challenge, &resp2challenge); +++processing access-chanllenge code+++ while (response->code == PW_ACCESS_CHALLENGE) { attribute_t *a_state, *a_reply; char challenge[BUFFER_SIZE]; /* Now we do a bit more work: challenge the user, and get a response */ if (((a_state = find_attribute(response, PW_STATE)) == NULL) || ((a_reply = find_attribute(response, PW_REPLY_MESSAGE)) == NULL)) { /* Actually, State isn't required. */ _pam_log(LOG_ERR, "RADIUS Access-Challenge received with State or Reply-Message missing"); retval = PAM_AUTHINFO_UNAVAIL; goto error; } /* * Security fixes. */ if ((a_state->length <= 2) || (a_reply->length <= 2)) { _pam_log(LOG_ERR, "RADIUS Access-Challenge received with invalid State or Reply-Message"); retval = PAM_AUTHINFO_UNAVAIL; goto error; } memcpy(challenge, a_reply->data, a_reply->length - 2); challenge[a_reply->length - 2] = 0; DPRINT(LOG_DEBUG, "Got Prompt=%s",challenge); /* It's full challenge-response, we should have echo on */ retval = rad_converse(pamh, PAM_PROMPT_ECHO_OFF, challenge, &resp2challenge); <<<<< here /* now that we've got a response, build a new radius packet */ build_radius_packet(request, user, resp2challenge, &config); /* request->code is already PW_AUTHENTICATION_REQUEST */ request->id++; /* one up from the request */ /* copy the state over from the servers response */ add_attribute(request, PW_STATE, a_state->data, a_state->length - 2); retval = talk_radius(&config, request, response, resp2challenge, NULL, 1); PAM_FAIL_CHECK; DPRINT(LOG_DEBUG, "Got response to challenge code %d", response->code); } +++code+++ +++log+++ May 28 23:12:13 sshd[20729]: pam_radius_auth: Sending RADIUS request code 1 May 28 23:12:13 sshd[20729]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -745295136. May 28 23:12:13 sshd[20729]: pam_radius_auth: Got RADIUS response code 11 May 28 23:12:13 sshd[20729]: pam_radius_auth: Got Prompt=YOUR PASSWORD HAS EXPIRED. PLEASE ENTER THE NEW PASSWORD: <<<< receive rely-message field May 28 23:12:13 sshd[20729]: pam_radius_auth: Got response to challenge code 11 May 28 23:12:13 sshd[20729]: pam_radius_auth: Got Prompt=PLEASE RE-ENTER THE NEW PASSWORD AGAIN FOR VERIFICATION: <<<< receive rely-message field May 28 23:12:18 sshd[20729]: pam_radius_auth: Got response to challenge code 3 May 28 23:12:18 sshd[20729]: pam_radius_auth: authentication failed +++log+++ -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-autoreply-the-access-cha… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

rlm_python configTuple question
by PENZ Robert 30 May '12

30 May '12

Hi! The python functions should return (return, replyTuple, configTuple). return is one of the following constants #RLM_MODULE_REJECT = 0 # /* immediately reject the request */ #RLM_MODULE_FAIL = 1 # /* module failed, don't reply */ #RLM_MODULE_OK = 2 # /* the module is OK, continue */ #RLM_MODULE_HANDLED = 3 # /* the module handled the request, so stop. */ #RLM_MODULE_INVALID = 4 # /* the module considers the request invalid. */ #RLM_MODULE_USERLOCK = 5 # /* reject the request (user is locked out) */ #RLM_MODULE_NOTFOUND = 6 # /* user not found */ #RLM_MODULE_NOOP = 7 # /* module succeeded without doing anything */ #RLM_MODULE_UPDATED = 8 # /* OK (pairs modified) */ #RLM_MODULE_NUMCODES = 9 # /* How many return codes there are */ replyTuble are the attributes which are send to the requesting NAS, but I couldn't find out what configTuple is exactly. I currently only pass an () and it works. Is it the same as "update control" and setting variables in the normal config files? What I would like to do is to provide a variable which can be used in the config file after calling the python module to compare it against "%{TLS-Client-Cert-Subject}" as I don't see a possible to get this variable in the python module to do the compare there. Thx for your help. Mit freundlichen Grüßen Robert Penz -------------------------------------------------------------- Dipl.Inf. Robert Penz DVT - Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 (0)512 508 3334 / Fax: +43 (0)512 508 3355 E-Mail: robert.penz(a)tirol.gv.at

2 1

Tunnel TLS Authentication with PAP
by val john 29 May '12

29 May '12

Hi.. i have freeradius that uses LDAP authentication password in md5 format and have ubuntu client that users WPA supplicant with following details, Authentication : Tunneled TLS CA certificate : ca.pem Inner Authentication : PAP Then the username and password , because im using CA certificate(ca.pem) of the radius in the client side , server and client communication should be secure ...correct me if im worng.. i just want to know , is these details are secure to send password via network , because when i ran radius in debug mode i can see the password in clear text. Thank You john

3 2

Problem with Freeradius.net + Mysql in Win server 2008r2
by Turamarth 29 May '12

29 May '12

I have installed Freeradius and mysql to use it for a Hostpot network on a Windows 7 64b on test lab and everithing is working fine. Now we are moving it to real server (Win server 2008r2 64b) to auth network clients in radius, and when i uncoment sql in radiussd.conf and i start in debug mode the server stops at: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 and i never go on far from here, and dont conect to db, or do nothing more, i reinstaled, reconfigured, triyed with all ips of mysql db ( is on localhost ) and nothing. any idea? thx -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-with-Freeradius-net-Mysql-i… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 12

How to use RADACCT in freeradius?
by faizal ghazali 29 May '12

29 May '12

Hi, My lecturer had give me an assignment to setup a freeradius server on ubuntu and print out an accounting report from the server. i have success setup this marvellous server with this tutorial link * http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with-mys… * and this *http://www.youtube.com/watch?v=fVRDbAxKcqw* : ) thanks 4 the great tutorial. The problem is i dont know what data to fill in the attribute in radacct phpmyadmin table and also don't know how to create a basic accounting report such as client start time connect, what is client ip, mac, etc.. can somebody help me for this matter? your help would be much appreciated. i am sorry for my stupidity and my broken English. plsss help me sir...

3 2

Address already in use but server is not running
by Michael Aldridge 29 May '12

29 May '12

I recently had to install debian 6.0 on one of my servers after a hard drive crash, and while I had freeradius running before, I can't seem to get it running now. I ran sudo apt-get install freeradius and hit enter to accept the additional packages, and I also installed dialup admin with the intention of getting to it after getting freeradius running, but now I am running into trouble with starting freeradius. The install completed without errors, but running sudo ./freeradius -X produces the following: Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 I can post the full contents of the debug dump, but this appears to be the only point at which an error is encountered. I am quite sure that there is not an instance already running, so I don't know what else could be using the port. Any ideas?

3 4

"No NAS-Port seen"
by Adam Karajah 28 May '12

28 May '12

Dears, I have freeradius installed on CentOS, and i am very interested in Simultaneous-use attribute to limit the number of logins per user. Anyway my nas seems to not sending NAS-Port attribute to freeradius which causes realm radutmp not to work. i looked all over the internet but i conuldnt find a solution, please help me to find a workaround to solve this problem. these are the two lines i keep seeing as an output from the debugging command radiusd -X : rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! its very urgent. thanks in advance.

2 4