October 2005 - Freeradius-Users - lists.freeradius.org

Still no answer
by hannibal 23 Oct '05

23 Oct '05

hi. i use jradius as authorize module. when jradius sent Access-Reject to freeradius, i got the following logs: rad_recv: Access-Request packet from host 127.0.0.1:32876, id=1, length=62 --- Walking the entire request list --- Waking up in 31 seconds... ////////////////////////// why in 31 seconds, that will take a long time to send Access-Reject Thread 8 got semaphore Thread 8 handling request 67, (7 handled so far) User-Name = "test" User-Password = "test" Message-Authenticator = 0x5cc77d6981e1386f5260a10691c9ce74 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 67 modcall[authorize]: module "preprocess" returns ok for request 67 rlm_jradius: packing attribute User-Name (type: 1; len: 4) rlm_jradius: packing attribute User-Password (type: 2; len: 4) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 92) rlm_jradius: packing packet with code: 0 (attr length: 0) rlm_jradius: sending 117 bytes to jradius server rlm_jradius: return code 8; receiving 2 packets rlm_jradius: reading packet: code=1 len=92 rlm_jradius: reading attribute: type=1; len=4 rlm_jradius: reading attribute: type=2; len=4 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=0 len=0 rlm_jradius: reading request: config_item: len=0 modcall[authorize]: module "jradius" returns updated for request 67 modcall: group authorize returns updated for request 67 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 67 rlm_jradius: packing attribute User-Name (type: 1; len: 4) rlm_jradius: packing attribute User-Password (type: 2; len: 4) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 92) rlm_jradius: packing packet with code: 3 (attr length: 0) rlm_jradius: packing attribute Post-Auth-Type (type: 1014; len: 4) rlm_jradius: sending 133 bytes to jradius server rlm_jradius: return code 8; receiving 2 packets rlm_jradius: reading packet: code=1 len=92 rlm_jradius: reading attribute: type=1; len=4 rlm_jradius: reading attribute: type=2; len=4 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=3 len=0 rlm_jradius: reading request: config_item: len=16 rlm_jradius: reading attribute: type=1014; len=4 modcall[post-auth]: module "jradius" returns updated for request 67 modcall: group Post-Auth-Type returns updated for request 67 Delaying request 67 for 1 seconds Finished request 67 Going to the next request Thread 8 waiting to be assigned a request --- Walking the entire request list --- Sending Access-Reject of id 1 to 127.0.0.1:32876 Cleaning up request 67 ID 1 with timestamp 435b0861 Nothing to do. Sleeping until we see a request. is there something to configure to reduce the waking up time span?? thank you. still no answer, anyone help me, thank you very much!!!

2 1

Setting up RADIUS with EAP
by Keith Osburn 23 Oct '05

23 Oct '05

Hello everyone, I'm having trouble setting up my RADIUS to use EAP. Everthing appears normal but the client never gets past "Attempting to Authenticate" If anyone has experience solving this problem I'd appreciate any help provided :-) Regards, ************ Log File*********** Here is the log file from running /usr/sbin/radius -X -A rad_recv: Access-Request packet from host 192.168.2.253:2049, id=0, length=127 User-Name = "kosburn" NAS-IP-Address = 192.168.2.253 Called-Station-Id = "0013109e63c9" Calling-Station-Id = "00904b624e10" NAS-Identifier = "0013109e63c9" NAS-Port = 60 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c016b6f736275726e Message-Authenticator = 0x3fe229ff76ac5518897afd4bbacaade2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 12 rlm_realm: No '/' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmslash" returns noop for request 12 rlm_realm: No '@' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 users: Matched entry kosburn at line 1 modcall[authorize]: module "files" returns ok for request 12 modcall: group authorize returns updated for request 12 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 12 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 12 modcall: group authenticate returns handled for request 12 Sending Access-Challenge of id 0 to 192.168.2.253:2049 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf80de34653e25d74ea49b2f2debeda9 Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.253:2049, id=0, length=139 User-Name = "kosburn" NAS-IP-Address = 192.168.2.253 Called-Station-Id = "0013109e63c9" Calling-Station-Id = "00904b624e10" NAS-Identifier = "0013109e63c9" NAS-Port = 60 Framed-MTU = 1400 State = 0xbf80de34653e25d74ea49b2f2debeda9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 Message-Authenticator = 0x65415f904ea823671c9fcdf5859edb5d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 13 rlm_realm: No '/' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmslash" returns noop for request 13 rlm_realm: No '@' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 13 users: Matched entry kosburn at line 1 modcall[authorize]: module "files" returns ok for request 13 modcall: group authorize returns updated for request 13 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 13 modcall: group authenticate returns handled for request 13 Sending Access-Challenge of id 0 to 192.168.2.253:2049 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0280af636895c756212430579c4c13bd Finished request 13 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.253:2049, id=0, length=213 User-Name = "kosburn" NAS-IP-Address = 192.168.2.253 Called-Station-Id = "0013109e63c9" Calling-Station-Id = "00904b624e10" NAS-Identifier = "0013109e63c9" NAS-Port = 60 Framed-MTU = 1400 State = 0x0280af636895c756212430579c4c13bd NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203005019800000004616030100410100003d0301435bc1b6fb8a0e3748685ba7bd6ae2215b5c83ce5f6a895681366253ccf0ecdc00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x89d0841ecd460f7ec92fda23a85cbe61 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 rlm_realm: No '/' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmslash" returns noop for request 14 rlm_realm: No '@' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 users: Matched entry kosburn at line 1 modcall[authorize]: module "files" returns ok for request 14 modcall: group authorize returns updated for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 14 modcall: group authenticate returns handled for request 14 Sending Access-Challenge of id 0 to 192.168.2.253:2049 EAP-Message = 0x0104040a19c0000006f1160301004a020000460301435bba463b3a0cf4b3866aeed9db8d18fd66fd4fe13a9e9badeec8eefe1b2d9a203867409260e1ba8fa0a62c2b2e54bae71cd5ee46b6723e571311dc2ea5b95ad300040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21a771d3dace9f2ac15015b2ca11ba9e Finished request 14 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.253:2049, id=0, length=139 User-Name = "kosburn" NAS-IP-Address = 192.168.2.253 Called-Station-Id = "0013109e63c9" Calling-Station-Id = "00904b624e10" NAS-Identifier = "0013109e63c9" NAS-Port = 60 Framed-MTU = 1400 State = 0x21a771d3dace9f2ac15015b2ca11ba9e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x888309fd2c450a9ac12dd4bb75ef6d66 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 rlm_realm: No '/' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmslash" returns noop for request 15 rlm_realm: No '@' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 users: Matched entry kosburn at line 1 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 15 modcall: group authenticate returns handled for request 15 Sending Access-Challenge of id 0 to 192.168.2.253:2049 EAP-Message = 0x010502f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x75ae22788c4e9f61f3bc83014ea1e657 Finished request 15 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.253:2049, id=0, length=139 User-Name = "kosburn" NAS-IP-Address = 192.168.2.253 Called-Station-Id = "0013109e63c9" Calling-Station-Id = "00904b624e10" NAS-Identifier = "0013109e63c9" NAS-Port = 60 Framed-MTU = 1400 State = 0x75ae22788c4e9f61f3bc83014ea1e657 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x9bb1bdbc7a23d8f43a42c8ba50add01e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "preprocess" returns ok for request 16 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 rlm_realm: No '/' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmslash" returns noop for request 16 rlm_realm: No '@' in User-Name = "kosburn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 16 users: Matched entry kosburn at line 1 modcall[authorize]: module "files" returns ok for request 16 modcall: group authorize returns updated for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 16 modcall: group authenticate returns handled for request 16 Sending Access-Challenge of id 0 to 192.168.2.253:2049 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1a49638ee4935ae625ddcd34927e721d Finished request 16 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 0 with timestamp 435bba46 Nothing to do. Sleeping until we see a request.

1 0

SUSE freeradius configuration
by Chris Esposito 23 Oct '05

23 Oct '05

I’m new to freeRadius and Linux (Suse) and need some help. I apologize but I really don’t know the question to ask because of my limited knowledge of Linux and wireless technology, but I’ll give it a try. I setup freeRadius v1.0.2 on SUSE v9.0. I have another NetWare 6.5 server installed hopefully to be used as the LDAP server that freeRadius will use to get usernames and passwords from eDirectory via LDAP. I followed the following guide for my setup… HYPERLINK "http://www.novell.com/coolsolutions/tip/15922.html"http://www.novell.com/co olsolutions/tip/15922.html I’m using D-Link DWP-8200 access points which supports WPA2/Enterprise. I’ve setup this access point to point to my SUSE server. I can start Radius on the Linux box, but when I try to connect through the access point, I am getting no response on the Radius server. Everything IP wise is fine, I can ping from everywhere and if I change the Access Point to a Linksys WAP55AG, I get a login screen (not that I know the format to put the username, password, and how domain would be used with NetWare). My client has the D-Link DWP-8200 access points, and I’d like to get it working with this if possible so they don’t have to buy 50 new access points. I believe I’m trying to use EAP/TLS with LDAP authentication. I guess my question is, does the D-Link 8200-AP work with freeRadius, and if so, does anyone know NetWare enough to give me a hand. I understand if that isn’t possible, but I thought I’d at least try. I’m sorry for being so vague, but maybe I can learn a little about wireless security and authentication if anything. The D-Link seems to have the same settings as the Linksys, so I hope it can work. Thanks- Chris -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.12.4/146 - Release Date: 10/21/2005

2 1

Any FreeRadius experts in NYC Area?
by Casey Sung 23 Oct '05

23 Oct '05

Hello everyone, I'm looking for a FreeRadius expert to setup and install in my company network. If you're available for quick consulting work please let me know. Thank you Casey Sung Grace Corporate Park LLC csung(a)corporatepark.net T) 212-300-2001 www.corporatepark.net 501 Fifth Avenue, 3rd Floor, New York, NY 10017 255 West 36 Street, 8th Floor, New York, NY 10018

2 1

erros building suse rpm
by Markus Krause 22 Oct '05

22 Oct '05

hi list, i tried to build an rpm-package for suse using freeradius-1.0.5 on both sles 9 and suse 10.0-oss with same results. unfortunately it did not go smoothly, here is what i did and what happend: 1) i edited freeradius.spec: - correcting the version info in the second line from 1.0.2 to 1.0.5 - changing versino from 1.0.4 to 1.0.5 in the section with name, licence, group, etc. - in BuildRequires i removed "postgresql", "libnscd", "libzio". the reason for removing the last two was that i could not find them in sles9. does anyone know in which package they should be? but i think that the building problems do not depend on these. 2) at the end of "CFLAGS" in the section "%build" i added "--with-experimental-modules" (i need the sqlcounter module) 3) then i run "rpmbuild -ba freeradius.spec". at the end (i assume after compiling, on bundling the package) i get: +++++ Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-1.0.5-build error: Installed (but unpackaged) file(s) found: /etc/raddb/example.pl RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/example.pl ----- as i do not use/need rlm_perl i just uncommented the line containing this information (after "install-scripts:" in src/modules/rlm_perl/Makefile.in) the building is succesfull, and the installed package works correctly. what would the correct action and not a work-around? regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

eap-sim
by Giorgos Kostopoulos 22 Oct '05

22 Oct '05

Hi all, I 'm trying to setup a radius server with eap-sim. 1)I tried freeradius and i have configured it (and messed around with the code, trying to avoid the server to get the rand from an gsm-operator/provider) I' have succesfully accepted the radius access request and i have succesfully send the radius access challenge (eap-sim start) .... The response i get though from the client is that the server is not authenticated... and so there is no radius access request(after eap-sim start) packet. Does this have to do anything with the rand ? 2)Supposed i have a virtual radius server who transmits the above packets. Can anyone tell me exactly the fields i need to create the buffer who is encrypted for the request authenticator and the message authenticator? (i need details about which attributes i need, the order of the bytes e.t.c. - the rfc is not very clear, especially about the message authenticator) thanks in advance

1 0

Question about mac address auth / dot1x / vlan assignement.
by Didier CONTIS 21 Oct '05

21 Oct '05

I apologize if the subject is a little bit off topic. I have what seems now to be a classic scenario where I am trying to do mac address auth / vlan assignment using Windows XP / Cisco Catalyst switch running IOS / FreeRadius 1.0.5 After reading several posts on the mailing list about the subject, I was wondering if someone could clarify a specific point: Can the Windows XP built-in supplicant send the host mac-address as the username / password (during EAP-MD5 or EAP-PEAP) ? Thanks in advance for any tips. Best regards - Didier.

1 0

Radlast and radwho fails
by Kevin Capwell 21 Oct '05

21 Oct '05

GIVEN: I can use both the test account and a laptop with an access point to access our wireless network via freeradius. However, I can not see who is currently online through radlast and radwho. Authentication Style: MAC address using the ${sysconfdir}/raddb/users file DETAILS Server OS: Mac OS X - 10.4.2 Darwin (fully qualified domain name) 8.2.0 Darwin Kernel Version 8.2.0: Fri Jun 24 17:46:54 PDT 2005; root:xnu-792.2.4.obj~3/RELEASE_PPC Power Macintosh powerpc radiusd - version 1.0.5 NAS: Netgear - Prosafe Wireless Access Point WG102 Firmware Version V1.0.31 ==Accounting is ON== Primary Accounting Server IP Address (suppressed) Port Number 1813 Shared Secret (suppressed) $ radlast last: /usr/local/var/log/radius/radwtmp: No such file or directory $ radwho radwho: Error reading /usr/local/var/log/radius/radutmp: No such file or directory $ /usr/local/sbin/radiusd -X ... Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. from /usr/local/etc/raddb/radiusd.conf ... radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "yes" } ... radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } ... accounting { detail unix radutmp } ... session { radutmp } ----------------------------------------- The views, opinions and statements contained in this transmission are not necessarily the views, opinions and statements of the School District of Onalaska. http://www.onalaska.k12.wi.us/ This e-mail, and any files transmitted with it may contain confidential material and is intended solely for the use of the individual to whom it is addressed. If you have received this e-mail in error, please discard the message and notify the sender directly.

3 5

ldap filter question
by Markus Krause 21 Oct '05

21 Oct '05

hi all! to verify some network devices which want to connect to a switch we want to use radius and store the mac-addresses in ldap. the switch passes the ethernet-mac-address to radius which should then be checked against the ldap entry for dhcp, there is an attribte dhcpHWAddress we already use successfully for dhcp. the dhcpHWAddress contains something like "ethernet 00:0e:35:c4:70:a8". how can i teach radius to use just the octect value (without the word "ethernet"=) of this attribute? i assume that i have to define something like 'filter = "dhcpHWAddress=%u" ', but how to strip of "ethernet"? thanks in advance for any tipps! regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

PEAP Machine Authentication
by Jérémy Cluzel 21 Oct '05

21 Oct '05

Hi, I looked in the samba 3.0.20 source code and I only found 2 calls to the "init_id_info2()" function in the "samba/source/rpc_client/cli_netlogon.c" file: In the "cli_netlogon_sam_logon()" function: 701 init_id_info2(&ctr.auth.id2, lp_workgroup(), 702 0, /* param_ctrl */ 703 0xdead, 0xbeef, /* LUID? */ 704 username, cli->clnt_name_slash, chal, 705 local_lm_response, 24, local_nt_response, 24); And in the "rpccli_netlogon_sam_network_logon()" function: 802 init_id_info2(&ctr.auth.id2, domain, 803 0, /* param_ctrl */ 804 0xdead, 0xbeef, /* LUID? */ 805 username, workstation_name_slash, (const uchar*)chal, 806 lm_response.data, lm_response.length, nt_response.data, nt_response.length); But nothing in the "cli_netlogon_sam_network_logon()" function... Regards, Jeremy

3 2