June 2005 - Freeradius-Users - lists.freeradius.org

Re: use_tunneled_reply
by ragan_davis＠colstate.edu 19 Jun '05

19 Jun '05

Ahh, I see. Based on the syntax you used it looks like I'd do this using local users file. However, I'm using edirectory for the user db. I have seen in the debug output where radius is checking for any reply items in the directory. Maybe I could use radiusReplyItem as an attribute in edir with a value "User-Name = ${User-Name}"? thanks, mack ----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Saturday, June 18, 2005 4:21 pm Subject: Re: use_tunneled_reply > -ragan_davis(a)colstate.edu wrote: > > > Did you set "User-Name = novelluser" in the *reply* for the > tunneled> > session? > > > > Hmmmm...I did not explicitly do this. How to? > > Set it as a reply attribute? > > user blah-blah = blah > User-Name = `%{User-Name}` > > > > You can verify that, independent of EAP, but using "radtest" with > > > the name & password of the tunneled user. > > > > I'm testing this now, but don't see the same "Access-Accept" > message in > > the debug output. Guess I'm still missing something. > > You will see the INNER TUNNEL Access-Accept. The reply attributes > in that Access accept are the ones which will be copied to the outer > tunnel, when TTLS is used. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: use_tunneled_reply
by Stefan.Neis＠t-online.de 18 Jun '05

18 Jun '05

Hi, > > You can verify that, independent of EAP, but using "radtest" with > > the name & password of the tunneled user. > > I'm testing this now, but don't see the same "Access-Accept" message in > the debug output. Guess I'm still missing something. Keep in mind that contrary to the "normal" RADIUS protocols where you just send a request and get an answer, EAP protocols are rather involved beasts, exchanging several packets between client and server before you get the final answer. Regards, Stefan

1 0

Re: use_tunneled_reply
by ragan_davis＠colstate.edu 18 Jun '05

18 Jun '05

----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Saturday, June 18, 2005 11:46 am Subject: Re: use_tunneled_reply > ragan_davis(a)colstate.edu wrote: > > This leads a dunce like me to believe that radius will send a > reply > > back to AP/NAS that has User-Name equaling "novelluser", rather > > than "anonymous". > > Did you set "User-Name = novelluser" in the *reply* for the tunneled > session? Hmmmm...I did not explicitly do this. How to? > > You can verify that, independent of EAP, but using "radtest" with > the name & password of the tunneled user. I'm testing this now, but don't see the same "Access-Accept" message in the debug output. Guess I'm still missing something. > > > I looked in the debug output (radiusd -A -X, right?). I think > this is > > what I am supposed to look for: > > Look at the REST of the debug output. It tells you what the reply > is in the tunnel, and what it's copying back to the outer session. > > Please, when you're reading the debug log, do MORE than just look at > the last few lines. Will do. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

FreeRadius & BSDi 4.2
by Edward Rempala 18 Jun '05

18 Jun '05

I have compiled FR on BSDi and got it working. But I seem to be having a strange problem. Once Auth. users can't go anywhere. They get a IP# and a gateway addy. (Our Modem Racks gives that out - USR Total Control). When you try to go to a webpage 99% of the time it just times out. So we turn off FR and turn on the old radius server, and everything is fine again. Has anyone seen something like this before? Edward Rempala WorldNet Access

2 1

warning "configure: error: no acceptable cc found in $PATH".
by freeradius 18 Jun '05

18 Jun '05

Hi all: My OS is fedora 3. I download <ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.4.tar.gz> freeradius-1.0.4.tar.gz. After tar -zxvf it, I do # ./configure first. But the system warning "configure: error: no acceptable cc found in $PATH". Any idea why this could happen? Thanks for any idea. Tommy

2 1

Re: use_tunneled_reply
by ragan_davis＠colstate.edu 18 Jun '05

18 Jun '05

Thanks for the reply. The supplicant indeed sends "anonymous" as outer, but also sends "novelluser" as inner. So, I think I understand that the AP/NAS can't see the inner as the request is on it's way to the radius....so at that point, all it knows is "anonymous". However, according to the comment in eap.conf (v1.0.2): "The reply attributes sent to the NAS are usually based on the name of the user 'outside' of the tunnel (usually 'anonymous'). If you want to send the reply attributes based on the user name inside of the tunnel, then set this configuration entry to 'yes', and the reply to the NAS will be taken from the reply to the tunneled request." This leads a dunce like me to believe that radius will send a reply back to AP/NAS that has User-Name equaling "novelluser", rather than "anonymous". I looked in the debug output (radiusd -A -X, right?). I think this is what I am supposed to look for: Sending Access-Accept of id 247 to 192.168.3.2:1024 MS-MPPE-Recv-Key = 0x17c9701998d6ad7ee94b37819449c3cb0ebd9804c5de36c141a1509816dc6d71 MS-MPPE-Send-Key = 0xff1226efbfd249e76d3a502c43cc2ca5a95a5a38e9bd0829ca6ba34fe089696a EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Before seeing this, my suspicion was that the NAS might somehow be ignoring the new value for User-Name, but it seems it's receiving exactly what radius is sending it. I thought the magical "use_tunneled_reply" setting was supposed to fix this? Am I understanding what "use_tunneled_reply" is actually supposed to do? Thanks for the patience and the advice. later, mack ----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Friday, June 17, 2005 1:23 pm Subject: Re: use_tunneled_reply > ragan_davis(a)colstate.edu wrote: > > Using FreeRADIUS 1.0.2, Cisco/Airespace 4100 WLAN switch as NAS, > and > > Odyssey Client v4.01 as supplicant. Kept seeing the user > > as "anonymous" in the WCS management software for the client. > > Because that's what the supplicant sends. > > > So, in eap.conf I changed use_tunneled_reply to equal yes. Still, > > replies to NAS show User-Name = "anonymous". Have I missed > > something? > > Run the server in debugging mode to see what's going on. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

stripping a slash?
by Chris Sigler 18 Jun '05

18 Jun '05

For some reason, when we run a query against radius and the username starts with a slash, it seems to ignore the slash. As a result, a user is able to log in with both "bob" and "/bob", although only one is right. Any ideas what could be the cause of this? Thanks! Chris Sigler

2 5

Auth: Login incorrect: [user/<CHAP-Password>]
by Adil Azmi Bikarbass 17 Jun '05

17 Jun '05

Dear FreeRadius list members, I'm really stuck with an authentication problem here: I'm getting the following error meesage anytime a user try to connect through my Freeradius server : Auth: Login incorrect: [user/<CHAP-Password>] (from client MT2_ADSL port 1476461184) Auth: rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Here is the radius entry for that user: user Password = "somepass", Simultaneous-Use = 2, Huntgroup-Name = "adsl-dialup" Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, NAS-Port-Type = Async, Service-Type = Framed-User, The Huntgroup-name : adsl-dialup is to specify the IP addresses of all the remote access servers we use Once i add the following line at the bottom of my users file the user get connected with no problem: DEFAULT Auth-Type := Accept Please advise what could be the problem Thanks in advance Adil -- |-Adil Azmi Bikarbass |-IT Manager, MTDS |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco

4 7

Inncorect link on the website.
by Marcin Jessa 17 Jun '05

17 Jun '05

Hi guys. The link to email archive page at http://www.freeradius.org/list/users.html points to http://lists.freeradius.org/archives/freeradius-users/ which does not exist. It should be pointed to https://list.xs4all.nl/pipermail/freeradius-users/ or have a header redirection in http://lists.freeradius.org/archives/freeradius-users/ for that address. Cheers, Marcin.

2 3

PPPOE Incorrect Subnet
by Cris Boisvert 17 Jun '05

17 Jun '05

I'm using a Microtik PPPOE Router solution All my users are up and autheticated fine But some of them are recieveing an incorrect Subnet Currently the customers are all receiving public IP addresses when authenticated, from a Pool. Of 64 I want them to received a 255.255.255.255 subnet... But currently they are getting different ones.. 255.255.255.192 255.255.255.240 255.255.255.224 I have tried setting them in Freeradius but to no avail. 192 I would understand because that's the subnet their in.. But Not the others. Is this something that should be defined in radius.. Or should the pppoe concentrator know To give them the correct subnet their? Thanx Cris

3 2