June 2005 - Freeradius-Users - lists.freeradius.org

Attribute and Message Editing
by Tahseen Hussain 30 Jun '05

30 Jun '05

Hi Everybody, Is it possilbe to avoid attribute editing and message editing by using EAP-TTLS or EAP-PEAP in a proxy environment? As far as I understton, In EAP-TTLS a tunnel is formed between a user and the TTLS server, now this TTLS server will forward the request to the proxy and proxy to the home radius server. So the threat here is from proxy, which can falsely edit attribute and messages. For example if home radius sever sends Accept-accept packet , it is possible that a proxy can change the same packet to Access-Reject (wantedly), so that the user will not be able to access visited network. Thanks in advance, Tahseen

2 1

Re: EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

I am still having an issue autheniticating a user with EAP. I think Alan, has pointed out the issue in his previous reply, about LDAP not retrieving the User-Password from Active Directory. My understanding (as little as it may be) of the ldap section of the radiusd.conf file is the password_attribute is responsible for retrieving the password. Below is the ldap config section of radiusd.conf. ldap { server = "mem-dc.mem-ins.com" basedn = "ou=mem users,dc=mem-ins,dc=com" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" identity = "cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com" password = {Secret} start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(memberof=%{Ldap-UserDn}))(&(objectClass=Group)(member=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = yes } but the output shows: rad_recv: Access-Request packet from host 172.16.5.71:1645, id=144, length=85 User-Name = "rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.5.71 NAS-Port = 24 EAP-Message = 0x0200000c017267726168616d Message-Authenticator = 0xc96d75a58b5af7b632fc0f3cc91876c8 rad_lowerpair: User-Name now 'rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.5.71/auth-detail-20050630' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.5.71/auth-detail-20050630 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mem-dc.mem-ins.com:389, authentication 0 rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/{secret} to mem-dc.mem-ins.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' radius_xlat: '(|(&(objectClass=GroupOfNames)(memberof=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=Group)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=domain users,ou=groups,ou=mem users,dc=mem-ins,dc=com, with filter (|(&(objectClass=GroupOfNames)(memberof=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=Group)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))) rlm_ldap::ldap_groupcmp: User found in group cn=domain users,ou=groups,ou=mem users,dc=mem-ins,dc=com rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 189 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 144 to 172.16.5.71:1645 Service-Type = Framed-User Framed-Protocol = PPP EAP-Message = 0x0101001604102a7c39455a6ffe060c3a06f4b9677974 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb7b91555ab2be2ca5f6ebc82b06f0ec Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.5.71:1645, id=145, length=120 User-Name = "rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.5.71 NAS-Port = 24 State = 0xcb7b91555ab2be2ca5f6ebc82b06f0ec EAP-Message = 0x0201001d0410db525b9aa0119fbbda00f3b61861beaf7267726168616d Message-Authenticator = 0x0751751a6adfd81ae56487289f42da9e rad_lowerpair: User-Name now 'rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/172.16.5.71/auth-detail-20050630' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.5.71/auth-detail-20050630 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "attr_filter" returns noop for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' radius_xlat: '(|(&(objectClass=GroupOfNames)(memberof=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=Group)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=domain users,ou=groups,ou=mem users,dc=mem-ins,dc=com, with filter (|(&(objectClass=GroupOfNames)(memberof=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=Group)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))) rlm_ldap::ldap_groupcmp: User found in group cn=domain users,ou=groups,ou=mem users,dc=mem-ins,dc=com rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 189 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. shouldn't the section: rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access have something that reflects userpassword retrieved (rlm_ldap: UserPassword retrieved, or sometjing like that)? Thanks Robert Graham

2 1

groups in eap/tls authentication
by Norbert Wegener 30 Jun '05

30 Jun '05

My users authenticate via certificates and eap/tls. Up to now they all get the same DEFAULTs for DNS servers and WINS servers assigend. Now there is demand, to assign some of them special servers. I would like to do this, defining another DEFAULT entry combined with a hint/check item or something else. If they would use normal accounts, they would be able to append a suffix to that account, so that a hint file comes into business. As their login is extracted from the certificate, they have no chance to do so. I would like to do something like this, but as far as I understand, this Group check-item will only work with Auth-Type=System: my.login(a)example.com, Group="abc" Fall-Through = Yes, your.login(a)example.com, Group="123" Fall-Through = Yes, DEFAULT Group="abc" Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:dns-servers=1.2.3.4 5.6.7.8", Fall-Through = No, DEFAULT Group="123" Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:dns-servers=11.22.33.44 55.66.77.88", Fall-Through = No Is there a way to do this? Thanks for an answer. Norbert Wegener

2 1

dialup_admin problem
by Okka Radius 30 Jun '05

30 Jun '05

I am using Freeradius version 1.04 that comes with its own version of dialup_admin. I've successfully got Freeradius to authenticate using MYSQL as a backend. My problem is in getting dialup_admin to read the database when I access my radius server on the web. My admin.conf for dialup_admin is below # # Main Configuration File # # it can be default or whatever language. Only greek are supported # from non latin alphabet languages # These attribute only apply for ldap not for sql # general_prefered_lang: en general_prefered_lang_name: English # # The charset which will be added as a meta tag in all pages # #general_charset: iso-8859-1 # # Uncomment this if normal attributes (not the ;lang-xx ones) in ldap # are utf8 encoded. # #general_decode_normal_attributes: yes # # The directory where dialupadmin is installed # general_base_dir: /usr/local/dialup_admin # # The base directory of the freeradius radius installation # #general_radiusd_base_dir: /usr/local/radiusd general_radiusd_base_dir: /usr/local/etc/raddb #general_domain: company.com general_domain: domain.name.ext # # Set it to yes to use sessions and cache the various mappings # You can also set use_session = 1 in config.php3 to also cache # the admin.conf # # ---- IMPORTANT -- IMPORTANT -- IMPORTANT ---- #Remember to use the 'Clear Cache' page if you use sessions and do any changes #in any of the configuration files. # general_use_session: no #general_use_session: yes # # This is used by the failed logins page. It states the default back time # in minutes. # general_most_recent_fl: 30 # # Realm setup # # Set general_strip_realms to yes in order to stip realms from usernames. # By default realms are not striped #general_strip_realms : yes general_strip_realms: no # # The delimiter used in realms. Default is @ # general_realm_delimiter: @ # # The format of the realms. Can be either suffix (realm is after the username) # or prefix (realm is before the username). Default is suffix # general_realm_format: suffix # # # Determines if the administrator will be able to see and change the user password through # the user edit page general_show_user_password: yes general_raddb_dir: %{general_radiusd_base_dir}/etc/raddb general_ldap_attrmap: %{general_raddb_dir}/ldap.attrmap # Need to fix admin.conf file parser #general_clients_conf: %{general_raddb_dir}/clients.conf general_clients_conf: /usr/local/etc/raddb/clients.conf general_sql_attrmap: %{general_base_dir}/conf/sql.attrmap general_accounting_attrs_file: %{general_base_dir}/conf/accounting.attrs general_extra_ldap_attrmap: %{general_base_dir}/conf/extra.ldap-attrmap # # it can be either ldap or sql # This affects the user base not accounting. Accounting is always in sql # general_lib_type: sql # # Define which attributes will be visible in the user edit page # general_user_edit_attrs_file: %{general_base_dir}/conf/user_edit.attrs # # Used by the Accounting Report Generator # general_sql_attrs_file: %{general_base_dir}/conf/sql.attrs # # Set default values for various attributes # general_default_file: %{general_base_dir}/conf/default.vals #general_ld_library_path: /usr/local/snmpd/lib # # can be 'snmp' (for snmpfinger) or empty to query the radacct table without first # querying the nas # This is used by the online users page # general_finger_type: snmp # # Defines the nas type. This is only used by snmpfinger # cisco and lucent are supported for now # #general_nas_type: cisco general_nas_type: other #general_snmpfinger_bin: %{general_base_dir}/bin/snmpfinger general_snmpfinger_bin: /usr/local/dialup_admin/bin/snmpfinger #general_radclient_bin: %{general_radiusd_base_dir}/bin/radclient general_radclient_bin: /usr/local/bin/radclient # # this information is used from the server check page # general_test_account_login: test #general_test_account_login: john #general_test_account_login: building general_test_account_password: testing123 #general_test_account_password: john101 #general_test_account_password: building101 # # These are used as default values for the user test page # #general_radius_server: localhost general_radius_server: fully.qualified.domain.name.of.server general_radius_server_port: 1812 # # can be either pap or chap # #general_radius_server_auth_proto: pap general_radius_server_auth_proto: chap # # sorry, single valued for now. Should become something like # password[server-name]: xxxxx # general_radius_server_secret: secret #general_auth_request_file: %{general_base_dir}/conf/auth.request general_auth_reguest_file: /usr/local/dialup_admin/conf/auth.request # # can be one of crypt,md5,clear # #general_encryption_method: crypt general_encryption_method: clear # # can be either asc (older dates first) or desc (recent dates first) # This is used in the user accounting and badusers pages # general_accounting_info_order: desc # # Use the totacct table in the user statistics page instead of the radacct # table. That will make the page run quicker. totacct should have data for # this to work :-) # general_stats_use_totacct: no #general_stats_use_totacct: yes # # If set to yes then we only allow each administrator to examine it's own entries # in the badusers table # general_restrict_badusers_access: no INCLUDE: %{general_base_dir}/conf/naslist.conf INCLUDE: %{general_base_dir}/conf/captions.conf # # The ldap server to connect to. # Both ldap_server and ldap_write_server can be a space-separated # list of ldap hostnames. In that case the library will try to connect # to the servers in the order that they appear. If the first host is down # ldap_connect will ask for the second ldap host and so on. # #ldap_server: ldap.%{general_domain} # # There are many cases where we have a small write master and # a lot of fast read only replicas. If that is the case uncomment # ldap_write_server and point it to the write master. It will be # used only when writing to the directory, not when reading # #ldap_write_server: master.%{general_domain} #ldap_base: dc=company,dc=com #ldap_binddn: cn=Directory Manager #ldap_bindpw: XXXXXXX #ldap_default_new_entry_suffix: ou=dialup,ou=guests,%{ldap_base} #ldap_default_dn: uid=default-dialup,%{ldap_base} #ldap_regular_profile_attr: dialupregularprofile # # If set to yes then the HTTP credentials (http authentication) # will be used to bind to the ldap server instead of ldap_binddn # and ldap_bindpw. That way multiple admins with different rights # on the ldap database can connect through one dialup_admin interface. # The ldap_binddn and ldap_bindpw are still needed to find the DN # to bind with (http authentication will only provide us with a # username). As a result the ldap_binddn should be able to do a search # with a filter of (uid=<username>). Normally, the anonymous (empty DN) # user can do that. #ldap_use_http_credentials: yes # # If we are using http credentials we can map a specific username to the # directory manager (which usually does not correspond to a specific username) # #ldap_directory_manager: cn=Directory Manager #ldap_map_to_directory_manager: admin # # Uncomment to enable ldap debug # #ldap_debug: true # # Allow for defining the ldap filter used when searching for a user # Variables supported: # %u: username # %U: username provided though http authentication # %mu: mappings for userdb # %ma: mappings for accounting # # One use of this would be to restrict access to only the user's belonging to # a specific administrator like this: # ldap_filter: (&(uid=%u)(manager=uid=%U,ou=admins,o=company,c=com)) # #ldap_filter: (uid=%u) # # If ldap_userdn is set then we use that for user dns, we don't perform an ldap # search. This can be somewhat faster. The variables supported for ldap_filter # are also supported here # #ldap_userdn: uid=%u,%{ldap_base} # # can be one of mysql,pg where: # mysq: MySQL database (port 3306) # pg: PostgreSQL database (port 5432) # sql_type: mysql #sql_type: mysq sql_server: fully.qualified.domain.name.of.server sql_port: 3306 sql_username: name sql_password: password sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas # # This variable is used by the scripts in the bin folder # It should contain the path to the sql binary used to run # sql commands (mysql and psql are only supported for now) sql_command: /usr/local/bin/mysql # # This variable is used by the scripts in the bin folder # It should contain the snmp type and path to the binary # used to run snmp commands. # (ucd = UCD-Snmp and net = Net-Snmp are only supported for now) general_snmp_type: net general_snmpwalk_command: /usr/bin/snmpwalk general_snmpget_command: /usr/bin/snmpget # # Uncomment to enable sql debug # sql_debug: true # # If set to yes then the HTTP credentials (http authentication) # will be used to connect to the sql server instead of sql_username # and sql_password. That way multiple admins with different rights # on the sql database can connect through one dialup_admin interface. #sql_use_http_credentials: yes # # If set the query will be added to all of the queries on the accounting # table #sql_accounting_extra_query: %ma # # true or false # sql_use_user_info_table: true sql_use_operators: true # # Set this to the value of the default_user_profile in your # sql.conf if that one is set. If it is not set leave blank # or commented out #sql_default_user_profile: DEFAULT # # sql_password_attribute: User-Password sql_date_format: Y-m-d sql_full_date_format: Y-m-d H:i:s # # Used in the accounting report generator so that we # don't return too many results # sql_row_limit: 40 # # These options are used by the log_badlogins script and by the # mysql driver # # Set the sql connect timeout (secs) sql_connect_timeout: 3 # Give a space separated list of extra mysql servers to connect to when # logging bad logins or adding users in the badusers table #sql_extra_servers: sql2.company.com sql3.company.com # # Default values for the various user limits in case the counter module # is used to impose such limits. # The value should be the user limit in seconds or none for nothing # counter_default_daily: 14400 counter_default_weekly: 72000 counter_default_monthly: none # # Since calculating monthly usage can be quite expensive we make # it configurable # This is not needed if the monthly limit is not none #counter_monthly_calculate_usage: true I am using Apache version 2.0.54 along with PHP-4.3.11 My apache httpd.conf section for dialup_admin is below <Directory /usr/local/apache2/htdocs/dialup> AuthName "Radius Auth" AuthType Basic AuthUserFile /usr/local/dialup_admin/.htpasswd require valid-user </Directory> When I connect to http://fully.qualified.domain.name.of.server/dialup and enter in the username and password , I get all the usual html pages BUT the moment I click on the check server link then the check fails the userid and pass specified in admin.conf and when I select anything else eg accounting , then it displays a simple message stating that it cannot connecting to the sql databse ( spelt like that ) and selecting any other link says that it cannot connect to the SQL database. These users defined in the admin.conf for test purposes are valid users in the correct mysql tables and they do authenticate successfully , I'm using MySQL Control Centre 0.94 Beta for Windows to add the users since I can't do it with the web interface since it does'nt want to work. Can any assist me , it would be much appreciated. Many thanks in advance.

1 0

Exec-Program-Wait vs rlm_exec vs rlm_<your own>
by Doug Hardie 30 Jun '05

30 Jun '05

I transitioned from Cistron radius some time ago. There the only option was Exec-Program-Wait. I had developed one that suited our needs. It transitioned quite well to freeradius. However, there are notes in various places that Exec-Program-Wait will somtime go away. The indicated replacement is rlm_exec. I tried to convert my programs over to that and never could quite get everything to work. There were always issues that have been discussed here at length. There were some patches that might have helped my situation, but I didn't want to have to keep remembering to patch new versions etc. Recently I took a more detailed look at rlm_example and decided to give that approach a try. Its actually quite easy to convert an Exec- Program-Wait into a rlm_xxxx. Some of the steps are not obvious and the really difficult part is figuring out what you need to do to get configure to work properly. The real advantage of this, however, is that there is no forking overhead. It runs a lot more efficiently and can do more than what the Exec-Program-Waits can do. Hence, I would suggest that rather than push the rlm_exec as the replacement for Exec-Program-Wait, that creating your own rlm_xxxx would be a better approach. There are no real instructions for creating your own rlm that I could find. However, the experience is still fresh and if you are interested I could put together a first draft of instructions on creating a rlm.

2 1

authenticate machine accounts with ntlm_auth
by Jérémy Cluzel 30 Jun '05

30 Jun '05

Hi, Is it possible to authenticate a machine account with ntlm_auth ? When a machine tries to authencate itself, the username looks like this: "host/hostname.domain.org" I don't know if ntlm_auth is able to understand this format... Regards Jeremy

2 1

[Q] Access-Reject logging
by Andrey Panin 30 Jun '05

30 Jun '05

Hello, I have rlm_perl module which performs some checks of Access-Request and if rlm_perl returns RLM_MODULE_REJECT freeradius sends Access-Reject, but this Access-Reject doesn't appear in detail log. is there any way to log Access-Reject's generated in authorize section ? Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

2 5

Certificate expired
by Albrecht, Robert-Manfred 30 Jun '05

30 Jun '05

Hello, I'm using a freeradius to secure my wlan. I`m using PEAP Authentification. The certificate was created at 28.06.2004 with a validity-time of two years (26.06.2006). Yesterday (28.06.2005) the radiusd stopped working and dropped the error "certificate expired". This is exactly one year before expiration. Is this a known bug ? Regards, Robert M. Albrecht

2 1

FW: Re: EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

Alan, Thanks for the response. > Do you mean EAP-MD5? I'm not sure what MD5-Challenge is... Yes - EAP-MD5, The windows side (supplicant) is set to MD5-Challenge >> I did get EAP to work when I supply the User-Password attribute in the users file, but I would like LDAP to fetch this if it is possible. > If you're using LDAP, it should be doing that already. I don't think it is configured right. So far I have been using LDAP for groupmembership searches only. How do you tell LDAP to fetch User-Password attribute? >> If I remove the User-Password attribute in the users file, the dubug out >> shows: User-Password is required for EAP-MD5 authenitication. Are you getting the User-Password attribute from LDAP? The debug log should show this. >> Username >> Password >> Domain >> >> If you supply all three values, the debug shows: >> >> Identity does not match user-name > You're re-writing the User-Name attribute somewhere. Again, the debug log will show this. I didn't see anything in the log. If I provide the domainname debug shows username as domain\\username, LDAP shows it as domain\username, and rlm_eap complains about Identity not matching. -Robert Graham

1 0

RE: [Q] Access-Reject logging
by Mitchell, Michael J 30 Jun '05

30 Jun '05

> > > > > Been here, done that. It doesn't help, looks like Access-Reject's > > > generated during authorize phase are never passed to > post_auth phase. > > > > Are you using the latest release of FreeRADIUS? It was a bug in > > version 1.0.2 and earlier. > > CVS snapshot. > Why is authorization failing? I know in 1.0.1 post-auth is not processed if the authorization module returns RLM_USERLOCK (eg in LDAP the access attribute has denied access). Not sure what the logic is for the latest versions though...

2 1