June 2005 - Freeradius-Users - lists.freeradius.org

windows xp sp2 EAP and radius
by Sergey Velikanov 30 Jun '05

30 Jun '05

настраиваю работу EAP по [url=http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html]док…] проблема в том что если я выбираю Smart Card or other Certificate на [url=http://web.archive.org/web/20031206113912/http://www.impossiblereflex.c…] то на радиусе я никаких запросов не вижу, если выбираю PEAP то запросы начинают приходить, может у кого есть идеи? целый день над этим бьюсь так и не получается заставить работать hello I've setup my windows xp & freerafius to use EAP (http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html) but if I select on my windows machine use "Smart Card or other Certificate" I seen nothing on radius, if u choose PEAP on my radius I see Cisco AP1300 log Jun 30 11:12:38.947: RADIUS(00000035): Storing nasport 307 in rad_db Jun 30 11:12:38.947: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.948: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.948: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/56, len 157 Jun 30 11:12:38.950: RADIUS: Received from id 1645/56 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:38.950: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:12:38.986: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:38.986: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.986: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.986: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/57, len 156 Jun 30 11:12:38.988: RADIUS: Received from id 1645/57 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:38.988: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:12:39.007: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.007: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.007: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.008: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/58, len 230 Jun 30 11:12:39.047: RADIUS: Received from id 1645/58 192.168.11.2:1645, Access-Challenge, len 1100 Jun 30 11:12:39.048: RADIUS/DECODE: EAP-Message fragments, 253+253+253+253+22, total 1034 bytes Jun 30 11:12:39.131: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.131: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.131: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.132: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/59, len 156 Jun 30 11:12:39.134: RADIUS: Received from id 1645/59 192.168.11.2:1645, Access-Challenge, len 821 Jun 30 11:12:39.135: RADIUS/DECODE: EAP-Message fragments, 253+253+253, total 759 bytes Jun 30 11:12:39.147: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.147: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.148: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.148: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/60, len 156 Jun 30 11:12:39.180: RADIUS: Received from id 1645/60 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:39.180: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:13:09.172: %DOT11-7-AUTH_FAILED: Station 0060.1d1e.245c Authentication failedReceived disconnect from 192.168.10.100: Time-out activated and freeradius show the same, on every packet it say > modcall[authenticate]: module "eap" returns handled for request 8 it never say "ok" and never send Reject or Accept packet What is wrong? I use radiusd: FreeRADIUS Version 1.0.4, for host , built on Jun 30 2005 at 15:08:01

1 0

FreeRadius + Mysql + MAC address authentication + linksys WRT54GS
by Carlos Sobrinho 30 Jun '05

30 Jun '05

Hi there, I'm sorry if this questions was already answered but I searched all day today and didn't come up with anything usefull for this situation. This is what I need. There will be: * 20 hotspots with a Linksys AP and a modified firmware (OpenWRT) and maybe chilispot. * Freeradius server * apache2 webserver * free-HS (SSID) The objective is to have some free hotspots on a certain area and the user, as soon as he chooses free-HS network, will be redirected to a register page. Maybe using a proxy trick or a php redirect. This page will ask simple questions like age, how did he found this but never username and password. The authentication will be made by MAC address but I could only find some examples regarding AP's MAC address in the users file. My problem is to have this auth made by the mysql database. If he disconnects and connects again his mac address will be in the data-base, and radius will find it and authorize and the internet will be normal, No proxy, no redirect. Maybe a 15m timeout of no activity... So basically what we need is a way for radius to check for this MAC address in the mysql db. I have a working freeradius+mysql server and I can do a radtest with a user's/password and the shared pass and all was ok. rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=163, length=20 My problems: * We don't have any certificate store to sign our certificate, * We don't want people to install certificates Another questions. What type of protocols should we use? EAP, PEAP, CHAP, MSCHAP, EAP/TLS, WEP ? The most simple for the window's users to access. Thank you in advance for the help With best regards Carlos Sobrinho -- ############################################################################# # These PRESERVES should be FORCE-FED to PENTAGON OFFICIALS!! # #############################################################################

2 1

(no subject)
by mupota 30 Jun '05

30 Jun '05

help

1 0

EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

Hello list, I have freeradius configured to authenicate users against active directory with ms-chap and can also do ldap group searches, all that is working great. Now what I need to do is implement 802.1x port authenication on our foundry switches and I'm running into problems. This is our layout: W2K Pro (using MD5-Challenge) -----> Foundry Switch -------> Freeradius --------> AD I have read a lot of articles/post on the web and looked over the docs (I don't know how many times) and I think I'm more confused than ever. So the first question is: Is this setup even possible? I did get EAP to work when I supply the User-Password attribute in the users file, but I would like LDAP to fetch this if it is possible. I came across a post suggesting this, but the answer was not very clear. If I remove the User-Password attribute in the users file, the dubug out shows: User-Password is required for EAP-MD5 authenitication. Another question I would like to ask is: When you configure the workstation (supplicant) for MD5-Challenge, it prompts you for: Username Password Domain If you supply all three values, the debug shows: Identity does not match user-name But if you leave the domain field blank, it works (providing that User-Password attribute is in the user file). I hope these questions make sense and hopefully someone out there can help. -Robert Graham

2 1

RE: How can i authenticate my users against Active Directory?
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

Well I am not running radiusd on my Linux box. Do I need to run radiusd on my Linux Box even though my radius server is running on a MS windows 2000 server? I thought only thing I had to do is setup pam_radius_auth to talk to my radius server. ___________________ Puneet Talwar -----Original Message----- From: Dusty Doris [mailto:freeradius@mail.doris.cc] Sent: Wednesday, June 29, 2005 4:15 PM To: FreeRadius users mailing list Subject: RE: How can i authenticate my users against Active Directory? > See I am trying to authenticate against the AD, but in my case the RADIUS > server is running on a Windows Server and my client is a Linux box. But > the problem I am having is that when I try to authenticate against the AD > from my Linux box I get error message in /var/log/messages > > login[4578]: pam_radius_auth: RADIUS server <Windows_Radius_Server > IP_address> failed to respond > login[4578]: pam_radius_auth: All RADIUS servers failed to respond. > > When I go check the log on the Radius server I can see the login attempts > that are made from the Linux box. > > So I am not sure where else I can see what I am doing wrong here. > What does the radius server show in debug mode? radiusd -X - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: How can i authenticate my users against Active Directory?
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

See I am trying to authenticate against the AD, but in my case the RADIUS server is running on a Windows Server and my client is a Linux box. But the problem I am having is that when I try to authenticate against the AD from my Linux box I get error message in /var/log/messages login[4578]: pam_radius_auth: RADIUS server <Windows_Radius_Server IP_address> failed to respond login[4578]: pam_radius_auth: All RADIUS servers failed to respond. When I go check the log on the Radius server I can see the login attempts that are made from the Linux box. So I am not sure where else I can see what I am doing wrong here. __________________________ Puneet Talwar -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, June 29, 2005 2:05 PM To: FreeRadius users mailing list Subject: Re: How can i authenticate my users against Active Directory? Dusty Doris <freeradius(a)mail.doris.cc> wrote: > You can always do an ldap search to AD for authorization and if the > password is coming over in clear text, you could just do a bind against AD > for authentication. Correct? Yes. But this won't work for PEAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

external script stays in <defunct> state after executing
by rashad 29 Jun '05

29 Jun '05

Still can't solve the problem. External script fired according to acct_users file stays in <defunct> state for every call. acct_users file: DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/sbin/testacct.php" My conf: Debian Linux 3.0 Freeradius: 1.0.4

3 2

RE: PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

See I am not sure if there is an option to increase the debugging level w/out edit the source code. If I have not choice to I will edit the source code to increase debugging level. __________________________ Puneet Talwar -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, June 29, 2005 2:04 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Can you please tell me which source code to modify? The source code to pam_radius_auth? You did say you wanted more debugging information from it. Why would you edit the source code to anything else? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

How can i authenticate my users against Active Directory?
by Schuster Christian 29 Jun '05

29 Jun '05

Hi @ all, I'm a freeradius newbie and try to authenticate a user against a active directory . My freeradius has version 1.0.2 I googled a lot and found differend hints how to implement this. (ntlm, pam-module), but no configuration example. Which of these ways is the securest way? Are there any other possibilities? Are there any manuals/helps or can someone discribe me how to implement this? thx Christian Schuster

4 5

Re: PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

Can you please tell me which source code to modify? Thanks ------Original Message------ From: Alan DeKok To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Sent: Jun 29, 2005 1:06 PM Subject: Re: PAM_RADIUS_AUTH "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I would like to know is there any way to increase the debug level on > PAM_RADIUS_AUTH module. Source code modifications. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------- Sent from my BlackBerry Wireless Handheld

2 1