June 2005 - Freeradius-Users - lists.freeradius.org

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

2 1

radclient: received response to request we did not send.
by Juan Nin 02 Jun '05

02 Jun '05

Hi, I'm trying to use radclient in order to disconnect users, with the following PHP script: <? $framed_ip = 'xxx.xxx.xxx.xxx'; $cisco_ip='aaa.aaa.aaa.aaa'; popen("/bin/echo 'Framed-IP-Address=$framed_ip' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x $cisco_ip disconnect secret", 'w'); ?> But I receive the error: Sending Disconnect-Request of id 3 to aaa.aaa.aaa.aaa:1700 Framed-IP-Address = xxx.xxx.xxx.xxx rad_recv: Disconnect-NAK packet from host aaa.aaa.aaa.aaa:1645, id=3, length=20 radclient: received response to request we did not send. This is the tcpdump (where bbb.bbb.bbb.bbb is the IP address of the server where I'm running the script from): 21:07:59.171286 IP bbb.bbb.bbb.bbb.40122 > aaa.aaa.aaa.aaa.1700: UDP, length 26 21:07:59.315031 IP aaa.aaa.aaa.aaa.datametrics > bbb.bbb.bbb.bbb.40122: RADIUS, Unknown Command (42), id: 0x03 length: 20 On my Cisco AS5300 I've added: aaa pod server auth-type any server-key secret What can be the problem?? Thanks in advance, Juan

2 1

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

1 0

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

1 0

Connecting to Windows server running Radius from a RH Linux
by Talwar, Puneet (NIH/NIAID) 02 Jun '05

02 Jun '05

I have successfully installed FreeRadius on my RH Linux box and I am trying to figure out how I can connect to the radius server which is running on a W2k server. I have add my RH Linux box as a client on the server I have the key as well. My question is how do I configure my Linux box to talk to the Radius server? I see a lot of docs on client and server setup, but I am not able to find a doc if I have a Radius server running on W2k, what steps I need to go have my RH Linux box talk to the Radius Server user authentication. FYI, Radius server is tied into Active Directory (AD) for authentication and other services. Thanks.

2 1

Connecting, disconnects, connects and crash.. Any ideas? I'm about to explode.
by Jean-Sébastien Nicaise 02 Jun '05

02 Jun '05

This is the same thing that previous post, I've put all the debug info this time and it's quite long (812 lines), although I have clearly delimited what was happening, ie: deamon starting, first connect, second connect, then no more. Basically it connects, disconnects, connects, then crashes the AP and nothing works anymore. I am trying to make Radius work with EAP-TLS, I used openssl to generate certificates, I generated like 5-6 different sets of certificates to be sure. any help please? :S thanks, Jean-Sébastien Nicaise

1 0

Proxy EAP-TTLS inner auth type
by Sayantan Bhowmick 02 Jun '05

02 Jun '05

Hi, I was tryin to figure out if it is possible to proxy only the inner auth type of EAP-TTLS. The only information I could find on this is: http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042098.html This talks about PEAP. Is the same possible for EAP-TTLS? Also i could not find any information about the attribute "proxy_tunnel_request_as_eap" mentioned in the previous mail. Can someone please point me to any documentation on how to configure the server to terminate the tunnel and proxy the inner auth type. Thanks in advance. Regards, -Sayantan

2 1

LEAP
by Luis Daniel Lucio Quiroz 02 Jun '05

02 Jun '05

Ehlo We are usign Cisco1200 AP for roaming, but AP needs to auth into radius. Because CISCO it must use LEAP. But it fails on this rlm_eap: EAP/leap rlm_eap: processing type leap rlm_eap_leap: No User-Password or NT-Password configured for this user rlm_eap: Handler failed in EAP/leap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 3 EAP with TLS and PEAP works well. LDAP user exists uid: AP-DATI userrPassword: cisco1234 sambaNTPassword: 3B298390489F668CA3C38047C7FE1266 sambaLMPassword: 8BE57A0FA91F460C19F10A933D4868DC How should I fix this? Regards,

4 6

Re: Authenticate to eDirectory
by Matthew Hunter 02 Jun '05

02 Jun '05

It works with eDirectory on Netware. We have freeradius using edirectory on a Netware box as the authenication source for our 802.1x WLAN. Works great. >>> dhesse(a)mmrcsl.org 6/2/2005 8:46 AM >>> Does this only work with versions of eDirectory running on Linux or will it work with eDirectory on Netware 6.5 Daniel D. Hesse Technology Administrator Methodist Manor Retirement Community 712-732-1120 Ext.116 dhesse(a)mmrcsl.org >>> sbhowmick(a)novell.com 6/2/2005 12:05 AM >>> Hi, FreeRADIUS 1.0.2 has been integrated with eDirectory to support wireless authentication. See (http://www.novell.com/documentation/edir_radius/index.html) You can also use FreeRADIUS 0.9.3. That supports LDAP authentication to eDirectory. In this case you could try EAP-TTLS + PAP. http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042093.html Hope this helps. Regards, -Sayantan >>>carnold5(a)nc.rr.com 06/01/05 12:35 pm >>> Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Running radiusd as an unprivileged user
by Andrey 02 Jun '05

02 Jun '05

Hi everyone, Just a quick question about running radiusd as a user other than root. Do I need to compile the server as that user? And do I need to do anything else other than uncomment the lines in radius.conf? Is there a help/doc file about this? Thanks a bunch. ======== Andrey

3 4