August 2005 - Freeradius-Users - lists.freeradius.org

16bit attributes...
by Wesley Spadola 12 Aug '05

12 Aug '05

BTW, Does FreeRADIUS support 16bit attributes yet? I see a message at http://lists.cistron.nl/pipermail/cistron-radius/2004-January/005824.html says that FR is close to doing it, but I haven't been able to find any information more recently to support this. Thanks, Wes

2 1

Re: LEAP and PEAP protocols
by David Mitton 12 Aug '05

12 Aug '05

LEAP is a proprietary protocol of Cisco's. They have never published a spec, but it has been reverse engineered. (use Google) It is severely flawed. PEAP is in an Internet Draft (v2), but what Microsoft has implemented (v0) and what Cisco supports(v1) are two different derivations of previous versions. You will have to do some archival spelunking to get specs that may agree with the implementations. Good luck! Dave. ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: LEAP and PEAP protocols Date: Fri, 12 Aug 2005 11:10:52 -0400 > > Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: > > I would like to know if any of you has somme information about LEAP and PEAP > > protocols. Does any RFC about them exist? I find nothing in the net. Thanks > > you!!! > > doc/rfc/* > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

conecpt question
by Markus Krause 12 Aug '05

12 Aug '05

hi all! what i am dreaming of (at least regarding radius ;-) ): - wlan with wpa/802.1x using freeradius - clients mostly windows xp, several mac os x, few linux (unimportant right now) - the normal users (known to the local unix network the accesspoint/switch is connected to via nis or (some day) ldap) can access easily just with their username and password, if possible without client certificates (to keep things simple for the user) - some special 'accounts' (for guests etc.) in the freeradius users files can this be realized with freeradius? as far as i understand the conecpts behind this all this means a have to use peap, eap/ttls or eap/mschap-v2, am i right? has anyone set up something like this and can help me with some ideas, hints about trap-doors and other trouble ahead? or even some example configuration files? any help is appreciated! thanks in advance for your help! ;-) markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

3 2

freeradius and oracle LDAP
by Allan Borman 12 Aug '05

12 Aug '05

Hi All, I have put together a freeradius server to authenticate users existing on our oracle LDAP directory. The issue that I have is getting the passowrd from oracle. I can probe the LDAP, get a user authorized and fallback to the default for the passowrd check which is the "system". It all works well. However our LDAP uses oracle on the back end to check the password. Has anyone configured radius to do this? I need to send a request to LDAP to check the password as well. Any suggestion or help or white paper or docs.... is appreciated very much in advance. Regards, Allan Borman allan.borman(a)hccs.edu

3 5

eap-ttls + PAP using Crypt-Password obtained by ldap
by Florian Prester 12 Aug '05

12 Aug '05

Hi, ist it possible to authenticate an user with eap-ttls using PAP with an Crypt-Password? The Crypt-Password is obtained by an LDAP-Server. I can do eap-ttls using MD5/PAP with an cleartext Password. thanks Florian -- -------------------------------------------------------------- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Germany Tel.: +499131 8527813

4 7

LEAP and PEAP protocols
by Juan Daniel Moreno 12 Aug '05

12 Aug '05

Hi everybody again, I would like to know if any of you has somme information about LEAP and PEAP protocols. Does any RFC about them exist? I find nothing in the net. Thanks you!!! Juan

2 1

radzap problem
by Soheb Ahmed 12 Aug '05

12 Aug '05

Hi, I am running FreeBSD5.4 and freeradius 1.0.4 is working fine with radwho and radlast. Problem is when I issue radzap command to any logged user, I get error like " Starting reading configuration file.....port 1813 is used by another radius server". Please help..... Thanks Md. Soheb Ahmed 708 Shahidbagh (First Floor), Dhaka 1217, Bangladesh. Email: soheb707@hotmail.com,soheb707@yahoo.com http://www.geocities.com/soheb707/ __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 4

Message without subject. EAP-MD5
by Juan Daniel Moreno 12 Aug '05

12 Aug '05

Sorry for my last message without subject. I've already repared my problem. I had put in my users file: "test" User-Password := password # Auth-Type = Local Reply-Message = "Hello, %u" and this Reply-Message (which is included in users file as an example) was the reason for my server to don't work. I've only commented this line and the server functions again. Thank you!!! I will ask you something about LEAP protocol soon .

1 0

(no subject)
by Juan Daniel Moreno 12 Aug '05

12 Aug '05

I am doing a client interface for radius authentication. To test my progress I have installed a freeradius 1.0.4 in a SuSe 9.3. I have configured almost all of the protocols (PAP, CHAP, MS-CHAPv1, MS-CHAPv2), but wen I tried to configure EAP-MD5 I had a lot of problems, like "not password found", etc. I changed somethings in my program, then I tested it with WinRadius and it functionned; but when I tested it with my freeradius it didn't function. I would like to know how to configure my freeradius 1.0.4 so it function with EAP-MD5. I send you the error messages in "./radiusd -xxyz -l stdout": rad_recv: Access-Request packet from host 192.168.2.63:1594 <http://192.168.2.63:1594>, id=80, length=55*--- Walking the entire request list ---* Cleaning up request 7 ID 97 with timestamp 42fb4a13 Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 8, (2 handled so far) User-Name = "test" EAP-Message = 0x025200090174657374 Message-Authenticator = 0x3ad1dba850a6555f55e323c808b2acd0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 users: Matched entry test at line 91 modcall[authorize]: module "files" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 82 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 80 to 192.168.2.63:1594 <http://192.168.2.63:1594> Reply-Message = "Hello, %u" EAP-Message = 0x015300160410f37740423ba2a90d29911e943424e5a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78773e2f34d4b5159977be0ef3156654 Finished request 8 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.2.63:1594 <http://192.168.2.63:1594>, id=80, length=88 Waking up in 31 seconds... Thread 5 got semaphore Thread 5 handling request 9, (2 handled so far) User-Name = "test" EAP-Message = 0x0253001804105060ab97739328de2b67fa7930d8633e0008 State = 0x78773e2f34d4b5159977be0ef3156654 Message-Authenticator = 0x3ebc35a4d37c84a293d3a3d4eb0a21fb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 users: Matched entry test at line 91 modcall[authorize]: module "files" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 83 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 9 modcall: group authenticate returns reject for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Thread 5 waiting to be assigned a request*--- Walking the entire request list ---* Sending Access-Reject of id 80 to 192.168.2.63:1594 <http://192.168.2.63:1594> EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 Reply-Message = "Hello, %u" Cleaning up request 9 ID 80 with timestamp 42fb4a30 THANK YOU!

1 0

simultaneous check - MYSQL
by Rohaizam Abu Bakar 12 Aug '05

12 Aug '05

Dear all, FB: 4.11 FR: 1.0.4 mysql: 4.1 >From sql.conf file, I would to add one more checking for simul. use i.e NAS-Port-Type... and changes as below:- Seems working.. Just wanna confirmation regarding "simul_verify_query "... what exactly this line do? I know it do verification .. but for what purpose.. thanks.. # Simultaneous Use Checking Queries ####################################################################### # simul_count_query - query for the number of current connections # - If this is not defined, no simultaneouls use checking # - will be performed by this module instance # simul_verify_query - query to return details of current connections for verification # - Leave blank or commented out to disable verification step # - Note that the returned field order should not be changed. ####################################################################### # Uncomment simul_count_query to enable simultaneous use checking # simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND Acct StopTime = 0" ##simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND Acct StopTime = 0" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND NASPor tType = '%{NAS-Port-Type}' AND AcctStopTime = 0" ##simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPA ddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTi me = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAdd ress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND NASPortType = '%{NAS-Port-Type}' AND AcctStopTime = 0"

2 1