January 2006 - Freeradius-Users - lists.freeradius.org

Dialupadmin and FreeRADIUS communication issues
by radius＠smartfoxsoftware.com 04 Jan '06

04 Jan '06

Hello, I've installed Ubuntu Linux 5.10 on a machine. I compiled the latest version of OpenSSL and FreeRADIUS and installed Apache on the machine via the XAMPP package (which has PHP5, MySQL). Everything seemed to be going good but whenever I configured Dialupadmin to begin inputting users into FreeRADIUS, Dialupadmin complains about not being able to find the table 'radius.userinfo'. I've tried installing the schema found in the FreeRADIUS package and tried the one in the Dialupadmin package and neither seem to work. Is this a Dialupadmin error or FreeRADIUS error? I've tried looking on the net concerning this error but have not seen anything regarding it. I'm not very proficient in MySQL but I've been using phpmyadmin to view the radius table. If anyone has any solutions to this problem, it would be greatly appreciated. I'm looking to setup a Free WISP in my area and this would have me ready to go. Should I use a different setup? Should I try and use source for everything? I had bad luck installing the needed software from the packages provided by the Ubuntu repositories.

3 2

RE: wireless - freeradius - MS ldap
by Alhagie Puye 04 Jan '06

04 Jan '06

> >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 4, 2006 9:27 AM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > >Here is the output of my RADIUS server. I verfied the > >account on the LDAP server as a domain admin > > > >rad_recv: Access-Request packet from host 10.1.1.27:32773, id=254, > >length=59 > >--- Walking the entire request list --- > >Waking up in 31 seconds... > >Threads: total/active/spare threads = 5/0/5 Thread 1 got > >semaphore Thread 1 handling request 0, (1 handled so far) > > User-Name = "radtest" > > User-Password = "Passw0rd" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 0 > > Processing the authorize section of radiusd.conf > >modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "radtest", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 152 > > modcall[authorize]: module "files" returns ok for request 0 > >rlm_ldap: - authorize > >rlm_ldap: performing user authorization for radtest > >radius_xlat: '(uid=radtest)' > >radius_xlat: 'ou=Local Users,dc=name,dc=serverdm,dc=domain,dc=edu' > >rlm_ldap: ldap_get_conn: Checking Id: 0 > >rlm_ldap: ldap_get_conn: Got Id: 0 > >rlm_ldap: attempting LDAP reconnection > >rlm_ldap: (re)connect to name.serverdm.domain.edu:389, Can you resolve name.serverdm.domain.edu successfully? Please verify that too. > >authentication 0 > >rlm_ldap: bind as powerful/userspass to name.serverdm.domain.edu:389 > >rlm_ldap: waiting for bind result ... > >rlm_ldap: LDAP login failed: check identity, password Verify first that you can infact query Active Directory with this username/password combination. There is a utility called ldapsearch. I believe it comes with OpenLDAP. Use that to directly query AD for verification. Here is an example: ldapsearch -LLL -h name.serverdm.domain.edu -x -b 'dc=domain,dc=com''(samaccountname=powerful)' -D powerful -w userspass What does your "ldap" section in radiusd.conf look like? Can you please provide copy? This will make sure that the credentials are correct or not. > >settings in ldap section of radiusd.conf > >rlm_ldap: (re)connection attempt failed > >rlm_ldap: search failed > >rlm_ldap: ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns fail for request 0 > >modcall: group authorize returns fail for request 0 There > >was no response configured: rejecting request 0 Server > >rejecting request 0. > >Finished request 0 > >Going to the next request > >Thread 1 waiting to be assigned a request > >rad_recv: Access-Request packet from host 10.1.1.27:32773, id=254, > >length=59 > >Sending Access-Reject of id 254 to 10.1.1.27:32773 > >--- Walking the entire request list --- > >Waking up in 3 seconds... > >--- Walking the entire request list --- > >Cleaning up request 0 ID 254 with timestamp 43bbea42 Nothing > >to do. Sleeping until we see a request. > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: wireless - freeradius - MS ldap
by Dickson, John 04 Jan '06

04 Jan '06

Here is the output of my RADIUS server. I verfied the account on the LDAP server as a domain admin rad_recv: Access-Request packet from host 10.1.1.27:32773, id=254, length=59 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "radtest" User-Password = "Passw0rd" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "radtest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for radtest radius_xlat: '(uid=radtest)' radius_xlat: 'ou=Local Users,dc=name,dc=serverdm,dc=domain,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to name.serverdm.domain.edu:389, authentication 0 rlm_ldap: bind as powerful/userspass to name.serverdm.domain.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32773, id=254, length=59 Sending Access-Reject of id 254 to 10.1.1.27:32773 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 254 with timestamp 43bbea42 Nothing to do. Sleeping until we see a request.

1 0

Re: Roaming with WPA-Enterprise/Radius
by David Mitton 04 Jan '06

04 Jan '06

802.11f is different than most IEEE 802 standards, in that it's a "Recommended Practice" not a standard. I'm not aware of any implementations, but I'd like to hear of them. Anyways, the IEEE 802 SA has withdrawn 802.11F as an RP as of 12/08/2005. Dave. ----- Original Message ----- From: "Artur Hecker" <hecker(a)wave-storm.com> To: z.ori(a)morehead-st.edu, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Roaming with WPA-Enterprise/Radius Date: Wed, 4 Jan 2006 14:16:08 +0100 > > hmmm, seriously though: > > - does anyone know of any APs on the market which support 802.11f? > - has anyone ever seen a reasonable non-proprietary definition of the > container content for the context transfer? > - has anyone ever thought of implementing the support for 802.11f into > freeradius? (i know alan hates its double-nested attributes :-) ) > - what about the preauthentication definitions in 802.11i? > > > ciao > artur > > > On 4 Jan 2006, at 14:07, Zoltan Ori wrote: > > > On Wednesday 04 January 2006 07:07, DI PAOLA ., VIERI wrote: > >> > >> Is there a way of "caching" or "pre-authenticating" or "propagating > >> authentication between APs"? > >> > >> Has anyone found a solution to this roaming problem in case one uses > >> WPA-Enterprise/Radius? > >> > > > > IAPP - IEEE 802.11F > > > > > > Zoltan Ori > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ > > users.html > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

802.1x, WinXP and LDAP
by Gary Algier 04 Jan '06

04 Jan '06

Hello: I am trying to get an HP Procurve 2650 Ethernet switch to use Freeradius 1.0.5 for 802.1x auth. The backend is Sun's directory server with all the necessary SambaNTPassword attributes, etc. to make Samba work. The client is a WinXP system. I am using the builtin supplicant. I can get it to work with the "Automatically use my Windows login..." box _unchecked_, but not with it checked. I would like to use the checked mode as then the user does not need to "click here to select a certificate or credentials for connection to the network". When the box is not checked, I get to type any value I want for the user ID and password. I can then get authenticated and the switch connects me to the proper VLAN. When the box is checked, I cannot get authenticated and the switch puts me on the "guest" VLAN. I should be able to authenticate, but the ID comes across as something like "MALACHITE\gaa". The first part is the netbios hostname and the second is the real ID. I have setup the hints, users and radiusd.conf files with: ---------------------------------------------------------------------------------------------- hints: ... DEFAULT NAS-IP-Address == 172.25.16.9, User-Name =~ "^(.*)\\\\(.*)" Hint = "8021XUSER", Stripped-User-Name = `${2}` ... users: ... DEFAULT Hint == "8021XUSER" Fall-Through = 1 ... radiusd.conf: ... ldap { server = "ldap.ulticom.com" basedn = "dc=ulticom,dc=com" filter = "(&(objectclass=person)(uid=%{Stripped-User-Name:-%{User-Name}}))" do_xlat = yes base_filter = "(objectclass=*)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ... ---------------------------------------------------------------------------------------------- The problem seems to be that the hostname is not always stripped. If I compare the output of "radiusd -X" between the two scenarios I see that the "unchecked" configuration does a lot of ldap lookups like: ---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 172.25.16.9:1025, id=208, length=193 Framed-MTU = 1480 NAS-IP-Address = 172.25.16.9 NAS-Identifier = "hp-50-9" User-Name = "gaa" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-85-40-71-ff" Calling-Station-Id = "00-14-22-dc-9b-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0201000801676161 Message-Authenticator = 0x29393306cb95a1c78586d546cf5eb462 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gaa radius_xlat: '(&(objectclass=person)(uid=gaa))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.ulticom.com:389, authentication 0 rlm_ldap: bind as / to ldap.ulticom.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa)) rlm_ldap: checking if remote access for gaa is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value ABABABABABABABABABABABABABABABAB & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value CDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user gaa authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 176 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 ---------------------------------------------------------------------------------------------- Eventually somebody is happy with this sequence and I am "in". With the "checked" configuration all the early lookups work, but the last lookup fails: ---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 172.25.16.9:1025, id=222, length=254 Framed-MTU = 1480 NAS-IP-Address = 172.25.16.9 NAS-Identifier = "hp-50-9" User-Name = "MALACHITE\\gaa" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-85-40-71-ff" Calling-Station-Id = "00-14-22-dc-9b-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" State = 0xe5aab6b483e09694dcbd98eb81ac64bf EAP-Message = 0x020600291900170301001ef47b2a4c59a72fa63123f178383e6518a535662859ed121d2819831f649f Message-Authenticator = 0x9b8b7d5de51ffffde87cfabe52688fbc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 hints: Matched DEFAULT at 36 radius_xlat: 'gaa' modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for MALACHITE\gaa radius_xlat: '(&(objectclass=person)(uid=gaa))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa)) rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value EFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEF & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value ABABABABABABABABABABABABABABABAB & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user MALACHITE\gaa authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 176 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - MALACHITE\gaa rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02060012014d414c4143484954455c676161 PEAP: Got tunneled identity of MALACHITE\gaa PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to MALACHITE\gaa PEAP: Sending tunneled request EAP-Message = 0x02060012014d414c4143484954455c676161 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MALACHITE\\gaa" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for MALACHITE\gaa radius_xlat: '(&(objectclass=person)(uid=MALACHITE))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=MALACHITE)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 5 modcall: group authorize returns notfound for request 5 ---------------------------------------------------------------------------------------------- So, why don't my regular expressions apply during the group authorize? How can I fix the group authorize? Perhaps I don't need it. Some day I may use it for controlling VLAN assignment, but for now I would be happy to just differentiate between "auth" and "not auth". -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

1 0

Roaming with WPA-Enterprise/Radius
by DI PAOLA ., VIERI 04 Jan '06

04 Jan '06

Hello, I have freeRadius version 1.0.5 on gentoo Linux (r3). I am using three Linksys WAP54G access points. I've managed to roam seamlessly both with Broadcom and Intel wireless laptops. However, this is true for open APs or with WEP encryption. If I use WPA-Enterprise with a Radius server, there's a long delay when switching between APs (10 seconds). The test environment is as follows: freeRadius.org Gentoo Linux server --- 3 Linksys WAP54G APs configured with WPA-Enterprise w/Radius --- 1 roaming laptop The delay seems to be due to re-authentication with the freeRadius server and that seems to be "expensive". Is there a way of "caching" or "pre-authenticating" or "propagating authentication between APs"? Has anyone found a solution to this roaming problem in case one uses WPA-Enterprise/Radius? Regards, Vieri

3 2

Doc's?
by Jonathan Carpenter 04 Jan '06

04 Jan '06

I am wanting to replace radiator radius with freeradius, but I can not find any documentation on how to setup and configure freeradius. I have visited the wiki page but do not see any howto's or anything. Can someone send me a link to the documentation on how to setup and configure freeradius and dialup_admin? Thanks, -- Jonathan Carpenter

2 1

CiscoAP->Freeradius->AD->ISA(ntlm authentication)
by Konne 04 Jan '06

04 Jan '06

hi @ all, is it possible to do following: my wireless-clients will authenticate through a ciscoAP. the client will be routed automatically to the chillispot login page. on the same server is freeradius installed. Freeradius looks in the ActiveDirectory if the user exists and has the rights to connect to the internet. if the authentication is ok, the user must surf over a ISA because there is installed websense. we have a windows domain and so we use a secure ntlm authentication. is it possible to have a transparent authentication through the isa-server. i mean if the client is in the condition that he can send the ntlm authentication, that he doestn't have to authenticate twice times. one time on the chillispot and the second on the isa server. is there any possibilty? my network, all cisco network devices (aironet 1424, catalyst 3750) (( )) wireless-clients (( )) AP - - - - - [routed network/VLANS]- - - - - freeradius/chillispot (( )) | | | | | ActiveDirectory/LDAP | ISA/Websense [ntlm authentation required] | | Firewall | Router | Internet thx

2 2

DNS non reachable
by Santiago Balaguer García 04 Jan '06

04 Jan '06

2 1

RE: wireless - freeradius - MS ldap
by Dickson, John 03 Jan '06

03 Jan '06

I am sorry. I received a request for the data I had already sent, and I ran the tests too. I will refrain. John -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Alan DeKok Sent: Tuesday, January 03, 2006 2:17 PM To: FreeRadius users mailing list Subject: Re: wireless - freeradius - MS ldap "Dickson, John" <JDickson2(a)mccneb.edu> wrote: > I sent this out earlier. Ah. Having been told that what you sent earlier is inadequate, your response is to re-send it. It's OK that you're a beginner. It's *not* OK to not read the FAQ or documentation which describe exactly how to test the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1