October 2006 - Freeradius-Users - lists.freeradius.org

WPA authentication works only with MacOS clients
by Josh Shamir 16 Oct '06

16 Oct '06

Hello all, I'm using WPA with EAP-TTLS and PEAP with a MacOS .Authentication works fine (even if enough slowly). The problem is that I can't authenticate WinXP client. I've readed that for using EAP-TTLS are required some other supplicant like SecureW2. Is SecureW2 required also for PEAP? Thanks for attention Best Regards, Josh

3 4

RE: Re:Help: How to authenticate additional attribute
by Garber, Neal 16 Oct '06

16 Oct '06

> Cisco AP's have a "dot11 location" config. stmt., I should also have mentioned that the "snmp server-location" config. stmt. controls the Location-name. For more info, see http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124newft /124t/124t2/ht_wispr.htm

1 0

Re: NAS Documentation
by Kevin Bonner 16 Oct '06

16 Oct '06

I read the mailing list... please send there in the future. On Sunday 15 October 2006 03:04, affora deeb wrote: > do u know about IAS windows server 2003 configuration with NORTEL NAS Nope, don't have a clue. I try to avoid any windows that can't stand against a harsh external environment. Maybe someone else on the list can help you with the issues you're finding. -Kevin

1 0

Autoreply: Reid Canavan is on vacation.
by Reid Canavan 16 Oct '06

16 Oct '06

I will be out of the office starting 10/16/2006 and will not return until 10/23/2006. I will respond to your message when I return.

1 0

Re: Pam radius authentication
by danieldinu＠rdslink.ro 16 Oct '06

16 Oct '06

anyone??? pls!!! no suggestions at all ? :( Pe 12 Oct 2006, la 12:46, danieldinu(a)rdslink.ro a scris: > >Hello! > >I try to authenticate ssh users logins using pam_radius_auth.so. >On my RedHat 9 I have the following setup: >- freeradius server > - users file: > test Auth-Type := Local, User-Password == "test" > > - clients.conf > client 127.0.0.1 { > secret = secret > shortname = localhost > } > >-pam radius module > - cat /etc/pam.d/sshd >#%PAM-1.0 >auth required pam_securetty.so >auth sufficient pam_radius_auth.so debug >auth required /lib/security/pam_unix_auth.so >account required pam_radius_auth.so debug >password required pam_stack.so service=system-auth >session required pam_stack.so service=system-auth >session required pam_limits.so >session optional pam_console.so > -cat /etc/raddb/server > 127.0.0.1 secret 1 > > >- pam_radius_auth.so is copied in /lib/security >-I created linux user test with home directory /home/test , without setting up a password >- freeradius started with radiusd -X > >Problem is that, when I trie to connect to this machine using ssh, the radius server receives the request, processes it, sends access-accept, but the ssh session is ended, without the user being really logged in !!! I don't know the reason why the user gets rejected... > >tail -f /var/log/secure >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: authentication succeeded >Oct 12 11:06:27 D-Server sshd[26585]: Accepted password for test from 10.243.30.42 port 2847 ssh2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got user name test >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Sending RADIUS request code 1 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: authentication succeeded >Oct 12 11:28:30 D-Server sshd[26590]: Accepted password for test from 10.243.30.42 port 2881 ssh2 > >from radiusd -X : >rad_recv: Access-Request packet from host 127.0.0.1:27615, id=253, length=97 > User-Name = "test" > User-Password = "test" > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = "sshd" > NAS-Port = 26590 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "512wyse83.cosmote.rom" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry test at line 80 > modcall[authorize]: module "files" returns ok for request 0 >modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type Local >auth: type Local >auth: user supplied User-Password matches local User-Password >Sending Access-Accept of id 253 to 127.0.0.1 port 27615 >Finished request 0 > >thank you! > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: module for deleting attributes
by Nicolas Baradakis 16 Oct '06

16 Oct '06

Lars Ricken wrote: > How can I understand you developed module for deleting attributes > from incoming radius requests. Can You send it to me via email or > give a link where I can download it.It's very important for me. I don't think there's any point in deleting attributes in the incoming request. Just don't check those attributes in authorize, that's all. If you've configured FreeRADIUS as a proxy, you want to delete the undesired attributes from the proxy request, not the incoming request. In this case you could use the attr_filter module in the pre-proxy section. See the rlm_attr_filter(5) manpage. PS: Please don't reply to freeradius-devel, this is a question for the freeradius-users mailing list. -- Nicolas Baradakis

1 0

Machine + User Authentication
by Muhammad Hammad 16 Oct '06

16 Oct '06

Hello everyone I would appreciate if anybody could tell me whethere FreeRADIUS supports the following scenario or not. Currently, we have Foundry FastIron Edge 2402 switch. What we need is to deploy 802.1x user AND machine authentication. 1) If (Machine authentication is successfull) then (If User authentication is successfull) Drop the user in their respective VLAN. 2) If (Machine authentication is successfull) then (If User authentication is NOT successfull) Drop the user in their default restricted VLAN. 3) If (Machine authentication is NOT successfull OR there is no machine certificate) Drop the user in their default restricted VLAN OR Dont allow access to the switch port. Now the question I want to ask is, whethere FreeRADIUS supports the third case i.e. to disallow access OR drop in restricted vlan if machine authentication fails. Cisco Machine Access Restriction 4.0 for Windows ( http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_data_sheet09…) claims to support the abaove scenario. It would be great if someone could also tell me the relative parameters/configuration for the above particular case, if FreeRADIUS supports it. Regards Hammad

1 0

Accounting-Response Log ??
by Rio Yang 16 Oct '06

16 Oct '06

Hi, I have two radius servers. (Freeradius and Juniper SBR). Freeradius server be a radius proxy to proxy all auth/acct requests to Juniper SBR. Then I sometimes found there are some accounting-stop request don't arrival to Juniper SBR. Because Freeradius server and Juniper SBR is in the different subnet and through firewall. I think this problem may cause by firewall. In the radius accounting communication model there should have request and response. Is freeradius log the accounting-response result ? How to enable it ? I want to this log to identify the problem. Thanks. Rio Yang

1 0

Mobile Phones Radius Authentications
by nsuralullec 16 Oct '06

16 Oct '06

Hi to all; I'm setting up GPRS with radius authentication. Authentication accepted when using the GPRS phone as modem for internet connections(PPP). Authentication fails when using GPRS WAP applications. GPRS phones security features was enabled including the username and password but the radius server keeps on rejecting connections. Is there any similar cases thats being resolved? Thanks for any replies... Regards, NUS __________________________________ What will the world find in 2020? Leave a part of your 2006 in the Yahoo! Time Capsule. Contribute now! http://timecapsule.yahoo.com/capsule.php?intl=ph

3 6

Any luck with 802.1x authentication using TTLS with MSCHAPv2 ?
by Mohammed Petiwala 15 Oct '06

15 Oct '06

Hi Alan, Mak: I tried the patch on both freeRADIUS 1.1.2 and freeRADIUS 1.1.3 - had seen similar problems with wpa-supplicant and freeRADIUS with EAP-TTLS/MS-CHAPv2 and hence had to enable wpa_workaround flag to get past the issue... (which was incorrect) But Mak's patch resolves the issue and now I can get EAP-TTLS/MS-CHAPv2 to work successfully without the workaround. I would suggest this patch go in as high-priority fix as part of the next release as it resolves the existing issues with the inner phase-2 mschapv2. Thx. Regards, Mohammed. Mak Moussa mmoussa at mmoussa.com Thu Oct 12 19:06:59 CEST 2006 Previous message: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? Next message: rewriting Frame-IP-Netmask Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Thanks to Alan Buxey for reattaching the files in a tgz file. Resending again. Mak -----Original Message----- From: freeradius-users-bounces+mmoussa=mmoussa.com at lists.freeradius.org [mailto:freeradius-users-bounces+mmoussa=mmoussa.com at lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, October 12, 2006 5:44 AM To: FreeRadius users mailing list Subject: Re: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? "Mak Moussa" <mmoussa at mmoussa.com> wrote: > He tested the patch successfully using v1.1.3 on Linux and both TTLS-mschap > and TTLS-mschav2 authentications worked fine. > I tested the patch using v1.1.2 on Freebsd 5.3 and got the same successful > authentications. Great. > Please review the attached patch for any additional improvements as needed. Hmm... > Content-Disposition: attachment; > filename="winmail.dat" Could you attach the files in a *standard* format (i.e. non-Outlook), or put them on a web page? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0