October 2006 - Freeradius-Users - lists.freeradius.org

Called-Station-ID and Cisco AP's
by Walter Reynolds 07 Oct '06

07 Oct '06

I am just starting looking into this, but it seems that the Called-Station-ID being logged from my Cisco AP's is off: What I see in the log is the following: Called-Station-Id = "0017.0f8c.25c1" However, the cisco itself shows something slightly different: Mac Address 0017.0f8c.25c0 As you can see, the last digit is off. This is not the only one. Another example.... Called-Station-Id = "0013.6078.7661" MAC Address 00:13:60:78:76:60 The only other system I have on the system (Bluesocket) does not have this discrepancy. I have searched through the archives, but trying to limit search by Called-Station-Id and cisco does not help a lot. Have others seen/noticed this before? If so any pointers to information on it? If not, can anyone else look and see if they are having a similar issue? Here is the information on AP Cisco Aironet 1200 IOS Firmware: 12.3(8)JA2 Using FreeRadius 1.1.2 The only conf file that even mentioned called station ID (that I am using) is radiusd.conf. Here is the subsection #attr_rewrite sanecallerid { # attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" # searchin = packet # searchfor = "[+ ]" # replacewith = "" # ignore_case = no # new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended # to the original string # append = no #} As it is commented out I do not see that it could be the issue. If you want any conf files let me know, I just did not want to clog up the message with lots of conf info that is not useful. Thanks to all. -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

5 9

Can Simultaneous-Use be used with EAP-TLS?
by Jason Wittlin-Cohen 06 Oct '06

06 Oct '06

I am using EAP-TLS for authentication so I have no use for a backend db to check username/password credentials. However, I would still like to prevent simultaneous logins with the same certificate. Is this possible without having an sql database? I have "Simultaneous-Users := 1" set in the "users" configuration file but it doesn't seem to do anything. Clients are being checked against this line in "users" DEFAULT Simultaneous-Use :=1

1 0

Can Session-Timeout be used to force users to re-authenticate?
by Jason Wittlin-Cohen 06 Oct '06

06 Oct '06

Is it possible to use the Session-Timeout setting to force wireless clients to re-authenticate with the RADIUS server at a given interval? Unfortunately my Acesss Point does not provide this functionality, so I either have to do it via a supplicant such as the Funk Odyssey Client or on the Freeradius server. I am running Freeradius 1.1.3 on a Debian Sarge 3.1 system and I'm using EAP-TLS for authentication. I don't think it matters but I'm using a Buffalo WHR-G54S Wireless Router with the DD-WRT v23 SP2 firmware. I am trying to force my wireless clients to re-authenticate with the RADIUS server every 30 minutes (1800 seconds) with the Session-Timeout setting. Currently I am testing with just one user, and the Session-Timeout = 1800 setting is being sent with the Radius Access Accept message (I can see it in the Accept Accept message when I run in debug mode). However, this seems to have no affect. The user does not re-authenticate at the given interval. Here's my setting from the users file: "Jason Wittlin-Cohen" Session-Timeout = 1800

2 1

freeradius bug?
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, why if I have in my clients.conf this configuration: client localhost { secret = testing123 nastype = other shortname = localhost login = test password = test } and I try #radtest test test localhost testing123 say: Sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host locahost:1812, id=231, length=20 Why is Access-Reject? There is a bug of freeradius? some idea?

3 4

clients
by Abel Monzon 06 Oct '06

06 Oct '06

I have a question.... Is possible no have secret for X client? Tanx, Abel

1 0

dialup_admin
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, I need administer my freeradius+mysql, and I ask: There is some utility in addition to dialup_admin? Tanx

1 0

I want to use freeradius to manage my socks5 proxy
by taft 06 Oct '06

06 Oct '06

I configured a socks5 proxy. This question for me is how to authenticate users who I permit to use my socks5 proxy and account them--such as period and data flow--- I do not know how to integrate socks5 authentication and freeradius together. Is there any one have any idea or can provide me some docs. to help me. Thank you very much -- please visit my blog http://blog.csdn.net/taft

2 3

free radius ntlm_auth problem
by Andris 06 Oct '06

06 Oct '06

Hello! I sucesfully installed a free radius server with ntlm_auth, but have one problem. I have user names in Windows 2003 domain with whitespaces like 'user 1' 'user 2' (i know this is a bit lame, but they was created about years ago and be wery hard to change), these username with whitespaces ntlm_auth string won't authorize. Usernames without whitespaces authorize succesfully. When run ntlm_auth manal and write usernames like 'user 1' than work. And i want put a NT group requirment too like a 'Domain Users' ntlm_auth string is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" How can I fix this ? Thanks! P.S. Sorry my englisg isnt perfect :) Andris

3 2

users-file overruling anything else
by florian.prester 06 Oct '06

06 Oct '06

Hi, I am using freeradius+perl+ldap. Meaning for every request I get the users information from a LDAP-Server, run it through some perl-code to distinguish some users form others for some reason (:-)). Now my problem are users not listed in the ldap-system. I want to use the users-file to overrule the ldap-system. Meaning if a user is found in the users-file and the password matches, ignore everything else. I think I had it working already, but somehow it does not work anymore! :-( My authorization-section looks as follows: authorize { preprocess chap mschap eap # # Read the 'users' file files # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # needed to get user information perl # needed to twist the users a little bit :-) } my users-file is standard, containing: "help" Auth-Type := Local, User-Password == "support" Idle-Timeout := 30 Thanks for your help, Florian Prester

2 1

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> LAN MAC Address: 00:17:94:EE:D8:C6 > Radio 1 MAC Address: 00:17:0F:8C:25:C0 > Radio 2 MAC Address: 00:17:0F:90:25:C0 At the risk of this sounding like a stupid question... If you do a show run in enable mode, do you see a mac-address command after the radio interface (i.e., have you manually changed the MAC addr of the radio)? It is possible to manually change it: int d0 mac-address 0017.0f8c.25c1 Even if you do this, a "sh int" command will still show the real MAC address (I just tried this on one of my test APs).

1 0