March 2006 - Freeradius-Users - lists.freeradius.org

RE: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

Using the standard schema, no it doesn't. However adding an nshortname field on *check/*reply allows us to define either a shortname from the nas table, or a null to achieve this. I was however hoping there was a nicer way. Regardless, I appreciate the time :) Cheers, John -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 31 March 2006 04:03 To: FreeRadius users mailing list Subject: Re: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > This is a single username, but the return being selective based on NAS. > > For example: > > Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 I'm not sure that the SQL module supports this. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Re: PsionTeklogix 9150
by Magnus Willigens 31 Mar '06

31 Mar '06

tried to get it working with handhelds of seriestype 7035... they just do leap (cisco) but the first series of the basestations are build with orinocco cards. ==> so this does not work. with xp clients md5 worked fine. tried tls and peap: the authentification worked but it does not share ip (no static and no dhcp). i don't know what i did wrong. i read that the authentificator has to do a workaround for the transmitted eapol package because microsoft changes the first 2 bits of the haeder (????). with xsupplicant it worked quiet well, so there must be a option for the 9150... if you get it working i would be very pleased if you could inform me how to do it. the ap only provides tx changing for the 4 static wep-keys and changes it after a standard period of 60 sec i think. there is no dynamic rekeying possible. our ap was too old to get it working with radius. and because of the fact that this are ap's for industrial use it would be very expensive to buy about 15 new ones... :) > -----Ursprüngliche Nachricht----- > Von: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Gesendet: 30.03.06 00:32:37 > An: <freeradius-users(a)lists.freeradius.org> > Betreff: PsionTeklogix 9150 > Hello, > > i would like to use freeradius authentication for psionteklogix 9150, instead of local authentication. > > Has sombody an experience with such client? > > thks, daniel > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

I think you missed the question then. This is a single username, but the return being selective based on NAS. For example: Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 The radcheck would be at the wrong phase to do this. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 29 March 2006 18:56 To: FreeRadius users mailing list Subject: Re: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > Can you give me an example in SQL please of how I might implement it using this fashion? You put the attribute name, operator, and value into SQL. > Is it not just a case of if it passes radcheck, then it will respond with radreply? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

2 1

Freeradius Expiration Date
by Atkins, Dwane P 31 Mar '06

31 Mar '06

I have looked into the db_mysql.sql and found that their was start and stop dates in the radacct. If I can get freeradius to use the radcheck table, does this mean it will automatically see the radacct table and use input from this table as well? Thanks Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

4 3

no sql log for proxied Accounting
by Ryan Melendez 31 Mar '06

31 Mar '06

Hello, I'm trying to configure freeradius to only sql log Accounting packets that are not proxied. I see the note in the config file that reads "accounting requests which are proxied are also logged in the detail file". That is fine, but I can't have it log to sql. In general I would only like to sql log Accounting records associated with realms configured for accthost = LOCAL. Has anyone else had success with this? radiusd: FreeRADIUS Version 1.1.0, for host , built on Mar 6 2006 at 20:41:50 Copyright (C) 2000-2003 The FreeRADIUS server project. Thanks, Ryan

1 0

VSA and other attributes in Access-Accept
by Mohammed Petiwala 30 Mar '06

30 Mar '06

Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

1 0

== error
by Cris Boisvert 30 Mar '06

30 Mar '06

Radius is up and running and authenticates fine.. But everytimes someone authenticates I get the "Error: Invalid operator for item Suffix: reverting to '=='" Message in the radius.log This is the error log below. Wed Mar 29 19:35:09 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Mar 29 19:35:09 2006 : Info: Ready to process requests. Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Auth: Login OK: [test(a)domain.com/test] (from client gw2.domain.com port 0) Thanx

4 6

Problem with ntlm winbind - No User-Password configured. Cannot create LM-Password
by Konne 30 Mar '06

30 Mar '06

hi my problem is following: ....... auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lehrer with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 5b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xa050d40 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 67 to 10.92.124.2:1645 EAP-Message = 0x010900261900170301001b0e5cfcbdba58b6fa4dff4d6d233650499c90b171a8c8a5ea5c7269 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd4008f5215934f6b818f5c3915e05b3 Finished request 6 Going to the next request Waking up in 5 seconds... i searched on the web but i found nothing. someone has an idea? thx

3 4

Telephony-Summit Announcment
by Peter Nixon 30 Mar '06

30 Mar '06

Hi Guys I will be giving the keynote speech on "AAA for fun and profit" at the Free Software/Open Source Telephony-Summit 2006. Hope to see some of you there. -Peter Free Software/Open Source Telephony-Summit 2006 Tuesday, May 2nd 2006 Wiesbaden, Germany For the third time the German Unix User Group (GUUG - www.guug.de) organises the Free Software/Open Source Telephony-Summit, an international workshop and technical conference for developers and users of Free Software/Open Source telephony applications and for those who want to know more about what the Free Software/Open Source world has to offer in the telephony and VoIP sector. For the first time the event will this year be held in association with LinuxTag (www.linuxtag.org) Europe's most important Open Source event. This way participants of the Telephony-Summit can profit from other LinuxTag events to deepen their knowledge. The all-day conference with two parallel tracks will take place in Wiesbaden, Germany. In the evening a social event is planned and included in the price of 360 EUR. (Students only pay 120 EUR.) Members of the German Unix User Group will get a 10% discount. If you register before April 13th 2006, you'll get an additional 10% early bird discount. Conference participants can visit the LinuxTag exhibition and talks on the next days, which take place nearby. You can also book additional tutorials. The conference program includes presentations from many Open Source projects like Asterisk, Ekiga, and OpenPBX. There are talks about SIP security, RADIUS and LDAP integration as well as reports about efforts to create carrier-class telephony switches. On the weekend before the conference a workshop will be held. This workshop is for invited Free Software/Open Source developers who can meet their peers and work together on new versions of their software, do interoperability tests and discuss their projects. Most developers will also be at the conference, so this is your chance to talk to the developers of your favourite projects. For more information and registration see the website at: http://www.linuxtag.org/2006/en/besucher/konferenzen/3rd-telephony-summit.h… -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

Mac address help
by Mordor Networks 30 Mar '06

30 Mar '06

Hello I have pppoe-server with freeradius and mysql backend working pretty good , thus i still want to know if it is possible to use mac adders with user name and password ? thanks in advanced

1 0