April 2006 - Freeradius-Users - lists.freeradius.org

c module
by kamanashisroy 02 May '06

02 May '06

Please tell me, how can i write a module of my own in c. Also, tell me how can i compile it and use with freeradius(also say the config file changes) -- View this message in context: http://www.nabble.com/c-module-t1532707.html#a4163751 Sent from the FreeRadius - User forum at Nabble.com.

2 1

New PHP for interface
by JasonN 01 May '06

01 May '06

I've have a set of new code for the PHP web-based interface to control users, specifically in relation to the MySQL and FreeRADIUS combo. These features are complete: add user[s] remove user[s] disable user[s] check user[s] password It is however clean PHP with straightforward readable code and is PHP4/5 compliant. Anyone interested in working on this new approach, please let me know. It's simple, nothing fancy, no frames, etc. in the HTML. And, it already works for the basic necessary features. I would like to see a few people code up some additional features. It works right now, as is, for most ISP needs. -- Please address your interest directly to me: imjasonn(a)gmail.com, so you don't get filtered to my FreeRADIUS box. You'll get quicker attention, since I don't read this list every day. -- Jason A. Nunnelley ---------------------------------------- http://www.jasonn.com/

4 4

Cisco Aironet Access-Reject messages
by David Smith 30 Apr '06

30 Apr '06

Hi there, I'm trying to use FreeRadius 1.1.1 to authenticate MAC addresses from a Cisco Aironet 1231 wireless access point. I have the perl module working, and it can compare a MAC address sent by the access point and return the Access-Accept message and the access point is all happy. This is done using the "return RLM_MODULE_OK" message. However, returning an Access-Reject message ("return RLM_MODULE_REJECT") just makes the access point continually keep sending Access-Request messages every time a Access-Reject message is returned. Is this normal? I can't see it... What I'm wanting to do is tell the access point that this MAC address is not valid, go away until it connects again... Here is the Access-Reject message that I return: rad_recv: Access-Request packet from host 172.20.1.201:1645, id=166, length=113 User-Name = "009096beba0c" User-Password = "009096beba0c" Called-Station-Id = "0014.693c.6250" Calling-Station-Id = "0090.96be.ba0c" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 665 NAS-IP-Address = 172.20.1.201 NAS-Identifier = "ap1" perl_pool: item 0x97a51b0 asigned new request. Handled so far: 3 found interpetator at address 0x97a51b0 rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: Service-Type = Login-User rlm_perl: RAD_REQUEST: Calling-Station-Id = 0090.96be.ba0c rlm_perl: RAD_REQUEST: Called-Station-Id = 0014.693c.6250 rlm_perl: RAD_REQUEST: Client-IP-Address = 172.20.1.201 rlm_perl: RAD_REQUEST: User-Name = 009096beba0c rlm_perl: RAD_REQUEST: NAS-Identifier = ap1 rlm_perl: RAD_REQUEST: User-Password = 009096beba0c rlm_perl: RAD_REQUEST: NAS-Port = 665 rlm_perl: RAD_REQUEST: NAS-IP-Address = 172.20.1.201 rlm_perl: Added pair Password-Retry = 0 rlm_perl: Added pair Reply-Message = Sorry, no authentication perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x97a51b0 Sending Access-Reject of id 166 to 172.20.1.201 port 1645 Reply-Message = "Sorry, no authentication" As you can see, i've added the Password-Retry option, but to no avail... Can anyone shed any light on this? Thanks, Dave Smith

2 1

sent tlv failure
by bel hassine monem 30 Apr '06

30 Apr '06

Hello, I installed freeradius-1.1.1 I'm using eap/peap and mschapv2 but radius server return access-reject when I try to authentificate a user Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.2.14:2050, id=0, > length=168 > User-Name = "root" > NAS-IP-Address = 192.168.2.14 > Called-Station-Id = "000f6645db2a" > Calling-Station-Id = "0020ed792d18" > NAS-Identifier = "000f6645db2a" > NAS-Port = 12 > Framed-MTU = 1400 > State = 0x9ffc28e6266e915f48a2c65201988172 > NAS-Port-Type = Wireless-802.11 > EAP-Message = > 0x020800261900170301001bdc0d980a2faf3b259a1c839845feaee7fa20acda7735f5da62fb21 > Message-Authenticator = 0xc1149f0adc27f8d6973700ddb42b51ab > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 78 > modcall[authorize]: module "preprocess" returns ok for request 78 > modcall[authorize]: module "chap" returns noop for request 78 > modcall[authorize]: module "mschap" returns noop for request 78 > rlm_realm: No '@' in User-Name = "root", looking up realm NULL > rlm_realm: Found realm "NULL" > rlm_realm: Adding Stripped-User-Name = "root" > rlm_realm: Proxying request from user root to realm NULL > rlm_realm: Adding Realm = "NULL" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "suffix" returns noop for request 78 > rlm_eap: EAP packet type response id 8 length 38 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 78 > users: Matched DEFAULT at 152 > modcall[authorize]: module "files" returns ok for request 78 > modcall: group authorize returns updated for request 78 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 78 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > eaptls_process returned 7 > rlm_eap_peap: EAPTLS_OK > rlm_eap_peap: Session established. Decoding tunneled attributes. > rlm_eap_peap: Received EAP-TLV response. > rlm_eap_peap: Tunneled data is valid. > rlm_eap_peap: Had sent TLV failure, rejecting. > rlm_eap: Handler failed in EAP/peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 78 > modcall: group authenticate returns invalid for request 78 > auth: Failed to validate the user. > Delaying request 78 for 1 seconds > Finished request 78 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 0 to 192.168.2.14:2050 > EAP-Message = 0x04080004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 78 ID 0 with timestamp 413fce87 > Nothing to do. Sleeping until we see a request. > thanks you, --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici. --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

2 1

Certificates in RADIUS and EAP-TLS
by Adam Rogalski 30 Apr '06

30 Apr '06

Hi folks I was writing my thesis (about security policy in town concil) and I thougt about using RADIUS and EAP-TLS. What can I do when I dismiss someone who got his own certificate from my CA, Can I do something to block him on my radius serwer, becouse when I was making this I didn't saw option to do this best regards Adam

2 1

RE: freeradius and active directory
by King, Michael 29 Apr '06

29 Apr '06

Yes. It's called ntlm_auth You need samba installed to use it, and join the freeradius computer to the domain. (Yes, you can join Linux to an active directory domain) > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Philippe Bacquaert > Sent: Friday, April 28, 2006 4:08 PM > To: freeradius-users(a)lists.freeradius.org > Subject: freeradius and active directory > > Hello, > > Are there any tool to connect freeradius to an active > directory (kerberos and MS Ldap attributes) ? > And in this case, what is your opinion about that kind of link ? > > Thanks in advance, > Philippe Bacquaert > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Missing line in Makefile
by Dennis Skinner 28 Apr '06

28 Apr '06

I also noticed this last time and forgot about it until I was just recompiling with --enable-developer. The Makefile seems to be missing a line like this: $(INSTALL) -d -m 755 $(R)$(libdir) It probably doesn't cause any problem if you use the default prefix, but if the directory doesn't exist, make install gets angry when it tries to put files there. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

parameters to use the attribute Reply-Message
by Philippe Bacquaert 28 Apr '06

28 Apr '06

Hello, I'm searching for a list of parameters to use in the reply attribute : "Reply-Message". I've only found the example in the "users" file : %u for the UserName Thanks in advance, Philippe Bacquaert

2 1

freeradius and active directory
by Philippe Bacquaert 28 Apr '06

28 Apr '06

Hello, Are there any tool to connect freeradius to an active directory (kerberos and MS Ldap attributes) ? And in this case, what is your opinion about that kind of link ? Thanks in advance, Philippe Bacquaert

1 0

appending things to User-Name before auth
by Christopher Carver 28 Apr '06

28 Apr '06

Hello, I'd like to append @domain.com to every username before the authentication step. I have been trying to use attr_rewrite to do this but I've been unsuccessful. Is this the proper module to use? Has anyone done this before? Thanks in advance, Chris Carver

3 3