May 2006 - Freeradius-Users - lists.freeradius.org

MAC authentication
by simon＠434canada.com 24 May '06

24 May '06

Hi, I am wondering if it is possible (and if so, how) to set up the clients.conf file to have clients recognized by their MAC address instead of their IP address (or an IP range). Not sure if this is possible, or the proper file to try in, but would love to hear some feedback. Thanks, Simon

2 1

Using PEAP and WinXP
by simon＠434canada.com 24 May '06

24 May '06

Hi, I have a question regarding the setup for the WinXP client when using PEAP. Does one always need to go into the properties for the AP and configure which servers to connect to or which root certification authorities are trusted? What I mean is, whether you produced a server certificate yourself and imported that CA onto the client machine, or whether you had a certificate signed by someone like Verisign, you would need to check the corresponding CA within the list. Thanks, Simon

1 0

Freeradius AD, LDAP, MYSQL
by fvt3 24 May '06

24 May '06

Is it possible to configure freeradius to authenticate off from active directory, ldap and mysql? I am looking to configure freeradius to hit active directory to see if user exist, if not hit ldap and mysql database for authentication. Since we can set it to hit ldap then mysql, I think it is possible for radius to hit AD then ldap then mysql. If this is true, how can I configure it to do so? Any help would be appreciate. Thanks. Ferno __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Multiple EAP types
by gARetH baBB 24 May '06

24 May '06

According to the docs: "Once EAP-Identity response is received by the server, based on the default_eap_type, the server will send a new request (MD5-Challenge request incase of md5, TLS-START request incase of tls) to the supplicant. If the supplicant is rfc2284 compliant and doesnot support the EAP-Type sent by the server then it sends EAP-Acknowledge with the supported EAP-Type. If this EAP-Type is supported by the server then it will send the respective EAP-request." But I can't get it to work ! I want to be able to support PEAP and TTLS. I set a default_eap_type of peap or ttls and a client (wpa_supplicant or Windows XP+SecureW2) can authenticate using that default type. But if I try to authenticate not using the default type it fails - the above described mechanism doesn't seem to kick in. What am I doing wrong ? [default type of ttls, trying to authenticate with peap using wpa_supplicant] rad_recv: Access-Request packet from host 10.1.1.7:1812, id=134, length=176 User-Name = "x@x" Cisco-AVPair = "ssid=x" NAS-IP-Address = 10.1.1.7 Framed-MTU = 1400 Called-Station-Id = "x" Calling-Station-Id = "x" NAS-Identifier = "DINKITCH" NAS-Port = 37 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x020100150174657374406c696c79686f7070696e67 Message-Authenticator = 0x8f0581d54ae3940c3e9b0bf7bd1297ad Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.7/auth-detail-20060524' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.1.1.7/auth-detail-20060524 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'x@x' rlm_sql (sql): sql_set_user escaped user --> 'x@x' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'x@x' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'x@x' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'x@x' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'x@x' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 134 to 10.1.1.7 port 1812 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfedb2ff2bb0d24ab41c48f3ab7eba8b9 Finished request 0 Going to the next request And that is that, the client claims authentication has failed.

2 3

Please ignore Quick mysql query help
by Jeremy ohara 24 May '06

24 May '06

---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

1 0

Quick mysql query help
by Jeremy ohara 24 May '06

24 May '06

hi there guys. i just need some help with mysql query. how can i include c:\dafds\ddsfsd into a feild. example +----+-------------+-----------------------+----+----------------------+ | id | UserName | password | DO | datalocation | +----+-------------+-----------------------+----+----------------------+ | 35 | guestuser35 | Password | := | c:\dsfds\ddd | +----+-------------+-----------------------+----+----------------------+ this is my insert query "Insert into mail (username,password,do,datalocation) Values ('$login','$passwd','$do','$datalocation';") Thanks ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

1 0

help to proxy by username prefix
by Vasco Santos 24 May '06

24 May '06

Hi people, I need to put a cistron-1.6.4 with mysql patch to proxy by username prefix. I Put this in config files: hint file: DEFAULT Prefix = "aaa/", Strip-User-Name = "No" Realm = "realmdomain.com" realms file: realmdomain.com XXX.XX.XX.XX:1645 hints nostrip trusted this modifications dont work. questions: they are some patchs or modifications to put this working? I see that if I make a update to a recent version, this option is suported correct? but the recent versions not have suport to mysql or any patch to work it mysql. :( Help me with one solution please. Tanks for or time.

1 0

VSA encoding
by Geoffroy Arnoud 24 May '06

24 May '06

Hi all, I have a question regarding Vendor-specific attribute encoding: What type of "smart" encoding are supported by radclient (and thus FreeRADIUS). I mean, I know I can use TLV encoded VSA - as described in the RFC, for example: WISPr-Redirection-URL=http://www.google.fr or Cisco-Account-Info=QT600 For VSA encoded only with Vendor-ID and String, I can use the syntax: Vendor-Specific=0x00000009FC140256305a31393939406f72616e67652e6672 (Cisco-Account-Info VSA I believe) I saw a strange dictionary amongst FreeRADIUS dictionaries: for USR robotics dictionay.usr It is talking about a NMC encoding, and the follinwg is added after the vendor id declaration: "format=4,0" As anyone explanation about this type of encoding? >From my side, I have a vendor (having a vendor-id) that uses the following encoding: RADIUS Attribute Id (1 byte) = 26 RADIUS Attribute Length (1 byte) = total length of attribute value + 2 Vendor ID (4 bytes) A Project Type attribute (1 byte) And as much attributes as possible (up to 248 bytes), using TLV where T is 1 byte and L is 1 byte. The following scheme shows the attribute encoding. 0 1 2 3 4 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type (26) | Length | Vendor-Id | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Vendor-Id (cont) | Project type | N°Attribute 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |AttributeLength| Value Attribute 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . | N°Attribute n |AttributeLength|. . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Value Attribute n . . . . . . . . . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Is FreeRADIUS able to support such encoding method? Or maybe with only one TLV attribute per RADIUS attribute (26 + L + VendorID + ProjectType + TLV)? For the moment, we use the Vendor-Specific=0x00.... method, but as the attributes are standardized with this vendor, we would like to use it, in a smarter way. Sorry if I have been a litte long. Thankyou in advance. Geof.

3 3

Expirey dates
by Jeremy ohara 24 May '06

24 May '06

Hi there I'm using Free radius 1.0.5 with mysql. i was wondering is there a way to setup where by if a user accounts expireds on 25/07/2006. when the user tries to get on on the 26th the user wont be let on cos the account has expired? Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

2 1

Need information about proxying
by Vishwanath Srikant Pattanshetti 24 May '06

24 May '06

Hello I am trying to using Freeradius1.1.0 I want to use it as a proxy to an external RADIUS server. In such a setup, if my external server is not up, and if I proxy a request to it, then I get back a access-reject, from my proxy radius server. Also If the username/password mismatch on external server then also I get a access-reject. Is there a way I can differentiate between these two? I mean is there a way I tell if the external RADIUS server is down OR Authentication at external RADIUS server has failed? Please please help in this regard. -Vishwa.

3 2