June 2006 - Freeradius-Users - lists.freeradius.org

Authentification link with PEAP + PAM + LDAP
by thomas hahusseau 07 Jun '06

07 Jun '06

Hello, Finally my boss is not interested in an PEAP authentication due to password and login stocked in clear in the OpenLDAP database, and he doesn't want to use the ntlm_auth to ask a Active Directory Server. So I wonder if that kind of authentication is possible. PEAP(MsCHAP) request --> Freeradius server (extract the hashed password ) --> Authentication request sent to PAM (login + Hashed password ) via rlm_auth ---> OpenLDAP Server ( compare hashed password received with the one stocked in database ) PAM is used as mediator to permit comparason with hashed stocked in OpenLDAP. My boss only wants cipher/hashed password and login.

3 2

Re: Freeradius-Users Digest, Vol 14, Issue 31
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

RE: peap authentication with active directory
by King, Michael 07 Jun '06

07 Jun '06

> -----Original Message----- > From: > On Behalf Of Kartthik Raghunathan > > A supplicant ie. win XP machine validates the identity and > logon credentials against active directory using > peap-mschapv2 randomly ie. every 30 mins or 60 mins. This > disturbs the wireless connectivity often and am unable to > complete this project due to this situation. In krb5.conf and > smb.conf i have left with default settings. here is my > radiusd.conf file, let me know someone faced this issue. is > there something am missing in my configuration. > It's not a FreeRADIUS problem. It's your access point. The access point determines when you should reauthenticated. (At least mine do) Also, my AP's allow me to stay connected while they are renegotioning. (My AP's have 4 states, Blocked, Connecting (Access is blocked), Connected, ReAuthenticated (Access is allowed)) I would consult your AP docs to figure out how to increase the Reauthetication time, but that is more a hack, they shouldn't be dropping your access while they reauthenticate. (Unless this is a change in behavior that everyone thinks is a good idea, my AP's are over 6 Years old, so it may not be standard practice now)

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 30
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

RE: Storing in SQL, Procedure call
by Jackie Lau 07 Jun '06

07 Jun '06

I tried both suggestions and still no luck. Any other suggestion on how to get a Stored Procedure to work with FreeRadius, unixODBC/FreeTDS and Microsoft SQL Server 2000? For some reason when trying to call a Stored Procedure rlm_sql module is trying to perform a query rather then the procedure call. Thanks! -----Original Message----- From: Marko Dinic [mailto:marko@yu.net] Sent: Tuesday, June 06, 2006 4:16 AM To: freeradius-users(a)lists.freeradius.org Cc: Jackie Lau Subject: Re: Storing in SQL, Procedure call Im using the same setup for access to some ancient Sybase and it works fine. However, the query doesn't use EXEC ... it's plain : accounting_stop_query = "sp_my_stored_procedure_name '%{SQL-User-Name}','%{Realm}', ...." I did have problems with freetds 0.62.3, tho, so I installed 0.63 and had no problems with Sybase access since then. On the other hand, Oracle setup (using rlm_sql_oracle) with "EXEC SP_NAME(...)" didn't work either, so I had to change it to "BEGIN SP_NAME(...); END;" Maybe that would work for your unixODBC/freetds setup too. -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. ----- > Hi, > > I'm using freeradius with freetds and unixodbc. I am having an issue > using a procedure call to insert to a Microsoft SQL Server. When I > try to use the procedure call 'exec', I see the following errors: > > radius_xlat: 'exec *** > rlm_sql (sql): Reserving sql socket id: 8 > query: exec *** > rlm_sql_unixodbc: '00000 ' > rlm_sql (sql): Couldn't update SQL accounting ALIVE record - 00000 > > But if I don't use a procedure call and use an insert command in its > place, it works just find. > > radius_xlat: 'INSERT **** > rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql > socket id: 3 > modcall[accounting]: module "sql" returns ok for request 6 > > My question is why can't I use a procedure call 'exec'? > > Thanks! > > > > >

3 2

One radius and 4 pppoe/pptp servers
by Mordor Networks 07 Jun '06

07 Jun '06

Hi all I have a small problem , i have a freeradius server with mysql backend and 3 pppoe server and one pptp server all the NAS'es "pppoe/pptp server" connect to the same radiusd and same mysql database , so when i add a user for exampe i added a user to server-one and his ip is 192.168.2.100 so the user must set the the server-name "server-one" in the service name when creating his connection setup , my problem is if a user on server-one did not set the service name or change it from server-one to server-two , he get connected to another server instead of server one , if he set the service name to server-two he get connected to server-two instead of server-one and if he did not set the service name at all he get connected to a ramdom server , how i can fix this issue , but forcing the user to get connect to the server we set up his account in . thanks

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 29
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 28
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

PEAP authentication with freerad ?
by thomas hahusseau 07 Jun '06

07 Jun '06

Hello, I would like to use PEAP to perfome authentication of wlan users , I choose PEAP because Users and Passwords are in an LDAP Server (OPEN-LDAP). According to me PEAP works like this : Phase 1 :: TLS handshake the server authenticate to the client as a trusted radius serveur and a cipher tunel is created. Phase 2 :: Login + Password + Domain hashed with MD5 are send to the Radius Server which ask LDAP server for password and login. acording to the doc file : realm_eap , freeradius supports only eap-tls (authentication based only on certificates (client + server ) lead and eap-MD5 ( according to me even if PEAP use MD5 hash , the EAP-MD5 is different with no mutual autenthication and no TLS handshake ) I dont want to use a full certifcate based solution like EAP-TLS or a authentification with no ciphered tunel like with EAP-MD5 Anyone could help me for using PEAP (or at least authentication with the two phases described upper) with freeradius ? thank you. Ps : sorry for english mistakes :)

5 7

Re: Freeradius-Users Digest, Vol 14, Issue 27
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0