July 2006 - Freeradius-Users - lists.freeradius.org

Active Directory (Win2003) rlm_ldap
by Charlie B 25 Jul '06

25 Jul '06

Question: What is causing the password to be encrypted? It is not the password entered. radtest bradbrookc putz041277! localhost 0 xxxxxxx rad_recv: Access-Request packet from host 127.0.0.1:32806, id=152, length=62 User-Name = "bradbrookc" User-Password = "\t\354B\252\355\345BI\237\034\217\316\315\363\351\271" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "bradbrookc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry bradbrookc at line 218 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for bradbrookc radius_xlat: '(&(SamAccountName=bradbrookc))' radius_xlat: 'ou=xxxxx,dc=xxx,dc=xxx,dc=xxx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to cnsxxxxxxxxx:389, authentication 0 rlm_ldap: bind as xxxxxx/xxxxxx to cnsxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=xxxx,dc=xx,dc=xxxx,dc=xxx, with filter (&(SamAccountName=bradbrookc)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user bradbrookc authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bradbrookc" with password "?ìBªíåBI???ÎÍóé¹" rlm_ldap: user DN: CN=xxxxxx\, xxx,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xxx rlm_ldap: (re)connect to cnsad.ads.nint.org:389, authentication 1 rlm_ldap: bind as CN=xxxx\, xxxx,OU=xxx,OU=xxx,DC=xxxx,DC=xxx,DC=org/ ?ìBªíåBI???ÎÍóé¹ to cnsxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [bradbrookc] (from client localhost port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- OS:Fedora Core 5 FreeRadius 1.0.5-1.2 Help would be great, I have been attempting different combination with no luck. thx

2 4

unsubscribe
by Sudhananda 25 Jul '06

25 Jul '06

unsubscribe This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message.Global Edge Software Ltd has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Global Edge Software Ltd reserves the right to monitor and review the content of all messages sent to or from this e-mail address

1 0

EAP utilities--urgent
by darshak＠elitecore.com 25 Jul '06

25 Jul '06

hi, all I need some help from group. I want to start free radius that only has EAP utilities. no proxy,nothing else then diff.. eap types. Which files can i take from free radius that i can independently use for eap / wireless authentication. In short my free-radius has only files replated to eap no xtra. Rgds Darshak

1 0

PEAP short question
by wekz 25 Jul '06

25 Jul '06

Hi all, I've been watching the logs and my question is why localhost takes part in the process.

3 3

verifying "/" exists in User-Password field
by Geoff Silver 24 Jul '06

24 Jul '06

I'm running FreeRadius 1.1 on two different ports, allowing slightly different auth methods on each port. On one of the ports, I would like to verify that the password sent contains a slash ("/") before attempting to authenticate the user. Why, you might ask? Well because on that port I'm actually just proxying the authentication requests. So, my users file entries look like: # Cisco NAS doing SSL authentication bob Huntgroup-Name=="Office", Hint==Port-1812, Auth-Type:=Accept Connect-Info="OFFICE_ACCESS" # Cisco NAS doing username/password authentication, proxied to another server bob Huntgroup-Name=="Office", Hint==Port-1645, Proxy-To-Realm:=UAS Connect-Info="OFFICE_ACCESS" My huntgroups file contains the "Office" to NAS-IP-Address mappings, and my hints file (which maps the UDP port the NAS connected on to one of the two above auth lines) looks like this: DEFAULT User-Name =~ "^(.*)$" Hint = "Port-%{request:Packet-Dst-Port}" What I need to do is figure out how to ensure that anyone authenticating with Hint==Port-1645 has a "/" in their User-Password attribute. People authenticating with Hint==Port-1812 will always have a User-Password attribute which matches their Username (but because SSL authentication is handled by the NAS, this area is authorization only, so we never check the User-Password attribute). I'm thinking this should be possible, but I'm just not sure the best way to handle it. Any advice is greatly appreciated.

2 4

Why doesn't := "Always match?"
by Paul Long 24 Jul '06

24 Jul '06

A man page (http://www.die.net/doc/linux/man/man5/users.5.html) for the users file says, "Attribute := Value ... Always matches as a check item..." So does that mean, no matter what the value is, it will always match the attribute? I don't see that happening. As an experiment, I have a supplicant in a WiFi phone with user name of "plong" and password of "123". With the following entry in the users file: plong Auth-Type = Local, User-Password := "126" ...I assumed it would match even though the value is different; however, it does not match, and the access request is rejected: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 126 for user plong authentication. rlm_chap: Pasword check failed To get it to match, I have to have the correct value: plong Auth-Type = Local, User-Password := "123" which results in this debug output: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: chap user plong authenticated succesfully In fact, := behaves exactly like == in this case. What's the deal? Why doesn't := "always match?" Am I misunderstanding what it means to "match?" Paul

4 8

internet users based on time+ath
by Marwan Sultan 24 Jul '06

24 Jul '06

Hello people, I'm On FreeBSD 6.1R its acting as a internet gateway for a comlex of 30 appartments. the internet to this box is connected thro a dsl and its up/running, Well, We want to bill whoever sharing our internet connection on a monthly bases so basically, I want to release internet access based on time+auth. and to manage those users. I have been told to use freeradius + nocat ? well, im not familiar with such stuff, although im a network admin, so decided to email your list, in a hope that kindly someone will help me of HOWTO. is it correct freeradious will do what we wants? do i need to install any extra packages? or only freeradious will do the trick, of auth users, and manage them? Please advice me with lot of thanks. Marwan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

i don't know radius security function. help me please!
by 나종현 24 Jul '06

24 Jul '06

1 0

EAP-TTLS MD5 hashed Passwords in MySQL Database for WPA-802.1x auth
by Christian Poessinger 24 Jul '06

24 Jul '06

Hello, I'm trying to setup a System to authenticate WLAN users via EAP-TTLS with md5 crypted passwords, stored in a sql database. I'm using MySQL as the Backend and it works great when the passwords are stored in cleartext or UNIX crypt. When i convert the password from crypt to md5 and change pap encryption_scheme to md5 it doen't work anymore. As I have to use the SQL attribute field with 'Crypt-Password' in it, it seems that it wants to use crypt passwords and not md5. I tried to change it to 'md5-password' but well ... that wasn't the answer. Here is the error: --------- modcall: entering group PAP for request 4 rlm_pap: login attempt by "foo" with password bar rlm_pap: Crypt-Password attribute but encryption scheme is not set to CRYPT modcall[authenticate]: module "pap" returns fail for request 4 modcall: leaving group PAP (returns fail) for request 4 auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 TTLS: Got tunneled Access-Reject --------- Anyone has an Idea how to use the MD5 hashed Passwords in the Database with EAP-TTLS for authentication? I appended my radius configuration. Thanks. ----------- CONFIG ------------ eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { private_key_file = /etc/ssl/rad.pem certificate_file = /etc/ssl/rad.pem CA_file = /etc/ssl/ca.pem dh_file = /etc/ssl/rad.dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } modules { pap { encryption_scheme = md5 } } authorize { preprocess suffix eap files sql } authenticate { Auth-Type PAP { pap } eap } users-file DEFAULT Auth-Type = PAP Fall-Through = 0 -------- END OF CONFIG -------------

1 0

LDAP macAddress attribute for MAC-Address filters
by luigi natalino 24 Jul '06

24 Jul '06

Hi, I need to implement MAC-Address filters,every user may have multiple MAC-Address. I'm using freeradius with openldap. Can i use ldap macAddress attribute to make this filters? How does Radius understand this attribute? Are request same modifications to ldap.attrmap, and if so what are the modifications to be made? Thanks in advance Bill Wood _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0