May 2007 - Freeradius-Users - lists.freeradius.org

SQL query in Pre-Proxy
by Ashraf Al-Basti 17 May '07

17 May '07

Dear all, i want to use freeradius as a proxy server for more than domain, but i need to do some query from the DB before doing proxy. i have a DB that contain the username and the telephone number and the domain for that user. i want to do a query to check if for that data, if matched to do proxy if not to cancel the proxy. please advice...

4 8

free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 17 May '07

17 May '07

Dear all My EAPTLS is working with free radisu 1.1.6 as i did every installation starts from zero Thanks for all for the help. I have few quires for free radius as i was using navis radius. 1 Where will i find the log of the authentication like.... username login ok...or login failed 2 One user\'s certificate if I installed in other user\'s laptop it works.I want one user certificate should work in one laptop only. 3 In users file i havn\'t added any certificate name as it is eap-tls.So if i want to remove the user from n/w i don\'t have control.Is ther any method like i can add the certificate names in users file then only it should work Regards Anoop

3 2

Problem with windows 802.1x client freeradius & digicert wildcard certificate
by Phil Brown 17 May '07

17 May '07

-----BEGIN PGP SIGNED MESSAGE----- I have a problem with getting freeradius 116 to work with our digicert wildcard certificate from winxp & vista 802.1x clients. Everything works fine with other clients & everything works fine if I use a self signed certificate. I have trawled through the list history & have taken all the actions that I found suggested (applying hotfixes) but have made no progress, any suggestions would be appreciated. rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 Phil Brown Lan support Room 2-04 Halpern House ISO department University of Portsmouth -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: PGP 5.0 for OS/2 Charset: cp850 wsBVAwUBRkwbkx8HY4rdc96FAQH4ggf/QSiD/5v30HOSGQwRPLcTYq8deJWjlNKl V3qtLrq6JiPRbPxPoQqrq5//euqec1Az8WgC8VJLzcgU6pBa9+OLp+CXBseHDU2N MyCz0vXFD4MdKCDzVt5fPcobhyCULS72pUiTG/GN/BUKdMBzi45lHTM7A2iI9k5V q5VSK7PRG5TKXu7uNW157VGhxKx7ATo3ghlgIVBbTta/qgjz42wyL9m/pzX22UrB NVJFfBJD2JvvxMHZXGOMhLer5Bi26s4lCiIEO3dgym7pqbXW+k8egjX6H0EKdseQ LCPvGLIobaYLGCRgqOR+XrVgK9dgUnPqTId6AihpOmKFJ0xntPSfUw== =ToEW -----END PGP SIGNATURE-----

2 1

users are sending CHAP passwords
by vik 17 May '07

17 May '07

Sorry for the double post before. I'm still stuck with that problem: How to tel the user not to send CHAP-Password ? As to the server version i will update to 1.1.6 later on today. Thx a lot. ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Get your own web address. Have a HUGE year through Yahoo! Small Business. http://smallbusiness.yahoo.com/domains/?p=BESTDEAL

2 1

Cisco Access Points
by Christian Ejlertsen 17 May '07

17 May '07

Hello to all I'm very new at this whole radius deal so I hope I can find a kind soul that could help me with this setup. I'm sorry if this is described somewhere I've been looking around and I don't seem to find this. For now i'm trying to get a very simple setup to work I have a Cisco 1121G AP which I want to use with my freeeradius server EAP/PEAP Nothing fancy just a user local on the freeradius server I can't get the user credentials to authenticate It's a Windows machine that I trying to authenticate with and the wireless netcard is set to use EAP (PEAP), no certificates and EAP-MSCHAPv2 as authentication method. I have a user in the radius users file called wifiuser User-Password := "SomePasswordHere" MS-CHAP-Use-NTLM-Auth := 0 In the clients.conf I have client 192.168.150.250 { secret = SomePasswordHere shortname = CiscoAP1121 nastype = cisco } In the eap.conf I unmarked default_eap_type = mschapv2 Then I read this in the eap.conf # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } Does this apply to my setup and if so what is an alternative to what I'm trying todo? When I debug on the cisco AP I get the following lines that are odd (Full log in bottom of the mail) *Apr 23 19:50:57.298: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.299: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.299: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.299: RADIUS: 33 It's a pretty standard Freeradius config havn't done anything to it but added some users and one other client. Thank you in advance Christian -------- LOGS BELOW --------- All I get in radius.log is Mon May 14 19:50:20 2007 : Info: rlm_eap_md5: Issuing Challenge --------------- CISCO DEBUG RADIUS ----------------------- *Apr 23 19:50:57.288: RADIUS/ENCODE(000000D3):Orig. component type = DOT11 *Apr 23 19:50:57.288: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.288: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.288: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.288: RADIUS: 33 [3] *Apr 23 19:50:57.288: RADIUS(000000D3): Storing nasport 336 in rad_db *Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.289: RADIUS/ENCODE(000000D3): acct_session_id: 82 *Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.289: RADIUS(000000D3): sending *Apr 23 19:50:57.290: RADIUS(000000D3): Send Access-Request to 192.168.150.1:1812 id 1645/33, len 135 *Apr 23 19:50:57.290: RADIUS: authenticator EA B6 33 72 6C 09 8E CF - 84 B1 60 BB 54 B8 55 BF *Apr 23 19:50:57.290: RADIUS: User-Name [1] 10 "wifiuser" *Apr 23 19:50:57.290: RADIUS: Framed-MTU [12] 6 1400 *Apr 23 19:50:57.290: RADIUS: Called-Station-Id [30] 16 "0017.0e86.2cb0" *Apr 23 19:50:57.290: RADIUS: Calling-Station-Id [31] 16 "000e.35e6.0bd0" *Apr 23 19:50:57.290: RADIUS: Service-Type [6] 6 Login [1] *Apr 23 19:50:57.291: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.291: RADIUS: EAP-Message [79] 15 *Apr 23 19:50:57.291: RADIUS: 02 02 00 0D 01 77 69 66 69 75 73 65 72 [?????wifiuser] *Apr 23 19:50:57.291: RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19] *Apr 23 19:50:57.292: RADIUS: NAS-Port [5] 6 336 *Apr 23 19:50:57.292: RADIUS: NAS-IP-Address [4] 6 192.168.150.250 *Apr 23 19:50:57.292: RADIUS: Nas-Identifier [32] 10 "VOICE-AP" *Apr 23 19:50:57.293: RADIUS: Received from id 1645/33 192.168.150.1:1812, Access-Challenge, len 80 *Apr 23 19:50:57.294: RADIUS: authenticator F9 A4 EE 6B E1 5A 8A AB - F5 BD 19 CA 96 33 48 CA *Apr 23 19:50:57.294: RADIUS: EAP-Message [79] 24 *Apr 23 19:50:57.294: RADIUS: 01 03 00 16 04 10 41 8F DB 50 B7 94 9A 30 DF CE [??????A??P???0??] *Apr 23 19:50:57.294: RADIUS: 60 DA D1 51 EB 08 [`??Q??] *Apr 23 19:50:57.294: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.294: RADIUS: State [24] 18 *Apr 23 19:50:57.295: RADIUS: DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54 FB [?SV????????F?!T?] *Apr 23 19:50:57.295: RADIUS(000000D3): Received from id 1645/33 *Apr 23 19:50:57.296: RADIUS/DECODE: EAP-Message fragments, 22, total 22 bytes *Apr 23 19:50:57.298: RADIUS/ENCODE(000000D3):Orig. component type = DOT11 *Apr 23 19:50:57.298: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.299: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.299: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.299: RADIUS: 33 [3] *Apr 23 19:50:57.299: RADIUS(000000D3): Using existing nas_port 336 *Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.300: RADIUS/ENCODE(000000D3): acct_session_id: 82 *Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.300: RADIUS(000000D3): sending *Apr 23 19:50:57.300: RADIUS(000000D3): Send Access-Request to 192.168.150.1:1812 id 1645/34, len 146 *Apr 23 19:50:57.300: RADIUS: authenticator 56 F3 92 78 A7 7A 09 FA - 99 29 51 99 7D E0 9F B3 *Apr 23 19:50:57.301: RADIUS: User-Name [1] 10 "wifiuser" *Apr 23 19:50:57.301: RADIUS: Framed-MTU [12] 6 1400 *Apr 23 19:50:57.301: RADIUS: Called-Station-Id [30] 16 "0017.0e86.2cb0" *Apr 23 19:50:57.301: RADIUS: Calling-Station-Id [31] 16 "000e.35e6.0bd0" *Apr 23 19:50:57.301: RADIUS: Service-Type [6] 6 Login [1] *Apr 23 19:50:57.302: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.302: RADIUS: EAP-Message [79] 8 *Apr 23 19:50:57.302: RADIUS: 02 03 00 06 03 19 [??????] *Apr 23 19:50:57.302: RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19] *Apr 23 19:50:57.302: RADIUS: NAS-Port [5] 6 336 *Apr 23 19:50:57.302: RADIUS: State [24] 18 *Apr 23 19:50:57.302: RADIUS: DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54 FB [?SV????????F?!T?] *Apr 23 19:50:57.302: RADIUS: NAS-IP-Address [4] 6 192.168.150.250 *Apr 23 19:50:57.303: RADIUS: Nas-Identifier [32] 10 "VOICE-AP" *Apr 23 19:51:02.527: RADIUS: no sg in radius-timers: ctx 0xC2506C sg 0x0000 *Apr 23 19:51:02.527: RADIUS: Retransmit to (192.168.150.1:1812,1813) for id 1645/34 *Apr 23 19:51:02.527: RADIUS: Received from id 1645/34 192.168.150.1:1812, Access-Reject, len 44 *Apr 23 19:51:02.528: RADIUS: authenticator 27 C2 B4 DD 14 F9 C3 C0 - DF 88 BD B5 DC 0D 6C 63 *Apr 23 19:51:02.528: RADIUS: EAP-Message [79] 6 *Apr 23 19:51:02.528: RADIUS: 04 03 00 04 [????] *Apr 23 19:51:02.528: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:51:02.529: RADIUS(000000D3): Received from id 1645/34 *Apr 23 19:51:02.529: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes ------------------------ CISCO DEBUG RADIUS END ---------------------

3 4

Re: freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

How do i tell my users not to send CHAP-Password ? Is pap allowed in the authorize section in 1.1.6 ? Thank you for the fastest answer i've ever expected ! ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. http://new.toolbar.yahoo.com/toolbar/features/mail/index.php

2 1

freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

How do i tell my users not to send CHAP-Password ? Is pap allowed in the authorize section in 1.1.6 ? Thank you for the fastest answer i've ever expected ! ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. http://new.toolbar.yahoo.com/toolbar/features/mail/index.php - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Pinpoint customers who are looking for what you sell. http://searchmarketing.yahoo.com/

1 0

radiusd, radtest, radclient
by leebra girl 17 May '07

17 May '07

i have pptpd connection, i want to implement with radius, but actually i still confuse with 3 argument, that is radiusd, radclient, and radtest i read the manual page about that, i think radiusd work on server side..?? and radclient and radtest, is use for user to connect into radius server....?/??is that right?? but, i have my client is windows XP, how can i use radclient and radtest for that??? thanks

2 1

freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

Hello, I have 1.1.3 server version. I would like to be able to store encrypted passwords on my computer, but i can't. I've read about everything dealing with this problem, but still i cannot manage to succeed. In my users file i have DEFAULT Auth-Type := PAP Fall-Through = Yes gogo User-Password := "my_encrypted_password_using_md5" .... Here i've tried also with Crypt-Password, but it doesn't work either. Still i have in the debugs: Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot use "CHAP-Password". Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i have disabled all chap options in the radiusd.conf. Here i have my radiusd.conf: http://bozadjiev.free.fr/files/radiusd.conf and users file: http://bozadjiev.free.fr/files/users Thank you for the time you'll spend reading, regards. ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

2 1

LDAP Group Support
by Clark J. Wang 17 May '07

17 May '07

I've read through the rlm_ldap wiki (http://wiki.freeradius.org/Rlm_ldap) and the sample radiusd.conf in FreeRADIUS package but I still don't know how to make LDAP Group work. Is there any more detailed examples? Thanks.

2 1