September 2007 - Freeradius-Users - lists.freeradius.org

proxy reply attribute
by Aren Chua 20 Sep '07

20 Sep '07

Hi, I do have a question about the proxy reply attribute. Where should i set/change the attribute like Session-Timeout and Idle-Timeout after the proxy authentication accepted? Thank you. Regards, Aren Chua _________________________________________________________________ Kick back and relax with hot games and cool activities at the Messenger Café. http://www.cafemessenger.com?ocid=TXT_TAGLM_SeptWLtagline

2 2

Do we like the same books?
by voipexpert 20 Sep '07

20 Sep '07

I just joined Shelfari to connect with other book lovers. Come see the books I love and see if we have any in common. Then pick my next book so I can keep on reading. Click below to join my group of friends on Shelfari! http://www.shelfari.com/Register.aspx?ActivityId=16229756&InvitationCode=da… voipexpert Shelfari is a free site that lets you share book ratings and reviews with friends and meet people who have similar tastes in books. It also lets you build an online bookshelf, join book clubs, and get good book recommendations from friends. You should check it out. -------- You have received this email because voipexpert (sunkara.raviprakash.feb14(a)gmail.com) directly invited you to join his/her community on Shelfari. It is against Shelfari's policies to invite people who you don't know directly. Follow this link (http://www.shelfari.com/actions/emailoptout.aspx?email=freeradius-users@lis…) to prevent future invitations to this address. If you believe you do not know this person, you may view (http://www.shelfari.com/voipexpert) his/her Shelfari page or report him/her in our feedback (http://www.shelfari.com/Feedback.aspx) section. Shelfari, 616 1st Ave #300, Seattle, WA 98104

1 0

Proxy server config with PAP or CHAP
by Amit Jain 19 Sep '07

19 Sep '07

Dear All, I am trying to configure the following. User -> Access Point -> Free Radius Server(acting as proxy server) -> Radius Server Now the above configuration works when I have PAP as authentication method. Now I need to have EAP MD5 auth between user and free radius server and PAP or CHAP between free radius server and Radius server. Please let me know, what I need to configure. Please reply soon as it is urgent... thanks for the help in advance. Regards, Amit Jain

2 3

EAP testing without AP?
by ST Wong (ITSC) 19 Sep '07

19 Sep '07

Hi all, I'm new to EAP and want to setup freeradius with EAP-TTLS support. After some struggling with 802.1x doc and terms, the radiusd is up. However, as my testing AP is not ready now, I've no way to test my setup. I wonder if it's possible to test the authentication server<->authenticator<->supplicant setup under an 'simulated' environment without AP since I only want to test the authentication setting. Would anyone please help? Thanks in advance. /ST Wong

3 5

Freeradius and Windows Vista
by Neal Bullins 19 Sep '07

19 Sep '07

I am running FR version 1.1.7 along with OpenSSL 0.9.8c on Debian. Authentication from XP works flawlessly and from what I have been able to tell from, with these versions I should be able to have Vista do PEAP/MSChapv2 authentication via Freeradius. However, it still seems that Vista stops the authentication process before the ntlm_auth call is made. Am I missing something obvious here? Thanks.

3 2

Limit users traffic quota via radius
by Anonymous 19 Sep '07

19 Sep '07

Hi, I'm trying to close the connection of a pre-paid mobile user, after he reached a limited amount of traffic (ie. 100 megabytes), the network device is a Cisco router. I've found may way to rate-limit the traffic bandwidth but not one to do this. Is radius the correct way to achieve this goal? It'all about vsa? Thanks all, Massimiliano

6 7

Re: Configuring FreeRADIUS to use ntlm_auth
by charles＠copel.com 19 Sep '07

19 Sep '07

Alan: Great ... you have reason ... My NAS was configured to send only PAP request. I reconfigured it to accept MS-CHAP and my FreeRadius works well. Best Regards. Charles. Alan DeKok <aland(a)deployingradius.com> Enviado Por: freeradius-users-bounces(a)lists.freeradius.org 17/09/2007 16:28 Favor responder a FreeRadius users mailing list Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc: cco: Charles Alcantara Borba/COPEL Assunto: Re: Configuring FreeRADIUS to use ntlm_auth charles(a)copel.com wrote: > 3) Configuring FreeRADIUS to use ntlm_auth for MS-CHAP > -> It didn´t work ... I don´t know what is wrong ... My output > FreeRadius presents the same messages that previously: You're not sending it an MS-CHAP request. Perhaps that's part of the problem. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Esta mensagem e seus anexos foram verificados por software anti-vírus. Recomenda-se que não sejam abertos e/ou executados anexos de mensagens de conteúdo ou remetente duvidoso.

1 0

RE: Freeradius and Windows Vista
by Josh Howlett 19 Sep '07

19 Sep '07

Make sure you're using a recent version of samba. Many distros still shib with older versions that won't work. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: 19 September 2007 17:09 > To: FreeRadius users mailing list > Subject: Re: Freeradius and Windows Vista > > Neal Bullins wrote: > > I am running FR version 1.1.7 along with OpenSSL 0.9.8c on Debian. > > Authentication from XP works flawlessly and from what I > have been able > > to tell from, with these versions I should be able to have Vista do > > PEAP/MSChapv2 authentication via Freeradius. However, it > still seems > > that Vista stops the authentication process before the > ntlm_auth call > > is made. Am I missing something obvious here? > > Nope. Vista *should* work, other people have it working > with similar configurations. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

odd user authenticated...
by Joe Vieira 19 Sep '07

19 Sep '07

Hello, Here is the run down on my set up. RHEL5 64bit - freeradius 1.1.6, samba 3.0.23c-2, using peap(ms-chapv2)/ ntlm_auth for authentication and ldap for authorization. so I have ntlm_auth configured and working correctly. everytime a specific user logs in, i see this directly after his login success. 80986-Tue Sep 18 17:10:37 2007 : Auth: Login OK: [students\\USER/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) <- user auth line. 80987:Tue Sep 18 17:10:37 2007 : Auth: Login OK: [RUN\\\305\355\277\255/<no User-Password attribute>] (from client wism2 port 29 cli 00-1B-77-27-B2-48) <- freaky line now, that looks like extended unicode to me in the username...obviously we don't have a user named that, or even a domain named 'RUN', moreover it doesn't seem like that "username" should even have been authorized thru the ldap rules.... -- Joe Vieira UNIX Systems Administrator Clark University - ITS

2 1

Freeradius +MS Win XP (EAP) problems
by Sergio Belkin 19 Sep '07

19 Sep '07

Hi, I want to configure freeradius (Linux) in order to authenticate and authorize MS Windows XP clients (people connect to Access Point Linksys). I am using EAP-PEAP and MSCHAP fron Windows. If I perform radtest from linux clients (using wired network) I have no problem to access, but I cannot from Windows XP, this is the messages when I run usinf radiusd -X: rad_recv: Access-Request packet from host 10.30.1.151:1032, id=66, length=115 User-Name = "sbelki" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020400061900 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0xbee0745e6005b8a43128657ff16d08ea Message-Authenticator = 0xc6044fc3eb7975f75f9afd9edfcca489 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 55 modcall[authorize]: module "preprocess" returns ok for request 55 modcall[authorize]: module "chap" returns noop for request 55 modcall[authorize]: module "mschap" returns noop for request 55 rlm_realm: No '@' in User-Name = "sbelki", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 55 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 55 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 55 rlm_ldap: - authorize rlm_ldap: performing user authorization for sbelki radius_xlat: '(uid=sbelki)' radius_xlat: 'ou=people,dc=palermo,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=palermo,dc=edu, with filter (uid=sbelki) request 57 done rlm_ldap: checking if remote access for sbelki is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value sample & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user sbelki authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 55 modcall: group authorize returns updated for request 55 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 55 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 55 modcall: group authenticate returns handled for request 55 Sending Access-Challenge of id 66 to 10.30.1.151:1032 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06bc31779a10f85cd934953e650bc051 Finished request 55 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 52 ID 63 with timestamp 46f01fd7 Cleaning up request 53 ID 64 with timestamp 46f01fd7 Cleaning up request 54 ID 65 with timestamp 46f01fd7 Cleaning up request 55 ID 66 with timestamp 46f01fd7 ***And This is the eap.conf: ********* eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_password = "" private_key_file = /etc/pki/tls/certs/radius.key certificate_file = /etc/pki/tls/certs/radius.crt CA_file = /etc/pki/CA/cacert.pem dh_file = /etc/raddb/certs/dh random_file = /dev/urandom include_length = yes } ttls { default_eap_type = md5 } peap { default_eap_type = mschapv2 } mschapv2 { } } Please tell me if something of this file is wrong. Thanks in advance!! -- -- Sergio Belkin -

2 3