January 2008 - Freeradius-Users - lists.freeradius.org

Project site down
by Frank Büttner 24 Jan '08

24 Jan '08

Hello, can it be, that the site is down?

5 4

Re: Re: Problem with Vista EAP-PEAP Authentication
by debug afone 24 Jan '08

24 Jan '08

Hi All, I solved this problem using cert gen tools from 2.0.1 version of FreeRadius, as advised by Alan. Sending Access-Accept of id 108 to 10.40.0.114 port 1073 User-Name = "LDAPAFONE\\nsouleman" MS-MPPE-Recv-Key = 0x98a6ba5cb9a9a972244128a592224d932a0350aaf8d4dda665a7472e4479c0b7 MS-MPPE-Send-Key = 0x07405f0d8af6adda158c16a0dbb2581c9be219dcf251fc9c8d74bb8c2498edb4 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 Thanks, problem Solved. Nicolas SOULEMAN.

1 0

EXAMPLE: unlang removing attribute inside a test
by Mike O'Connor 24 Jan '08

24 Jan '08

Hi Guys I thought I would send an example of unlang being used to remove an attribute after proxying. My attrs file add a Cisco-AVPair which needs removing if the customer is given a static ip address by the retail ISP. authorize { ..... if("%{reply:Framed-IP-Address}") { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } } } I also added the update option to the post-auth to remove the Cisco-AVPair in the case of a reject. post-auth { ...... Post-Auth-Type REJECT { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } sql_log } } One issue I could not seem to find a way of removing an attribute unless both the attribute and value match, this means that I have to list each of the pool individually. Cheers Mike

2 3

Re: extract different field from ldap on nas's ip address base
by arjuna＠ts.infn.it 24 Jan '08

24 Jan '08

> Is it possible to extract (to filter) different field in a ldap entry on > the base of the "nas" ip address? ok i've found out this old thread http://lists.cistron.nl/pipermail/freeradius-users/2004-December/039132.html and it was realy usefull, but i still have problem to make the rule in users file match the packet.... can someone tell me where to find out a guide, tutorial, README about the fields i can use in the rules inside users file? thanks, arjuna

2 1

Don't work freeradius with MySQL.
by mohsen rahmanian 24 Jan '08

24 Jan '08

Hi dears, I install freeradius, MySQL on Ubuntu 7 and work correctly with file authentication, but where follow "http://wiki.freeradius.org/SQL_HOWTO" instruction don't get any response. my output when run 'freeradius -x' are: **** Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Module: Loaded sql_log Module: Instantiated sql_log (sql_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. **** debug msg are: ##### rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 User-Name = "fred" CHAP-Password = 0xdd72a5e140beedbac0d9088eb9a4fb1bce rlm_chap: Setting 'Auth-Type := CHAP' rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 ##### I add my client IP (192.168.1.7) on clients.conf and naslist and insert a record in nas table . I use NTRadPing for test FreeRadius. Why? -- Best Regards Rahmanian

3 4

Unsubscribe
by Rakesh Jha 24 Jan '08

24 Jan '08

Unsubscribe. Thanks, Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

extract different field from ldap on nas's ip address base
by arjuna＠ts.infn.it 24 Jan '08

24 Jan '08

Is it possible to extract (to filter) different field in a ldap entry on the base of the "nas" ip address? arjuna

1 0

LDAP problem - How to set attribute where the extracted user password will be stored to.
by Tomasz Zieleniewski 24 Jan '08

24 Jan '08

Hi, I use radius 2.0.0-beta When I make an LDAP search by radius it puts the extracted user password into the User-Password attribute. How to change this? I want to have it stored in the Cleartext-Password. I configured ldap module password_radius_attribute = "Cleartext-Password" but it didn't help. Thank You for any help regards tomasz

5 6

freeradius 2.0.1 and xtradius
by John Joe 24 Jan '08

24 Jan '08

Hy, I am trying to proxy with freeradius 2.0.1 the requests to an xtradius. The problem is that it doesn't works how it should. rad_recv: Access-Request packet from host 127.0.0.1 port 35640, id=136, length=67 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "aol123", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound expand: %{User-Name} -> aol123 users: Matched entry DEFAULT at line 136 ++[files] returns ok ++[pap] returns noop Sending Access-Request of id 201 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP Service-Type = Framed-User Proxy-State = 0x313336 Proxying request 3 to home server 9.0.0.2 port 1812 Sending Access-Request of id 201 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP Service-Type = Framed-User Realm = "AOL" Proxy-State = 0x313336 Going to the next request Waking up in 0.9 seconds. WARNING: Insecure packet from host 213.157.176.7: Packet does not contain required Message-Authenticator attribute Waking up in 0.8 seconds. Waking up in 13.9 seconds. After this the client is authentificated by xtradius but I don't get the output of what the xtradius server says(the attributes.), and radtest give me this: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=136, length=20 The auth and acct on the xtradius are some scripts made in phyton. This give's me if I radtest directly the xtradius server: radtest aol123 test 9.0.0.2 10 testing1232 19 10.0.0.2 Sending Access-Request of id 80 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP radclient: received bad packet: WARNING: Insecure packet from host 9.0.0.2: Packet does not contain required Message-Authenticator attribute Sending Access-Request of id 80 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP radclient: received bad packet: WARNING: Insecure packet from host 9.0.0.2 : Packet does not contain required Message-Authenticator attribute And also I don't get the attributes. I must say that i haven't try to authentificate thru freeradius with a real client only with radtest it is posible to work even if I get thoes warnings and no attribute displayed? --------------------------------- Looking for last minute shopping deals? Find them fast with Yahoo! Search.

2 1

Customize messages from radiusd - possible?
by Spam Eater 24 Jan '08

24 Jan '08

Hi, I would like to know if it is possible to customize the messages that radiusd sends to the client. For example, I would like to translate the "You are already logged in - access denied" message to another string. Can this be done using Reply-Message in radiusd.conf? Thank you!

2 1