November 2008 - Freeradius-Users - lists.freeradius.org

Re: [main_pool] Could not find Pool-Name attribute
by robbe 17 Nov '08

17 Nov '08

What I want is that my wlan clients gets ip's from different ippools depending on which user/group is logging in! So I have no chance to realize that with freeradius? That would be sad. Robbe tnt-4 wrote: > > You have not enabled the module which is supposed to provide Pool-Name > from the configuration in inner-tunnel. But forget that. AP is going to > use DHCP to assign IP address and will ignore Framed-IP-Address. > > Ivan Kalik > Kalik Informatika ISP > > Dana 14/11/2008, "robbe" <edv(a)robbeberking.de> piše: > >> >>Hello >> >>I'm trying to use the ippool for wlan users. But without success. >>I now get tis error: [main_pool] Could not find Pool-Name attribute . >>And I have no idea why. >> >>The logile can be read at: >>http://pastebin.com/m50a78a30 >> >>Thanks for every help. >> >>robbe >>-- >>View this message in context: http://www.nabble.com/-main_pool--Could-not-find-Pool-Name-attribute-tp2048… >>Sent from the FreeRadius - User mailing list archive at Nabble.com. >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- View this message in context: http://www.nabble.com/-main_pool--Could-not-find-Pool-Name-attribute-tp2048… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRADIUS 2 server + FreeRADIUS client - something like POD (packet of disconnect)
by NiTr0 17 Nov '08

17 Nov '08

I use FreeRADIUS v2.0.1 on server side and FreeRADIUS client library v1.1.6 with pptpd/pppd on client side. Is there something like Mpd-drop-user attribute for MPD5? Or I must hangup sessions only by unusual way with 3rd-party client-server apps (for ex., telnet, snmp, etc)?

3 2

how to enable mutliple authentication types in freeradius server
by Nayan Gjain 17 Nov '08

17 Nov '08

2 1

EAP and server certificate
by Damjan 17 Nov '08

17 Nov '08

Just to be sure, all EAP types require the radius server to have a certificate right? and this certificate, i.e. it's parent needs to be installed in the supplicants, right? -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

4 3

PEAP-MD5 WPA auth failure freeradius-2.1.1
by Prasad Parab 17 Nov '08

17 Nov '08

Dear All, I am trying to authenticate using PEAP-MD5 for WPA using a wireless device as follows: Wifi client ----------------> AP --------------------> freeradius-2.1.1 (PEAP-EAP-MD5 , WPA ) <-------------- Authenticator <------------------- /usr/local/radius/etc/raddb/users file entry Windows-XP Service pack 2 user: client "client" Cleartext-Password := "test123" Password:test123 Reply-Message = "Hello, client" Attached are 2 wireshark captures One between wifi-client & authenticator Other between authenticator and radius server. It shows auth failure. Can u elaborate as to why this is happenning as user name and password are both correct??? Regards Prasad

1 0

Framed-User?
by Sergio Belkin 16 Nov '08

16 Nov '08

Sorry for the stupid question, what does "Framed-User" stand for? I hope not to be stoned to death because of such a question :) -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

ldap and unix return different results
by Craig White 16 Nov '08

16 Nov '08

I am trying to use mschap and the following is logged suggesting that ldap authorize succeeds but unix authorize fails but the passwords are the same (aside from the fact that samba hashes the password). I can ssh into the radius server with the user name and password... # getent passwd|grep craigwhite craigwhite:x:1013:1000:Craig White:/home/users/craigwhite:/bin/sh # radtest craigwhite MY_PASSWORD MY_RADIUS_SERVER 0 whatever and on the radius server running 'radiusd -X -f' Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.7:60829, id=45, length=62 User-Name = "craigwhite" User-Password = "MY_PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "craigwhite", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for craigwhite radius_xlat: '(uid=craigwhite)' radius_xlat: 'ou=People,ou=Accounts,o=MY_ORG,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=admin,o=Mullen,c=US/riod to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,ou=Accounts,o=MY_ORG,c=US, with filter (uid=craigwhite) rlm_ldap: checking if remote access for craigwhite is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [UX ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value HASHED_PASSWORD & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value HASHED_PASSWORD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user craigwhite authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [craigwhite]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Obviously this is something to do with the 'users' file configuration which is still at it's default and apparently this is the problem here... DEFAULT Auth-Type = System Fall-Through = 1 What nugget am I missing? Craig

1 1

Unknown module eap
by Craig White 16 Nov '08

16 Nov '08

freeradius newbie here...not sure where I went wrong and someone probably can figure this out in a second. New installation, following guide @ tldp and another ldap guide but I don't think the ldap is the problem here. Not knowing what is significant, I'll just give the whole output. CentOS 5 (freeradius-1.1.3-1.2.el5) still using default certificates so as not to complicate things too much yet. # radiusd -X -f Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 rlm_eap: No such sub-type for default EAP type peap radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. Can someone toss me a bone here? Craig

3 3

FreeRADIUS client + PAM integration
by Vinay 16 Nov '08

16 Nov '08

hi there, We are planning to use FreeRadius Client with PAM. Could you please give me the document/Links/FAQ explaining the integration of FreeRADIUS client with PAM? Thanks Vinay

2 1

FreeRADIUS + OpenLDAP + MSCHAPv2
by Tim Gustafson 16 Nov '08

16 Nov '08

Hello, I'm running FreeRADIUS on a shiny-new CentOS 5.2 machine. I'm trying to figure out how to configure FreeRADIUS to authenticate against an OpenLDAP server using MSCHAPv2. I Googled a lot of different phrases, and came up with some things that were mildly helpful. Right now, I have FreeRADIUS authenticating against the LDAP server without using MSCHAPv2, but I'm not understanding how to now activate the MSCHAPv2 part. Can anyone point me towards some information about activating MSCHAPv2 in this kind of setup? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 4