February 2008 - Freeradius-Users - lists.freeradius.org

UserName, Password + MAC authentication using Cisco's BBSM 5.3
by javkhlanbaatar＠newcomsystems.mn 04 Feb '08

04 Feb '08

Hello, I'm using Freeradius 1.1.17 version with Cisco's BBSM. With MySqL database too. I've storing username, passwords in mysql db. For now, authentication is OK. I want to check MAC address of users while they are authenticating. Inmy radcheck table: | id | UserName | Attribute | op | Value | +----+-------------+--------------------+----+-------------------+ | 3 | java | Password | == | password | | 18 | java | Calling-Station-Id | == | aa-bb-cc-dd-ee-ff | Also, BBSM's snmp is enabled. So I can get users' MAC addresses. I want Radius server checks username, password and MAC addresses at the same time when the user authenticate. Without Calling-Station-Id, authentication is OK. When I add Calling-Station-Id, the user cannot authenticate. In which table, do I enter this attribute? Also i cannot close or deactivate user session when I want to. When i removing from BBSM Mysql db, session is still open. Or can I put expiration time at every 03 o'clock? Could someone help me abt these?

6 10

ascend data filters not being returned
by Don James 03 Feb '08

03 Feb '08

Hi, When I run radtest, I get the following response: Sending Access-Request of id 64 to 192.168.1.41 port 1645 User-Name = "donjames(a)hendersonisp.com" User-Password = "donjames" NAS-IP-Address = 255.255.255.255 NAS-Port = 5 rad_recv: Access-Accept packet from host 192.168.1.41:1645, id=64, length=20 As you can see, the data from the ascend data filters is not being returned. I suspect that I have somehow turned on encryption. How do I set "plain text" communication? Sincerely, Don James

3 4

802.1x Authentication
by Devinder Singh 03 Feb '08

03 Feb '08

Hi Does Free Radius has support for 802.1x authentication such as providing Certificate. Can it also integrate with MIcrosoft Active Direcrtory, Regards -- Devinder

3 2

xpextension problems...
by SnahaD00 03 Feb '08

03 Feb '08

Hi, now I managed to setup and made freeradius -x is sending this: ... bunch of code... ... rad_recv: Access-Request packet from host 192.168.1.1:2049, id=0, length=150 User-Name = "Client Certificate" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0018f8db044b" Calling-Station-Id = "001de00fa589" NAS-Identifier = "0018f8db044b" NAS-Port = 35 Framed-MTU = 1400 State = 0x9adb99ca64043c01aaa3595d2f6348c7 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 Message-Authenticator = 0xef092ad0a33933ac15c7340d538ca9a5 Sending Access-Challenge of id 0 to 192.168.1.1 port 2049 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5298c579adf1167ca687f17658f9e092 I could say that winxp box and radius server see each other, but winxp box does nothing. help :) regards,

2 1

Debugging RLM modules
by Ali Majdzadeh 03 Feb '08

03 Feb '08

Hello All Is there any way to debug an RLM module using gdb? Kind Regards Ali Majdzadeh Kohbanani

3 4

Sql_log against postgresql
by Roy Walker 03 Feb '08

03 Feb '08

Have 2.0 running against a Postgresql database. The sql_log code looks like it functions differently than the sql statements in the postgres driver (stop packets are another insert instead of an update). Has anyone already changed out the sql lines match the way it works without sql_log, don't see why it would be an issue... if you have would you mind sharing it? PS Nice to see the column names were corrected in 2.0 (between MySql and Postgresql schemas). Thanks, Roy

2 1

RE: January 76% OFF
by freeradius-users＠list.xs4all.nl 02 Feb '08

02 Feb '08

1 0

pap "Cleartext-Password", sql etc...
by Andrew Long 01 Feb '08

01 Feb '08

When I have (radcheck) attribute `User-Password', authentication succeeds but we see the following: rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "elmaroma_cn3000" with CHAP password rlm_chap: Using clear text password "aromaescape" for user elmaroma_cn3000 authentication. rlm_chap: chap user elmaroma_cn3000 authenticated succesfully ++[chap] returns ok If I change the attribute to `Cleartext-Password', authentication fails and I see: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "elmaroma_cn3000" with CHAP password rlm_chap: Cleartext-Password is required for authentication ++[chap] returns invalid auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [elmaroma_cn3000/<CHAP-Password>] (from client cn3000_aroma port 0 cli 00-02-6F-xx-xx-92) The "users" file ---------------------- DEFAULT Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP --------------------- authorize { preprocess chap mschap suffix unix files sql expiration logintime noresetcounter dailycounter monthlycounter daypasscounter pap} authenticate { pap chap mschap} Thanks muchly, Andrew Long EWS

3 9

deactivate ldap.attrmap
by Sebastian Heil 01 Feb '08

01 Feb '08

Hello, we are using freeradius 2.0.1 on SLES 10. Our users are authorized and authenticated via ldap against a Novell eDirectory. When i look at a trace on the eDirectory, i see a lot of attributes, the Freeradius-Server wants to get from the directory. But we don't have any of these attributes in the directory, and we don't need them. So, i tried to comment out the line #dictionary_mapping = ${confdir}/ldap.attrmap in the radiusd.conf, but the server still wants to get the attributes from the directory. So, i commented out all the lines in the file ldap.attrmap, which doesn't work... The server still wants to have a least one active line in the file. ----------- rlm_ldap: dictionary mappings file /etc/raddb/ldap.attrmap did not contain any mappings /etc/raddb/radiusd.conf[637]: Instantiation failed for module "ldap" ----------- Is there a way to deactivate the ldap.attrmap file? Thanks a lot! Sebastian -- GMX FreeMail: 1 GB Postfach, 5 E-Mail-Adressen, 10 Free SMS. Alle Infos und kostenlose Anmeldung: http://www.gmx.net/de/go/freemail

5 13

Re: WPA and EAP-TTLS oddity
by William Bulley 01 Feb '08

01 Feb '08

According to Ivan Kalik <tnt(a)kalik.net>: > > It's hard to do PAP when you delete it from the authenticate section. > Problems are the result of your butchering of the default configuration. Thank you! The comment for the PAP paragraph in the authenticate section mentions a backend database which I don't have since I am using the users file. This comment is what led me to comment out the PAP paragraph. Regards, web... -- William Bulley Email: web(a)umich.edu

2 1