July 2008 - Freeradius-Users - lists.freeradius.org

Re : silly question of framed IP address
by Reveal MAP 17 Jul '08

17 Jul '08

Thanx Alan, it is clearer! But, is there a way to oblige some comp to use a specific IP address using radius attribute?? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 17 Juillet 2008, 6h21mn 00s Objet : Re: silly question of framed IP address Reveal MAP wrote: > I wonder if the attribute 8 (framed Ip address) of RADIUS acts like a > dhcp server, giving the IP to the supplicant or just verify/compare if > is conform to the Anthentication request ?? The Framed-IP-Address assigns IP addresses for PPP sessions. It does *nothing* for 802.1x sessions. You will need to run a DHCP server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 17 Jul '08

17 Jul '08

Why could EAP-TLS run OK and not EAP-PEAP, giving a message like that: "rlm_eap_peap: Received EAP-TLV response." below is the entire output. Thanx for the response!! --------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=99, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b97054012345511dfddf34251f30af4349bfda0f83797d643a3cea1 State = 0x766398ac716b81afdd1454abb61d46ce Message-Authenticator = 0xf76a88f5654802fac4faed08e055d5fb +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 99 to 10.10.44.246 port 1027 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 91 with timestamp +139 Cleaning up request 1 ID 92 with timestamp +139 Cleaning up request 2 ID 93 with timestamp +139 Cleaning up request 3 ID 94 with timestamp +139 Cleaning up request 4 ID 95 with timestamp +139 Cleaning up request 5 ID 96 with timestamp +140 Cleaning up request 6 ID 97 with timestamp +140 Cleaning up request 7 ID 98 with timestamp +140 Cleaning up request 8 ID 99 with timestamp +140 Ready to process requests. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

(no subject)
by jonas m 17 Jul '08

17 Jul '08

Hello! My Question is about the documentation that I found on the net.http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmi… anybody know if this is the best documentation there is.This differs from other guides that I have found. For example this document describes that you in should export your certificate from the eDirectory server and put it in the Freeradius server. Then edit the radius.conf tls_cacertfile with the path to the imported certificate. I have to do some schema changes if I should follow this documentation and before I do that I would like to be shore that this is the best guide. For starters we don’t use universal passwords today, and I am afraid that implementing this could have some negative affects on our live site. My goal is to use this in a “secure” wireless solution. Hop somebody can bring me some light in this matter. Regards /Jonas Magné _________________________________________________________________ Utmana dina kompisar i Sten, sax, påse! http://www.live.msn.se/messenger/#/News/

2 3

silly question of framed IP address
by Reveal MAP 17 Jul '08

17 Jul '08

Hello! I read this doc http://www.cisco.com/en/US/docs/ios/12_1t/12_1t5/feature/guide/dtrattr8.html and don't really understand. maybe cause of english style so i am expecting for an answer here: I wonder if the attribute 8 (framed Ip address) of RADIUS acts like a dhcp server, giving the IP to the supplicant or just verify/compare if is conform to the Anthentication request ?? ex: 1. if my client is radius database has framedip address == 192.168.0.10 or framed ip:= 192.168.0.10 and its ream Ip address during the authentication attempt is 192.168.0.9 instead of 192.168.0.10, what will happen? - thank you for the response! _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

How to cut the realm from a username before it is sent to authenticate against ldap with ttls/pap
by Andy An 16 Jul '08

16 Jul '08

Hi Alan/Ivan: Thanks for your useful posts on this mailing list so I could configured all basic stuff to work finally(though it's still a little challenging for me as a beginner) . Now two more specific problems would like to get your further help/guide: 1. How could I get a username/password authenticated against ldap without its realm if there is one(i.e. cut away the realm @something.ca)? I used Freeradius 2.0.5. We need this to see if: * A user is a home user and log in from home NAS/AP (in this case he may not use any realm at all) * or a user is a home user but log in from other colleage/university and proxied home by our upper eduroam proxy server at the guest college/university * or a user is a roaming user from other college/university and we need to proxy the request to the upper eduroam radius server and finally back to his home college/university for authenticating. 2. How could I get the client IP addresses to fill the "framedipaddress" field in the table raddacc? I used mysql as my accounting DB and the client ip addresses assigned by a dhcp server sitting in the LAN/VLAN. Now the field "framedipaddress" or "client-ip_address" is empty. Thank you in advance for your great help! -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

freeradius in windows
by sanjeev.kumarroy＠wipro.com 16 Jul '08

16 Jul '08

Hi, Has anyone ever done the porting of freeradius from Linux to Windows? I need this as I am not getting the source code for the Windows version of freeradius. If that can be got from some location or in case someone has it. Please let me know. I am really stuck-up. Any help would be great in this regard. Thanks. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

5 4

Problem with building 2.0.5 package for Debian Etch
by DaSilva 16 Jul '08

16 Jul '08

I have a problem with building a 2.0.5 package for Debian Etch. I have used http://wiki.freeradius.org/Build#Building_Debian_packages this tutorial for that but I only got this error message: # dpkg-buildpackage -b -uc dpkg-buildpackage: source package is freeradius dpkg-buildpackage: source version is 2.0.5-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture i386 dpkg-buildpackage: source version without epoch 2.0.5-0 debian/rules clean dpatch deapply-all 02-dialupadmin-help not applied to ./ . attempting to revert failed patch 01-radiusd-to-freeradius from ./: md5sums match, proceeding ... done (neither success nor failure guaranteed) rm -rf patch-stamp patch-stampT debian/patched dh_testdir dh_clean rm -f build-arch-stamp build-indep-stamp libltdl/stamp-h1 rm -f install-arch-stamp install-indep-stamp configure-stamp [ -f Make.inc ] && make distclean || true # The make clean forgets to remove this build directory [ -d src/modules/lib ] && rm -fr src/modules/lib || true # Put the original autotools files back in place [ -f config.sub.dist ] && rm config.sub && mv config.sub.dist config.sub || true [ -f config.guess.dist ] && rm config.guess && mv config.guess.dist config.guess || true debian/rules build test -d debian/patched || install -d debian/patched dpatch apply-all applying patch 01-radiusd-to-freeradius to ./ ... failed. make: *** [patch-stamp] Fehler 1 How can I solve that? Thanks in advance. -- View this message in context: http://www.nabble.com/Problem-with-building-2.0.5-package-for-Debian-Etch-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

python module log back to radius.log
by Michael da Silva Pereira 16 Jul '08

16 Jul '08

Hi All, I previously used a perl module and wrote content back to the radius.log file by using: &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); Has anybody got something doing this in python, I don't really want to open up the file and write data into it as radiusd has the file open already. Thanks, Mike

1 1

unlang question
by Norbert Wegener 16 Jul '08

16 Jul '08

With unlang I achive the following: Check, whether a special VLAN exists on a switch and if so, assign it. This works with the construct below. if ("%{sqlquery:SELECT value from radcheck where ( attribute='SIE-VLAN1' != '' and username='%{User-Name}') and value in (select vlan from vlan where nasname= '%{NAS-IP-Address}' ) }"!='') { update reply { Tunnel-Private-Group-ID ="%{sqlquery:SELECT value from radcheck where ( attribute='SIE-VLAN1' != '' and username='%{User-Name}') and value in (select vlan from vlan where nasname= '%{NAS-IP-Address}' )}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN } } To reduce sql queries I want to avoid the second. Can I store the result of the first query and use the value to assign Tunnel-Private-Group-ID? Thanks Norbert Wegener

2 1

How to configure FreeRadius so that clients don't have to be changed?
by DaSilva 16 Jul '08

16 Jul '08

I want to set up a FreeRadius server for WLAN authentification without the need to change anything on client PCs (because we have so much clients that this would be to much work). Is that possible? Thanks in advance. -- View this message in context: http://www.nabble.com/How-to-configure-FreeRadius-so-that-clients-don%27t-h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8