August 2008 - Freeradius-Users - lists.freeradius.org

Re: PEAP mschapv2 using xp native supplicant
by Ryan Setiawan H 26 Aug '08

26 Aug '08

>> rlm_mschap: Invalid LM-Password >> rlm_mschap: Invalid NT-Password > > Well, that should be a hint. How about trying to add a user && >password in the "users" file? An example is in the FAQ. when using users file it just work, the problem rose when using ldap backend. In ldap database, I've added the attribute LM-Password and NT-Password, and also add them in check item at ldap.attrmap -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

Re: PEAP mschapv2 using xp native supplicant
by Ryan Setiawan H 26 Aug '08

26 Aug '08

> Ryan Setiawan H wrote: > >>> Please post ALL of the debug output. I suspect that you are doing the >>> ldap lookups OUTSIDE of the TLS tunnel rather than INSIDE. >>> > ... > >> repost forgot change subject >> I'm sorry I didn't include all the debug, because it was so large... >> anyway here the debug : >> > > As I suspected... you are doing the LDAP lookups *outside* of the > tunnel. See raddb/sites-available/inner-tunnel. Ensure that the > references to "ldap" are uncommented. > > Alan DeKok. > Hi, I've uncomment the ldap section at inner-tunnel also make sure at eap.conf default eap type peap, but still don't work. I've tried to make the eap session directly go to inner-tunnel server at client.conf, but i think it's not good idea and also don't work. any other ways? or am I miss something? Thanks auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: Invalid LM-Password rlm_mschap: Invalid NT-Password rlm_mschap: Told to do MS-CHAPv2 for testing with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [testing/<via Auth-Type = EAP>] (from client dotix port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled } # server nispdot1x EAP-Message = 0x010a00261900170301001ba41a64fc5858e400f6380342e22751610df4070fb87d66fcd1dcbb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x252558f1222f410baf9655c23dbf74f3 Finished request 7. Going to the next request Waking up in 4.7 seconds. Framed-MTU = 1480 NAS-IP-Address = 192.168.12.130 NAS-Identifier = "ProCurve Switch 2650" User-Name = "testing" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1c-2e-73-85-00" Calling-Station-Id = "00-16-36-5a-f1-e4" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x252558f1222f410baf9655c23dbf74f3 EAP-Message = 0x020a00261900170301001ba49c9266682a7900ffd51675496e5519722e108c0e7a1eaf33a31a Message-Authenticator = 0xeaa952199e0cb6c5e3852ba39433eed3 server nispdot1x { +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

NAS-IP-Address, rlm_perl, and loopback
by Adam W. Sewell 26 Aug '08

26 Aug '08

I'm having a couple of issues particularly pertaining to the NAS-IP-Address variable that is passed from the switch. When a client sends the auth-request, we find that the authorize function of our perl script is being executed multiple times for the same request. I would think that the authorize function would only be called once. This also leads into the second issue I'm having that when the perl script does run, it doesn't always pass the same data in the NAS-IP-Address variable. Half the time it is the correct information and half the time it is 127.0.0.1. Can anyone shed some light on why this is happening? Thanks.

4 6

mysql configuration
by Ahmet DÜLGAR 25 Aug '08

25 Aug '08

hi everyone i use fedora 9 and freeraidus 2.0.5 i want to use mysql database for user lists and i want to limit time users login for example 3 hour or 3 days i looked documents for howto wpa i create the radius db by db_mysql.sql configure the sql.conf by writein login mysql password and include sql.conf in radiusd.conf but i only cant correct the statement, i think they are for 1.1.7 authorise { preprocess chap mschap suffix eap # We leave "files" enabled to allow creation of test users in /etc/raddb/users files sql pap}accounting { # We leave "detail" enabled to _additionally_ log accounting to /var/log/radius/radacct detail sql} i add this statment end of the radiusd.conf but it doesnt work i am new at freeradius and linux, thanks for replay _________________________________________________________________ Gelen kutunuzda hiç yer kalmamasından bıktınız mı? Windows Live Hotmail şimdi size 5GB ÜCRETSİZ depolama alanı sunuyor! Ücretsiz Windows Live Hotmail hesabınızı buradan alın! http://get.live.com/mail/overview

3 2

Question about Logging
by Aaron Spanik 25 Aug '08

25 Aug '08

I apologize in advance if this question is answered in the documentation, but if it is, I haven't been able to find it. I have the following setup: - Client daemon running on host A - FreeRADIUS 2.0.4 server running on host A proxying auth requests - Two Remote RADIUS servers serving authentication from a load-balanced pool - The client daemon sends authentication requests to the FreeRADIUS server with a username and password over loopback. - The FreeRADIUS server receives the Access-Request and proxies it to the remote RADIUS servers. - Responses from the RADIUS server are proxied back to the client daemon for action. - Accounting records are sent by the client daemon, however they are "swallowed" by the FreeRADIUS server (always ok) as accounting is not being used at this point. The first thing I will mention is that this I do not have any issue with this configuration; i.e. it works exactly the way it's supposed to. Recently, however, there has been reason to suspect that the two remote RADIUS servers are behaving inconsistently with each other (i.e. auth fails on one and then immediately succeeds on the other). Unfortunately, I have zero access to the remote RADIUS servers and limited access to the folks who could tell me whether something is, in fact, wrong with the remote configuration. In order to provide statistics on my end or at least look for trends, I would like to keep track of what remote server a given request is proxied to, but I can't seem to find an easy way of doing it: - I have auth_logging turned on so that my radius.log file contains basic Yay/Nay information about a particular auth request, but the IP of the server the request was proxied to is not included. - I have detail configured for auth-detail, pre-proxy-detail, post-proxy-detail, and reply-detail. All are pretty much stock except I put the User-Name into the header in a couple of them. None of these show the IP of the particular home server that a given request was sent to. I do understand that I can get this information if I run a full debug trace, however this is a production system and I don't need all that information, just one little piece, nor do I want to run a production server outputting to stdout. I have also peeled through all the dictionary files looking for an appropriate RADIUS Attribute which I could use. I found Packet-Src-Ip-Address and Packet-Dst-Ip-Address, which didn't work in any of the detail sections, as they all returned 127.0.0.1, which makes some sense to me given the initial source and destination of the request packets; I'm also pretty sure I shouldn't be using parameters from dictionary.freeradius.internal this way. I also found FreeRADIUS-Proxied-To, however it appears that's only for accounting packets. So my question is this: short of editing the source to make the auth_log pop the home server being contacted into the loglines in radius.log, is there any way to get that information on a per-request basis? Is there some unlang magic I could work in the pre- or post-processing phases? It doesn't really matter to me where the information goes, as long as I can associate it with a particular request. Thanks, /a -- Aaron Spanik a.spanik(a)ns.sympatico.ca

2 3

Re: Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

Can anyone send me a sample for the configuration for Quota control service profile in users file. ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 25, 2008 6:22:09 PM Subject: Re: Quota Control based on freeradius and SSG It is a separate entry (in users file). Documentation does explain what needs to be in the service profile in order to generate an additional request. Use += operator to put multiple service info attributes in a reply packet. http://www.cisco.com/en/US/docs/ios/12_2/12_2b/12_2b4/feature/guide/12bssgp… pap will live with Password as attibute, but for current freeradius version it should be Cleartext-Password. Ivan Kalik Kalik Informatika ISP Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: >I don't get a request for Quota, where does the Quota belong, I don't know where else to define it > > > > >----- Original Message ---- >From: Ivan Kalik <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Monday, August 25, 2008 1:11:41 PM >Subject: Re: Quota Control based on freeradius and SSG > >Post the debug. If you have set things up properly you should get three >requests: one for the user, one for the service and one for the quota. >Quota doesn't belong in service profile. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: > >>Hi >> I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: >> >>quota Password := "cisco" >> Service-Type = Outbound-User, >> Cisco-Service-Info = "R0.0.0.0;0.0.0.0", >> Cisco-Control-Info = "QV100" >> >>and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. >> >>Best Regards >> >> >> >> >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

TLS_accept:error in SSLv3 read client certificate A
by Martin Silvero 25 Aug '08

25 Aug '08

the method is eap+tls, ticket that need to know and what post. thanks!!! -- -- Silvero Martin

1 0

Re: Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

I don't get a request for Quota, where does the Quota belong, I don't know where else to define it ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 25, 2008 1:11:41 PM Subject: Re: Quota Control based on freeradius and SSG Post the debug. If you have set things up properly you should get three requests: one for the user, one for the service and one for the quota. Quota doesn't belong in service profile. Ivan Kalik Kalik Informatika ISP Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: >Hi > I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: > >quota Password := "cisco" > Service-Type = Outbound-User, > Cisco-Service-Info = "R0.0.0.0;0.0.0.0", > Cisco-Control-Info = "QV100" > >and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. > >Best Regards > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

Hi I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: quota Password := "cisco" Service-Type = Outbound-User, Cisco-Service-Info = "R0.0.0.0;0.0.0.0", Cisco-Control-Info = "QV100" and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. Best Regards

2 1

Re: Re: Re: expiration or session-timeot
by Bozhan Boiadzhiev 24 Aug '08

24 Aug '08

Thank you Ivan, it works as you said. As i read in documentation Expiration attribute have accept date values and as in mysql i decide that it is only date. May be it is good if this is fixed in documentation. And i don't know how this can be done Thanks Bozhan Boiadzhiev >-------- Оригинално писмо -------- >От: "Ivan Kalik" >Относно: Re: Re: expiration or session-timeot >До: "FreeRadius users mailing list" >Изпратено на: Четвъртък, 2008, Август 21 00:02:21 EEST >>As i understand Expiration attribute can get only date values. > >No, date and time: > >August 20 2008 13:45:00 > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0