September 2008 - Freeradius-Users - lists.freeradius.org

Re: How Can I use local /etc/passwd users for 802.1x
by Aydın KOÇAK 24 Sep '08

24 Sep '08

Hello Dear Ivan Kalik; Thank you for your response ; >From following link that you send indicate if i use eap-gtc everything is ok. But our switches does not support this protocol. http://deployingradius.com/documents/protocols/compatibility.html I think Finaly i can use EAP-MSCHAPv2 and NT hash(ntlm_auth) in this case i have use to samba . is it true ? and all users and password must be re-create . Last question PAP support all encryption include Unix crypt likewise my switches support pap but i can't find pap authentication support on windows-xp and secure-w2 . How can i find supplicant with support pap authentication for 802.1x ? Thank You, Akocak >Message: 2 >Date: Wed, 24 Sep 2008 10:35:06 +0100 >From: <tnt(a)kalik.net> >Subject: Re: How Can I use local /etc/passwd users for 802.1x > authentication >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <X4QzcHet.1222248906.0917230.tnt(a)kalik.net> >Content-Type: text/plain; charset=ISO-8859-2 > >You can't. Look at PEAP and EAP-MD5. > >http://deployingradius.com/documents/protocols/compatibility.html > >Ivan Kalik >Kalik Informatika ISP Dana 24/9/2008, "Ayd?n KO?AK" <akocak(a)turkom.com.tr> pi?e: >>Hello ; >>I need authenticate local /etc/passwd users with FreeRadius for wired and wireless network 802.1x authentication ? >>Is it posible ? >> >>Or i can migrate all local users to ldap server in this case is it posible ? Because i dare say 802.1x authentication not correctly work with encrypted password on ldap ? >> >>Could You please give information about this issue ? >> >>Thank You, >>Akocak. >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >>

2 1

AW: Acct-Input-Gigawords
by Lars 24 Sep '08

24 Sep '08

>>Is there a way (radius or ppp) to get the Accounting-Data on-the-fly >>(realtime) or maybe all 2 hours without disconnection the actual session of >>the user? >Depending on your NAS, you can send Accounting updates every 5 minutes ! The >attribute that NAS has to accept is called Acct-Interim-Interval. You can >set it to "300" ( 5 min ) ! Where can i set it up? I use rp-pppoe-server and ppp 2.4.4 on debian Regards & thx lars

2 1

(no subject)
by Arrigo Savio 24 Sep '08

24 Sep '08

Hi everybody. I installed Freeradius 2.1.0 on a Fedora 9 server. I installed dialup_admin to manage it: it partially works. I have some troubles in 2 sections: 1. Check Server. When I click on the menu, I see Wednesday, 24 September 2008, 12:36:31 CEST Server: 10.0.1.128:1812 (test user testuser) And nothing more. I can't see any log in radius logs. The same thing when I try to "test user" but it is the same page as above. 2. "Accounting" section. I can see the Select menus, but without any value inside. The strange thing is that If I select any rows (in a totally white list) the query is run. Basically, I have the option values, but not the tags in the list. Hope that someone had already fall in these problems. Regards Arryxyz

1 0

cleartext passwords against Active Directory
by Leese, MJ (Mark) 24 Sep '08

24 Sep '08

Hi, I need to authenticate employees at my lab onto our wireless network using a Captive Portal and our corporate database (Active Directory). The Access-Request from the Captive Portal contains a cleartext password but our Active Directory does not store cleartext passwords. Can someone please tell me what options I have? Is it possible to use rlm_krb, for example? I have used our RADIUS server to authenticate users against our Active Directory, but this was with ntlm_auth for users using 802.1X and MS-CHAP. Someone suggested I could authenticate the user with an LDAP bind, but I don't see how this would work. I'm running FreeRADIUS 1.1.4 but I can update to a newer version any time. Please help. I am running out of hair :) Thanks in advance, Mark.

2 1

How Can I use local /etc/passwd users for 802.1x authentication
by Aydın KOÇAK 24 Sep '08

24 Sep '08

Hello ; I need authenticate local /etc/passwd users with FreeRadius for wired and wireless network 802.1x authentication ? Is it posible ? Or i can migrate all local users to ldap server in this case is it posible ? Because i dare say 802.1x authentication not correctly work with encrypted password on ldap ? Could You please give information about this issue ? Thank You, Akocak.

2 1

Acct-Input-Gigawords
by Lars 24 Sep '08

24 Sep '08

Hi, i have 2 questions and i hope you'll help me. I use the freeradius in combination with mysql-server for accounting and authorizing. The first: how do i use the Acct-Input-Gigawords and Acct-Output-Gigawords Attributes with "FreeRADIUS Version 1.1.3" and "FreeRADIUS Version 1.0.2" and PPP 2.4.4? I set up the fields in the mysql-table but they do not get filled with data. The second: Is there a way (radius or ppp) to get the Accounting-Data on-the-fly (realtime) or maybe all 2 hours without disconnection the actual session of the user? Regards lars

3 2

..::Errors initializing modules::..
by Ing. Alfonso Reyes 24 Sep '08

24 Sep '08

Hi team. I'm having some issues with the configuration of the radius server, I'm getting the following: Error Initializing Modules. The thing is that my radius server has no issues with the configuration (eap.conf), and the instalation was succesful with mysql. I've checked the database looking for more information with no luck, I just found those two points and they are ok. http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg43172.h tml Attached configuration files and error. eap.txt correspond to the conf file found on the /etc/raddb/eap.conf Eap2.txt correspond to the conf file found on the /usr/local/etc/raddb/eap.conf Any ideas? Thanks for your help. Alfonso.

2 1

stripped username and accounting
by Alexandre Chapellon 24 Sep '08

24 Sep '08

Hello, I have NASes sending me unstripped username in requests, and a database with stripped usernames in it (which i use for accounting too). So i tried setting up proxying (to local) on the desired realms to for auth and accounting, the problem i face is that acounting is done both with stripped and unstripped usernames (2 line for one session). Is it a normal behaviour? how can i prevent this from happening? here follow informations: freeradius 2.0.5 ##proxy.conf## realm freeradius { auth_pool = local_pool acct_pool = local_pool ignore_null = yes ignore_default = yes } realm DEFAULT { } ##sites-enabled/default## authorize { preprocess chap mschap eap { ok = return } suffix sql ... } accounting { ippool sql }

2 1

object not found or got ambiguous search result
by Pramada Batchu 23 Sep '08

23 Sep '08

Hi, I am using Active directory as datasource for radius. I am getting "rlm_ldap: object not found or got ambiguous search result". I have configured ldap section as follows: ldap { server = "192.168.0.1" identity = "cn=sjadmin,ou=WID,dc=ecrt,dc=local" password = symbol basedn = "ou=WID,dc=ecrt,dc=local" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 #password_header = "{SHA}" password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = no } ldap_build_search_req ATTRS: dn ldap_send_initial_request ldap_send_server_request ldap_result ld 0x12026b140 msgid 7 ldap_chkResponseList ld 0x12026b140 msgid 7 all 1 ldap_chkResponseList returns ld 0x12026b140 NULL wait4msg ld 0x12026b140 msgid 7 (timeout 4000000 usec) wait4msg continue ld 0x12026b140 msgid 7 all 1 ** ld 0x12026b140 Connections: * host: 192.168.0.1 port: 389 (default) refcnt: 2 status: Connected last used: Tue Sep 23 21:21:01 2008 ** ld 0x12026b140 Outstanding Requests: * msgid 7, origid 7, status InProgress outstanding referrals 0, parent count 0 ** ld 0x12026b140 Response Queue: Empty ldap_chkResponseList ld 0x12026b140 msgid 7 all 1 ldap_chkResponseList returns ld 0x12026b140 NULL ldap_int_select read1msg: ld 0x12026b140 msgid 7 all 1 read1msg: ld 0x12026b140 msgid 7 message type search-result new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 0x12026b140 0 new referrals read1msg: mark request completed, ld 0x12026b140 msgid 7 request done: ld 0x12026b140 msgid 7 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 7, msgid 7) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result rlm_ldap: object not found or got ambiguous search result ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 Thanks, Pramada

1 0

Help with md5 database encryption
by Oscar Trejo 23 Sep '08

23 Sep '08

Hi, I had a freeradius server working, but only when the password are saved on the database on plain-text with out encryption, my question is about how to save the instructions on the table radcheck and radgroupcheck to work with Password encryption MD5. My working free radius tables had radcheck +----+----------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+--------+ | 3 | oscar | Password | == | uno | +----+----------+-----------+----+--------+ radgroupcheck +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | dinamico | Auth-Type | := | Local | +----+-----------+-----------+----+-------+ When i had the password with simple plaint text with out encryption the result is the next Auth: Login OK: [oscar/uno] (from client ##### port ########## cli ##:##:##:##:##:##) But I want to save the password with MD5 encryption, the freeradius load correctly the module pap, chap and eap with out errors, but when i try to change the configuration for example : radcheck +----+----------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+--------+ | 3 | oscar | MD5-Password | == | 1eaa8bb195869a23f081acbb5bf08527 | +----+----------+-----------+----+--------+ radgroupcheck +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | dinamico | Auth-Type | := | PAP | +----+-----------+-----------+----+-------+ the free radius log gave me the next error: Error: rlm_sql_getvpdata: database query error Info: rlm_sql (sql): No matching entry in the database for request from user [oscar] Auth: Login incorrect: [oscar/uno] (from client ##### port ########## cli ##:##:##:##:##:##) But i need the encryption with MD5, any suggestion Before any answer I gave you thanks for the help Bye -- Oscar Trejo Martínez Student Ing. Tecnologías de la Información

2 1