October 2009 - Freeradius-Users - lists.freeradius.org

"double" realm problem
by mr typo 30 Oct '09

30 Oct '09

Hello all, i do have a problem with our freeradius configuration and i have no idea how to solve it. we do have one realm configured domainname.com which works perfectly. every user who wants to authenticate with a different realm is proxied to an outside radius. server. the setup works fine. we do have some mobile devices who send something like: username@company.com@wlan.mnc003.mc username@company.com@Verisign... . . we send these requests to our proxy and the proxy sends it back to us,.... from my understanding i cant solve it with a regex in the proxy.conf, right? since the "realm" is just the string after the last @? anyone has an idea how i can process such request in my company.com realm? inside the realm i strip everything out, so it should work then. any ideas?kind regards -euroreg

6 23

SSL_read failed in a system call (-1), TLS session fails
by Guk Victor 30 Oct '09

30 Oct '09

Hello all, We're running FreeRADIUS 1.1.3 with EAP/TTLS (openSSL 0.9.8d) on Red Hat 5.1. The server will come up and process clients for a few days, but, every now and then it begins denying all auth-requests with the following error: Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Auth: Login incorrect: [host/user/<no User-Password attribute>] A restart makes the server happy and it goes back to properly auth'ing clients. Thanks in advance!

3 2

NotBefore, NotAfter or Date attributes fot temporary accounts
by Daniele Albrizio 30 Oct '09

30 Oct '09

In an old post Alan DeKok said he would patch freeradius to support temporary accounts using attributes like Date > "January 1 2010 13:00" Date > "January 12 2010 13:00" or Not-Before := "January 1 2010 13:00" Not-After := "January 12 2010 13:00" Somebody knows if such a feature has ever been included in Freeradius? Expiration attribute doesn't permit a "not-before" behaviour, Login-Time attribute doesn't permit month/year specification. Daniele Albrizio ======================== Old Post =============================== > -----Message d'origine----- > De : > [EMAIL PROTECTED] > radius.org > [EMAIL PROTECTED] > sts.freeradius.org] De la part de Alan DeKok > Envoyé : lundi 11 décembre 2006 19:47 > À : FreeRadius users mailing list > Objet : Re: NotBefore and Epiration (was Temporary Accounts), > Enhancement proposal > > > Thibault Le Meur wrote: > > > Enhancement proposal > > ==================== > > > > Why not implement the NotBefore part in the FR server code as it is > > already done for Expiration ? > > Or, add a "Date" attribute, that will compare against the > current date. You can then use configurations like: > > Date > "January 12 2006 13:00" > > And it should Just Work. Sure, this is a simpler way to do so. The only difference will be that the reply message will not say "Password has expired" or "Password not valid yet"... which, as far as I am concerned is not very important ;-) > I'll see if I can get a patch into 1.1.4. Thanks a lot... Thibault

2 3

problem regular expressions in hints file
by Ana Gallardo 30 Oct '09

30 Oct '09

Hello, I'm using Debian and Freeradius 2.0.4-3 I want to use the hints file to add an attribute named Intentos-Reject. I would like to use only one DEFAULT entry to match with @domain.es and with @ temp.domain.es If I use this DEFAULT entry the request don't match: #/etc/freeradius/hints DEFAULT Suffix =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... If I use this other DEFAULT entry the request match but Freeradius doesn't add Stripped-User-Name and I can't authenticate: DEFAULT User-Name =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... I don't know if I can use regular expressions with Suffix/Preffix atributes. Thank you very much and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________

2 5

Proxy Accounting
by adia 29 Oct '09

29 Oct '09

Dear All, We have FreeRADIUS Version 2.1.1 installed with mysql. Some of our users are authenticated via an external radius so we have configured a realm and proxy. All works well except accounting. The Freeradius does not seems to be sending the accounting to the remote server (local accounting to mysql works fine). This is the configuration we used: File realm: realm one { format = suffix delimiter = "#" ignore_default = no ignore_null = no } File proxy.conf: home_server pri_home_server { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = ****** response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server sec_home_server { type = auth+acct ipaddr = y.y.y.y port = 1812 secret = ****** response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool auth_failover_pool { type = fail-over home_server = pri_home_server home_server = sec_home_server } realm users{ type = radius auth_pool = auth_failover_pool acct_pool = auth_failover_pool nostrip } When using tcpdump on the server we don’t see any accounting request being issued by the radius. Your help please. Regards, Adi. -- View this message in context: http://www.nabble.com/Proxy-Accounting-tp26090474p26090474.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Time connected
by Sergio Belkin 29 Oct '09

29 Oct '09

Hi, Sorry for the stupid question, but I'd want to get how many time every user is connected, please could you provide some kind of guideliness? Using Version 2.1.1. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 4

Probably simple problem
by Paul Ryszka 29 Oct '09

29 Oct '09

Hello, I have problem that looks strange to me and probably is obvious but I can't find the solution. I try to authenticate freeradius against AD using ntlm auth : [root@localhost] /usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! NT_STATUS_OK: Success (0x0) debug log : [root@localhost raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) exec: wait = yes exec: program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=%{mschap:User-Name} --password=%{User-Password} " exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (ntlm_auth) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:58984, id=180, length=56 User-Name = "test" User-Password = "abcd123!" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 64 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ntlm_auth auth: type "ntlm_auth" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! ' Exec-Program: /usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 rlm_exec (ntlm_auth): External script failed modcall[authenticate]: module "ntlm_auth" returns fail for request 0 modcall: leaving group authenticate (returns fail) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 180 to 127.0.0.1 port 58984 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 180 with timestamp 4ae8c52e Nothing to do. Sleeping until we see a request. So I am puzzled a little bit because even if I copy the ntlm_auth line from debug output it returns access granted and it gives wrong password from within radius Any help would be appreciated. Thank You. Paul Ryszka

2 4

reply to NAS not correct
by T.Robers＠heidelberg.de 29 Oct '09

29 Oct '09

Hi, my Enterasys-switche need the filter-id for policy enforcement. I've got a problem with 802.1X authentication. Here is the log: rad_recv: Access-Request packet from host 172.16.255.101 port 49169, id=171, length=190 User-Name = "DNT1\\testtom" Service-Type = Framed-User Called-Station-Id = "00-1F-45-19-9C-68" Calling-Station-Id = "00-1C-25-9B-0E-EB" NAS-Identifier = "D2_Zi31_Tom" NAS-IP-Address = 172.16.255.101 NAS-Port = 1 NAS-Port-Id = "ge.1.1" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5a07edfa520df4edb36b506fccf290c2 EAP-Message = 0x020a001d1900170301001291f098b2e763cf55403eff0840390a3d3413 Message-Authenticator = 0xe6865e95c71f8c06d904dd297c05ee96 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] expand: %t -> Thu Oct 29 10:37:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 10 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { PEAP: Setting User-Name to DNT1\testtom Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DNT1\\testtom" State = 0xeb8ce38fea86f9b39b0a9d7efe7aaa3e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() [files] expand: OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de -> OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de [files] expand: sAMAccountName=%{mschap:User-Name} -> sAMAccountName=testtom rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter sAMAccountName=testtom rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=Group)(member=%{control:Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=Group)(member=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))(&(objectClass= GroupOfUniqueNames)(uniquemember=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter (&(cn=WWW)(|(&(objectClass=Group)(member=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde))(&(objectClass= GroupOfUniqueNames)(uniquemember=CN\3dTest\5c\2c Tom\2cOU\3dAbt11-2\2cOU\3dAmt11\2cOU\3dStadt Heidelberg\2cDC\3dheidelberg\2cDC\3dbw-online\2cDC\3dde)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Test\, Tom,OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter (objectclass=*) rlm_ldap: performing search in CN=WWW,CN=Users,DC=heidelberg,DC=bw-online,DC=de, with filter (cn=WWW) rlm_ldap::ldap_groupcmp: User found in group WWW rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 215 ++[files] returns ok [ldap] performing user authorization for DNT1\testtom [ldap] expand: sAMAccountName=%{mschap:User-Name} -> sAMAccountName=testtom [ldap] expand: OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de -> OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Abt11-2,OU=Amt11,OU=Stadt Heidelberg,DC=heidelberg,DC=bw-online,DC=de, with filter sAMAccountName=testtom [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user DNT1\testtom authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [DNT1\\testtom/<via Auth-Type = EAP>] (from client 172.16.255.101 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 Filter-Id = "Enterasys:version=1:policy=Mitarbeiter" EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" [peap] Got tunneled reply RADIUS code 2 Filter-Id = "Enterasys:version=1:policy=Mitarbeiter" EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 171 to 172.16.255.101 port 49169 EAP-Message = 0x010b00261900170301001b0c226877915fee81581e5cdc61a6b02b5e53a364ba4d32a2 1da9bc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a07edfa530cf4edb36b506fccf290c2 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.255.101 port 49169, id=172, length=199 User-Name = "DNT1\\testtom" Service-Type = Framed-User Called-Station-Id = "00-1F-45-19-9C-68" Calling-Station-Id = "00-1C-25-9B-0E-EB" NAS-Identifier = "D2_Zi31_Tom" NAS-IP-Address = 172.16.255.101 NAS-Port = 1 NAS-Port-Id = "ge.1.1" Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0x5a07edfa530cf4edb36b506fccf290c2 EAP-Message = 0x020b00261900170301001b5a6a60533756d32c9aab5a829fc0e0d05373ab92630a5ae1 12e1f0 Message-Authenticator = 0x3292991eacc6e9d3d99d5deef6d8b813 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.255.101/auth-detail-20091029 [auth_log] expand: %t -> Thu Oct 29 10:37:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DNT1\testtom", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "DNT1" for User-Name = "DNT1\testtom" [ntdomain] No such realm "DNT1" ++[ntdomain] returns noop [eap] EAP packet type response id 11 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [DNT1\\testtom/<via Auth-Type = EAP>] (from client 172.16.255.101 port 1 cli 00-1C-25-9B-0E-EB) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 172 to 172.16.255.101 port 49169 MS-MPPE-Recv-Key = 0x2089d240da067af3cffeae5b2ae13568d1db0f6d9f4120a8680f3438d63b7a63 MS-MPPE-Send-Key = 0xa991c884f9db4ae9b6cf6c5965d4c3ea46aa3b16a039a9a288c87413fe6cf4f6 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "DNT1\testtom" Finished request 10. Going to the next request Waking up in 4.9 seconds. The correct Filter-ID "Enterasys:version=1:policy=Mitarbeiter" in [peap] is pushed, but the switch got "invalid role". Is the Filter-ID overridden by the next Accept ? My users file contains DEFAULT Ldap-Group == "WWW" Framed-Filter-Id := "Enterasys:version=1:policy=Mitarbeiter" Any ideas ?

2 1

FreeRADIUS Active Directory Integration HOWTO
by Eduardo Gui 28 Oct '09

28 Oct '09

Hi, I´m new user. Does anyone help-me with FreeRADIUS Active Directory Integration HOWTO<http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO> ? This paper is no more avaiable on site. Thanks -- Eduardo Gui

2 1

Problem with Retrieving some Attributes
by mozafar roshany 28 Oct '09

28 Oct '09

Hi all I know that RADIUS server does AAA. Suppose that I have an active session (I made one with radclient). Now, I want to get an attribute of that session (for example, Calling-Station-Id); My problem is that I don't know what packet type should I send to RADIUS server to get attributes. My freeradius version: 2.0.4 in Debian Lenny. Thanks for any comment.

3 3