July 2009 - Freeradius-Users - lists.freeradius.org

Is it possible to terminate EAP/Authentication on an entirely different radius box through freeradius?
by Max Palatnik 10 Jul '09

10 Jul '09

Hi all, I have a question that some coworkers and I have been unable to answer in the last few weeks and we are hoping to have your insight. Here are the details (if I leave something important out, please let me know): We are running radiusd: FreeRADIUS Version 1.1.7, for host sparc-sun-solaris2.10 Currently we have TTLS/PAP authentication setup and working just fine. Some authentication occurs locally, while other realms are proxied off to another radius server that share a secret with us, but all TTLS tunnels are terminated by our freeradius box and then proxying is done radius to radius server. In the near future we will have some AD servers (LDAP) which will authenticate enterprise-wide credentials that are being issued to everyone on campus. In lab, we have made PEAP terminate on freeradius and then have used ntlm_auth & samba to proxy ms_chap out to the AD server for authentication. What we are wondering is if its possible to still have requests come through to our freeradius box, and instead of providing the certificate and proxying the contents of the inner tunnel to the AD box.. if its possible to simply proxy the entire request, PEAP/MSCHAP and all directly to their AD servers? They are hesitant to allow our freeradius box to join the domain, and if its doable, a workaround would be the preferred route. I hope this makes sense and thanks for any help offered. Sincerely, Max

3 5

radippool question
by Martin Badie 10 Jul '09

10 Jul '09

Hi, Af far as I see when a client gets an IP from pool an entry is created in radippool table: mysql> select * from radippool where expiry_time>now() ; +-----+------------+-----------------+---------------+-----------------+------------------+---------------------+----------+-----------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +-----+------------+-----------------+---------------+-----------------+------------------+---------------------+----------+-----------+ | 60 | pool | 1.2.3.4 | 10.0.0.1 | | aadadasdadadaa | 2009-07-10 18:57:52 | user1 | 13242346536 In sqlippool.conf we define lease_time as 3600 seconds. I want to ask what happens after 3600 seconds. I can see that the ip is still in radippool table but date is earlier from now. Does radiusd sends a packet back to NAS so client re-requests a new IP without a traffic disruption ? Or what happens? Regards.

2 1

Strange behavior with aliased ethernet port
by Alan Madill 10 Jul '09

10 Jul '09

We are setting up a new radius server and replacing several existing servers. During the transition we set a second ip address on eth0:1 on one of the new servers so that it would respond to radius and DNS queries in place of the retired server at its old ip address. We have been trying to debug an authentication issue with our vpop provider. Looking at the debug trace all appeared to be well. rad_recv: Access-Request packet from host 216.113.192.27:51209, id=131, length=170 User-Name = "name(a)domain.com" User-Password = "secret" NAS-IP-Address = 207.194.241.33 NAS-Identifier = "PGRGBC01AS01.provider.com" NAS-Port = 1189 NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP State = 0x Calling-Station-Id = "2505674819" Called-Station-Id = "5674831" Acct-Session-Id = "425788824" Ascend-Data-Rate = 31200 Ascend-Xmit-Rate = 46667 Processing the authorize section of radiusd.conf ...... rlm_ldap: user name authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Login OK: [name] (from client uniserv.2 port 1189 cli 2505674819) Sending Access-Accept of id 131 to 216.113.192.27 port 51209 Finished request 2 Going to the next request But the Windows DUN client would fail with a Error 691 Looking at a tcpdump of the traffic between the servers we see... [root@host raddb]# tcpdump -nn host 216.113.192.27 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 10:04:02.675842 IP 216.113.192.27.51209 > 204.244.116.2.1645: RADIUS, Access Request (1), id: 0x7e length: 171 10:04:02.680874 IP 204.244.116.14.1645 > 216.113.192.27.51209: RADIUS, Access Accept (2), id: 0x7e length: 20 10:05:20.101253 IP 216.113.192.27.51209 > 204.244.116.2.1645: RADIUS, Access Request (1), id: 0x7f length: 171 10:05:20.106329 IP 204.244.116.14.1645 > 216.113.192.27.51209: RADIUS, Access Accept (2), id: 0x7f length: 20 Notice the request comes to the aliased address but the reply comes from the real address of the port. Is this a configuration error, normal behavior, or a bug? Looking at other services such as DNS the reply comes back from the target ip address and port. Issue was resolved by having our vpop provider put in the proper addresses.

2 1

FreeRadius 2.1.6 + EAP-PEAP issue
by Anatoly Oreshkin 10 Jul '09

10 Jul '09

Hello, I am configuring FreeRadius 2.1.6 to athenticate MS Vista user using EAP-PEAP protocol. The file users looks as follows: csd-notebook\user_name Cleartext-Password := "user_password" Where csd-notebook is notebook name. This setting is working. But I would like to make 2 improvements to current configuration. 1. to have an ability to specify only user name in users file in order to not depend on user computer name. I was trying to do this by changing some FR 2.1.6 configuration parameters but failed. 2. To add athentication by computer MAC address I added Calling-Station-Id == "00-16-EA-8A-DE-38" parameter to users file csd-notebook\user_name Cleartext-Password := "user_password", Calling-Station-Id == "00-16-EA-8A-DE-38" but got such error message: ..... [eap] EAP packet type response id 17 length 67 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 159 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for oreshkin with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject What parameters should I change to make these 2 configurations to work ? Current FR 2.1.6 configuration is as follows. eap.conf: ---------- peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } modules/mschap: -------------- mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } modules/preprocess: ------------------- preprocess { with_ascend_hack = no with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } modules/realm: -------------- realm ntdomain { format = prefix delimiter = "\\" } sites-available/default: ----------------------- authorize { preprocess mschap suffix } authenticate { Auth-Type MS-CHAP { mschap } ... } sites-available/inner-tunnel: ---------------------------- authorize { mschap suffix update control { Proxy-To-Realm := LOCAL } ... } Thank you.

3 6

How to control a wpa_supplicant client request can only send to a hostapd NAS?
by DJ HENRY 09 Jul '09

09 Jul '09

How to control a wpa_supplicant client request can only send to a hostapd NAS? My network struct was following: RADIUS(freeradius) | | SWITCH(cisco) | | ------------------------------------------------ | | NAS1(hostapd) NAS2(hostapd) | | CLIENT1(wpa_supplicant) CLIENT2(wpa_supplicant) If the network only has the NAS1 device, the CLIENT1 can pass the authentication. When the network have two NAS device, which one is NAS1 and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, then NAS1 and NAS2 all send the request to radius. I don't know whether CLIENT1 under NAS1 or NAS2 in radius. How to control a wpa_supplicant client request can only send to a hostapd NAS? Thank you very much! The CLIENT1 MAC: 00:0F:1E:34:28:B4 The NAS1 MAC: 00:0F:1E:34:26:50 The NAS2 MAC: 00:0f:1e:00:00:83 The CLIENT1 log -------------------------- EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *---00:0f:1e:34:26:50---* RX EAPOL - hexdump(len=14): 02 00 00 0a 01 00 00 0a 01 68 65 6c 6c 6f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=0 EAP: EAP entering state RETRANSMIT EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *---**00:0f:1e:00:00:83**---* RX EAPOL - hexdump(len=46): 02 00 00 16 01 01 00 16 04 10 e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (4, MD5) CTRL-EVENT-EAP-METHOD EAP method 4 (MD5) selected EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=26): 02 00 00 16 01 01 00 16 04 10 02 c8 6c 9b 31 7d 34 bc 09 6a 0f f2 c3 a8 01 54 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: AS used the same Id again, but EAP packets were not identical EAP: workaround - assume this is not a duplicate packet EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=8): 02 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:00:00:83 RX EAPOL - hexdump(len=46): 02 00 00 04 03 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS The NAS1 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 44 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: authentication failed The NAS2 log -------------------------- Deauthenticate all stations br0: STA *---**00:0f:1e:34:28:b4**---* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 63 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: old identity '00:0F:1E:34:28:B4' updated with User-Name from Access-Accept '00:0F:1E:34:28:B4' br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=3 id=1 len=4) from RADIUS server: EAP Success The RADIUS log -------------------------- rad_recv: Access-Request packet from host 192.168.1.45 port 1024, id=0, length=168 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.45 NAS-Port = 0 Called-Station-Id = "*---**00-0F-1E-34-26-50:**---*" Calling-Station-Id = "*---**00-0F-1E-34-28-B4**---*" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000160130303a30463a31453a33343a32383a4234 Message-Authenticator = 0xdfe32c5308f652199fc3f87459b2f8b8 +- entering group authorize {...} rad_recv: Access-Request packet from host 192.168.1.44 port 1024, id=1, length=186 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.44 NAS-Port = 0 Called-Station-Id = "*---**00-0F-1E-00-00-83:**---*" Calling-Station-Id = "*---**00-0F-1E-34-28-B4**---**"* Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604107d5ea6ea11c7d9aded44a4b961b5ab41 State = 0x532668a453276c3283f462034e3542a3 Message-Authenticator = 0x98ac376bdacceb01003f6f6bb9604f9c +- entering group authorize {...} Sending Access-Accept of id 1 to 192.168.1.44 port 1024 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:0F:1E:34:28:B4"

2 2

Ips dont get assigned using sqlippool
by Zemke, Kai 09 Jul '09

09 Jul '09

Hi, im currently configuring and testing mysqlipool for freeradius. I followed the instructions from the freeradius wiki nad have my radius server running. Im Running the server with the "-X" Option and whenever a user is connecting I get the following output: Thu Jul 9 14:44:08 2009 : Info: [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND; -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND; Thu Jul 9 14:44:08 2009 : Debug: rlm_sql_mysql: MYSQL check_error: 1064 received Thu Jul 9 14:44:08 2009 : Error: sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND;' Im a bit stuck here since I don't understand why this error occurs. I have thre IPs configured in my radipppool table: pool_name framedipaddress pool 192.168.35.178 pool 192.168.35.179 pool 192.168.35.180 The user with that I'am testing has the following attributes (in table radreply): Service-Type = Framed-User Framed-Protocoll = PPP Fall-Through = Yes And the following in radcheck: Cleatext-Password := testzugang Pool-Name := pool I'm missing something essential I think but I can't see my mistake so far. Anyone who can point me in the correct direction? Mit freundlichen Grüßen Kai Zemke =========================================================== smartnet Online Service GmbH, Schnackenburgallee 177, 22525 Hamburg =========================================================== Geschäftsführer: Christian Suding, Claus Masch Ust.IdNr.:DE191136350 Handelsregister HRB 66463 Steuernummer: FA: Hamburg 54/855/01047 Fon: +49 (0) 40 5540-0 Fax: +49 (0) 40 5540-1040 kai.zemke(a)smartnet.de<mailto:kai.zemke@smartnet.de> Weitere Informationen siehe: http://www.smartnet.de<http://www.smartnet.de/> =========================================================== Hinweis: Diese Email kann vertrauliche und/oder rechtlich geschützte Informationen enthalten. Wenn Sie nicht der beabsichtigte Empfänger sind oder diese Email irrtümlich erhalten haben, informieren Sie bitte sofort den Absender telefonisch oder per Email und löschen Sie diese Email aus Ihrem System. Das unerlaubte Kopieren, sowie die unbefugte Weitergabe dieser Email ist nicht gestattet.Wir haften nicht für die Unversehrtheit von Emails, nachdem sie unseren Einfluss- Bereich verlassen haben.

3 3

EAP+PEAP SQL + MAC AUTH?
by Son Gus 09 Jul '09

09 Jul '09

Hello guys! I was hoping you could help me with something its been troubling me the last two days. Im using a freeradius to authtenticate users on a WPA-Enterprise enviroment. What i would like to do now is to add another layer of security matching the MAC address of the user as well the user+password. The user and password thing is working without a problem, but i dont quite understand what is the way (or the best way) to accomplish the MAC thing. Google says that i could use Calling-Station-id , so what i do is i create a Group and attach Calling-Station-id as a check item and put the MAC i want for that user to match but the user gets into the network no matter what MAC he has. I can see the calling-station-id coming from the NAS in the debug mode but doesnt seem to be checked. As an alternative i tried to use checkval. I add the checkval module on authorize.. and then where do i put the calling-station-id item? The questions are then: For the group to work, should i put another atribute apart from the calling-station-id for the check? Like the thing you do for Dynamic VLAN assignment... Whats the best/easiest way to accomplish this? checkval or using the attribute directly? I use freeradius 2.1.0 and daloradius. Users r stored in an sql database. Thanks in advance.

2 1

Error when multiple basedn are configured
by RamonL 09 Jul '09

09 Jul '09

Hello NG I configured a freeradius server and this did work well with one basedn. Now I want to define multiple basedn. I modified the configuration as described in the documentation found on the web When i start freeradius i get the following error message /etc/raddb/radiusd.conf[1915]: Line is not in 'attribute = valiue' format Errors reading radiusd.conf On the attachement you will find my radiusd.conf. The sections that i defined are ldapow and aldapnw. Can somebody help me to sove this problem? http://www.nabble.com/file/p24369138/radiusd_conf.rtf radiusd_conf.rtf Need urgently help. -- View this message in context: http://www.nabble.com/Error-when-multiple-basedn-are-configured-tp24369138p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Alvarion BreezeMax BTS - Service provisioning?
by Steve Evans 09 Jul '09

09 Jul '09

Hi, Hopefully someone has come across this before and can easily answer the question I am attempting to get an Alvarion Breezemax basestation working with FreeRadius for provisioning of services. Essentially it appears straight forward the manual provides the following info: 1 Verify that the necessary Service Profiles are available in the database of the relevant Base Station(s). 2 The Users List of the server must include the default User Name and Password of the NPU (both are KeepAliveUserNameAndPassword). 3 The format of the each Service in the ID Filter in the RADIUS Authentication server(s) is n:v:h:a:c; The ID Filter may include up to 5 Services, separated by “;”: s1;s2;... �n = Service Profile Name � v=<VLAN List>. v=<> is an empty VLAN list. � h=ON or OFF, indicating the configured Hybrid VLAN Mode. � a=<OFF or ON, VLAN ID>, indicating the configured Access VLAN Mode, and the Access VLAN ID for Access VLAN ON. � c=ON/OFF, indicating the configured VLAN Classification Mode. The first 2 are straight forward and as things stand the CPE user get authenticated by the Radius server however defining the service whatever I do cannot get it to work! The setup is just in a lab environment so the Radius server is just using the conf files no databases and in the very simple user file I have the following: username User-password == "password" Filter-id = "n=InternetAccess:v=<>:h=OFF:a=<OFF>:c=OFF;" The manual seems to point towards the filter-id but this does not work! I see in the reply-details log files that the filter-id is being sent however I then check on the Alvarion CPE and it doesn't have any Service configured. . . I have tried the alvarion-vsa-## and the the breezemax-attrb and these still make no difference! Has anyone got this working? The supposed Alvarion support is as widely reported non-existant - the two contacts I have are both on leave! Cheers in Advance Steve

4 12

Re: Freeradius-Users Digest, Vol 51, Issue 30
by gayathri reddy 09 Jul '09

09 Jul '09

Hi Kalik, Thanks for your help... Now i can send two Qos profiles and it's working fine. Thanks, Gayathri On Wed, Jul 8, 2009 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: freeradius active directory integration fails with "no > such realm" (Andrei-Florian Staicu) > 2. Re: want to authorise but not authenticate (Arran Cudbard-Bell) > 3. Re: want to authorise but not authenticate (Ivan Kalik) > 4. Re: How to configure 2 wimax qos profiles for the user in > users file (Ivan Kalik) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 08 Jul 2009 12:31:21 +0300 > From: Andrei-Florian Staicu <andrei.staicu(a)gmail.com> > Subject: Re: freeradius active directory integration fails with "no > such realm" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A546769.8020709(a)googlemail.com> > Content-Type: text/plain; charset=ISO-8859-2; format=flowed > > Alan DeKok wrote: > > Andrei-Florian Staicu wrote: > > > >> Hello again. I've reached the output from here: > >> http://pastebin.com/d19f28a24 , and i still don't understand why it > >> doesen't call the ntlm_auth line > >> > > > > It looks like you are adding a "Proxy-To-Realm := LOCAL". > > > > ... > > > >> PEAP: Sending tunneled request > >> EAP-Message = > >> 0x02060018014950534f305c616e647265692e737461696375 > >> FreeRADIUS-Proxied-To = 127.0.0.1 > >> User-Name = "IPSO0\\andrei.staicu" > >> server inner-tunnel { > >> +- entering group authorize > >> rlm_realm: Looking up realm "IPSO0" for User-Name = > >> "IPSO0\andrei.staicu" > >> rlm_realm: Found realm "IPSO0" > >> rlm_realm: Adding Stripped-User-Name = "andrei.staicu" > >> rlm_realm: Adding Realm = "IPSO0" > >> rlm_realm: Authentication realm is LOCAL. > >> ++[ntdomain] returns noop > >> ++[mschap] returns noop > >> ++[control] returns noop > >> > > > > Why is that "update control" section there? What is in it? > > > > > > > >> rlm_eap: Request is supposed to be proxied to Realm LOCAL. Not doing > >> > > EAP. > > > > It's being proxied to realm LOCAL. You have added a LOCAL realm. > > Don't do that. > > > > > >> ++[eap] returns noop > >> WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not > >> exist! Cancelling invalid proxy request. > >> > > > > Even more proof. The IPSO0 realm above is added because it exists. > > The server does NOT add a "Proxy-To-Realm := LOCAL". You have done > > that. Delete it from your configuration. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > It works now. Thank you very much for clearing thing up for me. > > > ------------------------------ > > Message: 2 > Date: Wed, 08 Jul 2009 10:33:22 +0100 > From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > Subject: Re: want to authorise but not authenticate > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A5467E2.5040309(a)sussex.ac.uk> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 8/7/09 10:19, A.L.M.Buxey(a)lboro.ac.uk wrote: > > hi, > > > > heres one for a wednesday morning. > > > > > > we have a system that we've been done plain authorizations > > via FreeRADIUS - the device sends the following RADIUS request > > > > username: userid > > password: userid > > > > (ie the system sends the username and makes the password the same) > > > > okay. fair enough....a bit of unlang and a check that if the username = > password > > then set the Auth-Type to something false et voila. all okay. > > > > > > it has now been decided to also do authentication via RADIUS > > and this is where things get messy. > > > > > > by removing the Auth-Type kludge, we can successfully authenticate > > a real user with their real password.... however, the authorization > > now fails because the device still sends username/password with > > the password the same as the username - this now hits the > > FreeRADIUS server which cannot find a valid Auth-Type for the user > > and thus fails authentication and therefore sends back a 'blurgh' > > to the box requesting authorization. > > authorize { > if((User-Name == User-Password) && %{ldap:etc...}){ > update control { > Auth-Type := 'NULL' > } > } > else { > // Authentication modules > } > } > > > Auth-Type NULL { > ok > } > > > > > this is to be expected because there is nothing in the request to > > distoniguish between an authorization request and an authentication > > request. > > > > so the question is, how do we handle this so that the system can > > send a username=password for authorization AND a proper authentication > > can happen WITHOUT (hers a gotcha) the user doing something cute > > like putting their username in as their password! ;-) > > Slightly confused as to what you want... Try again without the caffeine ? > > Arran > > -- > Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk>, > Systems Administrator (AAA), > Infrastructure Services (IT Services), > E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT > DDI+FAX: +44 1273 873900 | INT: 3900 > GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 > > > ------------------------------ > > Message: 3 > Date: Wed, 8 Jul 2009 10:35:04 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: want to authorise but not authenticate > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <10825.194.176.105.43.1247045704.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > > > we have a system that we've been done plain authorizations > > via FreeRADIUS - the device sends the following RADIUS request > > > > username: userid > > password: userid > > > > (ie the system sends the username and makes the password the same) > > > > okay. fair enough....a bit of unlang and a check that if the username = > > password > > then set the Auth-Type to something false et voila. all okay. > > > > > > it has now been decided to also do authentication via RADIUS > > and this is where things get messy. > > > > > > by removing the Auth-Type kludge, we can successfully authenticate > > a real user with their real password.... however, the authorization > > now fails because the device still sends username/password with > > the password the same as the username - this now hits the > > FreeRADIUS server which cannot find a valid Auth-Type for the user > > and thus fails authentication and therefore sends back a 'blurgh' > > to the box requesting authorization. > > > > this is to be expected because there is nothing in the request to > > distoniguish between an authorization request and an authentication > > request. > > > > so the question is, how do we handle this so that the system can > > send a username=password for authorization AND a proper authentication > > can happen WITHOUT (hers a gotcha) the user doing something cute > > like putting their username in as their password! ;-) > > Send Service-Type = Authorize-Only in authorization request. Then you can > distinguish between the requsts. Or do authorization in the same time as > authentication. > > Without opening a major security hole. You can set Auth-Type to Accept if > User-Name = User-Password in the request but that would enable anyone to > log in knowing just username. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 4 > Date: Wed, 8 Jul 2009 10:39:48 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: How to configure 2 wimax qos profiles for the user in > users file > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <59554.194.176.105.43.1247045988.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > > > I am trying to configure the two wimax qos profiles for the single user > as > > one for uplink and another for downlink. > > If i configure the same attributes two times, in the Access-Accept > message > > the first configured wimax attribute value only is sending but its not > > sending the same attribute again which has different value. is there any > > way > > to do this and make it work? > > http://wiki.freeradius.org/Operators > > += > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 51, Issue 30 > ************************************************ >

1 0