January 2010 - Freeradius-Users - lists.freeradius.org

Re:A special user to matcheon all usernames
by zhongwei feng 16 Jan '10

16 Jan '10

hi, pang jiacai: try this : in authorize section : redundant { sql files } in users file : DEFAULT Auth-Type := Accept Session-Timeout := 300 　　 > >Hi,all: > I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail steps. thanks. > >

1 0

A special user to matcheon all usernames
by pang_jiacai 16 Jan '10

16 Jan '10

Hi,all: I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail steps. thanks.

2 1

Problems with XPsp3 and FreeRADIUS
by Seth 15 Jan '10

15 Jan '10

I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server. I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part: Successful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/peap* *Info: [eap] processing type peap Info: [peap] processing EAP-TLS Info: [peap] eaptls_verify returned 7 Info: [peap] Done initial handshake Info: [peap] eaptls_process returned 7 Info: [peap] EAPTLS_OK Info: [peap] Session established. Decoding tunneled attributes. Info: [peap] Received EAP-TLV response. Info: [peap] Success Info: [peap] Using saved attributes from the original Access-Accept Unsuccessful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/mschapv2* *Info: [eap] processing type mschapv2 Info: [mschapv2] +-entering group MS-CHAP (...) Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Info: [mschap] Told to do MS-CHAPv2 for seth with NT-Password ... Info: Debug: Exec-Program output: Logon failure (0xxc000006d) Info: Debug: Exec-Program-Wait: plaintext: Logon failure (0xxc000006d) Info: Debug: Exec-Program: returned 1 Info: [mschap] External script failed. Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Info: ++[mschap] returns reject Info: [eap] Freeing handler Info: ++[eap] returns reject Info: Failed to authenticate the user. Why is one auth request using the mschapv2 group and the other PEAP? Both are from the same client on the same switchport. Has anyone else run into this type of problem? Is there a configuration on the supplicant or Active Directory that could cause this? More information if necessary: from modules.conf eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/cert_privkey.key certificate_file = ${raddbdir}/cert_certificate. pem CA_file = ${raddbdir}/cert_ca_cert.pem dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = %{Stripped-User-Name:-%{User-Name}} peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } } Thanks, /Seth

4 5

Problems with configuration Cisco -> freeradius
by michi-bazi 15 Jan '10

15 Jan '10

Hello everybody, my first post here, hope you are able to help me. Honestly said I am a little bit confused. Here is my problem: I tried to setup the freeradius for cisco authentication. Sadly it didn't work. My reference how to configure was this: http://evilrouters.net/2008/11/19/configuring-freeradius-to-support-cisco-a… To my bad it didn't work. Here is what I have typed into the config files: users: cisco Auth-Type: = System Service-Type = NAS-Prompt-User, # cisco-avpair =”shell:priv-lvl=15” radiusd.conf: user = root group = root clients.conf: client 192.168.101.0/26 { secret =Test_1 shortname = site_a nastype = cisco } The switch is configured: aaa new-model ! ! aaa authentication login default group radius local aaa authentication login localauth local aaa authentication ppp default if-needed group radius local aaa authorization exec default group radius local aaa authorization network default group radius local aaa accounting delay-start vrf default aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa accounting system default start-stop group radius ! ip radius source-interface Vlan1 vrf default radius-server host 192.168.128.246 auth-port 1812 acct-port 1813 key Test_1 ! control-plane Ping is running through. When I type show ip aaa to the switch I get this: sh aaa servers RADIUS: id 2, priority 1, host 192.168.128.246, auth-port 1812, acct-port 1813 State: current UP, duration 49s, previous duration 0s Dead: total time 0s, count 13 Quarantined: No Authen: request 76, timeouts 76 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 19 Author: request 0, timeouts 0 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 0 Account: request 60, timeouts 60 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 15 Elapsed time since counters last cleared: 6d23h35m site_mgt_manchester# Would be great if you could help me, don't know what's wrong. Best regards Michael -- View this message in context: http://old.nabble.com/Problems-with-configuration-Cisco--%3E-freeradius-tp2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

freeradius + sqlippool
by Konstantin Chekushin 15 Jan '10

15 Jan '10

Good afternoon! I have a question. It is necessary to assign ip-address by RADUIS-server to gprs user. My decision is to use freeradius+sqlippool for this purpose . But there is one problem. ippool name is initially unknown. It should be taken depending on a phone number. I.e. there is one more table in my database, where is a conformity - number (calling station id)=ip pool. (If calling-station-id does not present in the table  - RADIUS takes default ippool name.) Is there a good way to realize the similar scheme? Thanks for advices.

2 2

freeRADIUS talk to multiple AD forests
by John 15 Jan '10

15 Jan '10

Hello, We are using freeRADIUS-1.1.6. The backend server is Active directory. It can work well for single AD forest (A.com). We are using Global catalog port 3286 to get attribute from A.com. We want to support another forest (B.com) which is trust with A.com. unfortunatly Global catalog can not access different forests info. How can we get attrubutes from these AD forests? If we do not configure another LDAP instance for B.com. Is there a way to get attributes from B.com? Best. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

Server Certificate Signing Request Question
by Ben Wiechman 14 Jan '10

14 Jan '10

I am generating a CSR for Verisign (WiMAX) to support EAP-TTLS. Some of the examples I see use the -nodes switch when generating the CSR, and others do not. Is the use of nodes CA specific, or why would I want to or not want to use -nodes. I see that when it is used the private key will not be encrypted, but I'm afraid I don't understand the ramifications of that. Any help or a link to a helpful RTFM would be greatly appreciated. Ben

1 0

RADIUS comparison tee
by John Morrissey 14 Jan '10

14 Jan '10

In moving our RADIUS infrastructure to FreeRADIUS, I wrote a tee to transparently compare FreeRADIUS' responses with those of our existing Radiator installations. It sniffs RADIUS traffic on the current machine, replays the requests to another RADIUS server, and compares the received responses with the sniffed responses. Differences are emitted to stdout, and known differences can be configured so they're automatically ignored. http://horde.net/~jwm/software/misc/comparison-tee john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

1 0

Auth-Type and Group precedence
by liran tal 14 Jan '10

14 Jan '10

Hey guys, Setting an Auth-Type := Accept to a user while also associating the same user to a group with Auth-Type := Reject results in a successful login of the user due to the Auth-Type := Accept in radcheck table taking precedence. Is it possible to give a higher priority to the group association? System is a FreeRADIUS 1.1.7 install with a mysql database backend. Regards, Liran.

1 0

Freeradius 2.x + MySQL: Failed to authenticate the user
by Alexander 14 Jan '10

14 Jan '10

Hello all, I have a new setup with Freeradius 2.1.7, Dialup Admin 1.80 and MySQL 5.0.77 running under Red Hat ES 5.4. Access from Freeradius to MySQL is working fine but user 'dummy' does not get authenticated. After hours of searching through my setup it seems to me that the problem is rather related to my Freeradius configuration than to MySQL. I tested locally with radtest and remotly with NTRadPing: Access-Reject. From the attached debug output can you see why? Thanks in advance! Cheers, Alexander

2 2