October 2010 - Freeradius-Users - lists.freeradius.org

how to get vendor specific attribute value
by Noura Kossentini 08 Oct '10

08 Oct '10

Hello, I want to retrieve the value of the vsa attribute from the Access-accept response of free radius (I use tiny radius client). I tried to add attribute in the users file like this: testing Cleartext-Password := "toto@titi" ROLE = user But I found unknown attribute sent in the ethereal trace even though I defined it in a customer dictionary. i need your help

2 5

Re: Problemes with the mystic of freeradius configuration
by Phil Mayers 08 Oct '10

08 Oct '10

On 08/10/10 10:36, Klaus Ethgen wrote: > Hello newsgroup, hello Alan DeKok, > > I tried to solve my problem with Daniel Bertolo from Switch but was not > success, so he told me to ask here. > > I want to configure a virtual server that always return ok to be used as > probe for a load balancer (Cisco ACE). So what I tried was to just copy > the status server and tried the following: > server tests { > authorize { > ok > } > > authenticate { > ok > } > } > > Unfortunately I get the following in the debug output: Try this: authorize { update control { Auth-Type := Accept } } > No authenticate method (Auth-Type) configuration found for the request: Rejecting the user This is the problem. > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. > > Do anybody have an idea how to solve that? You'll have to be a bit more specific than that. Also, this is two different issues in the same email; try posting each separate problem individually. > > Ah, yes. Please excuse that I did not post the full configuration and > debug output as there is many confidential stuff inside. If someone need > special answers, please tell me and I will see what I can do. We need the debug output, or we can't help you. However - for eduroam setup, including example FreeRadius configs, try googling for "FreeRadius eduroam" - there are white papers and example configs.

1 0

auth: Failed to validate the user.
by Daniel Sandulescu 08 Oct '10

08 Oct '10

Hello! I got a following and do not know where erroare mistake. cylon2:/etc/freeradius# radtest test-user test-pass 192.168.1.1 10 danieladmin Sending Access-Request of id 198 to 192.168.1.1 port 1812 User-Name = "test-user" User-Password = "test-pass" NAS-IP-Address = 192.168.1.1 NAS-Port = 10 rad_recv: Access-Reject packet from host 192.168.1.1 port 1812, id=198, length=20 ------- ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test-user/test-pass] (from client cyclon2 port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test-user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 192.168.1.1 port 39973 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +21 Ready to process requests.

1 0

WiMax VSA Support
by Anup 07 Oct '10

07 Oct '10

Hi, I would like to know whether latest Freeradius version has the support for WiMax VSAs? Also please tell me how to send the WiMAX Qos Descriptors in Access-Accept Regards Anup ______________________________________ Scanned and protected by Email scanner

5 9

Optional authorize methode
by Ricardo Frías Alvarez 07 Oct '10

07 Oct '10

Hello! I don't know how to configure Radius to do this : I want that radius accepts the access, if files or ldap returns ok. In descriptive code: IF files return 'OK' THEN access-accept ELSE IF ldap return 'OK' THEN access-accept ELSE access-reject After I saw the documentation, I thought that I can do this with fail-over and I add this code to sites-enabled/default: authorize { ... group { files { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, return "ok" # if "detail1" returned "fail" } ldap { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, don't do "detail2" } } ... With this configuration it's happening the following: If files return OK the username/password are accepted. If files return fail username/password are rejected directly. This is not what I want. I want that if files fail then check ldap. How I can configure radius to implement this functionality? Thanks you very much, Ricardo Frías.

2 2

Problem with Alcatel 4604 and Cisco ACS
by matteo 07 Oct '10

07 Oct '10

Hello, I'm in trouble trying to authenticate a client connecting to an Alcatel 4604 (Aruba device) to a Cisco ACS, because my alcatel send as Called-Station-Id value its mac-address. On the Cisco side, this value correspond to the SSID value, while this attribute on Alcatel is send via Aruba-Essid-Name (attribute 5 in dictionary.aruba). Is there a way to change this behavior or a remap of this attribute for Alcatel? Thanks. Matteo

2 3

MSCHAP issue - [mschap] FAILED: MS-CHAP2-Response is incorrect
by jon michaels 07 Oct '10

07 Oct '10

Hi, I am attempting to replicate a test setup into production and somewhere along the way I must have forgotten something. I have an NT-Password stored in a mysql database and currently get the following response from freeradius upon authenticating: rad_recv: Access-Request packet from host 127.0.0.1 port 58065, id=224, length=130 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "jo" MS-CHAP-Challenge = 0x6bc832b0733a709ab358ab111e88da69 MS-CHAP2-Response = 0x0d00f974435c9a9eb2abaa5f8350b8c4b30600000000000000000a9a21d7cb82b31bfbd804045063702431fa9ff46e928dd9 NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "jo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> jo [sql] sql_set_user escaped user --> 'jo' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jo' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jo' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'jo' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'jo' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'jo' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'jo' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for jo with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jo attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 224 to 127.0.0.1 port 58065 Waking up in 4.9 seconds. Cleaning up request 6 ID 224 with timestamp +888 Ready to process requests. I think I missed one option when documenting the test setup. Unfortunately the test setup was accidentally deleted. Would anyone know what I missed? Thanks, Jon.

2 1

None
by latha_vgopal＠yahoo.com 07 Oct '10

07 Oct '10

http://laramolino.it/und9.html

1 0

PEAP w/ freeradius to LDAP storing ntPassword
by schilling 06 Oct '10

06 Oct '10

Hi All, We are trying to use ldap as backend database for dot1x peap authentication thru freeradius. The following link has good explanation. http://vuksan.com/linux/dot1x/802-1x-LDAP.html But do we really need both ntpassword and lmpassword in the ldap directory? How the process work regarding ntpassword authentication. Is the following sequence in the right direction? windows client send username and ntpassword to NAS NAS send the username/ntpassword to radius in a tunnel radius unwrap the tunnel, using the username to fetch the ntpassword from ldap, do a comparison of ldap returned ntpassword and unwrapped ntpassword, if they are the same, authentication accept. Thanks, Schilling

3 3

Free Radius , how to make it work with dynamic clients
by Rajendra Hegde 06 Oct '10

06 Oct '10

Hello, I want to make free radius work with dynamic set of clients - Clients will have specific range (not just any client) - Clients will have some shared secret. Can it do 2 objectives listed above? I know there is a macro WITH_DYNAMIC_CLIENTS, But after compiling it with having defined WITH_DYNAMIC_CLIENTS, What else I need to configure and how to run, not very sure. Regards, Rajendra Hegde Software Developer CRYPTOCard Inc Website: www.cryptocard.com <http://www.cryptocard.com/> Address: 340 March Road, Suite 600 Ottawa, ON, Canada K2K 2E4 The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. Please see our legal details at http://www.cryptocard.com CRYPTOCard Inc. is registered in the province of Ontario, Canada with Business number 80531 6478. CRYPTOCard Europe is limited liability company registered in England and Wales (with registered number 05728808 and VAT number 869 3979 41); its registered office is Aztec Centre, Aztec West, Almondsbury, Bristol, UK, BS32 4TD

2 1