November 2010 - Freeradius-Users - lists.freeradius.org

Building freeradius from source
by Nirmal Guhan 02 Nov '10

02 Nov '10

Hi, Am trying to compile freeradius (freeradius-server-2.1.10) for my own distro (based on 2.6.32 kernel from kernel.org) and running into compilation errors. : libtool: link: `rlm_eap_md5.lo' is not a valid libtool object gmake[9]: *** [rlm_eap_md5.la] Error 1 Please let me know a way to fix this. Also, radiusd seems to be pulling in many shared libraries. Do I need to compile them from source myself or are there any short cuts (if someone has tried this before) ? I know compiling it for Fedora or a similar distro is easier but unfortunately that won't help me. Note that I just need simple password (cleartext) based authentication leaving out the crypto stuff. Thanks, Nirmal

2 3

Authenticating agains AD issues
by Johnson, Neil M 02 Nov '10

02 Nov '10

I've been following the reciepe on the "Deploying RADIUS" web site, but I have been unable to get an iPhone or Laptop to authenticate to wireless. It appears from the log that ntlm_auth is behaving correctly but the the challenge continues. I'm running 2.1.9 on Fedora 12 using the demonstration certificates. Here is the last part of the log file: Thanks in advance. -Neil [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for nmjoo with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> IOWA\nmjoo [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User- Name:-None}} -> --username=IOWA\nmjoo [mschap] mschap2: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> -- challenge=13fe382b60e3bba9 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> -- nt-response=24bf15cdc812e5f7fb9723f21143bb775b24a1914870caf0 Exec-Program output: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program-Wait: plaintext: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 112 to 128.255.11.74 port 32768 EAP-Message = 0x010a005b19001703010050f59dec82774ce4b8dc5bb542e29881b2cb321a7136c39e4f1a498708fa2515da475f29ec726bd310dd96ab7ae6de4a85f079285567b375a7fa02d137f9d0d2adcf75dc887c91c50a41e041c13b370882 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa489d972ac83c05d8d6d2302f3fa3977 Finished request 17. Going to the next request Waking up in 3.2 seconds. Cleaning up request 0 ID 95 with timestamp +9 Cleaning up request 1 ID 96 with timestamp +9 Cleaning up request 2 ID 97 with timestamp +9 Cleaning up request 3 ID 98 with timestamp +9 Cleaning up request 4 ID 99 with timestamp +9 Cleaning up request 5 ID 100 with timestamp +9 Cleaning up request 6 ID 101 with timestamp +9 Cleaning up request 7 ID 102 with timestamp +9 Cleaning up request 8 ID 103 with timestamp +9 Waking up in 1.0 seconds. Cleaning up request 9 ID 104 with timestamp +10 Cleaning up request 10 ID 105 with timestamp +10 Cleaning up request 11 ID 106 with timestamp +10 Cleaning up request 12 ID 107 with timestamp +10 Cleaning up request 13 ID 108 with timestamp +10 Cleaning up request 14 ID 109 with timestamp +10 Cleaning up request 15 ID 110 with timestamp +10 Cleaning up request 16 ID 111 with timestamp +10 Cleaning up request 17 ID 112 with timestamp +10 Ready to process requests. -- Neil Johnson Network Engineer Information Technology Services The University of Iowa Work: 319 384-0938 Mobile: 319 540-2081 Fax: 319 355-2618 E-mail: neil-johnson(a)uiowa.edu

5 13

RE: Problem with LDAP and SSHA password
by Maurice James 01 Nov '10

01 Nov '10

I posted a working config for your exact problem last week. Take Johns advice. Thanks -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of Rafal Kaminski Sent: Monday, November 01, 2010 10:59 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Problem with LDAP and SSHA password W dniu 11/1/10 3:56 PM, Rafał Kamiński pisze: > Hi, > > I configured Freeradius + Ldap and ssha Password like userPassword but > when I try connect I have this debug log: > > ---CUT--- Ok - my bad :) I clicked "Send" fast. ---CUT--- Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: looking for reply items in directory... Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: user rafal.kaminski authorized to use remote access Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[ldap] returns ok Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[expiration] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[logintime] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[pap] returns noop Mon Nov 1 14:53:39 2010 : Debug: rad_check_password: Found Auth-Type EAP Mon Nov 1 14:53:39 2010 : Debug: auth: type "EAP" Mon Nov 1 14:53:39 2010 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Mon Nov 1 14:53:39 2010 : Debug: auth: Failed to validate the user. Mon Nov 1 14:53:39 2010 : Auth: Login incorrect: [rafal.kaminski/<via Auth-Type = EAP>] (from client 192.168.37.3 port 0) Mon Nov 1 14:53:39 2010 : Debug: Found Post-Auth-Type Reject Mon Nov 1 14:53:39 2010 : Debug: +- entering group REJECT Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: expand: %{User-Name} -> rafal.kaminski Mon Nov 1 14:53:39 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[attr_filter.access_reject] returns updated Mon Nov 1 14:53:39 2010 : Debug: Delaying reject of request 0 for 1 seconds Mon Nov 1 14:53:39 2010 : Debug: Going to the next request Mon Nov 1 14:53:39 2010 : Debug: Waking up in 0.9 seconds. Mon Nov 1 14:53:40 2010 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 217 to 192.168.37.3 port 1812 ---END-CUT--- Where is the problem? Thanks for help, because I can't resolve that problem for 2-3 days :( -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Problem with LDAP and SSHA password
by Rafał Kamiński 01 Nov '10

01 Nov '10

Hi, I configured Freeradius + Ldap and ssha Password like userPassword but when I try connect I have this debug log: ---CUT--- -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany

4 4

Dynamic VLAN Assignment based on a certificate, not a user.
by Бисер Миланов 01 Nov '10

01 Nov '10

Hello! Some time ago Alan mentioned that the new 2.1.10 version will support such a thing. However, I can't seem to find it in the docs. Can anyone shed some light on how that can be done with the new functionality? ----------------------------------------------------------------- Вижте последните новини във Vesti.bg! http://www.vesti.bg/

2 1