March 2011 - Freeradius-Users - lists.freeradius.org

access challenge on empty password
by izotov 01 Apr '11

01 Apr '11

Hi, I use pam_radius with openssh on a FreeBSD box. When I authenticate, and for the first time I simply enter an empty password then the second time I am prompted for the password characters are echoed on the terminal. As I can see my freeradius server responses an access challenge to request with an existing user and empty password combo. Is this a normal behaviour? How can I configure the system not to do so? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/access-challenge-on-empty-password-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Freeradius + Active Directory
by Ronald Chan 01 Apr '11

01 Apr '11

Hi List, I'm really sorry if this has been asked before, I was able to setup to authenticate radius via AD, now the problem my problem is, is there a way i can apply for Max-All-Session to each account on ad, just like with any other modules like rlm_sql ?, or I should say, is there a pre-autheticate section on the configs just like with pre-accounting section?, please bare with my english :D. Thanks in advance, Best regards, Ronaldo Chan

4 5

Convite para conectar-se no LinkedIn
by Rui Oliveira via LinkedIn 31 Mar '11

31 Mar '11

LinkedIn ------------Rui Oliveira requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, Eu gostaria de adicioná-lo à minha rede profissional no LinkedIn. -Rui Accept invitation from Rui Oliveira http://www.linkedin.com/e/f5ihn8-gly9zgzk-5r/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… View invitation from Rui Oliveira http://www.linkedin.com/e/f5ihn8-gly9zgzk-5r/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… -- (c) 2011, LinkedIn Corporation

1 0

Re: Certificate Compatibility - RESOLVED
by Ben Wiechman 31 Mar '11

31 Mar '11

Configuring the default_eap_type = mschapv2 in the ttls section allowed the EAP authentication to succeed. It had been at the default setting of md5. On Wed, Mar 30, 2011 at 12:49 PM, Jim Rice <jmrice6640(a)yahoo.com> wrote: > Hi Ben, > > I really appreciate you taking the time to help me with this. Thanks! > > I believe that I have those three pieces installed. > > I discovered that I had specified server.pem for the private_key_file in eap.conf. Changed that to server.key, but ended with the same results. > > I wonder what else I might need to fix in the eap.conf file. > I'm still not really sure how EAP_TLS and EAP_TTLS fit together... > > Perhaps a few more miles on the doc treadmill and I will graduate from the ranks of clueless newbie, and ask more intelligent questions. > > Thanks again for your patience. > > Jim > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

Certificate Compatibility - Successful Network Entry
by Ben Wiechman 31 Mar '11

31 Mar '11

While testing authentication with a Motorola Canopy AP I noticed that I was getting a Certificate Compatibility warning. I understand why this typically happens. What struck me as odd is that network entry still succeeds. Just to verify nothing really out of the ordinary was happening I verified the CA certificate that the server was using and re-imported this certificate onto the device, but still receive the same notification and still the same successful network entry. Does FR only use the State attribute to determine if the previous session didn't complete? The reason I ask is that the State attribute sent by FR in the Access-Challenge, and then echoed in the following Access-Request are the same, but the warning appears to truncate the value. Sending Access-Challenge of id 0 to 10.0.12.129 port 1273 User-Name = "anonymous" EAP-Message = 0x0107005f15800000005517030100508d4766c847a9447872b323a9bd33e47f6b3fc9a3be04184631d16bb14289d9d3f2387d214da2b3103eb90e7f9934044382fbe188be4b0a54956e6059b864b36088912d8de6da414965ea8577aca8bf87 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc2539648c75483204cf5c8028cb0d506 Finished request 9. Going to the next request Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 10.0.12.129 port 1273, id=0, length=99 Cleaning up request 9 ID 0 with timestamp +54 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xc2539648c7548320 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "anonymous" State = 0xc2539648c75483204cf5c8028cb0d506 NAS-IP-Address = 10.0.12.129 NAS-Port = 5 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1020 EAP-Message = 0x020700061500 Message-Authenticator = 0x333490df7d6b149bd645a83de291660e This appears to be a client side issue, but I would like to confirm that this is the case. I'm a little confused as to what is really happening here. Ben

1 0

Ldap Authentication question
by Ramon Escriba 31 Mar '11

31 Mar '11

Hi, I've a freeradius-server-2.1.9-1.7.x86_64 running in opensuse 11.3. My authentication frontend is an openldap2-2.4.21-9.1.x86_64. I have correct mac address authentication, but *ONLY* the first try, the later always fail. I'm using 3 devices, the first one that connects logs in fine, but the others fail. Has any one a clue of what I did wrong? I've multiple rules in users file, all of them with Auth-Type = <ldap instace name>, one "rule/ldap instance" per vlan. With radius -X I see a correct first authentication, but the others fail. Kind regards.

3 7

Attribute NOT being returned in access-accept ?
by Robert Roll 30 Mar '11

30 Mar '11

Freeradius Version 2.1.10 I'm trying to return a vendor attribute, but I don't seem to be seeing it in the access-accept ? I am inner tunneling to Peap, and you can see the attribute is there... Airespace-Interface-Name = "wifi-chem-uconnect" but I'm not seeing it in the packet from eapol and I'm also seeing it in the final Access-Accept sent from freeradius ? Sending Access-Accept of id 10 to 155.97.142.192 port 52965 MS-MPPE-Recv-Key = 0x0e6bf137da352024fe32478d9b9c2cdabbba6a94f9e185e16ce5601b8e4a8328 MS-MPPE-Send-Key = 0x99880b1843e321c484ceeb0ed19f55e2bbfa769f68e8783615beb220b13bb761 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "whatever" ------------ From Peap ----------------------------------- [peap] Got tunneled reply RADIUS code 2 Airespace-Interface-Name = "wifi-chem-uconnect" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x7aa77766e328dcdf3e38555995889912 MS-MPPE-Recv-Key = 0x6af45f9c8437843caf8d2c2ea1f7d7d2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tstRad9" [peap] Tunneled authentication was successful. Thanks, Robert

2 2

Help retrieving sqlcounter values
by Mark D. Montgomery II 30 Mar '11

30 Mar '11

We are working on re-setting up our hotspot (coovachilli/freeradius accounting in sql/ldap authentication) better and are trying to setup bandwidth limiting and such. What we seem to be having problems with is how to pull the data out of the sqlcounter module to compare the data used to the data limit. Such as: if ( amount_user_has_used >= limit_allowed) { do stuff to block them or whatever } We are trying to understand how the counter-name (Max-Usage-Allowed), check-name (Check-Max-Usage), and reply-name (Reply-Max-Usage) in the counter (UsageCounter) are accessed and evaluated to do the comparison. When we put if (<counter-name> >= blah) in, the function appears to be called and run, but this does not give us a valid comparison. Freeradius debug shows that the counter sql query is running and producing a numerical output, but obviously this is not the correct way to call it to get the comparison we want. We have tried such things as <counter-name>:<check-name> and such but just get errors and the counter query never runs. Any insight? We have searched all over and have not been able to get this working yet. Thanks. Mark II -- Mark D. Montgomery II http://www.techiem2.net

1 0

Re: Certificate Compatibility
by Jim Rice 30 Mar '11

30 Mar '11

Hi Ben, I am confused. If the certificate is incorrect, then what is this? > [ttls] (other): SSL negotiation finished successfully > SSL Connection Established But I will review to be sure.

3 3

Certificate Compatibility
by Jim Rice 30 Mar '11

30 Mar '11

Trying to test EAP-TTLS with Canopy AP. Getting this: (FR 2.1.10)... WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2f1a7f7f2b1c6afb did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Unfortunately the wiki is down... FreeRADIUS Wiki has a problem Sorry! This site is experiencing technical difficulties. Try waiting a few minutes and reloading. It's been down for a while now. Does anyone have this info in another form? Thanks!

3 10