December 2012 - Freeradius-Users - lists.freeradius.org

Fwd: FW:
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, I am sending an Access-Request packet using radeapclient without password,** ** I am giving the following attributes in radeapclient:**** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** But server is sending Access-Reject to the request.**** Following are the logs of radeapclient:**** ** ** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** <+++ EAP decoded packet:**** EAP-Message = 0x01d3001604107b44069aa80b67319a536bfd4f8ac713**** Message-Authenticator = 0xb4499f3ee54742d9dd8469980720dcf6**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** EAP-Id = 211**** EAP-Code = Request**** EAP-Type-MD5 = 0x107b44069aa80b67319a536bfd4f8ac713**** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 211**** Message-Authenticator = 0x00000000000000000000000000000000**** EAP-Type-MD5 = 0x10d2c45d5e328b2b2db8bd66c7d171635d**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** <+++ EAP decoded packet:**** EAP-Message = 0x04d30004**** Message-Authenticator = 0xf6f7e2707ef22ea86a660a4ddce7fb30**** EAP-Id = 211**** EAP-Code = Failure**** ** ** On further investigation, i found an example to test eap-md5 in the source code{ freeradius-2.1.8 } in src/tests**** ** ** Example is :**** ** ** echo 'User-Name = "eapmd5"'**** echo 'Cleartext-Password = "md5md5"'**** echo 'NAS-IP-Address = marajade.sandelman.ottawa.on.ca'**** echo 'EAP-Code = Response'**** echo 'EAP-Id = 210'**** echo 'EAP-Type-Identity = "eapsim'**** echo 'Message-Authenticator = 0'**** echo 'NAS-Port = 0' )**** ** ** ** ** But EAP RFC3579 and RFC2869 states that User-Password should not be part of a radius packet containing EAP-Message attribute,**** ** ** **** it written that “An Access-Request that contains either a User-Password or** ** CHAP-Password or ARAP-Password or one or more EAP-Message attributes**** MUST NOT contain more than one type of those four attributes. If it**** does not contain any of those four attributes, it SHOULD contain a**** Message-Authenticator. If any packet type contains an EAP-Message**** attribute it MUST also contain a Message-Authenticator.”**** ** ** ** ** Please let me know if any specific configuration need to be done on the server so that server sends Access-Accept.**** **** ** ** Thanks in advance. Arpit

2 1

(no subject)
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, can we send accounting request using radeapclient ??**** **** I am getting the following error:**** ** ** radeapclient -x 172.168.200.15 acct testing123**** User-Name= " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** rlm_eap: EAP-Message not found**** <+++ EAP decoded packet:**** ** Regards, Arpit

2 1

Lost user
by Dmitry Korzhevin 27 Dec '12

27 Dec '12

Hi, Can you please give advice in next situation: mysql> SELECT * FROM `radpostauth` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; +-------+----------------------------------------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +-------+----------------------------------------+------+---------------+---------------------+ | 24825 | {E6395348-49C3-C12A-2998-B60329D0CA5C} | | Access-Accept | 2012-12-16 04:20:59 | +-------+----------------------------------------+------+---------------+---------------------+ 1 row in set (0.00 sec) mysql> SELECT * FROM `radacct` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; Empty set (0.00 sec) mysql> I have user in table radpostauth, but i can't find same user in table radacct. How could it be? http://dpaste.com/852738/ Nothing in logs: grep -r "{E6395348-49C3-C12A-2998-B60329D0CA5C}" /var/log/freeradius/ Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

4 6

how to read db files?
by Periko Support 26 Dec '12

26 Dec '12

Hi guys. Exist a way to read freeradius db files? db.daily, etc, etc. This are berkeley db files or what type of are those? I'm using flat files not sql settings. FR 2.x, thanks!!!

1 0

Re: Lost user
by Alan Buxey 26 Dec '12

26 Dec '12

As Alan has said, your radpostauth table has an entry because the RADIUS server dealt with an auth request...your radact table entry has no entry likely because no accounting packet was received. Run in debug mode and see what occurs alan

1 0

radusergroup without primary key
by Efi merdler 26 Dec '12

26 Dec '12

Hello, I'm using radius 2.1.12 with postgresql as a backend. I've noticed that radusergroup does not contain any key column. There is a complaint on the subject posted back in 2007 (http://lists.freeradius.org/pipermail/freeradius-devel/2007-August/003239.h…) however nobody addressed it. We are accessing the table from an external process and it requires a primary key to be successful, how would you recommend handling it ? Cheers

3 4

Enforcing use of Eap-TLS or PEAP
by kjonca＠o2.pl 24 Dec '12

24 Dec '12

I try to set up radius authentication in my WiFi network. I want to have: 1. one user (samsung phone) should be authenticated with PEAP 2. others should be authenticated with EAP-TLS. Naive approach is to use Auth-Type but its treated as "misuse" at http://deployingradius.com/documents/configuration/auth_type.html But example is only for ms-chap, and I don't know which attribute(?) use to force PEAP /EAP-TLS Any help? Am I missing something? KJ -- http://blogdebart.pl/2009/12/22/mamy-chorych-dzieci/ QOTD: "It's been real and it's been fun, but it hasn't been real fun."

2 1

Re:Re: Is there a way to renew pptp user information of a user connected mikrotik?
by 조명산 24 Dec '12

24 Dec '12

2 1

Is there a way to renew pptp user information of a user connected mikrotik?
by 조명산 24 Dec '12

24 Dec '12

2 1

Where To Replace '%S' with '${sqlmod-inst}'
by Prabhpal S. Mavi 23 Dec '12

23 Dec '12

Hi FreeRadius List, After installing configuring the server. Almost everything worked just fine. Version: freeradius-2.1.12-4.el6_3.x86_64 radiusd -X 1.) WARNING: Please replace '%{%k}' with '${key}' 2.) WARNING: Please replace '%S' with '${sqlmod-inst}' Replaced '%{%k}' with '${key}'AND No-1 Warning Gone Away. But there is no %S in the query or in entire counter.conf.' i have also checked related files did not find %S anywhere. 1.) "/etc/raddb/radiusd.conf" 2.) "/etc/raddb/clients.conf" 3.) "/etc/raddb/sql.conf 4.) "/etc/raddb/dictionary" 5.) "/etc/raddb/modules/counter" 6.) "/etc/raddb/sql/mysql/counter.conf" 7.) "/etc/raddb/sites-available/default" Should i ignore the warning? i am sure that someone would have come across this warning. Is any one know the solution? i am not enough to reach to the root. Please help guys, i need your help. Thanks / Thanks / Thanks

1 0