- Freeradius-Users - lists.freeradius.org

EAP-TTLS/EAP-PEAP Certificats
by Vincent Guardiola 20 Dec '11

20 Dec '11

Hi all, I have just one question about client certificats with EAP-TTLS or EAP-PEAP. I would like use certificats client with authentication MSCHAPv2 it's possible ? It's possible to use client certificats for create TLS tunel and use mschapv2 auth inside ? In my test the authentication is MSCHAPv2 or client certificat but not both in same time . Thx. Vincent

3 10

Inner tunnel external proxy fails under stress due to zero vectors
by Brian Julin 20 Dec '11

20 Dec '11

Greetings, While testing a setup that uses inner tunnel proxying I was noticing that there were spurious failures if the setup was stress tested. I managed to eliminate back-end latency as a possible cause by testing instead to a simple auth against rlm_passwd (with NTLM crypts.) I also tried with both servers running recent 3.0 repo code, so it's a problem that has likely been there at least from 2.1.10. After a long dig through the debugs, finally I noticed from a packet dump that packets with 0x00 vectors were hitting the wire, and when IDs were recycled that of course results in false "duplicates" (as well as the other crypto-related issues with that.) The packets with the 0x00 vectors were the inner-tunneled packets emitted from the proxying server. If I understand things right, these packets are generated by the EAP modules allocating a fake request, which is passed back through as if the server were handling the inner tunnel itself, and then when the proxy codepath is taken, this "fake" packet is then recycled as the outgoing request to the home server. Looking through the source we have this warning in request_alloc_fake src/main/utils.c: /* * This isn't STRICTLY required, as the fake request MUST NEVER * be put into the request list. However, it's still reasonable * practice. */ ...however this seems to be just what is happening. In fact, if above that I change: diff --git a/src/main/util.c b/src/main/util.c index 94ee443..e6a1a26 100644 --- a/src/main/util.c +++ b/src/main/util.c @@ -437,7 +437,7 @@ REQUEST *request_alloc_fake(REQUEST *request) */ fake->server = request->server; - fake->packet = rad_alloc(0); + fake->packet = rad_alloc(1); if (!fake->packet) { request_free(&fake); return NULL; ...then the setup passes stress testing just fine. Trouble is I'm not sure if there are ramifications to doing that...

2 1

Problem with sql entry
by Miha Zoubek 20 Dec '11

20 Dec '11

Hi, please help me out why I am getting two entries in mysql table (radacct) for outgoing call. If the call is answered I get two entries and one entry if the call is not answered (this is ok). Reason that I am asking this is that I do not see that my NAS is sending two start packet and to stop packet for answered call (you can see below). Please help me out understand why radius add two entries for stop packet if only one is send from NAS. 1. Call is not answered. 3126.504593 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=192, l=265) 3126.506361 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=192, l=20) 3128.512626 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Access-Request(1) (id=193, l=61) 3128.514192 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Access-Accept(2) (id=193, l=20) 3135.215365 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=194, l=362) 3135.217317 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=194, l=20) 2. Call is answered. 3142.992787 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=195, l=265) 3142.994570 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=195, l=20) 3145.001503 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Access-Request(1) (id=196, l=61) 3145.003161 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Access-Accept(2) (id=196, l=20) 3154.440904 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=197, l=401) 3154.443202 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=197, l=20) Bellow I am pasting only radius log for answered call. rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 48752, id=198, length=265 Acct-Status-Type = Start Acct-Session-Id = "d446d20a-6d1c-4ffd-9b59-1aedbf63b74c" User-Name = "123456789" Freeswitch-Src = "123456789" Freeswitch-CLID = "123456789" Freeswitch-Dst = "051357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = zzz.zzz.zzz.zzz Freeswitch-Context = "default" Freeswitch-Ani = "123456789" Freeswitch-Source = "mod_sofia" Freeswitch-Callstartdate = "2011-12-20T09:49:22.535428+0100" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xxx.xxx.xxx.xxx,NAS-IP-Address = xxx.xxx.xxx.xxx,Acct-Session-Id = "d446d20a-6d1c-4ffd-9b59-1aedbf63b74c",User-Name = "123456789"' [acct_unique] Acct-Unique-Session-ID = "01f7930c1c838911". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xxx.xxx.xxx.xxx [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] expand: %t -> Tue Dec 20 09:49:38 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> 123456789 ++[radutmp] returns ok [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 123456789 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 198 to xxx.xxx.xxx.xxx port 48752 Finished request 48. Cleaning up request 48 ID 198 with timestamp +5699 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 46971, id=199, length=61 User-Name = "123456789" User-Password = "1234" NAS-Port = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123456789' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123456789' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123456789' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "1234" [pap] Using clear text password "1234" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 199 to xxx.xxx.xxx.xxx port 46971 Finished request 49. Going to the next request Waking up in 4.9 seconds. Cleaning up request 49 ID 199 with timestamp +5701 Ready to process requests. rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 35569, id=200, length=401 Acct-Status-Type = Stop Acct-Session-Id = "68507972-f9d9-46c7-bf22-59020602ffe2" Freeswitch-Hangupcause = Normal-Clearing User-Name = "123456789" Freeswitch-Src = "123456789" Freeswitch-CLID = "Extension 123456789" Freeswitch-Dst = "38651357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = yyy.yyy.yyy.yyy Freeswitch-Context = "default" Freeswitch-Ani = "123456789" Freeswitch-Source = "mod_sofia" Freeswitch-Billusec = 3089990 Freeswitch-Callstartdate = "2011-12-20T09:49:24.552424+0100" Freeswitch-Callanswerdate = "2011-12-20T09:49:30.669405+0100" Freeswitch-Callenddate = "2011-12-20T09:49:33.759395+0100" Acct-Session-Time = 3 Freeswitch-Signalbond = "outbound" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xxx.xxx.xxx.xxx,NAS-IP-Address = xxx.xxx.xxx.xxx,Acct-Session-Id = "68507972-f9d9-46c7-bf22-59020602ffe2",User-Name = "123456789"' [acct_unique] Acct-Unique-Session-ID = "a2fd914fe7c27b9c". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xxx.xxx.xxx.xxx [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] expand: %t -> Tue Dec 20 09:49:49 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> 123456789 rlm_radutmp: Logout entry for NAS xxx.xxx.xxx.xxx port 0 has wrong ID ++[radutmp] returns ok [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstarttime = '%{Freeswitch-Callanswerdate}', acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstarttime = '2011-12-20T09:49:30.669405=2B0100', acctstoptime = '2011-12-20 09:49:49', acctsessiontime = '3', acctinputoctets = '0' << rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: %{Acct-Session-Time} -> 3 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Inpu rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 123456789 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 200 to xxx.xxx.xxx.xxx port 35569 Finished request 50. Cleaning up request 50 ID 200 with timestamp +5710 Going to the next request Ready to process requests. -- Best regards / Lep Pozdrav Miha Zoubek Softnet d.o.o.

2 2

VSA's and local dictionary
by Andrew Long 20 Dec '11

20 Dec '11

Greetings, I am running freeradius-server-2.1.8-0 on CentOS 5.6 and am setting up some new NAS, Nomadix AG3100. Every so often, when running in debug, the server reports "Invalid packet code 4 sent to authentication port from client AG3100 port 1032 : IGNORED". After searching past threads, I understand there is no way to know what is being sent short of sniffing the packets. As I'm not doing much with accounting, I'm not terribly concerned, but it did prompt me to take a look at the dictionaries in /usr/share/freeradius. Sure enough, there is a Nomadix dictionary file, but it lists only 13 attributes (content below), while the vendor supplied list includes 6 additional VSA's. I read in the dictionary man page that "The dictionaries in /usr/local/share SHOULD NOT be edited", while "If you need to add new attributes, please edit the /etc/raddb/dictionary file". So, the question is, will the following entry in /etc/raddb/dictionary correctly add the "new" attributes? I have not entered the types yet, waiting on the OEM for some clarification. #ATTRIBUTE name number type [vendor|options] ATTRIBUTE Nomadix-Qos-Policy 14 [type] Nomadix ATTRIBUTE Nomadix-SMTP-Redirect 17 [type] Nomadix ATTRIBUTE Nomadix-Centralized-Mgmt 18 [type] Nomadix ATTRIBUTE Nomadix-Group-Bw-Policy-ID 19 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-up 20 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-Down 21 [type] Nomadix Thank you for any help. - Andrew Long Here is the existing dictionary... # FILE: /usr/share/freeradius/dictionary.nomadix # -*- text -*- # # Version: $Id$ # VENDOR Nomadix 3309 # BEGIN-VENDOR Nomadix ATTRIBUTE Nomadix-Bw-Up 1 integer ATTRIBUTE Nomadix-Bw-Down 2 integer ATTRIBUTE Nomadix-URL-Redirection 3 string ATTRIBUTE Nomadix-IP-Upsell 4 integer ATTRIBUTE Nomadix-Expiration 5 string ATTRIBUTE Nomadix-Subnet 6 string ATTRIBUTE Nomadix-MaxBytesUp 7 integer ATTRIBUTE Nomadix-MaxBytesDown 8 integer ATTRIBUTE Nomadix-EndofSession 9 integer ATTRIBUTE Nomadix-Logoff-URL 10 string ATTRIBUTE Nomadix-Net-VLAN 11 integer ATTRIBUTE Nomadix-Config-URL 12 string ATTRIBUTE Nomadix-Goodbye-URL 13 string VALUE Nomadix-IP-Upsell PrivatePool 0 VALUE Nomadix-IP-Upsell PublicPool 1 END-VENDOR Nomadix ############# END FILE #############

2 2

VLAN attribution in an eduroam setting - proxied users
by Rui Ribeiro 20 Dec '11

20 Dec '11

Good morning list, I´ve been setting up a freeradius to operate in the eduroam environment. At the moment my problem is the VLAN attribution that is done depending on the Windows domain of the user, or if it is in roaming from another institution. I´ve solved the VLAN based in the Windows domain, using in the /etc/freeradius/users file the following directives. DEFAULT Ldap-Group == "ISCTE" Service-Type = "Framed-User", Reply-Message = "Eduroam ISCTE", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "211" DEFAULT Ldap-Group == "Alunos" Service-Type = "Framed-User", Reply-Message = "Eduroam Alunos", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "212" As for the VLAN attribution wether the user is a roaming user (i.e. goes to a proxy to be authenticated), I have done several tries, without sucess. Haven't managed to do it through the users file above;my last attemp was trying to setting them up in the /etc/freeradius/attrs file with attr_filter.post-proxy, however it seems to interfere with the AEP/password negotiation. The setup is as follows, and I would like to ask for an alternative of where to insert the roaming VLAN. post-proxy { post_proxy_log attr_filter.post-proxy # here <--------------------------- Post-Proxy-Type Fail { detail } } and then the attrs file: DEFAULT EAP-Message =* ANY, User-NAme =* ANY, MS-MPPE-Send-Key =* ANY, MS-MPPE-Recv-Key =* ANY, Message-Authenticator =* ANY, State =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY, MS-CHAP-MPPE-Keys =* ANY, Service-Type := "Framed-User", Reply-Message := "Eduroam Roaming", Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-Id := "216", Framed-MTU := 1300, Framed-Filter-ID =* ANY Regards, Rui Ribeiro

2 1

sqlippool IP conflict problem
by Коньков Евгений 20 Dec '11

20 Dec '11

Hi, FreeRadius. while frame IP address to user there are three stage in sqlippool clear find update clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired. This will cause IP conflict. does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 6

PATCH: fixing log messages in rlm_sqlippool
by Коньков Евгений 20 Dec '11

20 Dec '11

rlm_sqlippool.c if ((data->allocate_find == NULL) ||. (strlen(data->allocate_find) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_find' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-find' statement must be set."); sqlippool_detach(data); return -1; } if ((data->allocate_update == NULL) || (strlen(data->allocate_update) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_update' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-update' statement must be set."); sqlippool_detach(data); return -1; }

1 0

Hi
by Jeisson Fabian Perez Rodriguez 20 Dec '11

20 Dec '11

Hi, I have a problem with freeradius! I installed it, and the server is running nice but when I try to connect to this server from another terminal, the server stop suddenly and in the window appears segment fault somebody can help me, please!

3 8

FreeRadius Authentication using Active Directory
by McSparin, Joe 19 Dec '11

19 Dec '11

I have followed several tutorials for setting up Active Directory with FreeRadius. When I run the ntlm_auth from the command line I get a success message however when I run the radtest with the username and password I get a Access-Reject. I am using FreeRadius 1.8 and I have included the message I get from radiusd -X. Any input would be greatly appreciated. rad_recv: Access-Request packet from host 10.1.174.126:3421, id=26, length=49 User-Name = "testuser" User-Password = "testpassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "jmcsparin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

Cisco WLC + freeradius
by LEONARDO FELL 19 Dec '11

19 Dec '11

I'm trying to configure dynamics wlans using Cisco WLC + freeradius, but I have some issues. I modified the ldap.attrmap, including the attributes: replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId However, when a try to connect, the freeradius replies a "0" (ex: Tunnel-Private-Group-Id:0) after the attribute, as you can see below: Sending Access-Accept of id 146 to 10.1.0.161 port 32768 Tunnel-Private-Group-Id:0 = "85" Tunnel-Medium-Type:0 = 802 Tunnel-Type:0 = VLAN Filter-Id = "Enterasys:version=1:policy=Aluno" MS-MPPE-Recv-Key = 0xcfcf3c464de734110cda4f22dc1ed36c2e7e5c629861059036e61fb5e98d104b MS-MPPE-Send-Key = 0x8115583c24b0c533eca2417e1a82e092bd908417dee2cecdeb3b89d857f4634f EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "leofell" I think it may the problem and I'd like to know why it happens.. Thanks! -- Leonardo Fell Setor de Redes - NTI Centro Universitário UNIVATES Fundação Vale do Taquari de Educação e Desenvolvimento Social - FUVATES Telefone: (51)37147000 Ramal 5809 www.univates.br

3 5