- Freeradius-Users - lists.freeradius.org

SQL - inserting yearmonth variable
by Steven Staples 12 Dec '11

12 Dec '11

Good morning list.. I am trying to insert a YEAR and MONTH into my sql table. I have in the past, used a stored procedure for the accounting start/stop, which worked well. >From what I see, %S will give me a current timestamp, but how can I get/extract the year and month from this? Or is there an easier way to do this... I tried adding: Yearmonth = $(date +%Y%m) As a variable, and then putting it into the sql query like: accounting_start_query = "INSERT INTO ...<snip>'${Yearmonth}' But that didn't work. Could someone please help me with getting a year & month variable set? THANKS!!! Steve

2 1

Testing LDAP server return code?
by John Doppke 12 Dec '11

12 Dec '11

Is there a way to test the return code or message from the LDAP server so a different reply-message can be sent on "server is unwilling to perform"? thanks, -John

2 1

RFC compliance for Access Challenge
by sanal kumar kariazhath 12 Dec '11

12 Dec '11

Hi, As per RFC, it looks like the Access Challenge must not contain any attributes other than Reply-Message, State, Vendor-Specific, Session-Timeout and Idle-Timeout. But if i put the configuration options as below for the EAP user 'USER5', then the access challenge from Free Radius server contains those attributes. USER5 Cleartext-Password := "xyz" Service-Type = Framed-User, Framed-IP-Address = 255.255.255.255, Framed-MTU = 576, Tunnel-Medium-Type = "6", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = 400, Please find the debug logs below: Version: radiusd: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jun 8 2011 at 15:45:1 Debug logs (Have changed the IP address) -------------------------------------------------------------- Ready to process requests. rad_recv: Access-Request packet from host AA.BB.CC.DD port 1812, id=38, length=94 NAS-IP-Address = DD.EE.AA.DD NAS-Port-Type = Ethernet NAS-Port = 43 Calling-Station-Id = "00-00-01-00-04-00" User-Name = "USER5" EAP-Message = 0x0239000a015553455235 Message-Authenticator = 0x8db99a77b408552561675e84e7840868 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "USER5", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 57 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry USER5 at line 215 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 38 to DD.EE.AA.DD port 65163 Service-Type = Framed-User Framed-IP-Address = 255.255.255.255 Framed-MTU = 576 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "400" EAP-Message = 0x013a00160410f646c8b9a0a056801f6d89a3d919ccc5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xda41235ada7b273294cf6090be1d930c Finished request 4. Going to the next request Waking up in 4.9 seconds. -------------------------------------------------------------- Would like to know why Free Radius is putting the user configuration data in Access Challenge ? Appreciate the early response on the same, Thanks, -Sanal

3 3

802.1x authentication
by gary 11 Dec '11

11 Dec '11

Hi All I am trying to set up 802.1x with EAP PEAP/TTLS method by using intel PROSset client tool with the PC. Sometimes authentication success but mostly it fail. Log attached could someone give me some direction?thanks a lot. Best Regards Gary

5 8

wpa2 freeradius peap rlm_perl
by Ray Eads 10 Dec '11

10 Dec '11

Hi. I'm using freeradius-2.1.10-5.el6.x86_64 from RHEL 6. I'd like to use freeradius to accomplish a specific authentication goal, and haven't met with success yet. I'm assuming this is either because the configuration is difficult, or I'm trying to solve the problem the wrong way, or I don't understand the protocols, or a combination of all three. Essentially, I'd like to have an access point offer WPA2 Enterprise authentication to wireless devices of various makes and models. I'd like the user to submit for traditional username/password authentication to the radius server (without a client side certificate). I'm able to produce a yes/no answer with an rlm_perl script that functions as expected with a normal radius query. My problem is that I haven't been able to connect that rlm script properly when freeradius is contacted as part of an EAP message. >From what I can tell, my choice of Windows compatible EAP types is fairly limited. I've used PEAP in the past, but only with the intended AD repository of passwords. With this application, I'd like to use the rlm_perl script instead of AD accounts as a source of usernames and passwords. Big picture-wise, am I on the right path, or is this fundamentally the wrong way? I'm imagining a PEAP -> rlm_perl configuration. -- Ray Eads (reads(a)sno-isle.org) Network Engineer II

1 1

Re: Query regarding LEAP-authentication
by Alan Buxey 09 Dec '11

09 Dec '11

LEAP is an older form of 802.1X authentication method...superseded by PEAP, TTLS etc. You need to define a RADIUS server and use WPA/enterprise or WPA2/enterprise, or the LEAP option if your kit supports it (its sometimes listed separately) WEP is not LEAP. alan

1 0

Re: Linksys WIFI Authentication using freeradius?
by Alan Buxey 09 Dec '11

09 Dec '11

Does the router send any accounting packets ? The accounting packets, if sent ate from the NAS and therefore won't be in any EAP tunnel the clients will be using 802.11i , hence EAP , hence the need to know and trust the server cert of the RADIUS server alan

1 0

Query regarding LEAP-authentication
by Ajay Garg 09 Dec '11

09 Dec '11

Hi all. I am trying to connect to a network, via LEAP authentication. When I open 192.168.1.1 (IP address of my router), and visit the "wireless" section, I see that there are four different options 1. Radius 2. WPA Enterprise 3. WPA2 Enterprise 4. WPA/WPA2 Enterprise 2., 3., 4. are obvious. I believe 1. indicates that the router (access point) supports LEAP authentication. (I ask this, because I have read at many places, that LEAP-authentication requires support from the access-point.) So, assuming the above is true, I proceed further. Now, at 192.168.1.1, besides the obvious settings for WPA/WPA2, there is also a setting for "WEP" keys (which I believe is requried for LEAP authentication). Fair enough. I have set a WEP key. Now, I try to connect through nm-applet. nm-applet asks me two parameters (besides the obvious ones, like SSID, etc.) : a. Username b. Password * Now, my query is, what do these two parameters correspond to ? (The most obvious answer is that they correspond to username-password, as set in "users" file for the freeradius server - the obvious pair that is used in TTLS, TLS and PEAP authentication. But then where does WEP keys come into picture ??)* Obviously, I ask all this because I am unable to connect via LEAP-authentication :-) Regards, Ajay

2 1

authentetication with mysql and NAS type= other
by tolik_shavlovsky＠mail.ru 09 Dec '11

09 Dec '11

Dear All, i installed FR v 2.1.2 and mysql 5.1.55. user database is in mysql DB. 1. I was lucky to auth Wifi users via cisco AP (NAS type cisco). but Simulteneous-Use is not working. 2. my wimax users (vendor Alvarion) cannot authenticate. Althou, i can authenticate them from users file. what can be a problem? thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/authentetication-with-mysql-and-NAS… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 19

Authentication via ntlm_auth with check the user group
by Сергей Усов 09 Dec '11

09 Dec '11

Hi I try to configure authentication via ntlm_auth to check the user group. All authentication attempts are rejected The same configuration without checking groups is working correctly policy.conf: extract_ssid { if(Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i){ update request { Called-Station-SSID := "%{7}" } if (Called-Station-SSID == localnet1) { update request{ AD-Group := WiFisec } } else { update request{ AD-Group := WiFi-public } } } else { noop } } modules/mschap ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=POMORSU+%{AD-Group}" sites-enabed/default authorize { preprocess extract_ssid freeradius 2.1.10+dfsg-2 debian squeeze

3 12