- Freeradius-Users - lists.freeradius.org

Settign up postauth to record radius-client name and other information
by William 17 Nov '10

17 Nov '10

Greetings, I am trying to figure out how to record the full Auth information into the postauth table in SQL... here is the /var/log/radius/radius.log output: Thu Nov 16 15:06:07 2010 : Auth: Login OK: [testuser/kikikat] (from client Local2 port 21) Thu Nov 16 15:10:00 2010 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [testuser/kikikat2] (from client Local2 port 1) What I want to store int he radpostauth table is: (These are already working) Date/time, Username, Password, reply(accept/reject), (I want to add these) Calling_Station, Called_Station, NAS_Short_name from clients.conf What %{Attributes} would I use for these? Wm

2 1

Execute PRISM into HOSTAPD?
by Octavio Ramirez 17 Nov '10

17 Nov '10

Hello, I am working with ubuntu 9.10, I installed freeradius server 2.1.10, Radius server is ok, but I am trying to implement "hostapd" in order to have a management of several access points. Thus, I installed the "hostapd" program, but I have a question concerning with other software related to hostapd. I downloaded PRISM by using the "update manager" utility provided by Ubuntu. How can I execute PRISM by using a terminal? Which are the commands to execute PRISM? Do you have a "quick install" document to install PRISM? Thanks in advance. Octavio Ramírez Rojas

1 0

EAP-SIM and EAP-AKA support
by dfds fds 17 Nov '10

17 Nov '10

From: dfds fds <srinujob2004(a)yahoo.com> Subject: EAP-SIM and EAP-AKA support To: freeradius-users(a)lists.freeradius.org, freeradius-devel(a)lists.freeradius.org Date: Wednesday, November 3, 2010, 6:47 PM Hi, I am trying to setup a radius server with EAP-SIM and EAP-AKA supportIt seems to be freeradius server supports EAP-SIM but i am not sure about AKA , is freeradius supports EAP-AKA also. Could you please fwd procedure to setup freeradius server with EAP-SIM and AKA support. is there is any freely available servers , which supports these features? Thanks for your help RegardsSrinivas

3 3

Logging ntlm authentication
by Sion 17 Nov '10

17 Nov '10

Hi, I've got freeradius 2.1.7 setup on a CentOS system working as an AAA server for our WPA Enterprise based wireless network with clients successfully authenticating using PEAP and TTLS. Now to my question, I've configured linelog to log certain attributes but I also want it to log either the Exec-Program output of ntlm_auth or the peap reply value for the MS-CHAP-Error attribute but so far I've been unsuccessful in doing this. Is this possible? if so can anybody give me any pointers? Regards, Sion

6 34

Differences between FreeRadius and GNU Radius
by den2k 17 Nov '10

17 Nov '10

Hi, I'm new to RADIUS and I have to configure a rather complex system. Due to the lack of (well made) documentation on the wiki I googled around and I've found a good manual for GNU Radius (the old radiusd). So my question is: how much can I rely on that documentation while writing configuration files for FreeRADIUS? Does exist some piece of documentation which lists the differences between the two systems? I'm especially interested in the 'huntsgroup' file and in the authentication protocols Thank you for interesting, Denis -- \ __ __ _ * _\ \__\ \ \ _\ \/ \_\ \__ \ \ \__ \\ -------------------------> Registered Linux User # 372295 -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM d--- s:+: a-- C+++ UL+++S E--- W+(-) N o+ w--- O? M-- PS+ PE Y+ PGP t+(++) 5? X- R* tv-- b+ DI+ D++++ G+ e h! r++ y* ------END GEEK CODE BLOCK------

2 1

Having two MS-MPPE key pairs...
by Panagiotis Georgopoulos 17 Nov '10

17 Nov '10

Hello all, I am using EAP-TTLS/EAP-MSCHAPv2 to authenticate clients with a FR 2.1.10 backend AAA server. Requests go over an Access Point (playing the role of the NAS), then get forwarded to a Proxy AAA FR 2.1.10 server and finally get routed to my backend server. My client is using wpa_supplicant with "EAP=TTLS" and "Phase2="autheap=mschapv2"" options in the configuration file. The problem I am having is that when the FR sends the final Accept-Accept to the client, I end up having two MS-MPPE-Send-Key and MS-MPPE-Recv-Key keys of different length, one added by the mschap module and one added by the eap module, as seen here : Sending Access-Accept of id 52 to 2001:db95::100 port 1814 Reply-Message = "Hello, bob-mr1" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x8566119a6066e8eb7c1663dea8d1629b MS-MPPE-Recv-Key = 0xc1f99bac753248c48db73fd5585bf810 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "bob-mr1" MS-MPPE-Recv-Key = 0x2eb89da2ac20179cb2b99391f94ca2bddf1701c67c524badad98ce56f09873dc MS-MPPE-Send-Key = 0x0cf013411cfcea14ae9dee56baaf5467e55caed80fa83ffbbdf0f5998ce7fe62 EAP-Message = 0x03cf0004 Proxy-State = 0x3130 (if someone wants a full debug output of the server it is posted here : http://pastebin.com/aXFMXXbT ) Having two MS-MPPE key pairs is wrong and does not allow the end-client to properly finish its key exchange with the Access Point, but restarts the EAP-TTLS communication. I figured out that I could remove one pair of keys, by either doing this at the end of my post-auth section of my inner-tunnel : update reply { MS-MPPE-Send-Key !* 0x00 MS-MPPE-Recv-Key !* 0x00 } ..or if I set "use_mppe=no" to the mschap module although this means that I will be loosing the MS-MPPE-Encryption-Policy and MS-MPPE-Encryption-Types attributes as well. Which one do you think is the best approach and has less impact for other authentication methods (e.g. straightforward mschapv2 or others)? By the way, I also tried using PEAP and mschapv2 for phase 2 but it didn't have the above problem (it had just one pair of MS-MPPE keys). Isn't that weird since mschapv2 in PEAP is also eap-mschapv2 so it would expect to get exactly the same phase 2 with EAP-TTLS.. What am I missing here? Thanks a lot in advance, Panos

1 0

How to block user to authenticate over ldap
by eduardo moreira 16 Nov '10

16 Nov '10

Hi, With help of list i make my freeradius + ldap, now works. But now i have other doubt, how to disable one user to authenticate in freeradius? Remember, i dont block user to log in ldap, but block user to use freeradius. Thank for help.

2 1

Chargeable-User-Identity implementation
by Stefan Winter 16 Nov '10

16 Nov '10

Hello, since quite a while, there's an implementation of Chargeable-User-Identity in the works by people of eduroam R&D (inside the GEANT3 project). Attached is the most recent implementation. We hope that it is worthy of inclusion into the mainline release now: it's a small set of new files (modules/cui, SQL schema definitions) and a few stand-in replacements that augment some shipped files (policy.conf, sites-available/*). Please take a look and comment. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 5

proxy.conf - type = auth issue
by Alan Buxey 16 Nov '10

16 Nov '10

hi, Tue Nov 16 11:16:39 2010 : Info: Exiting normally. Tue Nov 16 11:16:42 2010 : Error: /etc/raddb/proxy.conf[118]: Home server test2 of unexpected type "auth" realm test2.co.uk { pool = test2 } server_pool test2 { home_server = test2 } home_server test2 { ipaddr = 10.11.12.13 secret = "topsecret" type = auth port = 1645 strip } this is with 2.1.10 why isnt type = auth valid? the remote server doesnt have a listener for accounting so I dont want it to handle accounting... alan

2 1

one of the FreeRADIUS FTP servers is dead
by Alan Buxey 15 Nov '10

15 Nov '10

Hi, it appears that one of the servers answering as ftp.freeradius.org is poorly. failing FTP connect and not pingable Name: ftp.freeradius.org Address: 64.34.165.250 Name: ftp.freeradius.org Address: 88.191.76.128 [src]# ping 64.34.165.250 PING 64.34.165.250 (64.34.165.250) 56(84) bytes of data. --- 64.34.165.250 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1000ms [src]# ping 88.191.76.128 PING 88.191.76.128 (88.191.76.128) 56(84) bytes of data. 64 bytes from 88.191.76.128: icmp_seq=1 ttl=52 time=15.0 ms alan

1 0