- Freeradius-Users - lists.freeradius.org

Question about NAS-Port attribute when using freeradiusclient
by Ali Majdzadeh 08 Oct '10

08 Oct '10

Hello All I am using freeradiusclient in combination with PPP in order to setup RADIUS authentication for PPTP users. Actually, I managed to authenticate users using RADIUS but I noticed that the NAS-Port attribute which is sent to RADIUS server is always 0. Is this normal? Is there any way to generate proper values for NAS-Port? Is this attribute set by radiusclient or is it extracted from somewhere else? (PPP, maybe?) Warm Regards Ali Majdzadeh Kohbanani

2 4

Problem with MSCHAP
by Mark Holmes 08 Oct '10

08 Oct '10

This is my first post to this list, so first of all, hi! I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth. Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29 I have the ntlm_auth part working in as far as I can put DEFAULT Auth-Type = ntlm_auth in users and then do radtest user password localhost 0 testing123 and I see the server returns Access-Accept. I then configure MS-CHAP, removing the DEFAULT Auth-Type from users and editing modules/mschap as follows ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" and set up a wireless access point up to, add it to clients and have it point at the radius server Now when I try to connect I get Access-Reject - I've tried a couple of devices - an iPhone and a Win XP machine. Output from radius -X at the bottom of this message. The bit that looks relevant to me is ++[mschap] returns noop Which I guess indicates a problem with mschap somewhere Also [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" [suffix] No such realm "mydomain.ox.ac.uk" However I'm not sure I need to worry about that bit - at the moment this is just a single, stand alone RADIUS server so I'm not sure I need to worry about realms or do I?.... Not sure where to go from here - are there some basic things I should check? I haven't included my conf files in this post but happy to do so if required. Any advice/hints much appreciated as to how I should look to troubleshoot this. Thanks, Mark Output from -X Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.1.10 port 1286, id=39, length=267 Message-Authenticator = 0x2e5d3be1821aead988b3d37cba9afd08 Service-Type = Framed-User User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" Framed-MTU = 1488 State = 0x0f85e60107a2ffd7a9724559c0c7d131 Called-Station-Id = "00-24-73-54-22-C2:Test-WLAN" Calling-Station-Id = "78-E4-00-B2-E2-D5" NAS-Identifier = "Wireless AP - I6" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0227002b1900170301002067b2b3a9663cb4262b845b709b8619eb1d6ae803961cb66e52227722f3d8e496 NAS-IP-Address = 192.168.1.10 NAS-Port = 4 NAS-Port-Id = "STA port # 4" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" [suffix] No such realm "mydomain.ox.ac.uk" ++[suffix] returns noop [eap] EAP packet type response id 39 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> firstname.lastname(a)mydomain.ox.ac.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 99 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 99 Sending Access-Reject of id 39 to 192.168.1.10 port 1286 EAP-Message = 0x04270004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 90 ID 30 with timestamp +1733 Cleaning up request 91 ID 31 with timestamp +1733 Cleaning up request 92 ID 32 with timestamp +1733 Cleaning up request 93 ID 33 with timestamp +1733 Cleaning up request 94 ID 34 with timestamp +1733 Cleaning up request 95 ID 35 with timestamp +1733 Cleaning up request 96 ID 36 with timestamp +1733 Cleaning up request 97 ID 37 with timestamp +1733 Cleaning up request 98 ID 38 with timestamp +1733 Waking up in 0.9 seconds. Cleaning up request 99 ID 39 with timestamp +1733 Ready to process requests.

5 6

Re: Problemes with the mystic of freeradius configuration
by Alan DeKok 08 Oct '10

08 Oct '10

Klaus Ethgen wrote: > Phil Mayers <p.mayers(a)imperial.ac.uk> schrieb: >> Try this: ... > Doesn't work: > server probes { > +- entering group authorize {...} > ++[ok] returns ok > ++[handled] returns handled > } # server probes The debug log shows that you did *not* try Phil's suggestion. > I believe that. But I defined a authenticate method: "ok" And I do not > want freeradius to think that it should do some extra work than that > what I told them. Go back and read the default configuration files. The "authenticate" section is composed of a set of *individual* authentication methods. You can't just delete them all and expect them to work. i.e. If you don't understand how the server works, it's not a good idea to butcher the configuration. Go back and try Phil's suggestion. It works. Don't put anything else in the "authorize" section. Don't use an "authenticate" section. > Hmmm.. I'll try. I want to have all configuration concerning one virtual > server to be encapsulated within this server. As I read the > documentation and the examples, that work for some configuration > settings but not for all. Exactly. If you want different configurations for a virtual server, use different configuration files. See raddb/radrelay.conf for an example. > Well, ok, I will the next time. Principle it is all the same that the > documentation about freeradius only covers the standard tasks but if you > need a configuration that is a bit special you are on your own. Exactly. The server includes documentation on how it works, and what each configuration option does. It's left to you to figure out how to translate that into your requirements. The server does *not* include documentation for how to set up your environment. We don't know what you want, and there are millions of possible configurations. Alan DeKok.

1 0

Re: Problemes with the mystic of freeradius configuration
by Alan Buxey 08 Oct '10

08 Oct '10

Hi, > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. the proxy.conf entries are global - so you cannot have a single isolated way - you need to share the file. our current recipe is quite simple, in 'human readable' terms : is this user a local user? yes -> mark realm as local no -> mark realm as eduroam if realm = local then update the control proxy to local if realm = eduroam then update the control proxy to eduroam then, in proxy.conf have your eduroam config as a nice boilerplate. its okay - but I really really wouldnt want to drop such a configuration on top of someone elses server as, the joy of FreeRADIUS , is that people can do whtings in so many ways...and by defining realms and control lgoic you could/may break their internal logic, unlang etc. what we DO suggest is that sites have a virtual server for dealing with things that come from their national proxies - as the proxy would already have checked that the user is theirs etc - so you can skip lots of stuff and go straight to the authorization/authentication stages. alan

1 0

how to get vendor specific attribute value
by Noura Kossentini 08 Oct '10

08 Oct '10

Hello, I want to retrieve the value of the vsa attribute from the Access-accept response of free radius (I use tiny radius client). I tried to add attribute in the users file like this: testing Cleartext-Password := "toto@titi" ROLE = user But I found unknown attribute sent in the ethereal trace even though I defined it in a customer dictionary. i need your help

2 5

Re: Problemes with the mystic of freeradius configuration
by Phil Mayers 08 Oct '10

08 Oct '10

On 08/10/10 10:36, Klaus Ethgen wrote: > Hello newsgroup, hello Alan DeKok, > > I tried to solve my problem with Daniel Bertolo from Switch but was not > success, so he told me to ask here. > > I want to configure a virtual server that always return ok to be used as > probe for a load balancer (Cisco ACE). So what I tried was to just copy > the status server and tried the following: > server tests { > authorize { > ok > } > > authenticate { > ok > } > } > > Unfortunately I get the following in the debug output: Try this: authorize { update control { Auth-Type := Accept } } > No authenticate method (Auth-Type) configuration found for the request: Rejecting the user This is the problem. > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. > > Do anybody have an idea how to solve that? You'll have to be a bit more specific than that. Also, this is two different issues in the same email; try posting each separate problem individually. > > Ah, yes. Please excuse that I did not post the full configuration and > debug output as there is many confidential stuff inside. If someone need > special answers, please tell me and I will see what I can do. We need the debug output, or we can't help you. However - for eduroam setup, including example FreeRadius configs, try googling for "FreeRadius eduroam" - there are white papers and example configs.

1 0

auth: Failed to validate the user.
by Daniel Sandulescu 08 Oct '10

08 Oct '10

Hello! I got a following and do not know where erroare mistake. cylon2:/etc/freeradius# radtest test-user test-pass 192.168.1.1 10 danieladmin Sending Access-Request of id 198 to 192.168.1.1 port 1812 User-Name = "test-user" User-Password = "test-pass" NAS-IP-Address = 192.168.1.1 NAS-Port = 10 rad_recv: Access-Reject packet from host 192.168.1.1 port 1812, id=198, length=20 ------- ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test-user/test-pass] (from client cyclon2 port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test-user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 192.168.1.1 port 39973 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +21 Ready to process requests.

1 0

WiMax VSA Support
by Anup 07 Oct '10

07 Oct '10

Hi, I would like to know whether latest Freeradius version has the support for WiMax VSAs? Also please tell me how to send the WiMAX Qos Descriptors in Access-Accept Regards Anup ______________________________________ Scanned and protected by Email scanner

5 9

Optional authorize methode
by Ricardo Frías Alvarez 07 Oct '10

07 Oct '10

Hello! I don't know how to configure Radius to do this : I want that radius accepts the access, if files or ldap returns ok. In descriptive code: IF files return 'OK' THEN access-accept ELSE IF ldap return 'OK' THEN access-accept ELSE access-reject After I saw the documentation, I thought that I can do this with fail-over and I add this code to sites-enabled/default: authorize { ... group { files { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, return "ok" # if "detail1" returned "fail" } ldap { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, don't do "detail2" } } ... With this configuration it's happening the following: If files return OK the username/password are accepted. If files return fail username/password are rejected directly. This is not what I want. I want that if files fail then check ldap. How I can configure radius to implement this functionality? Thanks you very much, Ricardo Frías.

2 2

Problem with Alcatel 4604 and Cisco ACS
by matteo 07 Oct '10

07 Oct '10

Hello, I'm in trouble trying to authenticate a client connecting to an Alcatel 4604 (Aruba device) to a Cisco ACS, because my alcatel send as Called-Station-Id value its mac-address. On the Cisco side, this value correspond to the SSID value, while this attribute on Alcatel is send via Aruba-Essid-Name (attribute 5 in dictionary.aruba). Is there a way to change this behavior or a remap of this attribute for Alcatel? Thanks. Matteo

2 3