- Freeradius-Users - lists.freeradius.org

Re: Problemes with the mystic of freeradius configuration
by Alan DeKok 08 Oct '10

08 Oct '10

Klaus Ethgen wrote: > Phil Mayers <p.mayers(a)imperial.ac.uk> schrieb: >> Try this: ... > Doesn't work: > server probes { > +- entering group authorize {...} > ++[ok] returns ok > ++[handled] returns handled > } # server probes The debug log shows that you did *not* try Phil's suggestion. > I believe that. But I defined a authenticate method: "ok" And I do not > want freeradius to think that it should do some extra work than that > what I told them. Go back and read the default configuration files. The "authenticate" section is composed of a set of *individual* authentication methods. You can't just delete them all and expect them to work. i.e. If you don't understand how the server works, it's not a good idea to butcher the configuration. Go back and try Phil's suggestion. It works. Don't put anything else in the "authorize" section. Don't use an "authenticate" section. > Hmmm.. I'll try. I want to have all configuration concerning one virtual > server to be encapsulated within this server. As I read the > documentation and the examples, that work for some configuration > settings but not for all. Exactly. If you want different configurations for a virtual server, use different configuration files. See raddb/radrelay.conf for an example. > Well, ok, I will the next time. Principle it is all the same that the > documentation about freeradius only covers the standard tasks but if you > need a configuration that is a bit special you are on your own. Exactly. The server includes documentation on how it works, and what each configuration option does. It's left to you to figure out how to translate that into your requirements. The server does *not* include documentation for how to set up your environment. We don't know what you want, and there are millions of possible configurations. Alan DeKok.

1 0

Re: Problemes with the mystic of freeradius configuration
by Alan Buxey 08 Oct '10

08 Oct '10

Hi, > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. the proxy.conf entries are global - so you cannot have a single isolated way - you need to share the file. our current recipe is quite simple, in 'human readable' terms : is this user a local user? yes -> mark realm as local no -> mark realm as eduroam if realm = local then update the control proxy to local if realm = eduroam then update the control proxy to eduroam then, in proxy.conf have your eduroam config as a nice boilerplate. its okay - but I really really wouldnt want to drop such a configuration on top of someone elses server as, the joy of FreeRADIUS , is that people can do whtings in so many ways...and by defining realms and control lgoic you could/may break their internal logic, unlang etc. what we DO suggest is that sites have a virtual server for dealing with things that come from their national proxies - as the proxy would already have checked that the user is theirs etc - so you can skip lots of stuff and go straight to the authorization/authentication stages. alan

1 0

how to get vendor specific attribute value
by Noura Kossentini 08 Oct '10

08 Oct '10

Hello, I want to retrieve the value of the vsa attribute from the Access-accept response of free radius (I use tiny radius client). I tried to add attribute in the users file like this: testing Cleartext-Password := "toto@titi" ROLE = user But I found unknown attribute sent in the ethereal trace even though I defined it in a customer dictionary. i need your help

2 5

Re: Problemes with the mystic of freeradius configuration
by Phil Mayers 08 Oct '10

08 Oct '10

On 08/10/10 10:36, Klaus Ethgen wrote: > Hello newsgroup, hello Alan DeKok, > > I tried to solve my problem with Daniel Bertolo from Switch but was not > success, so he told me to ask here. > > I want to configure a virtual server that always return ok to be used as > probe for a load balancer (Cisco ACE). So what I tried was to just copy > the status server and tried the following: > server tests { > authorize { > ok > } > > authenticate { > ok > } > } > > Unfortunately I get the following in the debug output: Try this: authorize { update control { Auth-Type := Accept } } > No authenticate method (Auth-Type) configuration found for the request: Rejecting the user This is the problem. > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. > > Do anybody have an idea how to solve that? You'll have to be a bit more specific than that. Also, this is two different issues in the same email; try posting each separate problem individually. > > Ah, yes. Please excuse that I did not post the full configuration and > debug output as there is many confidential stuff inside. If someone need > special answers, please tell me and I will see what I can do. We need the debug output, or we can't help you. However - for eduroam setup, including example FreeRadius configs, try googling for "FreeRadius eduroam" - there are white papers and example configs.

1 0

auth: Failed to validate the user.
by Daniel Sandulescu 08 Oct '10

08 Oct '10

Hello! I got a following and do not know where erroare mistake. cylon2:/etc/freeradius# radtest test-user test-pass 192.168.1.1 10 danieladmin Sending Access-Request of id 198 to 192.168.1.1 port 1812 User-Name = "test-user" User-Password = "test-pass" NAS-IP-Address = 192.168.1.1 NAS-Port = 10 rad_recv: Access-Reject packet from host 192.168.1.1 port 1812, id=198, length=20 ------- ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test-user/test-pass] (from client cyclon2 port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test-user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 192.168.1.1 port 39973 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +21 Ready to process requests.

1 0

WiMax VSA Support
by Anup 07 Oct '10

07 Oct '10

Hi, I would like to know whether latest Freeradius version has the support for WiMax VSAs? Also please tell me how to send the WiMAX Qos Descriptors in Access-Accept Regards Anup ______________________________________ Scanned and protected by Email scanner

5 9

Optional authorize methode
by Ricardo Frías Alvarez 07 Oct '10

07 Oct '10

Hello! I don't know how to configure Radius to do this : I want that radius accepts the access, if files or ldap returns ok. In descriptive code: IF files return 'OK' THEN access-accept ELSE IF ldap return 'OK' THEN access-accept ELSE access-reject After I saw the documentation, I thought that I can do this with fail-over and I add this code to sites-enabled/default: authorize { ... group { files { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, return "ok" # if "detail1" returned "fail" } ldap { fail = 1 # remember "fail" with priority 1 ok = return # if we succeed, don't do "detail2" } } ... With this configuration it's happening the following: If files return OK the username/password are accepted. If files return fail username/password are rejected directly. This is not what I want. I want that if files fail then check ldap. How I can configure radius to implement this functionality? Thanks you very much, Ricardo Frías.

2 2

Problem with Alcatel 4604 and Cisco ACS
by matteo 07 Oct '10

07 Oct '10

Hello, I'm in trouble trying to authenticate a client connecting to an Alcatel 4604 (Aruba device) to a Cisco ACS, because my alcatel send as Called-Station-Id value its mac-address. On the Cisco side, this value correspond to the SSID value, while this attribute on Alcatel is send via Aruba-Essid-Name (attribute 5 in dictionary.aruba). Is there a way to change this behavior or a remap of this attribute for Alcatel? Thanks. Matteo

2 3

MSCHAP issue - [mschap] FAILED: MS-CHAP2-Response is incorrect
by jon michaels 07 Oct '10

07 Oct '10

Hi, I am attempting to replicate a test setup into production and somewhere along the way I must have forgotten something. I have an NT-Password stored in a mysql database and currently get the following response from freeradius upon authenticating: rad_recv: Access-Request packet from host 127.0.0.1 port 58065, id=224, length=130 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "jo" MS-CHAP-Challenge = 0x6bc832b0733a709ab358ab111e88da69 MS-CHAP2-Response = 0x0d00f974435c9a9eb2abaa5f8350b8c4b30600000000000000000a9a21d7cb82b31bfbd804045063702431fa9ff46e928dd9 NAS-IP-Address = xx.xx.xx.xx NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "jo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> jo [sql] sql_set_user escaped user --> 'jo' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jo' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jo' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'jo' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'jo' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'jo' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'jo' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for jo with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jo attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 224 to 127.0.0.1 port 58065 Waking up in 4.9 seconds. Cleaning up request 6 ID 224 with timestamp +888 Ready to process requests. I think I missed one option when documenting the test setup. Unfortunately the test setup was accidentally deleted. Would anyone know what I missed? Thanks, Jon.

2 1

None
by latha_vgopal＠yahoo.com 07 Oct '10

07 Oct '10

http://laramolino.it/und9.html

1 0