- Freeradius-Users - lists.freeradius.org

Ignoring EAP-Type/tls because we do not have OpenSSL support.
by Douglas Caro 10 Sep '10

10 Sep '10

Hi, In #freeradius -X, I have those messages: Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. I've researched on the subject, but I didn't find anything. Linux Debian Lenny Freeradius 2.0.4 Thanks Douglas

5 5

Re: Freeradius-Users Digest, Vol 65, Issue 43
by Douglas Caro 10 Sep '10

10 Sep '10

Thanks for all, but it didn't work... #dpkg -l |grep freer ii freeradius 2.1.8+dfsg-1~bpo50+1 a high-performance and highly configurable R ii freeradius-common 2.1.8+dfsg-1~bpo50+1 FreeRADIUS common files ii freeradius-dialupadmin 2.1.8+dfsg-1~bpo50+1 set of PHP scripts for administering a FreeR ii freeradius-ldap 2.1.8+dfsg-1~bpo50+1 LDAP module for FreeRADIUS server ii freeradius-mysql 2.1.8+dfsg-1~bpo50+1 MySQL module for FreeRADIUS server ii freeradius-postgresql 2.1.8+dfsg-1~bpo50+1 PostgreSQL module for FreeRADIUS server ii freeradius-utils 2.1.8+dfsg-1~bpo50+1 FreeRADIUS client utilities ii libfreeradius-dev 2.1.8+dfsg-1~bpo50+1 FreeRADIUS shared library development files ii libfreeradius2 2.1.8+dfsg-1~bpo50+1 FreeRADIUS shared library # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. The messages keep appearing Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Thanks Douglas

2 1

Beginner Question: "Hotspot Login Failed"
by Sean Wingert 10 Sep '10

10 Sep '10

Hi All, In my testing lab (yes, I'm new to FreeRadius), usernames entered (e.g. with attribute User-Password in sql radcheck table) via my NAS (dd-wrt with Chillispot) refuse to authenticate (error below), whereas attribute=Auth-Type (what DaloRadius calls a "PIN") works fine. I'm using the packaged MySQL (5.0.51a-24+lenny3) with FreeRadius (2.0.4+dfsg-6)and freeradius-dialupadmin (2.0.4+dfsg-6) on Debian Lenny, along with Daloradius 0.9-8 for GUI frontend. Below is the Daloradius-populated mysql table (again, only 4321 works fine, regardless of password entered): +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 9 | aaa | MD5-Password | := | 47bce5c74f589f4867dbd57e9ca9f808 | | 7 | 123 | User-Password | := | 123 | | 8 | 4321 | Auth-Type | := | Accept | | 10 | bbb | SHA1-Password | := | bbb | | 11 | ccc | CHAP-Password | := | ccc | | 12 | eee | Cleartext-Password | := | eee | +----+----------+--------------------+----+----------------------------------+ 6 rows in set (0.00 sec) ================================== Debug output of working connection ================================== rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=191 User-Name = "4321" User-Password = "\223=\0322\343\233\361a\365\323\320\333_\245×¼" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c890e8900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x468b4f124525571d6d37d6d1ec69cbdd WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '4321' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '4321' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '4321' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [4321/\223=\0322\343\233\361a\365\323\320\333_\245×¼] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{User-Password} -> =93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.0.72 port 2112 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=8, length=125 Acct-Status-Type = Start User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:36:57 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Delay-Time} -> expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('4c890e8900000000', 'd3e9d3ef96f2f8d9', '4321', '', '0.0.0.0', '0', 'Wireless-802.11', '2010-09-09 08:36:57', NULL, '0', '', '', '', '0', '0', '00-24-A5-6F-81-0A', 'C4-17-FE-1C-5C-9D', '', '', '', '192.168.182.3', '0', '0', '') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 8 to 192.168.0.72 port 2110 Finished request 2. Cleaning up request 2 ID 8 with timestamp +2711 Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +2711 Ready to process requests. ================================== debug output of broken connection ================================== rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=9, length=173 Acct-Status-Type = Stop User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" Acct-Input-Octets = 436077 Acct-Output-Octets = 4958088 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 3923 Acct-Output-Packets = 6229 Acct-Session-Time = 863 Acct-Terminate-Cause = User-Request +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:51:21 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Input-Gigawords} -> 0 expand: %{Acct-Input-Octets} -> 436077 expand: %{Acct-Output-Gigawords} -> 0 expand: %{Acct-Output-Octets} -> 4958088 expand: %{Acct-Delay-Time} -> expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-09-09 08:51:21', acctsessiontime = '863', acctinputoctets = '0' << 32 | '436077', acctoutputoctets = '0' << 32 | '4958088', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = '4c890e8900000000' AND username = '4321' AND nasipaddress = '0.0.0.0' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 9 to 192.168.0.72 port 2110 Finished request 0. Cleaning up request 0 ID 9 with timestamp +9 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=190 User-Name = "123" User-Password = "\236\326v\220t\221ê P\277\307;?\025`" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c891e9900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xdc1dfade75373068738e32d415253503 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "123", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 123 rlm_sql (sql): sql_set_user escaped user --> '123' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "?Öv?t?ê?P¿Ç;??`" rlm_pap: Using clear text password "123" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [123/\236\326v\220t\221ê?P\277\307;?\025`] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 192.168.0.72 port 2112 Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +34 Ready to process requests. This message is intended only for the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited, and you are requested to return the original message to the sender.

4 8

FreeRadius2+daloRAIUS mschap problem: No Cleartext-Password configured
by Denis Iskandarov 10 Sep '10

10 Sep '10

My setup: CentOS 5.5 x32 freeradius2-2.1.7-7.el5 mysql-5.0.77-4.el5_5.3 daloRADIUS 0.9-8 SVN (0.9.-9) used for 802.1x EAP-TLS and EAP-TTLS (maybe for peap in future as well) with Ubiquiti and Mikrotik network equipment setup works perfectly without sql with text conf files. when creating user in sql getting next error: (Output omitted) Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for ubnt123 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\223E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 cli 00-15-6D-5A-4F-5E) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ubnt123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds I found some topics in regarding this same error in different setups but nothing helped me me to solve this problem. Please help. Thanks in advance.

4 6

Radmin - hup query
by John Horne 10 Sep '10

10 Sep '10

Hello, Running Freeradius 2.1.10 on CentOS 5.5 I have been taking a quick look at the radmin 'hup' command. However, I am having a problem getting it to work: radmin -e hup ERROR: You do not have write permission. See "mode = rw" in /var/run/radiusd/radiusd.sock However, the socket file shows: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 Sep 10 04:02 /var/run/radiusd/radiusd.sock ls -ld /var/run/radiusd drwxr-xr-x 2 radiusd radiusd 4096 Sep 10 04:02 /var/run/radiusd If I run the radmin command as root or the radiusd user, I get the ERROR message. Additionally in the radius log file I see (when the radmin command is run): Fri Sep 10 12:59:28 2010 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Fri Sep 10 12:59:28 2010 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock I'm not sure what the first message means as the file already exists, and the second one says it is closing the socket, yet the socket file still exists (unless it literally means it is closing the socket but leaving the file there.) Any suggestions as to what is going on here? John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

4 5

Restricting Clients and Users
by omega_one＠mail.com 10 Sep '10

10 Sep '10

Hi all. I need that: - system group A access only switch 1.1.1.1 and 1.1.1.2 - system group B access only switch 2.1.1.1 and 2.1.1.2 I created local group of users A and B and associated users /etc/raddb/clients.conf client 1.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 1.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } /etc/raddb/users DEFAULT Group == "A", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Group == "B", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject How can i modify my configurations to let only A users to access switch 1.1.1.1/2 and B users access switch 2.1.1.1/2 ? Thanks. =

2 1

SQL Logging Access-Reject
by Kristoffer Milligan 10 Sep '10

10 Sep '10

Hello again list, I'm still working on my FreeRADIUS server in connection with 4Motion equipment from Alvarion. It's getting better and better and more integrated, but I still have a few quirks I need to work out. My main problem now is the logging part. In the post-auth section, I have added some SQL logging. I am logging Access-Accept and Access-Reject. My problem is that access-rejects are appearing scrambeled.. Example: | 50 | user1(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:36 | | 51 | =7Bam=3D1=7D917341235F4283123A58E52B623D2790(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:39 | | 52 | =7Bam=3D1=7AC00FA703F004Q25ED1EF4E3DCB5F4A2B(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:47 | | 53 | user2(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:58 | The SQL statement from sql_log module is: Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{SQL-User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" How can I log the tried username in cleartext? - Kristoffer Milligan

2 1

Re: Re: Re: Re: Re: FreeRADIUS with Samba3, AD(Samba4) and and Windows XP
by Бисер Миланов 10 Sep '10

10 Sep '10

Guys, anyone? Do you need more config info? Can you help?

1 0

Re: Re: Re: Re: FreeRADIUS with Samba3, AD(Samba4) and and Windows XP
by Бисер Миланов 10 Sep '10

10 Sep '10

I have disabled certificate checking on the Windows machine. Here's the log from the XP client: Reason: An internal error has occurred. Reason code: 327685 Error code: -2147023537 On the switch I see this repeated several times. The ca58 MAC is the Windows MAC, so this means that it somehow manages to answer to the RADIUS? *Mar 10 18:32:57.644: dot1x-ev(Gi0/2): Received pkt saddr =0019.6654.ca58 , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.0029 *Mar 10 18:32:57.644: dot1x-ev(Gi0/2): dot1x_sendRespToServer: Response sent to the server from 0xA00006DE (0019.6654.ca58) *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Sending EAPOL packet to group PAE address *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Role determination not required *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Sending out EAPOL packet *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Role determination not required *Mar 10 18:32:57.653: dot1x-ev:Enqueued the eapol packet to the global authenticator queue *Mar 10 18:32:57.653: EAPOL pak dump rx *Mar 10 18:32:57.653: EAPOL Version: 0x1 type: 0x0 length: 0x005F *Mar 10 18:32:57.653: dot1x-ev: dot1x_auth_queue_event: Int Gi0/2 CODE= 2,TYPE= 25,LEN= 95 ----------------------------------------------------------------- Чартъри до Египет – Кайро, Хургада и круиз по Нил. 8 дни, от 275€ http://www.astralholidays.bg/pochivki/program/38/country/8.html

1 0

Newbie: help to configure PEAP extension for windows XP wireless Clients
by Stephane Brodeur 10 Sep '10

10 Sep '10

Hi, I am a newbie with Radius and I have problems to authenticate XP wireless clients with eap. I think that my first problem is due to the fact that Windows XP client requires a Certificate Authority since Windows only recognized signed certificate. I could not find the certificate properties windows as shown in the following link: http://deployingradius.com/documents/configuration/eap.html My first question is where is this Smart Card or other Certificate Properties window, is it in the wireless 802.1x configuration window or in the internet explorer where you import certificate. I am using Windows XP with service pack 3. 2) Does FreeRadius generates automatically a self-signed Certificates when we start radiusd -X for the first time. Can we also imports the ca.der file into Windows XP to test our PEAP authentication. Does the server certificate created with the self-signed certificate is good enough to authenticate Windows XP wireless client 3) Can we used the root/server/client self-signed certificate for authentication EAP-TLS. Does making new root/server/client certificate with the make function overides thte self-one Thanks for all your help Stephane

2 1