- Freeradius-Users - lists.freeradius.org

Beginner Question: "Hotspot Login Failed"
by Sean Wingert 10 Sep '10

10 Sep '10

Hi All, In my testing lab (yes, I'm new to FreeRadius), usernames entered (e.g. with attribute User-Password in sql radcheck table) via my NAS (dd-wrt with Chillispot) refuse to authenticate (error below), whereas attribute=Auth-Type (what DaloRadius calls a "PIN") works fine. I'm using the packaged MySQL (5.0.51a-24+lenny3) with FreeRadius (2.0.4+dfsg-6)and freeradius-dialupadmin (2.0.4+dfsg-6) on Debian Lenny, along with Daloradius 0.9-8 for GUI frontend. Below is the Daloradius-populated mysql table (again, only 4321 works fine, regardless of password entered): +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 9 | aaa | MD5-Password | := | 47bce5c74f589f4867dbd57e9ca9f808 | | 7 | 123 | User-Password | := | 123 | | 8 | 4321 | Auth-Type | := | Accept | | 10 | bbb | SHA1-Password | := | bbb | | 11 | ccc | CHAP-Password | := | ccc | | 12 | eee | Cleartext-Password | := | eee | +----+----------+--------------------+----+----------------------------------+ 6 rows in set (0.00 sec) ================================== Debug output of working connection ================================== rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=191 User-Name = "4321" User-Password = "\223=\0322\343\233\361a\365\323\320\333_\245×¼" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c890e8900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x468b4f124525571d6d37d6d1ec69cbdd WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '4321' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '4321' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '4321' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [4321/\223=\0322\343\233\361a\365\323\320\333_\245×¼] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{User-Password} -> =93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.0.72 port 2112 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=8, length=125 Acct-Status-Type = Start User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:36:57 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Delay-Time} -> expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('4c890e8900000000', 'd3e9d3ef96f2f8d9', '4321', '', '0.0.0.0', '0', 'Wireless-802.11', '2010-09-09 08:36:57', NULL, '0', '', '', '', '0', '0', '00-24-A5-6F-81-0A', 'C4-17-FE-1C-5C-9D', '', '', '', '192.168.182.3', '0', '0', '') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 8 to 192.168.0.72 port 2110 Finished request 2. Cleaning up request 2 ID 8 with timestamp +2711 Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +2711 Ready to process requests. ================================== debug output of broken connection ================================== rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=9, length=173 Acct-Status-Type = Stop User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" Acct-Input-Octets = 436077 Acct-Output-Octets = 4958088 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 3923 Acct-Output-Packets = 6229 Acct-Session-Time = 863 Acct-Terminate-Cause = User-Request +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:51:21 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Input-Gigawords} -> 0 expand: %{Acct-Input-Octets} -> 436077 expand: %{Acct-Output-Gigawords} -> 0 expand: %{Acct-Output-Octets} -> 4958088 expand: %{Acct-Delay-Time} -> expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-09-09 08:51:21', acctsessiontime = '863', acctinputoctets = '0' << 32 | '436077', acctoutputoctets = '0' << 32 | '4958088', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = '4c890e8900000000' AND username = '4321' AND nasipaddress = '0.0.0.0' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 9 to 192.168.0.72 port 2110 Finished request 0. Cleaning up request 0 ID 9 with timestamp +9 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=190 User-Name = "123" User-Password = "\236\326v\220t\221ê P\277\307;?\025`" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c891e9900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xdc1dfade75373068738e32d415253503 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "123", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 123 rlm_sql (sql): sql_set_user escaped user --> '123' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "?Öv?t?ê?P¿Ç;??`" rlm_pap: Using clear text password "123" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [123/\236\326v\220t\221ê?P\277\307;?\025`] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 192.168.0.72 port 2112 Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +34 Ready to process requests. This message is intended only for the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited, and you are requested to return the original message to the sender.

4 8

FreeRadius2+daloRAIUS mschap problem: No Cleartext-Password configured
by Denis Iskandarov 10 Sep '10

10 Sep '10

My setup: CentOS 5.5 x32 freeradius2-2.1.7-7.el5 mysql-5.0.77-4.el5_5.3 daloRADIUS 0.9-8 SVN (0.9.-9) used for 802.1x EAP-TLS and EAP-TTLS (maybe for peap in future as well) with Ubiquiti and Mikrotik network equipment setup works perfectly without sql with text conf files. when creating user in sql getting next error: (Output omitted) Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for ubnt123 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\223E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 cli 00-15-6D-5A-4F-5E) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ubnt123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds I found some topics in regarding this same error in different setups but nothing helped me me to solve this problem. Please help. Thanks in advance.

4 6

Radmin - hup query
by John Horne 10 Sep '10

10 Sep '10

Hello, Running Freeradius 2.1.10 on CentOS 5.5 I have been taking a quick look at the radmin 'hup' command. However, I am having a problem getting it to work: radmin -e hup ERROR: You do not have write permission. See "mode = rw" in /var/run/radiusd/radiusd.sock However, the socket file shows: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 Sep 10 04:02 /var/run/radiusd/radiusd.sock ls -ld /var/run/radiusd drwxr-xr-x 2 radiusd radiusd 4096 Sep 10 04:02 /var/run/radiusd If I run the radmin command as root or the radiusd user, I get the ERROR message. Additionally in the radius log file I see (when the radmin command is run): Fri Sep 10 12:59:28 2010 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Fri Sep 10 12:59:28 2010 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock I'm not sure what the first message means as the file already exists, and the second one says it is closing the socket, yet the socket file still exists (unless it literally means it is closing the socket but leaving the file there.) Any suggestions as to what is going on here? John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

4 5

Restricting Clients and Users
by omega_one＠mail.com 10 Sep '10

10 Sep '10

Hi all. I need that: - system group A access only switch 1.1.1.1 and 1.1.1.2 - system group B access only switch 2.1.1.1 and 2.1.1.2 I created local group of users A and B and associated users /etc/raddb/clients.conf client 1.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 1.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } /etc/raddb/users DEFAULT Group == "A", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Group == "B", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject How can i modify my configurations to let only A users to access switch 1.1.1.1/2 and B users access switch 2.1.1.1/2 ? Thanks. =

2 1

SQL Logging Access-Reject
by Kristoffer Milligan 10 Sep '10

10 Sep '10

Hello again list, I'm still working on my FreeRADIUS server in connection with 4Motion equipment from Alvarion. It's getting better and better and more integrated, but I still have a few quirks I need to work out. My main problem now is the logging part. In the post-auth section, I have added some SQL logging. I am logging Access-Accept and Access-Reject. My problem is that access-rejects are appearing scrambeled.. Example: | 50 | user1(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:36 | | 51 | =7Bam=3D1=7D917341235F4283123A58E52B623D2790(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:39 | | 52 | =7Bam=3D1=7AC00FA703F004Q25ED1EF4E3DCB5F4A2B(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:47 | | 53 | user2(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:58 | The SQL statement from sql_log module is: Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{SQL-User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" How can I log the tried username in cleartext? - Kristoffer Milligan

2 1

Re: Re: Re: Re: Re: FreeRADIUS with Samba3, AD(Samba4) and and Windows XP
by Бисер Миланов 10 Sep '10

10 Sep '10

Guys, anyone? Do you need more config info? Can you help?

1 0

Re: Re: Re: Re: FreeRADIUS with Samba3, AD(Samba4) and and Windows XP
by Бисер Миланов 10 Sep '10

10 Sep '10

I have disabled certificate checking on the Windows machine. Here's the log from the XP client: Reason: An internal error has occurred. Reason code: 327685 Error code: -2147023537 On the switch I see this repeated several times. The ca58 MAC is the Windows MAC, so this means that it somehow manages to answer to the RADIUS? *Mar 10 18:32:57.644: dot1x-ev(Gi0/2): Received pkt saddr =0019.6654.ca58 , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.0029 *Mar 10 18:32:57.644: dot1x-ev(Gi0/2): dot1x_sendRespToServer: Response sent to the server from 0xA00006DE (0019.6654.ca58) *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Sending EAPOL packet to group PAE address *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Role determination not required *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Sending out EAPOL packet *Mar 10 18:32:57.653: dot1x-ev(Gi0/2): Role determination not required *Mar 10 18:32:57.653: dot1x-ev:Enqueued the eapol packet to the global authenticator queue *Mar 10 18:32:57.653: EAPOL pak dump rx *Mar 10 18:32:57.653: EAPOL Version: 0x1 type: 0x0 length: 0x005F *Mar 10 18:32:57.653: dot1x-ev: dot1x_auth_queue_event: Int Gi0/2 CODE= 2,TYPE= 25,LEN= 95 ----------------------------------------------------------------- Чартъри до Египет – Кайро, Хургада и круиз по Нил. 8 дни, от 275€ http://www.astralholidays.bg/pochivki/program/38/country/8.html

1 0

Newbie: help to configure PEAP extension for windows XP wireless Clients
by Stephane Brodeur 10 Sep '10

10 Sep '10

Hi, I am a newbie with Radius and I have problems to authenticate XP wireless clients with eap. I think that my first problem is due to the fact that Windows XP client requires a Certificate Authority since Windows only recognized signed certificate. I could not find the certificate properties windows as shown in the following link: http://deployingradius.com/documents/configuration/eap.html My first question is where is this Smart Card or other Certificate Properties window, is it in the wireless 802.1x configuration window or in the internet explorer where you import certificate. I am using Windows XP with service pack 3. 2) Does FreeRadius generates automatically a self-signed Certificates when we start radiusd -X for the first time. Can we also imports the ca.der file into Windows XP to test our PEAP authentication. Does the server certificate created with the self-signed certificate is good enough to authenticate Windows XP wireless client 3) Can we used the root/server/client self-signed certificate for authentication EAP-TLS. Does making new root/server/client certificate with the make function overides thte self-one Thanks for all your help Stephane

2 1

None
by John 10 Sep '10

10 Sep '10

Hi all, We upgrade freeradius from 1.1.6 to 2.1.18 recently. Looks 2.1.8 will reply a Access-Reject when [ldap] return fail, but 1.1.6 is just keep silence. Is there a way to let 2.1.8 reply nothing in the case? Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.85 port 32770, id=182, length=130 Service-Type = Authorize-Only NAS-Port-Type = Wireless-802.11 User-Name = "test2008" MS-CHAP-Challenge = 0x766bb4f5ae93e28b4630b8fbc674e137 MS-CHAP2-Response = 0x3700e851effcf3aa3f7731204ca90dcbd98300000000000000006c9248ca4d87e72d0b4a91dbd2672bb1f8f5b725187953ff NAS-IP-Address = 10.155.20.85 +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for test2008 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=test2008) [ldap] expand: OU=Domain Controllers,dc=aero-hz,dc=cn -> OU=Domain Controllers,dc=aerohive-hz,dc=cn [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.155.3.2:389, authentication 0 [ldap] bind as hhe(a)aero-hz.cn/w200h to 10.155.3.2:389 [ldap] hhe(a)aero-hz.cn bind to 10.155.3.2:389 failed: Can't contact LDAP server [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Sending Access-Reject of id 182 to 10.155.20.85 port 32770 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 182 with timestamp +10 Ready to process requests.

2 5

Wildcard in realm name? possible??
by Difan Zhao 09 Sep '10

09 Sep '10

Dear developers/experts, I haven't bugged you guys for too long so I decided to come back with a strange question so you know that I'm still your loyal user. I need to proxy requests with the following username pattern to a remote server. host/<PC name>.gtcorp.com This is what the username looks like when the Windows PC is doing PEAP with use of the PC's name instead of the actual user's username. Don't know why but seems to be strange! So I guess my first question is that, is it possible to have wildcard (e.g. "*") in the realm name? I did read all the docs I could possibly found and I tested the configs as well but I couldn't get it to work... Here is the debug while I'm doing testing with radtest program. As you see that it always matches the "DEFAULT" realm but not the *.gtcorp.com that I defined... I'm using 2.1.6 on RHEL4. So! Help help! [root@NE_OVI ~]# radtest 'host/difan.gtcorp.com' xxxx localhost 0 test123 Sending Access-Request of id 163 to 127.0.0.1 port 1812 User-Name = "host/difan.gtcorp.com" User-Password = "xxxx" NAS-IP-Address = 66.150.161.140 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=163, length=20 ------------------------------------------------------------------------ ------------ rad_recv: Access-Request packet from host 127.0.0.1 port 15676, id=163, length=73 User-Name = "host/difan.gtcorp.com" User-Password = "xxxx" NAS-IP-Address = 66.150.161.140 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [GTCORP] Looking up realm "difan.gtcorp.com" for User-Name = "host/difan.gtcorp.com" [GTCORP] Found realm "DEFAULT" [GTCORP] Adding Realm = "DEFAULT" [GTCORP] Proxying request from user host to realm DEFAULT [GTCORP] Preparing to proxy authentication request to realm "DEFAULT" ++[GTCORP] returns updated [suffix] Request already proxied. Ignoring. ++[suffix] returns ok ... The followings are my relevant configs: ================================================================== /etc/raddb/proxy.conf (I did try many other realm names such as *.gtcorp.com as well) ================================================================== proxy server { default_fallback = no } ############################### home_server GTK_Radius_Auth { type = auth ipaddr = 1.1.1.1 port = 1812 secret = xxxx } home_server GTK_Radius_Acct { type = acct ipaddr = 1.1.1.1 port = 1813 secret = xxxx } #################################################### home_server_pool GTK_Radius_Auth_Pool { type = fail-over home_server = GTK_Radius_Auth } home_server_pool GTK_Radius_Acct_Pool { type = fail-over home_server = GTK_Radius_Acct } #################################################### realm ~"*.gtcorp.com" { nostrip auth_pool = GTK_Radius_Auth_Pool acct_pool = GTK_Radius_Acct_Pool } # # This realm is for requests which don't have an explicit realm # prefix or suffix. User names like "bob" will match this one. # realm NULL { nostrip auth_pool = GTK_Radius_Auth_Pool acct_pool = GTK_Radius_Acct_Pool } # # This realm is for ALL OTHER requests. # realm DEFAULT { nostrip auth_pool = GTK_Radius_Auth_Pool acct_pool = GTK_Radius_Acct_Pool } =========================================================== /etc/raddb/modules/realm =========================================================== realm GTCORP { format = suffix delimiter = "/" } ========================================================== /etc/raddb/sites-available/default ========================================================== ... authorize { preprocess chap mschap GTCORP Suffix ... } Thanks!! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com <mailto:difan.zhao@guest-tek.com> Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com <http://www.guest-tek.com> http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/Logo.jpg<ht tp://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/Logo.jpg> INTERNET | MEDIA | VOICE http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/image004.jp g<http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/image004. jpg> The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 2