- Freeradius-Users - lists.freeradius.org

Enabling Session Resumption in FreeRadius
by Panagiotis Georgopoulos 08 Sep '10

08 Sep '10

Hello all, I have a client that uses EAP-TTLS to authenticate to a FreeRadius (2.1.8) over different access networks. After some handovers from one network to another, I see in my FR log that session resumption fails, and specifically I see : Debug: SSL Connection Established Debug: SSL Application Data Info: [ttls] eaptls_process returned 3 Info: [ttls] Skipping Phase2 due to session resumption Info: [ttls] FAIL: *Forcibly stopping session resumption as it is not allowed* Info: [eap] Freeing handler Info: ++[eap] returns reject Info: Using Post-Auth-Type Reject Then a full EAP-TTLS exchange follows from the beginning that succeeds. However, the failure message above "Forcibly stopping session resumption as it is not allowed" implies that there is somewhere in the FR a setting that will allow it? Am I assuming rightly? If yes, where is this setting? If no, does anyone know why session resumption fails ? Thanks a lot in advance, Panos

3 3

Fwd: ldap group lookup help
by Walter Gould 08 Sep '10

08 Sep '10

I never saw a reply to my below e-mail. Would anybody have any thoughts or ideas on why our ldap group lookups fail after some period of time...? If it would help to send debug output, I can... Just for my information, are many folks out there using ldap/AD group lookups on large FR installs? Thanks in advance, Walter -------- Original Message -------- Subject: ldap group lookup help Date: Thu, 02 Sep 2010 09:49:02 -0500 From: Walter Gould <gouldwp(a)auburn.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Group, We are having problems with ldap group lookups... Here's our environment. Using Freeradius 2.1.8 to authenticate wireless users against our AD servers and perform ldap group membership lookups. Using WPA2-AES-PEAP-MSCHAPv2. When radiusd is started, initially the lookups work fine and we see successful auth's in our radius logs. But, after some period of time, we eventually begin to see bunches of "Invalid user:" radius logs. The only thing that seems to fix this is to remove the ldap group lookups from the freeradius config. In our ldap module, the basedn we specify is dc=auburn,dc=edu (as we have multiple user ou's). Not sure if that might be causing an issue or not..? One thing I have noticed is there are 3 ldap group lookups that each say "rlm_ldap::ldap_groupcmp: User found in group xxxx". I have read posts about configuring the ldap module to us the inner-tunnel - which I have done. Is there anyway to reduce the number of group lookups to only one? Not sure if the extra lookups are causing unneeded traffic which may be causing issues? Also, I see 10 Access-Request packets and about the same number of Access-Challenge packets.. Is this normal? Just wondering if excessive unneeded traffic is what is overloading the AD/ldap servers? Any help or suggestions will be appreciated. Thanks, Walter Gould Auburn University

1 0

Wrong Vlan assignment by freeradius, threading issue?!
by Jan Zacharias 08 Sep '10

08 Sep '10

Hi Folks, I'm running into some very bad issue: when running freeradius in threaded mode (default) it's mixing up CONCURRENT requests resulting in a wrong vlan assignment. Here are the logs of two clients (OSX and Ubuntu). The Ubuntu supplicant (wpa-suppl.) always fails the first login try, but this is normal. This is with reauthentification interval of 10 seconds, so requests seem to overlap: Tue Sep 7 16:45:36 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:39 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:41 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:45:44 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 208 due to unfinished request 267 Tue Sep 7 16:45:53 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:59 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:46:01 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 232 due to unfinished request 291 Now let's check what Vlans got assigned (this is the vmps log, vmps gets only this MAC via rad2vmps and looks up the vlan in a mysql db): ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 So freeradius takes the MAC of the OSX client and inserts it into the request that is associated with the Ubuntu client - VERY BAD. Now I only changed the reauthentification interval to 20 seconds, so the requests do not overlap anymore for sure. Tue Sep 7 16:46:50 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:47:17 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Vmps log: ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 The short reauthentification interval is just to simulate a few more clients for stresstesting purposes. Can anyone help? The operating system is FreeBSD 8.1-RELEASE i386 and always las load averages of 0.00, 0.00, 0.00 Switch hardware is cisco WS-C3560G-48PS with firmware (12.2(53)SE2 C3560-IPSERVICESK9-M). Best, Jan

2 6

Freeradius not unescaping \ and "
by Murray Long 07 Sep '10

07 Sep '10

I have the following setup: CoovaChilli accepts user login requests and sends radius packets to freeradius freeradius then proxies the requests (based on realm) onto a second freeradius server. If I attempt a login with username "A\" The first freeradius server recieves packets with UserName atribute = "A\\" and sends a packet to the sencond radius server with username attribute = "A\\\\" (as reported by wireshark) So it looks like freeradius is not correctly unescaping the username attribute. (Or incorrectly re-escaping) before the proxy. How is freeradius expected to behave when escaping backslash and quote characters before proxying? And is it possible to alter this behavior though configuration? Thanks, Murray

3 9

Best Authentication Method for Various Supplicant
by homyang cha 07 Sep '10

07 Sep '10

Hello I am running freeradius-2.17 on CentOS-5.5 box with mysql-5.0.77 as backend and daloradius-0.9-8 as the web management. I have successfully configured an tested EAP-MD5, PEAP and PAP authentication using windows 7 as supplicant with wired 802.1x authentication (no certificates used) and NAS as a Huawei Switch (Quidway S5600 Series) and seems to be working fine. Now my issues are: in my networks there are various kinds of OS running for supplicants. To name a few are Windows XP (SP2, SP3), Windows Vista, Windows 7, Fedora, CentOS, Ubuntu and Mac OS X. I have to configure AAA applicants systems in such a way all this systems are supported. Can someone help me suggest or have any idea/experience on this. What could be the best authentiation method that I can use so that all this supplicants using different OS are supported. Also I use wired connection as well as wireless connection in the network. Does anybody throw some light on this matter? Thanks in Advance -- homyang (aka puran)

2 3

FreeRADIUS expertise in Switzerland
by Steudler, Oliver 07 Sep '10

07 Sep '10

Hello, I hope this is not too Off Topic, but I am looking for a company with FreeRADIUS expertise for a substantial Project in Switzerland ? Would greatly appreciate it if someone could recommend a reliable and competent partner for this. Regards Oliver Steudler steudler (at) netcloud (dot) ch +41 79 214 97 82

1 0

Problem with rlm_perl
by Nasser Heidari 07 Sep '10

07 Sep '10

Dear Folks, I'm using a perl module to record and save clients MAC address to DB. In situations that cisco-av-pair is not included in RADIUS packet, I'm replacing it with 0000.0000.0000. Everything is working just fine in test environment but when running on production servers the recorded MAC address for those clients without cisco-av-pair attribute in their packet is not 0000.0000.0000 but it's a wrong MAC which belongs to another packet received seconds ago. We even captured all the RADIUS traffic sent form NASes and replayed it in our test environment but I wanted to capture users mac address, so I've added a perl module , and after parsing cisco-av-pair attribute , I save it to DB. In normal situation everything works like a charm , but in some cases, If NAS doesn't send mac-address attribute, I expect to save a 0000.0000.0000 mac address in DB , but no success. There is a condition that I check if mac-address attribute exists in request or not, if exist it's ok , if not it should update request with a 0000.0000.0000 mac address.

2 3

EAP-MD5 testing with radeapclient and eapol_test
by Chidanand Gangur 07 Sep '10

07 Sep '10

Hi All, I have a proxy setup ( proxy server 192.168.6.134) where users are proxied to home server (192.168.7.40). Host IP address = 192.168.6.181 FreeRADIUS version 2.1.9 User authentication using radclient works fine when I issue following command echo "User-Name=raduser(a)mytest.com,Password=pass123" | radclient 192.168.6.134 auth testing123 I get following response on my proxy server rad_recv: Access-Accept packet from host 192.168.7.40 port 1812, id=104, length=68 Proxy-State = 0x3737 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a505b1000001370001c0a8072801cb4d87ddbf246a0000000000000016 I try the same test to work out with EAP using following command: echo "User-Name=raduser(a)mytest.com ,Password=pass123,EAP-Code=Response,EAP-Id=210,EAP-Type-Identity= raduser(a)mytest.com" | radeapclient -x 192.168.6.134 auth testing123 I see following output on proxy server: rad_recv: Access-Request packet from host 192.168.6.181 port 32771, id=108, length=107 User-Name = "raduser(a)mytest.com" User-Password = "pass123" EAP-Message = 0x02d2001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0xe61561c7667d60c2fbc37709b16e8193 Mon Sep 6 06:48:30 2010 : Info: +- entering group authorize {...} Mon Sep 6 06:48:30 2010 : Info: ++[preprocess] returns ok Mon Sep 6 06:48:30 2010 : Info: ++[chap] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[mschap] returns noop Mon Sep 6 06:48:30 2010 : Info: [suffix] Looking up realm "mytest.com" for User-Name = "raduser(a)mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Found realm "mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Adding Stripped-User-Name = "raduser" Mon Sep 6 06:48:30 2010 : Info: [suffix] Adding Realm = "mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Proxying request from user raduser to realm mytest.com Mon Sep 6 06:48:30 2010 : Info: [suffix] Preparing to proxy authentication request to realm "mytest.com" Mon Sep 6 06:48:30 2010 : Info: ++[suffix] returns updated Mon Sep 6 06:48:30 2010 : Info: [eap] Request is supposed to be proxied to Realm mytest.com. Not doing EAP. Mon Sep 6 06:48:30 2010 : Info: ++[eap] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[unix] returns notfound Mon Sep 6 06:48:30 2010 : Info: [files] users: Matched entry DEFAULT at line 195 Mon Sep 6 06:48:30 2010 : Info: [files] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:48:30 2010 : Info: ++[files] returns ok Mon Sep 6 06:48:30 2010 : Info: ++[expiration] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[logintime] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[pap] returns noop Mon Sep 6 06:48:30 2010 : Info: WARNING: Empty pre-proxy section. Using default return values. Mon Sep 6 06:48:30 2010 : Info: Proxying request 0 to home server 192.168.7.40 port 1812 Sending Access-Request of id 40 to 192.168.7.40 port 1812 User-Name = "raduser" User-Password = "pass123" EAP-Message = 0x02d2001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0x00000000000000000000000000000000 NAS-IP-Address = 192.168.6.181 Proxy-State = 0x313038 Mon Sep 6 06:48:30 2010 : Debug: Going to the next request Mon Sep 6 06:48:30 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 192.168.7.40 port 1812, id=40, length=69 Proxy-State = 0x313038 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a605b2000001370001c0a8072801cb4d87ddbf246a0000000000000017 Mon Sep 6 06:48:30 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:48:30 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:48:30 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:48:30 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:48:30 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:48:30 2010 : Info: ++[eap] returns noop Mon Sep 6 06:48:30 2010 : Info: Found Auth-Type = Accept Mon Sep 6 06:48:30 2010 : Info: Auth-Type = Accept, accepting the user Mon Sep 6 06:48:30 2010 : Info: +- entering group post-auth {...} Mon Sep 6 06:48:30 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 108 to 192.168.6.181 port 32771 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a605b2000001370001c0a8072801cb4d87ddbf246a0000000000000017 User-Name = "raduser(a)mytest.com" When I use eapol_test client to using following command: eapol_test -c /tmp/eapol.conf -a 192.168.6.134 -p 1812 -s testing123 -r 1 eapol.conf is as follows network={ key_mgmt=NONE eap=MD5 identity="raduser(a)mytest.com" password="pass123" } I see following output on my proxy server: Mon Sep 6 06:53:49 2010 : Info: Proxying request 0 to home server 192.168.7.40 port 1812 Sending Access-Request of id 166 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.7.40 port 1812, id=166, length=109 Proxy-State = 0x30 Session-Timeout = 6 EAP-Message = 0x0101002304101f3bc497bfe2cfaf507a66218e4dcb01524f4f54544553544c41424144 State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x467eeb430357cbddf194719353853d80 Mon Sep 6 06:53:49 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:53:49 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:53:49 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:53:49 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Sending Access-Challenge of id 0 to 192.168.6.181 port 32771 Session-Timeout = 6 EAP-Message = 0x0101002304101f3bc497bfe2cfaf507a66218e4dcb01524f4f54544553544c41424144 State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "raduser(a)mytest.com" Mon Sep 6 06:53:49 2010 : Info: Finished request 0. Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.6.181 port 32771, id=1, length=171 User-Name = "raduser(a)mytest.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0xe1da93d7d4f4d4b68cf9ef4333a1f8eb Mon Sep 6 06:53:49 2010 : Info: +- entering group authorize {...} Mon Sep 6 06:53:49 2010 : Info: ++[preprocess] returns ok Mon Sep 6 06:53:49 2010 : Info: ++[chap] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[mschap] returns noop Mon Sep 6 06:53:49 2010 : Info: [suffix] Looking up realm "mytest.com" for User-Name = "raduser(a)mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Found realm "mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Adding Stripped-User-Name = "raduser" Mon Sep 6 06:53:49 2010 : Info: [suffix] Adding Realm = "mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Proxying request from user raduser to realm mytest.com Mon Sep 6 06:53:49 2010 : Info: [suffix] Preparing to proxy authentication request to realm "mytest.com" Mon Sep 6 06:53:49 2010 : Info: ++[suffix] returns updated Mon Sep 6 06:53:49 2010 : Info: [eap] Request is supposed to be proxied to Realm mytest.com. Not doing EAP. Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[unix] returns notfound Mon Sep 6 06:53:49 2010 : Info: [files] users: Matched entry DEFAULT at line 195 Mon Sep 6 06:53:49 2010 : Info: [files] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Info: ++[files] returns ok Mon Sep 6 06:53:49 2010 : Info: ++[expiration] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[logintime] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[pap] returns noop Mon Sep 6 06:53:49 2010 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 177 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 Mon Sep 6 06:53:49 2010 : Info: Proxying request 1 to home server 192.168.7.40 port 1812 Sending Access-Request of id 177 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.7.40 port 1812, id=177, length=47 Proxy-State = 0x31 EAP-Message = 0x04010004 Message-Authenticator = 0x9ce0e5c3b355540c348cbff29f5f40f2 Mon Sep 6 06:53:49 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:53:49 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:53:49 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:53:49 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Mon Sep 6 06:53:49 2010 : Info: Using Post-Auth-Type Reject Mon Sep 6 06:53:49 2010 : Info: +- entering group REJECT {...} Mon Sep 6 06:53:49 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Sep 6 06:53:49 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Sep 6 06:53:49 2010 : Info: Delaying reject of request 1 for 1 seconds Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 6 06:53:50 2010 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.6.181 port 32771 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Mon Sep 6 06:53:50 2010 : Debug: Waking up in 3.9 seconds. Mon Sep 6 06:53:54 2010 : Info: Cleaning up request 0 ID 0 with timestamp +48 Mon Sep 6 06:53:54 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 6 06:53:55 2010 : Info: Cleaning up request 1 ID 1 with timestamp +48 Mon Sep 6 06:53:55 2010 : Info: Ready to process requests. I have never succedded with eapol_test. I doubt on NAS-IP-Address attribute in Access=Request which is 127.0.0.1. Can some body point me where am I going wrong? -- Chidanand Gangur Pune.

4 9

Save Passwords Encrypted in DB
by Nasser Heidari 06 Sep '10

06 Sep '10

Hi, I want to save encrypted passwords in DB. As I reviewed mailing list , it looks that I don't need major changes on my Freeradius and DB records. Currently my users password in database is like this : +------------+---------------+------------------+----+------------------ ----+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ----+ | 10001 | nasser | User-Password | := | plainpass | +------------+---------------+------------------+----+------------------ ----+ And I authenticate users with pap module . I've changed DB entry to this : # openssl passwd -1 plainpass $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ +------------+---------------+------------------+----+------------------ ------------------------------------------+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ------------------------------------------+ | 10001 | nasser | Crypt-Password | := | $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ | +------------+---------------+------------------+----+------------------ ------------------------------------------+ But no success, also I add Password-With-Header := "{crypt}" to my sql.conf but no success ! Do I missing something ? What kind of changes do I need? My Freeradius Version is 2.1.7 Thanks in advance.

2 4

RADIUS reading LDAP attributes
by Sigurd Foshaug 04 Sep '10

04 Sep '10

Hi all, I have a freeradius 2.1.3 running and I can successfully authenticate users. I would like to use a users LDAP attribute so I can provide them with different permissions on the proxy server. I have currently mapped a RADIUS attribute to the LDAP attribute and it successfully reads the attribute when a user is authenticating. >From radiusd -X: rlm_ldap: description -> My-Local-LDAP-Comment = "STAFF" So the user in question has STAFF as a comment in his ldap description attribute. I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this: ATTRIBUTE My-Local-LDAP-Comment 3000 string and in the raddb/ldap.attrmap I have added: replyItem My-Local-LDAP-Comment description Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS, so I can make rules depending on its contents? Any suggestions on what to do, or which documentation to read would be appreciated. Thanks, Sigurd

2 2