- Freeradius-Users - lists.freeradius.org

Proxy not working properly with PAP
by John Campbell 30 Aug '10

30 Aug '10

We are using FreeRADIUS Version 0.9.3 (I know - it's old). We are authenticating users on a network of wireless access controllers and are trying to integrate a new type of access controller. This controller can only authenticate using PAP (I know - it's old and unsecure). We use MySQL for the user database. We have built a custom application to manage user passwords. If an authentication attempt is not successful (no user account, expired password, invalid password) then FreeRADIUS sends a proxy request to the customer application to deal with the situation. When we use PAP, FreeRADIUS is sending proxy requests to the custom application in the case of: User not in the MySQL database User is in the MySQL database but the password has expired The problem is that it is not (or at least does not appear to be) sending a proxy request in the case of: User is in the MySQL database, there is a non-expired password but the submitted password is incorrect. We have very detailed logging on the custom application starting with the reception of a message on the port - here is a sample: [10/08/29 16:26:54:567]C[PortThread ]Received message on UDP port 15000. However, in problem case we don't see anything - so it seems to me that FreeRADIUS is not proxying this authentication request to the custom application. I have searched radius.conf and proxy.conf for some setting that would manage this without luck. Also it is important to note that this problem does not occur when we are using MS-CHAPV2 which we do with other controllers we have integrated with - it seems to be associated with PAP. Also - in case you were wondering users can authenticate if they have a valid user name and password. Any suggestions would be appreciated. Regards, John

2 1

Dealing with Incomplete Sessions
by Gabriel Marais 29 Aug '10

29 Aug '10

Hi Guys I was wondering how everyone was dealing with incomplete sessions ? I have some incomplete sessions that are quite old (sometimes days) where it seems like the Stop Accounting packet sever reached my server (or for reason unknown to me). Is it wise to just run a script every x days to append a manual date/time to those sessions ? Thanks, Gabriel

2 1

aaa authentication login and dot1x with one server
by Sascha Frey 29 Aug '10

29 Aug '10

Hi all, I'm trying to set up freeradius to authenticate users logging in to our switches (Cisco IOS) and provide authentication for 802.1X. 1. SSH/Telnet access to our switches for admin users (aaa authentication login) - Every user who is able to login to the server running freeradius should be able to login to the switches (Linux server with libpam-ldapd (nslcd) and pam_access.so to limit access by netgroup) - Using PAM seems to be the right way (direct access to the LDAP database would allow all users and not only certain users with membership in the admin netgroup (pam_access with /etc/security/access.conf) 2. IEEE 802.1X with EAP-TTLS and dynamic VLAN assignment (aaa authentication dot1x) - Using the freeradius LDAP module (direct access to the LDAP database) - 802.1X users are in a separate subtree (ou=dot1x,dc=example,dc=com) How do I setup freeraius to use PAM for authenticating users? How do I combine both functions with different auth methods in one server? I found some howtos for #2, which doesn't seem to be the problem. I appreciate any help. Regards Sascha

1 0

Adding Multiple Cisco-AVPairs using rlm_perl
by James Nedila 29 Aug '10

29 Aug '10

I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response. Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this? Thanks, James

5 8

Simultaneous-Use
by Student University 28 Aug '10

28 Aug '10

Dears , i configured *Simultaneous*-*Use:=1 , i followed the document step by step but i noticed that radutmp not updated and when check this file using radwho i see an entries for previously logged users even i disconnect all users ,,, Best Regard , *

1 0

EAP-MSCHAPv2 and smbpasswd
by Jonathan Black 27 Aug '10

27 Aug '10

I've dug around in documentation looking to find out if EAP-MSCHAPv2 can use the smbpasswd file to authenticate wireless clients. Is it possible to have the smbpasswd file authenticate EAP-MSCHAPv2 requests? Thanks! Jonathan

2 1

usergroup problems with separate auth and accounting databases
by Trey Scarborough 27 Aug '10

27 Aug '10

I have to mysql configurations for one for my authentication request and one for the accounting data. When it make a groupcheck query it is always using the module for the accounting server is there anyway to make this function correctly and have it use the configuration for the authentication database. Any Ideas of why this is happening Here some output while doing a request sql1 is the authentication DB and sql2 is the accounting rad_recv: Access-Request packet from host 127.0.0.1 port 2701, id=94, length=61 User-Name = "user(a)domain.net" CHAP-Password = 0x00000000000000000000000 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "domain.net" for User-Name = "user(a)domain.net" [suffix] No such realm "vortexmail.com" ++[suffix] returns noop [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql1): Reserving sql socket id: 4 [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] User found in radcheck table [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT.................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT .................................. [sql1] sql_groupcmp [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 4 rlm_sql (sql2): Released sql socket id: 4 [sql1] sql_groupcmp finished: User is NOT a member of group active Invalid operator for item Sql-Group: reverting to '==' rlm_sql (sql1): Released sql socket id: 4 ++[sql1] returns ok [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 3 rlm_sql (sql2): Released sql socket id: 3 [files] sql_groupcmp finished: User is NOT a member of group active [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 2 rlm_sql (sql2): Released sql socket id: 2

2 8

How to debug rlm_perl in multithread?
by Eugen Konkov 27 Aug '10

27 Aug '10

HI, FreeRadius. when run radiusd -X it works fine. But when run in multithread (without -X) it core dump after ten or twelve queriest to radiusd. please help any. -- Eugen Konkov mailto:kes-kes@yandex.ru

4 3

user password question
by David Peterson 27 Aug '10

27 Aug '10

Is there a limit to the length of the user password? I have a client trying to connect via EAP-TTLS with the password quikynikinyoky (yeah strange default password eh) but I get a "Wrong MSCHAPv2 response". If I change it to a short one, unl0ck, it works. The username is macaddress(a)WiMax.com by default where the words macaddress are the WAN address of the client. David Peterson Engineer Wireless Connections

2 1

connect java aaplication to radius server using freeradius
by Noura Kossentini 27 Aug '10

27 Aug '10

Hi, In our company it's forbidden to use products with GPL License. So I ca not use Jradius client to connect my client application to a radius server. Since that FreeRadius is distributed under BSD, it's allowed to me to use this library. My queqtion is can you help me on how can I connect and authenticate my java application to a radius server using FreeRadius client?? Thanks in advance

1 0