- Freeradius-Users - lists.freeradius.org

Re: Lost and confused
by jin jin 05 Mar '10

05 Mar '10

Message: 1 Date: Fri, 5 Mar 2010 10:27:50 +0700 From: "Fajar A. Nugraha" <fajar(a)fajar.net> Subject: Re: Lost and confused To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <7207d96f1003041927s3ac683d8g1b32a892bb553009(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Please do NOT include entire mail digest content in your mail. It's unnecessary, waste network bandwidth, and prevents other from seeing the point. On Fri, Mar 5, 2010 at 7:44 AM, jin jin <jyajin(a)yahoo.com.sg> wrote: > radiusd: #### Opening IP addresses and Ports #### > listen { > ??? type = "auth" > ??? ipaddr = * > ??? port = 0 > Failed binding to socket: Address already in use > /etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 Try "netstat -anp | grep 1812". It should print what program is using that port. -- Fajar I did what you say and here is the result: lauwk@lauwk-desktop:~$ sudo netstat -anp | grep 1812 [sudo] password for lauwk: udp 0 0 0.0.0.0:1812 0.0.0.0:* 1505/freeradius >From the above I take it that freeRADIUS is using the correct port right? I followed the documents and didn't touch the configuration file at all because I'm a total beginner. What can I do from this part onwards? Thanks for the reply. Sincerely, Jin New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/sg/

4 3

assignement
by omega bk 05 Mar '10

05 Mar '10

hello, to sum up my case. 1) radius authenticate user in users file 2) my client is windows xp wired 3) successfull vlan is set to 100 Tunnel-Type = VLAN, Tunnel-Medium-type = IEEE-802, Tunnel-Private-Group-ID = 100 so, if auth successed the switch assign to vlan100 , it works. (fa0/24) but if auth fails, i'd like to send him to vlan 120 so in my fa0/24 i did: interface FastEthernet0/24 switchport access vlan 100 switchport mode access dot1x pae authenticator dot1x port-control auto dot1x auth-fail vlan 120 => here supposed to send it to vlan 120 spanning-tree portfast BUT, in case of auth failed, it doesn't work Anybody can help me?

2 2

A question about the NAS-Port on FreeRadiusServer 2.1.4 + Postgresql 8.4.2
by 蔡暮章 05 Mar '10

05 Mar '10

Hello, we are working on the FreeRadiusServer 2.1.4 + Postgresql 8.4.2, and trying to authenticate different 'users' according to the NAS-Port in the request packets. We build the db table 'nas' by the scripts nas.sql: /* * Table structure for table 'nas' */ CREATE TABLE nas ( id SERIAL PRIMARY KEY, nasname VARCHAR(128) NOT NULL, shortname VARCHAR(32) NOT NULL, type VARCHAR(30) NOT NULL DEFAULT 'other', ports int4, secret VARCHAR(60) NOT NULL, server VARCHAR(64), community VARCHAR(50), description VARCHAR(200) ); Since the 'ports' column exists in the table 'nas', we wonder if it has some relationship with the NAS-Port in the request packets. We tried some values for the column, but didn't work. Anyone can tell me the meaning of the column 'ports'? Now we can configure a virtual server for each NAS (by the column 'server' of the table 'nas'). Can I configure a virtual server for each NAS-Port? If so, how can I acheive that? Thank you! Best Regards, Alaxis _________________________________________________________________ MSN十年回馈，每位用户可免费获得价值25元的卡巴斯基反病毒软件2010激活码，快来领取！ http://kaba.msn.com.cn/?k=1

3 3

FAILURE at the end of eapol test result
by R C 05 Mar '10

05 Mar '10

Resending in a plain text format... Hi, What does the FAILURE at the end of the eapol test result mean? But, the eap authentication is successful as shown below. Why is there a failure at the end of the result when the eap authentication is successful? Thanks for your help. .... ........ RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 11 57 03 9f b7 b4 cb ef 7a 51 fc c3 34 c4 b5 57 6a a7 08 59 a9 5f 97 cc d9 73 8c 6e e7 d5 f1 f9 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 decapsulated EAP packet (code=3 id=4 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAPOL test timed out EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 220 mismatch: 0 FAILURE thanks, rc.

1 0

FAILURE at the end of eapol test
by R C 05 Mar '10

05 Mar '10

Hi, What does teh FAILURE at the end of the eapol test result mean? But, the eap authentication is successful as shown in green color below. ________________________________ .... ........ RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 11 57 03 9f b7 b4 cb ef 7a 51 fc c3 34 c4 b5 57 6a a7 08 59 a9 5f 97 cc d9 73 8c 6e e7 d5 f1 f9 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 decapsulated EAP packet (code=3 id=4 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAPOL test timed out EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 220 mismatch: 0 FAILURE ________________________________ thanks, rc.

2 1

Re: Lost and confused
by jin jin 05 Mar '10

05 Mar '10

--- On Thu, 4/3/10, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> wrote: From: freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 59, Issue 15 To: freeradius-users(a)lists.freeradius.org Date: Thursday, 4 March, 2010, 7:00 PM Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Lost and confused (jin jin) 2. Re: Can a wpa_supplicant talk to a Free Radius server without a NAS in between? (Alan DeKok) 3. Re: freeradius 1.1.8 hangs in rlm_perl on 64bit (Alan DeKok) 4. Re: vlan and freeradius (Alan DeKok) 5. Re: Lost and confused (Alan DeKok) 6. Re: special query for authentication (Bob Brandt) 7. Threads & Perl (Alexandr Kovalenko) ---------------------------------------------------------------------- Message: 1 Date: Thu, 4 Mar 2010 14:39:46 +0800 (SGT) From: jin jin <jyajin(a)yahoo.com.sg> Subject: Lost and confused To: freeradius-users(a)lists.freeradius.org Message-ID: <535148.16355.qm(a)web76001.mail.sg1.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" This is the first time that I'm trying to set up a freeRADIUS server (Ver 2.1.0) using Ubuntu 9.10 and I'm running into walls. I used the debug mode and this is the output Failed binding to socket: Address already in use /etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 I googled but the closest match was a bug which was fixed earlier on. I'm not really sure what the above meant either. Do I have to connect my freeRADIUS server to my ADSL router first before I run freeRADIUS in debug mode? I am sorry if I have asked a few dumb questions, thanks in advance to the people replying to me. Best regards, ??????????????????? Jin New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/sg/

2 1

License for radperf
by R C 04 Mar '10

04 Mar '10

Hi, In the README for radperf tool, the following gives information about Licensing. I downloaded the tool but am not sure if i can run it without the license as per the highlighted red sections below. Please advise. I just want to run this tool on my machine to load test my radius server. ________________________________ This archive contains the "radperf" tool. It is similar in some ways to the FreeRADIUS "radclient" program, but it is much more capable. See the "radclient.1" file, or "radclient.html" for the documentation. The "lib" directory includes a copy of the FreeRADIUS library, libfreeradius-radius.a, along with a copy of its license, the LGPL. The "share" directory contains a copy of the FreeRADIUS dictionaries, along with a copy of their licenses, the GPL. Please note that the "radperf" program is NOT licensed under the GPL, and it is NOT licensed under the LGPL. Redistribution of any files in this archive is NOT permitted without the prior written permission of Network RADIUS. You may have to set the LD_LIBRARY_PATH appropriately before using radperf. e.g.: $ export LD_LIBRARY_PATH=./lib $ ./radperf ... Please contact Network RADIUS at <sales(a)networkradius.com> toobtain individual licensing for this product. ________________________________ thanks, rc.

2 2

FreeRadius upgrade from 1.3 to 2.0.4
by Trevor Jennings 04 Mar '10

04 Mar '10

Hello, I recently upgraded one of our freeradius servers from 1.3.3 to 2.0.4. We use this for mac authentication for wireless which is working fine and also ldap authentication for our vpn users. The problem I am having with the ldap authentication is that when a user tries to authenticate with their user@domain, it does not work! However, it works fine if the user does not add the domain name. Is there a glitch with v2.0.4 or a configuration issue that I am missing? I am using this in the ldap config:- filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" but the Stripped-User-Name appears to be blank when using debug mode. Cheers, - Trevor

2 2

vlan and freeradius
by omega bk 04 Mar '10

04 Mar '10

Hello, so i would like to redirect my winxp authenticated to VLAN1 and if not authenticated , this client must be in vlan2 i got a switch cisco so how to handla this with freeradius? thank u

7 14

special query for authentication
by mwarren 04 Mar '10

04 Mar '10

I am trying to setup something where I can have multiple NAS devices where users can roam. Some NAS devices people will be able to have the first level of service free(sponsored NAS). I need to be able to identify and authenticate people who sign up to the free service to only be allowed to use the free spots and not take their free account to a paid location. I am looking at several possibilities of maybe adding a field with say usage = free or paid as an example and I want the NAS-Identifier, WISPr-Location-ID or theMS-CHAP-Domain to equal the "free" or "paid". The query would be something like WHERE usage = ${MS-CHAP-Domain} .... but I cannot figure out where and how to do this. Can anyone help and if you have another idea please let me know. -- View this message in context: http://old.nabble.com/special-query-for-authentication-tp27776513p27776513.… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3