- Freeradius-Users - lists.freeradius.org

AW: Freeradius-Users Digest, Vol 54, Issue 89
by INACIO ALVES 19 Oct '09

19 Oct '09

Thanks Ivan Kalik, Now my server is authenticating the users (Linux and Windows). The next step is migrate my users to MySQL or PostgreSQL database. So I need alter the file sites-available/default to include the line sql and remove the lines unix and files. Is this? Second. I set the Framed-IP-Address := 192.168.2.253, Framed-IP-Netmask = 255.255.255.0 to my user, but I don't receive this IP on my machine. I disable the DHCP on my AP and continue not receive this configuration. I need install a DHCP server on my server and close MACxIP to send this configurations to my machine? No more, thanks again. Inácio Alves http://www.polluxweb.com/inacioalves/site

1 0

RE:
by INACIO ALVES 19 Oct '09

19 Oct '09

Thanks to all, But, how I said, I don't need proxy, Then I have commented the line proxy proxy_requests = no #$INCLUDE proxy.conf See http://pastebin.com/m52c747e3 to my radiusd.conf Therefore, I don't know why the log is Sun Oct 18 19:20:54 2009 : Info: [pap] No clear-text password in the request. Not performing PAP. Sun Oct 18 19:20:54 2009 : Info: ++[pap] returns noop Sun Oct 18 19:20:54 2009 : Info: WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Sun Oct 18 19:20:54 2009 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Sun Oct 18 19:20:54 2009 : Info: WARNING: Use the PAP or CHAP modules instead. Sun Oct 18 19:20:54 2009 : Info: No User-Password or CHAP-Password attribute in the request. Sun Oct 18 19:20:54 2009 : Info: Cannot perform authentication. Sun Oct 18 19:20:54 2009 : Info: Failed to authenticate the user. Sun Oct 18 19:20:54 2009 : Auth: Login incorrect: [user] (from client wlan- alves-private-network port 0 via TLS tunnel)On my proxy.conf I have(even whithout use then, I don't alter this file) # DEFAULT EAP-Type == PEAP, Proxy-To-Realm := LOCAL # realm LOCAL { # If we do not specify a server pool, the realm is LOCAL, and # requests are not proxied to it. } Inácio Alves http://www.polluxweb.com/inacioalves/site --- freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> schrieb am Mo, 19.10.2009: Message: 1 Date: Mon, 19 Oct 2009 00:54:39 +0000 (GMT) From: INACIO ALVES <inacioalves(a)yahoo.de> To: freeradius-users(a)lists.freeradius.org Message-ID: <370578.7811.qm(a)web27401.mail.ukl.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" I'm trying configure the freeRADIUS on my wireless network but i'm having problems. My scnario: Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 clients ----- ((( AP ))) ____ [freeRADIUS server] When I execute the radiustest I get rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, length=20 and when I execute radclient I get Received response ID 146, code 2, length = 32 But when I try authenticate on my nootebook I get rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 My debug output is on address: http://pastebin.com/f7e47862f. My clients.conf is on: http://pastebin.com/f30e4955d And my users is on: http://pastebin.com/f5d958f63 This is my initial configuration. I want migrate to MySQL or PostgreSQL when the server is ready, I don't need proxy, and i need provide/revoke digital certificates to my clients. ------------------------------ Message: 7 Date: Mon, 19 Oct 2009 09:07:25 +0100 From: "nf-vale" <nf-vale(a)critical-links.com> Subject: Re: To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200910190907.25443.nf-vale(a)critical-links.com> Content-Type: Text/Plain; charset="iso-8859-15" Check your proxy / realms configuration. The reason why it fails is described in the logs: Sun Oct 18 19:20:54 2009 : Info: [pap] No clear-text password in the request. Not performing PAP. Sun Oct 18 19:20:54 2009 : Info: ++[pap] returns noop Sun Oct 18 19:20:54 2009 : Info: WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Sun Oct 18 19:20:54 2009 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Sun Oct 18 19:20:54 2009 : Info: WARNING: Use the PAP or CHAP modules instead. Sun Oct 18 19:20:54 2009 : Info: No User-Password or CHAP-Password attribute in the request. Sun Oct 18 19:20:54 2009 : Info: Cannot perform authentication. Sun Oct 18 19:20:54 2009 : Info: Failed to authenticate the user. Sun Oct 18 19:20:54 2009 : Auth: Login incorrect: [user] (from client wlan- alves-private-network port 0 via TLS tunnel) Nelson Vale On Monday 19 October 2009 01:54:39 INACIO ALVES wrote: > I'm trying configure the freeRADIUS on my wireless network but i'm having > problems. > > > > My scnario: > > Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 > > > > clients ----- ((( AP ))) ____ [freeRADIUS server] > > > > When I execute the radiustest I get > > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, > length=20 > > > > and when I execute radclient I get > > Received response ID 146, code 2, length = 32 > > > > But when I try authenticate on my nootebook I get > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 > > > > My debug output is on address: http://pastebin.com/f7e47862f. > > My clients.conf is on: http://pastebin.com/f30e4955d > > And my users is on: http://pastebin.com/f5d958f63 > > > > This is my initial configuration. I want migrate to MySQL or PostgreSQL > when the server is ready, I don't need proxy, and i need provide/revoke > digital certificates to my clients. > > In?cio Alves > http://www.polluxweb.com/inacioalves/site ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 54, Issue 86 ************************************************

2 1

AW: Freeradius-Users Digest, Vol 54, Issue 86
by INACIO ALVES 19 Oct '09

19 Oct '09

Thanks to all, But, how I said, I don't need proxy, Then I have commented the line proxy proxy_requests = no #$INCLUDE proxy.conf See http://pastebin.com/m52c747e3 to my radiusd.conf Therefore, I don't know why the log is Sun Oct 18 19:20:54 2009 : Info: [pap] No clear-text password in the request. Not performing PAP. Sun Oct 18 19:20:54 2009 : Info: ++[pap] returns noop Sun Oct 18 19:20:54 2009 : Info: WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Sun Oct 18 19:20:54 2009 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Sun Oct 18 19:20:54 2009 : Info: WARNING: Use the PAP or CHAP modules instead. Sun Oct 18 19:20:54 2009 : Info: No User-Password or CHAP-Password attribute in the request. Sun Oct 18 19:20:54 2009 : Info: Cannot perform authentication. Sun Oct 18 19:20:54 2009 : Info: Failed to authenticate the user. Sun Oct 18 19:20:54 2009 : Auth: Login incorrect: [user] (from client wlan- alves-private-network port 0 via TLS tunnel)On my proxy.conf I have(even whithout use then, I don't alter this file) # DEFAULT EAP-Type == PEAP, Proxy-To-Realm := LOCAL # realm LOCAL { # If we do not specify a server pool, the realm is LOCAL, and # requests are not proxied to it. } Inácio Alves http://www.polluxweb.com/inacioalves/site --- freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> schrieb am Mo, 19.10.2009: Message: 1 Date: Mon, 19 Oct 2009 00:54:39 +0000 (GMT) From: INACIO ALVES <inacioalves(a)yahoo.de> To: freeradius-users(a)lists.freeradius.org Message-ID: <370578.7811.qm(a)web27401.mail.ukl.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" I'm trying configure the freeRADIUS on my wireless network but i'm having problems. My scnario: Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 clients ----- ((( AP ))) ____ [freeRADIUS server] When I execute the radiustest I get rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, length=20 and when I execute radclient I get Received response ID 146, code 2, length = 32 But when I try authenticate on my nootebook I get rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 My debug output is on address: http://pastebin.com/f7e47862f. My clients.conf is on: http://pastebin.com/f30e4955d And my users is on: http://pastebin.com/f5d958f63 This is my initial configuration. I want migrate to MySQL or PostgreSQL when the server is ready, I don't need proxy, and i need provide/revoke digital certificates to my clients. ------------------------------ Message: 7 Date: Mon, 19 Oct 2009 09:07:25 +0100 From: "nf-vale" <nf-vale(a)critical-links.com> Subject: Re: To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200910190907.25443.nf-vale(a)critical-links.com> Content-Type: Text/Plain; charset="iso-8859-15" Check your proxy / realms configuration. The reason why it fails is described in the logs: Sun Oct 18 19:20:54 2009 : Info: [pap] No clear-text password in the request. Not performing PAP. Sun Oct 18 19:20:54 2009 : Info: ++[pap] returns noop Sun Oct 18 19:20:54 2009 : Info: WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Sun Oct 18 19:20:54 2009 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Sun Oct 18 19:20:54 2009 : Info: WARNING: Use the PAP or CHAP modules instead. Sun Oct 18 19:20:54 2009 : Info: No User-Password or CHAP-Password attribute in the request. Sun Oct 18 19:20:54 2009 : Info: Cannot perform authentication. Sun Oct 18 19:20:54 2009 : Info: Failed to authenticate the user. Sun Oct 18 19:20:54 2009 : Auth: Login incorrect: [user] (from client wlan- alves-private-network port 0 via TLS tunnel) Nelson Vale On Monday 19 October 2009 01:54:39 INACIO ALVES wrote: > I'm trying configure the freeRADIUS on my wireless network but i'm having > problems. > > > > My scnario: > > Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 > > > > clients ----- ((( AP ))) ____ [freeRADIUS server] > > > > When I execute the radiustest I get > > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, > length=20 > > > > and when I execute radclient I get > > Received response ID 146, code 2, length = 32 > > > > But when I try authenticate on my nootebook I get > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 > > > > My debug output is on address: http://pastebin.com/f7e47862f. > > My clients.conf is on: http://pastebin.com/f30e4955d > > And my users is on: http://pastebin.com/f5d958f63 > > > > This is my initial configuration. I want migrate to MySQL or PostgreSQL > when the server is ready, I don't need proxy, and i need provide/revoke > digital certificates to my clients. > > In?cio Alves > http://www.polluxweb.com/inacioalves/site ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 54, Issue 86 ************************************************

1 0

how to get a UserName from a Pool
by Alisson 19 Oct '09

19 Oct '09

Hi, I need to redirect a customer to a page with the pool and I need to get his UserName. I tougth to use the MK API to acess, I used the NASIPAddress, UserName and Password, The redirect and acess MK API its easy, but my problem is how to get the UserName of one customer if I have alot of customers with one NASIpAddress? -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 2

HINTS and EAP correspondence issue.
by Matthieu Lazaro 19 Oct '09

19 Oct '09

Hello list, I have a little question about hints and EAP. Trying to set up machine authentification, I have been able to rewrite my user-name to match my requirements in my Open ldap: get rid of the host/ and add $ ( host/machinename --> machinename$) using hints. But it ends up with this error after ldap authorisation: [eap] Identity does not match User-Name, setting from EAP Identity And it fails the authentification part. How can I tell EAP the new user name? It works when I use realm in proxy.conf and remove the $ at the end of the machine uid in my ldap, but this won't do as I don't want to rename all the uids. Best regards, Matthew

2 3

Several virtual servers with different log files?
by Francisco Javier Valdera Garcia 19 Oct '09

19 Oct '09

Hi, I have a freeRadius 2.1.7 server with three virtual servers listening to different kinds of clients. I would like to know whether it is possible to define different log files for these virtual servers, instead of the global log file defined in radiusd.conf. Reading the README file inside the sites-available directory, it seems that it is not possible to define a 'log' section in a virtual server. Thanks for the help, Francisco Javier Valdera.

3 4

mysql radgroupcheck, deny access
by Michael Bowe 19 Oct '09

19 Oct '09

I had some older Debian 4.0 (etch) servers, with freeradius v1.1.3 installed from packages. I then upgraded to Debian 5.0 (lenny), which comes with freeradius v2.0.4 After upgrading I ran into some problems with my radgroupcheck rules. In radgroupcheck, I have some rules to restrict which NAS users are allowed to connect to. Here's an example : mysql> select * from radcheck where username = 'mbowe-test'; +------+------------+----------------+----+--------------------------------- ---+ | id | username | attribute | op | value | +------+------------+----------------+----+--------------------------------- ---+ | 708 | mbowe-test | Crypt-Password | := | <SNIPPED> | +------+------------+----------------+----+--------------------------------- ---+ mysql> select * from radreply where username = 'mbowe-test'; Empty set (0.00 sec) mysql> select * from radusergroup where username = 'mbowe-test'; +------------+----------------+----------+ | username | groupname | priority | +------------+----------------+----------+ | mbowe-test | dialup-freedom | 1 | +------------+----------------+----------+ mysql> select * from radgroupcheck where groupname = 'dialup-freedom'; +----+----------------+------------------+----+----------------------------- + | id | groupname | attribute | op | value | +----+----------------+------------------+----+----------------------------- + | 3 | dialup-freedom | NAS-IP-Address | !~ | ^111.222.333.(1|2|3|4|5|6)$ | | 4 | dialup-freedom | Simultaneous-Use | := | 1 | +----+----------------+------------------+----+----------------------------- + mysql> select * from radgroupreply where groupname = 'dialup-freedom'; +----+----------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+---------------------+ | 9 | dialup-freedom | Service-Type | := | Framed-User | | 10 | dialup-freedom | Framed-Protocol | := | PPP | | 11 | dialup-freedom | Framed-IP-Address | = | 255.255.255.254 | | 12 | dialup-freedom | Framed-IP-Netmask | := | 255.255.255.255 | | 13 | dialup-freedom | Framed-Compression | := | Van-Jacobson-TCP-IP | | 14 | dialup-freedom | Idle-Timeout | := | 1800 | | 15 | dialup-freedom | Session-Timeout | := | 14400 | | 16 | dialup-freedom | Port-Limit | := | 1 | +----+----------------+--------------------+----+---------------------+ Under the older freeradius, if the mbowe-test user tried to connect to a NAS with IP 111.222.333.1|2|3|4|5|6 then their access would be rejected. However under the newer freeradius, the user can now get online OK. (The group doesn't match so the 'dialup-freedom' attributes are not returned) In my sql.conf I have read_groups = yes I tried installing the freeradius 2.1.7 from source, and it gives the same result as the 2.0.4 from packages (user can get online). Am I doing something wrong? Let me know if you would like me to paste some debugs. Michael.

2 1

No NAS-Port seen warning
by Robert White 19 Oct '09

19 Oct '09

Hey, I keep getting a warning message in my Radius setup... WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent This is true enough. But I am sending a slightly different attribute: 'Quintum-NAS-Port'. Do I have control over this 'NAS-Port prefix? Or can I make rlm_acct_unique look for Quintum-NAS-Port instead of just NAS-Port? Any help appreciated. Thanks, Rob

4 4

None
by INACIO ALVES 19 Oct '09

19 Oct '09

I'm trying configure the freeRADIUS on my wireless network but i'm having problems. My scnario: Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 clients ----- ((( AP ))) ____ [freeRADIUS server] When I execute the radiustest I get rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, length=20 and when I execute radclient I get Received response ID 146, code 2, length = 32 But when I try authenticate on my nootebook I get rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 My debug output is on address: http://pastebin.com/f7e47862f. My clients.conf is on: http://pastebin.com/f30e4955d And my users is on: http://pastebin.com/f5d958f63 This is my initial configuration. I want migrate to MySQL or PostgreSQL when the server is ready, I don't need proxy, and i need provide/revoke digital certificates to my clients. Inácio Alves http://www.polluxweb.com/inacioalves/site

3 2

How to configure Wrong Message-Authenticator in Free-radius server response
by Venseen 19 Oct '09

19 Oct '09

Hi, I have to insert cooked Message-authenticator in Free-radius srver Message, I tried to insert it in the users file in raddb. But, the configured value is not observed in the Access Accept packets for the Radius Server. Changes in raddb/users: hp Cleartext-Password := "hp123" Message-Authenticator = "0x12345000000000000000000000000000" Then I came to know that this wud not be taken while Calculating Message-Authenticator, Any help on cooking Message Authentictor without modifying the code is appreciated, Note: I have successfully modified code and able to do it, but i need to if it is possible by simple config file change Thanks Venseen -- View this message in context: http://www.nabble.com/How-to-configure-Wrong-Message-Authenticator-in-Free-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1