- Freeradius-Users - lists.freeradius.org

[Link two authentication requests for Wimax]
by Thomas Fagart 06 Oct '09

06 Oct '09

Hello, I would like to know if this is possible to do the following with Freeradius. eg to ask him to have memory. Description I've got one authentication request (called request 1) coming from an ASN GW that will contain the mac adress of the CPE in some attribute. Freeradius will send an access accept. This authentication success will enable the CPE to get connected to the base station. (EAP-TTLS) Then I will have a second authentication request (called request 2) coming from a Broadband Access Server. This equipement will transform DHCP request into a Radius request. This authentication request will also have in some attributes, the mac addresses of the CPE. Questions Is that possible to configure freeradius to send an authentication success to request 2 only if request 1 has been seen and has been successfully authenticate. (based on the mac address) ? What are the module that could be used (probably sql to be able to keep track of request 1) ? Thanks Thomas

3 4

Update on MS-CHAP Authentication / Bug 17
by Garber, Neal 06 Oct '09

06 Oct '09

Here's some feedback I received (off-list) regarding the patch for bug 17.. I received an E-mail from someone experiencing the userid case sensitivity issue with EAP/MS-CHAPv2 in FR. He applied the patch attached to bug 17 and confirmed that it fixed the problem for him. I too have the patch applied (for about 6 weeks now) to two of our FR servers and haven't seen any issues. Neal -----Original Message----- From: Garber, Neal Sent: Friday, October 02, 2009 1:58 AM To: 'Marco D'Ettorre' Subject: RE: MS-CHAP Authentication / Bug 17 Thank you for sharing your experience Marco. At some point, I'd like to post your information to the FreeRADIUS list as Alan DeKok wanted to see positive feedback from testers before he accepted my patch. Is that Ok? Thanks again for your time and I'm pleased that the patch helped resolve your problem. Neal -----Original Message----- From: Marco D'Ettorre Sent: Thursday, October 01, 2009 4:55 PM To: Garber, Neal Subject: Re: MS-CHAP Authentication / Bug 17 Hi Neal, I applied your patch to 2.1.7. Before writing you I was testing v1.1.8; then I tried 2.1.7 before applying the patch (with the same issue) and finally with your patch. The issue is solved. Now I can logon the workstation with both upper and lower cases, and automatic ms-chap authentication always works. I have not still wrote you an email because I did like to include more details, extract of log files and configurations, but I was too busy with other activities to do. I'll send you some details as soon as possible. Thank you Marco Garber, Neal ha scritto: > > Hi Marco, > > Did you have a chance to apply the patch and test? If I can help, let > me know.. > > Neal > ------------------------------------------------------------------------ > *From:* 'Marco D'Ettorre' > *Sent:* Wednesday, September 23, 2009 5:31 PM > *To:* Garber, Neal > *Subject:* Re: MS-CHAP Authentication / Bug 17 > > Hi Neal, > > I'm having the problem and I'd like to solve it as quick as possible. > > I am a fan of opensource developing (my main interest is testing > OpenLDAP, and I'm also one of the manteiners of italian OpenLDAP ML), > and I'll be very happy to help you if I can. I will post you the > results of my tests (and a description of the environment). > > Thank you > M. > > ----- "Neal Garber" ha scritto: > Absolutely! You can get it from http://bugs.freeradius.org > <http://bugs.freeradius.org/> (then enter 17 for the bug number). > Thanks for your interest. > > Out of curiosity, are you having the problem described in the bug or > are you just a kind soul who wants to help me by testing this? > > Neal > ------------------------------------------------------------------------ > *From:* Marco D'Ettorre> > *Sent:* Wednesday, September 23, 2009 12:31 PM > > *To:* Garber, Neal > > *Subject:* MS-CHAP Authentication / Bug 17 > Hi, > > > > is your patch available for download? > > > > Thanks > > M. > > *Ing. Marco D'Ettorre* > Consultant > *SysNet s.r.l.* > *Gruppo Partners Associates*

2 1

Status server & python example
by John Doppke 06 Oct '09

06 Oct '09

Does anyone have an example of getting stats from freeRadius via status-server using python and pyrad? To me it looks like I'm sending the correct packet, but the server complains about the message authenticator or shared secret. I'm pretty sure I'm calculating it per RFC. An authentication request with the same secret works, so I don't think it's that. Regards, -John Doppke

2 1

implemnting ipv6 with freeradius and juniper ERX
by Ram Akuka 06 Oct '09

06 Oct '09

Hi, I am trying to implement ipv6 on my network using freeradius and juniper ERX as NAS. So I looked for some documentation and found that In order to assign ipv6 address to a user using radius I need 2 attribuets. Framed-IPv6-Prefix and ERX-IPv6-NdRa-Prefix I patched the juniper dictionary as found in Juniper webpage - and added the attributes to a user, now there's 2 problems. 1. Can someone help me with the format of the ERX-IPv6-NdRa-Prefix or where can I read about this? 2. When trying to debug this - I run the daemon radius -Xxx and for some reason I can't see the acess-request process only the accounting. I want to fully understand the process and know exactly what attributes the radius is sending the NAS. How can I do this? Thanks in advance, -- Ram

2 2

Selective Authentication
by Tawanda Kavayi 06 Oct '09

06 Oct '09

Hi, Is it possible to configure FR to forward authentication requests to a different radius server based on username attributes. For example, user(a)domain1.com should authenticate locally, whereas user(a)domain2.com should be forwarded to a different server for authentication. Regards, Tawanda

2 1

None
by David Jones 06 Oct '09

06 Oct '09

Hello, from first time poster. Is there anyone on the list who has an actual working example of two factor authentication coded in perl using rlm_perl they would be willing to share? There are a number of incomplete examples, and a some hints as to errors in them, and I've taken all this on board and as a result can pass the challenge response back to the NAS. What I'm having difficulty with is keeping state, so I can determine if an Authorize request is the first hit (real password) or the second (the second factor). Thanks. Davey Jones.

3 2

Re: RE: Davey Jones
by David Jones 06 Oct '09

06 Oct '09

A product of being called David Jones; I normally get the locker jokes first :)

2 1

Re: Overriding proxy response
by Eric 05 Oct '09

05 Oct '09

Hi All, Any pointers on how to start hacking the source? What I need to do is look for MS-CHAP-Error 648 (which means the password needs to be changed) and then add a different IP address and filter + DNS server information in order for the end-user to be redirected to a webserver. I can't do all of it in rlm_perl because I need to proxy to a windows IAS. Cheers John Morrissey wrote: > I would like to override failed (rejected, timed out) proxy responses with > local authentication data. IOW, if the proxy request fails, I want to > process the request locally. That can't really be done with the current server. You will need to hack the source code to get this done. > It looks like the proxy reply trumps local authorization/authentication, and > I can't find a way to override the proxy's response code. Yes. There is usually ONE source for authentication. Turning a reject into an accept is a *very* unusual practice. > If this was the opposite way (don't proxy for accounts that exist locally), > it seems I could remove Proxy-To-Realm to prevent proxying. > > Is there a way to do the opposite (perform proxying and override the proxy's > response with local auth)? No. Alan DeKok.

4 8

failed to authenticate when using md5 passwords with postgresql
by José Adiel Blandón Rivera 05 Oct '09

05 Oct '09

Hi everyone, I'm looking the manner to configure chillispot connecting to freeradius using postgressql database users. Everything goes good when I use clear passwords in the database but when I tried to use md5 password it don't authenticate :S Has someone configured freeradius in this situation? Sorry for my English I speak Spanish xD regards

2 4

Aruba-User-Vlan, how to configure RADIUS to send the that aruba VSA to the controller
by aangles 05 Oct '09

05 Oct '09

have freeradius 2.1, and the configuration of my users file is like the following: ... DEFAULT Auth-Type = LDAP Aruba-User-Vlan = 20, Fall-Through : = 1 .... once I do radiusd -X, I see only the first access-challenge with the Aruba-User-Vlan Attirbute, and no more access-challenges have this attribute. So, it is not working , May be i am close to the solution but I don't know what to do, and also I don't know what happen. Aruba does not put me in that Vlan ID.Of course RADIUS has its Aruba propietary dictionary included. I don't the steps to get it work successfully. I send to you a capture of wireshark: http://www.nabble.com/file/p25716490/radiusWireshark radiusWireshark Somebody can help me please? Any ideas please? http://www.nabble.com/file/p25716490/radiuswireshark1.jpg http://www.nabble.com/file/p25716490/radiuswireshark2.jpg http://www.nabble.com/file/p25716490/radiuswireshark3.jpg http://www.nabble.com/file/p25716490/radiuswireshark5.jpg Also, see this debug from Aruba controller. Aruba puts the guest in the VLAN 232!!. it is not the VLAN configured in the Radius users file. thanks a lot I hope somebody knows what happen and can help me http://www.nabble.com/file/p25716490/aruba_debug.jpg Thank you -- View this message in context: http://www.nabble.com/Aruba-User-Vlan%2C-how-to-configure-RADIUS-to-send-th… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 9