- Freeradius-Users - lists.freeradius.org

Problem receiving requests
by Fernando 25 Feb '09

25 Feb '09

Hi all, I'm trying to comunicate Freeradius with an external entity (A). Freeradius sends some information to A, which is processed by A, and A requires contact Freeradius to obtain some attributes from a certain user. --------------------- ------------------------------------- | Freeradius | | External ENTITY A | ----------------------- -------------------------------------- Application specific request(TCP socket) ------------------------------------------------------------------------> processing time RADIUS (Access-Request) XX <----------------------------------------------------------------------- (A needs information) RADIUS (Access-Accept) -------------------------------------------------------------------------> getting attribute data Application specific response (TCP socket) <----------------------------------------------------------------------- XX ----> This request fails, not is processed by Freeradius. The message arrives to Freeradius' network interface but we can not see any debug message informing that the message is processed. Thank you very much, Fernando.

2 3

Re: Problem with configuring freeradius for WPA with LDAP having MD5 paswords
by sankalpk 25 Feb '09

25 Feb '09

Hi Ivan, Thanks a lot for the guidance. I rectified the problem. The debug mode shows that it is receiving the request from the WAN IP of the IP (192.168.104.xxx) , while the NAS-IP appeared to be the its LAN IP (192.168.1.xxx). As a result, Radius Server was trying to send the Access-Challenge to the LAN IP of the Access Point, which was not reachable, hence the problem. However, I stuck up at a later stage. The authentication is happening when the users are defined in the "users" file. Then I conencted the Radius Server to LDAP, which is working only if the "UserPassword" in LDAP is stored in plain-text. But my LDAP server contains all the paswords in md5 encypted format. I could not get a solution for authenticating users when their paswords are stored in MD5. I tried to generate MD5 password from the client machine (which is a windows XP) using a small script in C#, but the MD5 generated passwords from C# differ from those in LDAP ( quite strange !!!) When I supply the MD5 encrypted password (if passwords are encrypted using slappasswd in LDAP server) from the Windows XP client, it works fine. Can somebody help me in getting users authenticated with LDAP if the passwords are in MD5?? I went through a document in the Internet that says EAP does not support MD5 hashes, only EAP-GTC and PAP does. Can someone suggest a solution for getting users authenticated through AP whith their passwords stored in MD5?? Thanks and Regards, SaN >>I've been trying to autheticate a Wireless Acess Point through a Radius >>Server for last 1 month, but things doesn't seem to be working for me. >>The Radius Server is authenticating when I test it with the radtest >>command. It also worked for a Cisco 2950 switch. But no luck when I use >>the Access Point. I have tried 3 different accesspoints, including >>Linksys, D-Link and the Firepro, but none of them worked. >> >>I do not get any error when I check the radius in debug mode. It says >>"Sending Access-Challange to ....", but the client doesn't get >>authenticated. I seriously need help on this. >> >>1. Do I really need certificates for authentication? >> >> > >Yes. That conversation is EAP-TLS. *You* have selected that >authentication method when you were creating the connection. > > > >>Is there a way to >>achieve WPA with UserName and Password, without installing certificates? >> >> > >Yes. You can do PEAP with usernames and passwords. You might need to >install CA certificate if you are signing your own. > > > >>2. Should the AP send "User-Password" attribute to the Radius Server? >> >> > >No. > > > >>Or >>should the Radius Server send an Access-Challange to the AP, and AP does >>matching and all. >> >> > >AP does nothing. It jast passes the challenge to the users machine. > >Ivan Kalik >Kalik Informatika ISP > > > DISCLAIMER: This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may containconfidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email or any action taken in reliance on this e-mail is strictly prohibited and may be unlawful. The recipient acknowledges that Tulip Telecom Limited is unable to exercise control or ensure or guarantee the integrity of/overthe contents of the information contained in e-mail transmissions and further acknowledges that any views expressed in this message are those of the individual sender and no binding nature of the message shall be implied or assumed unless the sender does so expressly with due authority of Tulip Telecom Limited. Before opening any attachments please check them for viruses! and defects.

2 1

does peap/mschap-v2 must use with ldap?
by 张̍ 25 Feb '09

25 Feb '09

I configured my freeradius 1.1.7 + oracle + cisco 3750 switch to do 802.1x authentication for wired client. I configured it with EAP/MD5 method and it works well. Now I want to use peap/mschap-v2 method,but I didn't configure LDAP in radiusd.conf,and when the server start it report some error.Below are the details: radiusd.conf: authorize { preprocess mschap sql eap } authenticate { Auth-Type MS-CHAP { mschap } eap } eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } The debug message of radiusd -X: rad_recv: Access-Request packet from host 10.0.99.1:1645, id=141, length=252 NAS-IP-Address = 10.0.99.1 NAS-Port = 50441 Cisco-NAS-Port = "FastEthernet4/0/41" NAS-Port-Type = Ethernet User-Name = "testuser" Called-Station-Id = "00-19-2F-E1-C0-AD" Calling-Station-Id = "00-10-C6-A8-DA-00" Service-Type = Framed-User Framed-MTU = 1500 State = 0xb9868a780c968e9716093b01742690ee EAP-Message = 0x0206005a1900170301004f4ea0464ecb62296c3fe83ddbe7cb46cfc87deccd3b5d7786299443f17d173f52209f2eefb5497f3153bdd751357d7b5beb55afb0d7e60d775792b375564444f5f30c0ad8cae5c74b398405d8cc4b63 Message-Authenticator = 0x3ced719a5b1cfdb5e3e3c49fa411e309 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 90 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '00-10-C6-A8-DA-00' or mac is null) ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572 PEAP: Setting User-Name to testuser PEAP: Adding old state with 64 0b PEAP: Sending tunneled request EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x640b188d31bc5ddc785afe862ca9225f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '' or mac is null) ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): User testuser not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User testuser not found in radgroupcheck rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0) ...... and ...... modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client bg3750 port 50441 cli 00-10-C6-A8-DA-00) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Does it because I'm not configure LDAP? Does PEAP/MSCHAP-V2 must use with LDAP? In my database I have already add the "testuser User-Password := test123" in radcheck table but it doesn't work. _________________________________________________________________ 讲述中国特色文化，体验不同的节日习俗，快来微软春节搜索！ http://chunjie.live.com/?form=PANER01

3 2

SMF manifest to run freeradius in solaris 10
by Thomas Noppe 25 Feb '09

25 Feb '09

Has anyone got such a manifest for solaris 10? Kind regards Thomas --------------------------------------------------------------------------------------------- Thomas Noppe Dienst Informatiesystemen - S&O thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> +32 16 34 79 87 +32 16 34 78 01 UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | www.uzleuven.be<http://www.uzleuven.be>

2 3

Why is groupname field blank in radacct
by ngwarai zed 25 Feb '09

25 Feb '09

I installed freeradius and have noticed that all while other fields are filled in on the radacct table some are not. Of particular importance to me is the groupname field. I need this field because I need to know which group the customer is from so that I charge them accordingly. A person may belong to more than one group and we need a particular group the person used to log into the system. How can we cause the groupname to be written to the radacct table? Thank you.

2 1

RE: Freeradius-Users Digest, Vol 46, Issue 96
by Shimon Weinreich 25 Feb '09

25 Feb '09

Tnx Ivan, I'll upgrade it. ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה -----Original Message----- From: freeradius-users-bounces+shimon=openu.ac.il(a)lists.freeradius.org [mailto:freeradius-users-bounces+shimon=openu.ac.il@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 11:45 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 46, Issue 96 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. SMF manifest to run freeradius in solaris 10 (Thomas Noppe) 2. Re: does peap/mschap-v2 must use with ldap? (Nicolas Goutte) 3. RE: auth: Failed to validate the user - NEED SOME HELP ! (tnt(a)kalik.net) 4. RE: SMF manifest to run freeradius in solaris 10 (Mats Blomgren B) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Feb 2009 10:09:45 +0100 From: Thomas Noppe <thomas.noppe(a)uz.kuleuven.ac.be> Subject: SMF manifest to run freeradius in solaris 10 To: freeradius <freeradius-users(a)lists.freeradius.org> Message-ID: <B44A93F24BD174408E495C668C3E3E763945333E06(a)EX2007-MBX-1.uz.kuleuven.ac.be> Content-Type: text/plain; charset="us-ascii" Has anyone got such a manifest for solaris 10? Kind regards Thomas --------------------------------------------------------------------------------------------- Thomas Noppe Dienst Informatiesystemen - S&O thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> +32 16 34 79 87 +32 16 34 78 01 UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | www.uzleuven.be<http://www.uzleuven.be>

1 0

RE: Welcome to the "Freeradius-Users" mailing list
by Maitreyi Sharma 25 Feb '09

25 Feb '09

Hi I am facing strange issue while running radtest from remote IP and radiusd running on other IP but on the same network. My Radius server is not listening to any other client except localhost. I've added all clients entries in clients.conf file. What could be the issue? Pls advise. -Thanks Maitreyi -----Original Message----- From: freeradius-users-bounces+maitreyi.sharma=hcl.in(a)lists.freeradius.org [mailto:freeradius-users-bounces+maitreyi.sharma=hcl.in@lists.freeradius .org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 1:21 PM To: Maitreyi Sharma Subject: Welcome to the "Freeradius-Users" mailing list Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! To post to this list, send your email to: freeradius-users(a)lists.freeradius.org General information about the mailing list is at: http://lists.freeradius.org/mailman/listinfo/freeradius-users If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: http://lists.freeradius.org/mailman/options/freeradius-users/maitreyi.sh arma%40hcl.in You can also make such adjustments via email by sending a message to: Freeradius-Users-request(a)lists.freeradius.org with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: suhaanee Normally, Mailman will remind you of your lists.freeradius.org mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you. DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

2 1

RE: Freeradius-Users Digest, Vol 46, Issue 94
by Shimon Weinreich 25 Feb '09

25 Feb '09

Hey Tim, Tnx for the quick answer. In the meantime I figured out my problem. In 'users' file I commented out: ----- # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # #DEFAULT Auth-Type = System # Fall-Through = 1 ----- Which 'tells' Radius to authenticate with /etc/passwd. Now localcheck works fine. I have another problem. I enter a client with a secret in clients.conf file: ---- Client 192.168.10.10 { secret = XXXXXXXX shortname = Test } But while testing from Client 192.168.10.10 - I got: --- rad_recv: Access-Request packet from host: 192.168.10.10:45931, id=56, length=53 Ignoring request from unknown client 192.168.10.10:45931 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. ------------ Any hint?? ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה -----Original Message----- From: freeradius-users-bounces+shimon=openu.ac.il(a)lists.freeradius.org [mailto:freeradius-users-bounces+shimon=openu.ac.il@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 8:45 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 46, Issue 94 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. auth: Failed to validate the user - NEED SOME HELP ! (Shimon Weinreich) 2. RE: auth: Failed to validate the user - NEED SOME HELP ! (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Feb 2009 08:35:38 +0200 From: "Shimon Weinreich" <shimon(a)openu.ac.il> Subject: auth: Failed to validate the user - NEED SOME HELP ! To: <freeradius-users(a)lists.freeradius.org> Message-ID: <A8DAF37AB05CA74C938F57DD1909576614360D(a)AMNON.openu.local> Content-Type: text/plain; charset="windows-1255" Hello, My name is Shimon from the Open Univ. of Israel. I installed freeradius and I want the Users to authenticate with /etc/raddb/users file NOT /etc/passwd file. Below is a printout of /usr/sbin/radius ?X ?y ---------------------- rad_recv: Access-Request packet from host 127.0.0.1:54057, id=172, length=59 User-Name = "monitor" User-Password = "XXXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "monitor", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry monitor at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1 port 54057 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 49a4e630 Nothing to do. Sleeping until we see a request. ----------------------------------------------------- Can someone help me with defining radius NOT to authenticate with /etc/passwd But with /etc/raddb/users file. Tnx, ------- ?????, ????? ???????? ??????????? ??????

2 1

auth: Failed to validate the user - NEED SOME HELP !
by Shimon Weinreich 25 Feb '09

25 Feb '09

Hello, My name is Shimon from the Open Univ. of Israel. I installed freeradius and I want the Users to authenticate with /etc/raddb/users file NOT /etc/passwd file. Below is a printout of /usr/sbin/radius –X –y ---------------------- rad_recv: Access-Request packet from host 127.0.0.1:54057, id=172, length=59 User-Name = "monitor" User-Password = "XXXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "monitor", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry monitor at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1 port 54057 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 49a4e630 Nothing to do. Sleeping until we see a request. ----------------------------------------------------- Can someone help me with defining radius NOT to authenticate with /etc/passwd But with /etc/raddb/users file. Tnx, ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה

3 2

auth type as check item in users file
by Luke 24 Feb '09

24 Feb '09

Hi, I'm trying to figure out how to check to see if the auth type is mschap in the users file. I can find tons of help on setting the Auth-Type, but not a lot on how to compare it. Additional background info: I'm running 802.1x with two auth types, certificate based and mschap. I have a default (meaning, no other checks performed) users entry to assign anyone who authenticates but doesn't match a group entry further up the file into a specific vlan. However, if I'm going to add in certificate based authentication, these will also hit that default setting, and I don't want it to... I want the certificate based authenticators to not have a vlan assigned to them by 802.1x.

2 1