- Freeradius-Users - lists.freeradius.org

Problems with wifi authentication: [mschap] No Cleartext-Password configured...
by Leonardo Marques 05 Dec '08

05 Dec '08

Hi guys, I'm with problems on my first radius authentication server for wireless clients. I've made some progress, but now I'm with problems that I don't know how to solve. I want to use the NIS user database. Freeradius version: 2.1.1, compiled from source on mandriva 2008.1 (yes, i don't like mandriva, but i have to use it) With radtest, I already can authenticate with users located on /etc/raddb/users/ , /etc/passwd and NIS' users: Example: leonardolocal@lcc56:~$ radtest leonardo lalala 172.16.0.2 0 xpto Sending Access-Request of id 65 to 172.16.0.2 port 1812 User-Name = "leonardo" User-Password = "radius1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=65, length=20 leonardolocal@lcc56:~$ radtest usuario1 lalala 172.16.0.2 0 xpto Sending Access-Request of id 57 to 172.16.0.2 port 1812 User-Name = "usuario1" User-Password = "senha1" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=57, length=20 leonardolocal@lcc56:~$ radtest localradius lalala 172.16.0.2 0 xpto Sending Access-Request of id 135 to 172.16.0.2 port 1812 User-Name = "localradius" User-Password = "radius1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=212, length=20 Until here, everything was ok, the problems begins when I try authenticate through wireless access point: The PEAP doesn't work. And by TTLS/MSCHAPv2 works, but only for users located on the /etc/raddb/users file, and not for NIS' or passwd' users. Error that happens when a I try connect with TTLS/MSCHAPv2 and with user not listed on the /etc/raddb/users file: Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for leonardo with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. I've uploaded the /etc/raddb/radiusd.conf,/ etc/raddb/eap.conf, module /etc/raddb/modules/mschap and also a log from the radiusd -X with a login try which generates the above error and the radiusd startup on the server: http://ivete.fis.unb.br/fradius/ I've found on google a discussion, on this list (http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg48660.…) which a guy had the same error than me, but he was using the ldap database as user's database. And I don't understood what procedures he used to solve his problems. Please, if somebody have some tip, tell me, I don't know what to do anymore :/ Sorry for the poor english. Thanks in advance, -- --------------------------- Leonardo Marques --------------------------- Blog: BeNerd.analyx.org Website: www.analyx.org

2 2

rlm_perl
by Saeed Akhtar 05 Dec '08

05 Dec '08

Hi all, I have problem in rlm_perl module.... I found a documentation which says that rlm_perl is not in default modules of freeradius so you have to add a value "rlm_perl" in src/modules/stable before configuring freeradius. I added that. Now in wiki of freeradius, I read rlm_perl and do what ever he says. But i got an error, as I never found DEFAULT Auth-Type = System.. so I added my own entry of DEFAULT Auth-Type = Perl. But now when I execute it, it gives following error: /usr/local/etc/raddb/users[61]: parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type Error reading /usr/local/etc/raddb/users I just want to install rlm_perl and use it in accounting section, so that I can count its packets in and out.and time usage of user and make my own decisions. Can anyone please help me, I'll be Thankful Regards, Saeed Akhtar

2 1

radius user queries for uid anonymous in ldap
by Sergio Belkin 05 Dec '08

05 Dec '08

Hi, I use freeradius with EAP-TTLS y EAP-PEAP, below there is ldap log, I wonder why radius "bothers" to query for anonymous uid and not only for uid into the tunnel Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 fd=15 ACCEPT from IP=123.45.67.89:56075 (IP=0.0.0.0:636) Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 fd=15 TLS established tls_ssf=256 ssf=256 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 BIND dn="cn=freeradius,ou=applications,dc=cadorna,dc=edu" method=128 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 BIND dn="cn=freeradius,ou=applications,dc=cadorna,dc=edu" mech=SIMPLE ssf=0 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 RESULT tag=97 err=0 text= Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=anonymous)" Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=anonymous)" Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=glinde)" Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=jinfan)" Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 3 08:55:05 sinclair slapd[11285]: conn=1264 fd=15 closed (idletimeout) Does make sense to query for anonymous? Thanks in advance Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4

Re: include_length and EAP-TTLS
by Gong Cheng 05 Dec '08

05 Dec '08

(sorry i still don't know how to reply into a thread from yahoo web mail) Yeah I agree. All the supplicants I used are ok with that. I just thought I might point it out ... Thanks for your reply Alan. Re: include_length and EAP-TTLS ________________________________ * To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> * Subject: Re: include_length and EAP-TTLS * From: Alan DeKok <aland(a)deployingradius.com> * Date: Fri, 05 Dec 2008 07:58:14 +0100 * In-reply-to: <542789.4743.qm(a)web82103.mail.mud.yahoo.com> * References: <542789.4743.qm(a)web82103.mail.mud.yahoo.com> * Reply-to: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> * User-agent: Thunderbird 2.0.0.18 (Macintosh/20081105) ________________________________ Gong Cheng wrote: > I wonder if this is a small violation of the EAP-TTLS RFC (5281). > > In RFC 5281 http://tools.ietf.org/html/rfc5281#section-9.2.2, it states: > > " .... Fragments other than the first MUST NOT have the L > bit set. ... > " > > while this behavior is configurable in eap.conf: ... > I confess that I only actually SEE the behavior in the now ancient 1.1.6 version, and only took a quick look at the 2.1.0 config file and source code. I apologize if I missed something or this had been brought up before. I don't think it's serious. I don't know why this is a MUST NOT, because it makes very little difference to the protocol. And supplicants that break if the L bit is set on second fragments are badly written. Alan DeKok.

1 0

Re: Proxy - wrong IP
by Jørn Kostøl 05 Dec '08

05 Dec '08

I got it working once I upgraded to 2.1.2. Guess something was wrong with my 2.1.1 install. A pity that it's not possible to have more then one proxy listener as this would be very useful. I guess I'll have to nest multiple freeradius installs in the future when I need to proxy to other networks. Cheers, Jørn Greg Woods wrote: >> You can control this. Read radiusd.conf, and look for the >> documentation in the "listen" section. > > What this means in a nutshell is that there is no direct way to tell > freeradius what source IP address to use when proxying(I'll be happy > if I'm proven wrong on that). Perhaps you could try reading what I said? Or, if you're not running 2.x, .... upgrade. > The only way to accomplish this is to force freeradius to listen on > only a single IP address (which I think is what Alan is suggesting). > This will cause freeradius to use that IP as the source for anything > it sends. I have run into this issue on multihomed servers and it's > the only way I found to solve it. This is documented. It works. It does what I said. Alan DeKok.

2 1

include_length and EAP-TTLS
by Gong Cheng 05 Dec '08

05 Dec '08

I wonder if this is a small violation of the EAP-TTLS RFC (5281). In RFC 5281 http://tools.ietf.org/html/rfc5281#section-9.2.2, it states: " .... Fragments other than the first MUST NOT have the L bit set. ... " while this behavior is configurable in eap.conf: " # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes " I understand that it is for EAP-TLS (which does not have this restriction) but I think EAP-TTLS is controlled by the same line. (?) I confess that I only actually SEE the behavior in the now ancient 1.1.6 version, and only took a quick look at the 2.1.0 config file and source code. I apologize if I missed something or this had been brought up before. -gong

2 1

usergroup
by sugiarto tjahyono 05 Dec '08

05 Dec '08

Hi All, I have a few problem. i have freeradius version 1.0.5 running with rlm_sql. radcheck : username, attribute, op, value "test1","password","==","testpass" "test2","password","==","testpass" radreply : none radusergroup : "test1","HS1" "test2","HS2" "test2","HS1" radgroupcheck : groupname, attribute, op, value "HS1","Called-Station-Id","==","device1" "HS2","Called-Station-Id","==","device2" radgroupreply : groupname, attribute, op, value,prio "HS1","Framed-Pool","=","pool1",0 "HS2","Framed-Pool","=","pool2",0 the problem is user test1 and test2 can connect and get pool1 but user test2 can't connect and can't get pool2 i already use Fall-Through = Yes in radreply and radgroupreply, but it still not work. when i use freeradius 2.1.1, that setting is work. Does freeradius 1.0.5 doesn't support multiple group or something wrong with my setting? how many group that can be assigned to one user in freeradius 2.1.1?

1 0

Proxy - wrong IP
by Jørn Kostøl 04 Dec '08

04 Dec '08

Hi, My server has two interfaces, A and B. My NAS is on interface A and I'm proxying to another Radius on interface B. My problem is that FreeRadius is sending packets to the Radius at interface B with the IP of interface A (the listening interface to my NAS). I'm running FreeRadius v2.1.1. I've tried to add another listening interface with the IP from interface B, but no difference (shot in the dark really). How can I force FreeRadius to use another IP for the proxying? Cheers, Jørn

3 3

Re: Beating a dead horse, or freeradius 2.1.1 and active directory
by tnt＠kalik.net 04 Dec '08

04 Dec '08

PS. What is the error that you get when you remove quote around ntlm_auth. For users file entry as is in the howto. Ivan Kalik Kalik Informatika ISP

2 4

windows supplicant
by Craig White 04 Dec '08

04 Dec '08

I've been working on this on/off for 2 weeks now and I'm confused. I found on this Windows laptop I've been playing with that I can't connect via the built-in Windows XP SP3 supplicant but one connection I can make is using the Intel ProSet (it's a 2100) but the only way that I've been able to connect is using TTLS. The Intel Pro-Set suggests that my connection is: Security Mode: WPA Encryption Algorithm: TKIP 802.11 Authentication: Open 802.1x Authentication: TTLS (MS-CHAP) and I note that MS-CHAPv2 doesn't work here So I'm now wondering if the problem is my setup of eap.conf the MS-CHAPv2 I am authenticating RRAS from a Windows server and Macintosh and iPhone clients without issue. Craig

1 0