- Freeradius-Users - lists.freeradius.org

EAP-SIM
by Fernando 27 Nov '08

27 Nov '08

Hi all, I'm trying to configurate a basic scenario form EAP-SIM using wpa_supplicant like client, hostapd like access point and freeradius like AAA server. So, I don't know how to configure EAP-SIM in freeradius as default EAP method. Could somebody provide me with a configuration for freeradius? Thanks, Fernando.

2 3

My error:
by Martin Silvero 27 Nov '08

27 Nov '08

Hello! but this log are of Radius, you tell me a problem is in the supplicant? but I try with many supplicant and I have the same error. Ever had a case like this? because I come with this problem long ago and do not get results despite dealing with various forms and follow the documentation. thanks again.

1 0

attr_filter issue
by Mustapha Bouikhif 27 Nov '08

27 Nov '08

Hi Folk, I have activated attr_filter for a realm (dr4.cnrs.fr) and want users from that realm to have 2 possible values of VLANs (VISITEUR or SIRC) Here is my attr_file: dr4.cnrs.fr Service-Type == Login-User, Framed-IP-Address == 255.255.255.254, Framed-MTU >= 576, Proxy-State =* ANY, Reply-Message =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2, Proxy-State =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, User-Name =* ANY, Called-Station-Id =* ANY, Calling-Station-Id =* ANY, NAS-Port-Type =* ANY, NAS-Port =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, Framed-Filter-ID =* ANY, Tunnel-Type == VLAN, # Tunnel-Type =* ANY, Tunnel-Medium-Type == IEEE-802, # Tunnel-Medium-Type =* ANY, Trapeze-VLAN-Name == VISITEUR, Trapeze-VLAN-Name == SIRC, # Trapeze-VLAN-Name =* ANY, Tunnel-Private-Group-Id == VISITEUR, Tunnel-Private-Group-Id == SIRC # Tunnel-Private-Group-Id =* ANY When i test the connexion with my account (my attribute Tunnel-Private-Group-Id = Trapeze-VLAN-Name = VISITEUR), the authentification is OK but radius server do not send this attribute to the NAS: they are filtered and they should not. When I set those attributes to * ANY, every thing works well. I don't understand this behaviour. Thanks for any ideas/help -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

3 5

Somewhat OT: Mac OS self asigned IP issues
by Sergio Belkin 27 Nov '08

27 Nov '08

Hi, I am using OpenWRT Kamikaze and sometimes there is a problem with Mac OS clients. Clients get Access-Accept, but Mac OS says that only gets a self asigned IP and then it can't surf the web. Problem happens using either TTLS or PAP. It is a problem of Mac OS or a OpenWRT one? I'd be glad to read suggestions and comments... Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 2

combining LDAP and SQL
by mj mailing lists user 27 Nov '08

27 Nov '08

Hi, I've got a working (my)sql freeradius2.1 configuration where users are put in groups (usergroup). I added an 'IP' column to radgroupcheck table so that I can force radius clients into some groups (via %{Client-IP-Address} ) . This allows me to say who can connect from where (WiFi, Dialup, StudentRooms,...) and have users in multiple groups Up to now all my users are stored in the db. I'm now asked to integrate a new LDAP server into the equation. Not all users will be put in LDAP (guest users, conference groups will stay in the DB). So there still be users in the DB. All LDAP users have to be granted WiFi access. Other access are DB dependent (dialup,StudentRooms,...) I've tried to add both ldap and sql authorization but I've got trouble limiting LDAP users. This is how it should work: a: if LDAP OK and client is in "WiFi" accept b: if LDAP OK and user in usergroup for the right group (%{Client-IP-Address} dependent) accept c: if LDAP !OK do the classic sql processing. If I understand well the usual sql process is as follows: 1. check user in radcheck 2. if found check user in usergroup 3. if found check radgroupcheck But if LDAP knows the user I've got to add 'WiFi' group to the result of the usergroup query and skip the radcheck query Do you see a way through this? Thanks for reading me. Michel

1 0

Methods not supported by freeradius source code
by Fernando 27 Nov '08

27 Nov '08

Hi all, after configure EAP2 module and test it with EAP-MD5 (it works properly) I want use the EAP-PSK and/or EAP-GPSK . But if I add in eap2 module ... eap2 { psk { } } When I run radiusd... it fails showing that "psk is unknown", how can these not native freeradius methods provided by libeap.so (hostap) be used? Thanks.

1 1

Freeradius error: "Discarding conflicting packet"
by jelle-e 27 Nov '08

27 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21

MAC based auth
by Hegedus Gabor 26 Nov '08

26 Nov '08

Hi, read manuals but i don't know how can i use mac based authentication. I used eap-tls and username/pass. It worked good. but when I not log on to the Windows server, I want to authenticate the computer, cos my server services have to reachable. pc try authenticate using name like host/PCNAME but i don't know what is a password... I think if i use mac address based auth., i don't need username/pass, simply enough a mac address. or is it a wrong idea? how can i set it to use just mac addresses to authentication?I want authenticate the hardware not the user(cos the user is not logged on). configuration: newest freeRadius, cisco switch, win xp thanks GH

8 20

Configuration sample of a PDSN - FreeRADIUS - MySQL enviroment...
by Aldo 26 Nov '08

26 Nov '08

Hello, does somebody can please provide some FreeRADIUS configuration sample of an environment like mine? Which is: -Wireless Telephony provider that offer EVDO for subscribers (CDMA) -PDSN -FreeRADIUS -MySQL (or Postgres) Thanks in advance to all Aldo

1 0

LDAP group checking
by Paul Bartell 26 Nov '08

26 Nov '08

Im having a hard time figuring out how to do group checking with freeradius. I am trying to authenticate against open directory, but I have no idea where to give the group name to check for. (modifying the schema isint really an option)

1 0