- Freeradius-Users - lists.freeradius.org

Re: Is it possible to recognize clients not by their IP addresses?
by Sebo PL 28 Nov '08

28 Nov '08

> > > It might be in the future. dynamic-clients virtual server works just with > > Packet-Src-IP-Address now. There are plans to make NAS-Identifier > > available to it as well. You will be able to set different shared > > secrets then. > > I'm waiting for such NAS-ID exactly and hope it might be based on the > SSID of the AP. Or it may be based on Calling-Station-Id I see the MAC address of the AP in this attribute attached to each message send to the radius server.

2 1

Re: Re: Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo 28 Nov '08

28 Nov '08

Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say nothing about RAIUS. I know HLR can handle the Phone authorization for data usage, but that will enable/disable MMSC and EVDO in bundle, lets say I configure the PDSN with the FreeRADIUS for the EVDO, what do you recommend me to authenticate MMSC? Thanks again. > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 26 Nov 2008 08:30:38 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <492CFB1E.8080600(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Aldo Zavala wrote: > >> Hello, I in our network we have two data services: >> 1.- MMSC (Multimedia Message Service Center) >> 2.- EVDO (Evolution-Data Optimized) >> >> I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. >> >> Are there more people who figured out how to make possible this configuration-like? >> > > If those services use RADIUS for authentication, then it's possible. > See their documentation for the list of features that they support. > > Alan DeKok. > >

3 2

PPTP + FreeRadius + LDAP
by Douglas Macedo 28 Nov '08

28 Nov '08

Hey guys, i'm trying configure a VPN Server with PPTP, using the 'radiusclient', to connect on a FreeRadius, with auth in a LDAP Server. I "finished" the configure, but when a try connect with a client Windows XP, don't work. The radiusd -X output: ===== [root@server /usr/local/etc/raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded LDAP ldap: server = "ldap.telemedicina.ufsc.br" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "XXXXXXX" ldap: basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" ldap: filter = "(&(objectClass=posixAccount)(uid=%u))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{Cleartext-Password}" ldap: password_attribute = "sambaNTPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5bc100 Module: Instantiated ldap (ldap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32838, id=28, length=94 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" CHAP-Challenge = 0x5eeda4e624ec08496ead36b7895bb06f1eb3a24801 CHAP-Password = 0xe41a875f6823b9777d806817d4d3a3121d NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 198 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nobody radius_xlat: '(&(objectClass=posixAccount)(uid=nobody))' radius_xlat: 'ou=Users,dc=telemedicina,dc=ufsc,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.telemedicina.ufsc.br:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=telemedicina,dc=ufsc,dc=br/XXXXX to ldap.telemedicina.ufsc.br:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Users,dc=telemedicina,dc=ufsc,dc=br, with filter (&(objectClass=posixAccount)(uid=nobody)) rlm_ldap: Password header not found in password 5A88C11C0EDC83D3DEA6AE1A0653E889 for user nobody rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNtPassword as NT-Password, value 5A88C11C0EDC83D3DEA6AE1A0653E889 & op=21 rlm_ldap: Adding sambaLmPassword as LM-Password, value 89E0B38AC380D2B8AAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "nobody" with CHAP password rlm_chap: Could not find clear text password for user nobody modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. *Login incorrect (rlm_chap: Clear text password not available): *[nobody] (from client access-vpn port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 150.162.67.254 port 32838 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 28 with timestamp 492d66b7 Nothing to do. Sleeping until we see a request. ==== The result of 'radtest': epiderme:/etc/ppp# radtest nobody XXXXX ldap.telemedicina.ufsc.br:1812 1 XXXXXX Sending Access-Request of id 241 to 150.162.67.5 port 1812 User-Name = "nobody" User-Password = "0101" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Accept packet from host 150.162.67.5:1812, id=241, length=20 == Please, anyone can help me? Thanks in advanced. Douglas

4 17

Is it possible to recognize clients not by their IP addresses?
by Sebo PL 27 Nov '08

27 Nov '08

Hi!! The format of ${raddbdir} /clients.conf defines NAS by its IP pool. And what if I'd like to have a pool of NASes each using unique secret but not to specyfy their IP or domain names to the freeradius config files? Is it possible to do so? When I was trying to create 2 client sections for same IP pool but diferent secrets only the second was working. #clients.conf client 0.0.0.0/0{ secret = test1 shortname = public1 } client 0.0.0.0/0{ secret = test2 shortname = public2 } And with such configuration sending requests with 'secret = test1' always fails :(

2 2

How to test whether EAP-PEAP works?
by Sebo PL 27 Nov '08

27 Nov '08

Hi all! Is it possible to test whether EAP works from the shell? I'm looking for something simullar to: $ radtest And the only thing I found is this: http://wiki.eduroam.cz/rad_eap_test/ But I'm confused about this script cause I just can't see any 'chalange' or etc in # freeradius -X when $ rad_eap_test I use freeradius-1.1.7@Debian. Here is the output of: # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "before" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/peap/radsrv.key" tls: certificate_file = "/etc/freeradius/peap/radsrv.pem" tls: CA_file = "/etc/freeradius/peap/root.crt" tls: private_key_password = "99e7c2a6d917239f32ebf9cbffebb062" tls: dh_file = "/etc/freeradius/peap/dh" tls: random_file = "/etc/freeradius/peap/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1089, id=0, length=123 User-Name = "sebopl" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x0200000b017365626f706c Message-Authenticator = 0xc1f9054dc966ca6d78baa2e7ac480605 rad_lowerpair: User-Name now 'sebopl' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "sebopl", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry sebopl at line 89 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 127.0.0.1 port 1089 Reply-Message = "Welcome %u :)" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 492e9f4f Nothing to do. Sleeping until we see a request. And here is: $ rad_eap_test -H localhost -P 1812 -S test1 -u sebopl -p password -m WPA-EAP -c -e PEAP access-reject; 2 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=123 Attribute 1 (User-Name) length=8 Value: 'sebopl' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '70-6F-6C-69-73-68' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=27 Value: 'rad_eap_test + eapol_test' Attribute 79 (EAP-Message) length=13 Value: 02 00 00 0b 01 73 65 62 6f 70 6c Attribute 80 (Message-Authenticator) length=18 Value: c1 f9 05 4d c9 66 ca 6d 78 ba a2 e7 ac 48 06 05 Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=0 length=35

3 2

new to radius: wireless ap with radius: TLS problem ?
by Jerome Blomart 27 Nov '08

27 Nov '08

Hello, i am new to freeraidus. Have set up a radius server for a linksys ap. - debian server: compiled a freeradius with eap/tls support - mysql db: - tried "dialupadmin" and "phpMyprepaid": but those had problems in their "sql" scripts ( default values for timestamp and smallint ). - corrected sql scripts and created database - as i have applied the scripts from multiple sources on the same db, the tables structures are a bit special comparing to tutorials stuff - access point ( linksys ): - configured : - RADIUS server name ( ip address given ) - RADIUS port - shared pass phrase ( NAS sghared secret given -- configured in mysql's radius.nas table ) - generated four keys ( to complie with the linksys's dialogs ) Now : As i try Wireless clients connections : - the client connects to the wireless network, and tries to get an ip address....but no...after retries it disconnects to the network What is happenning: - in the freeradius's outpput i ca

2 1

SOS FreeRADIUS
by ELOM ETSE 27 Nov '08

27 Nov '08

I'm a user of daloRADIUS. I set up successfuly coovaAp for redirection. Now i want to configure FreeRADIUS for authentification. Here are some settings: Server FreeRADIUS: Bind address: * Port: 0. Must i use Listen options and add the real address? that is 192.168.1.14? What about clients.conf file? Must i add also the NAS address or set it on 127.0.0.1? I ask these questions because of the fact that radtest didn't match with these settings! I need your help because i'm just a beginner! ________________________________ ETSE Elom, Etudiant en fin de formation en informatique au CIC/UL-TOGO ________________________________

4 3

EAP-SIM
by Fernando 27 Nov '08

27 Nov '08

Hi all, I'm trying to configurate a basic scenario form EAP-SIM using wpa_supplicant like client, hostapd like access point and freeradius like AAA server. So, I don't know how to configure EAP-SIM in freeradius as default EAP method. Could somebody provide me with a configuration for freeradius? Thanks, Fernando.

2 3

My error:
by Martin Silvero 27 Nov '08

27 Nov '08

Hello! but this log are of Radius, you tell me a problem is in the supplicant? but I try with many supplicant and I have the same error. Ever had a case like this? because I come with this problem long ago and do not get results despite dealing with various forms and follow the documentation. thanks again.

1 0

attr_filter issue
by Mustapha Bouikhif 27 Nov '08

27 Nov '08

Hi Folk, I have activated attr_filter for a realm (dr4.cnrs.fr) and want users from that realm to have 2 possible values of VLANs (VISITEUR or SIRC) Here is my attr_file: dr4.cnrs.fr Service-Type == Login-User, Framed-IP-Address == 255.255.255.254, Framed-MTU >= 576, Proxy-State =* ANY, Reply-Message =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2, Proxy-State =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, User-Name =* ANY, Called-Station-Id =* ANY, Calling-Station-Id =* ANY, NAS-Port-Type =* ANY, NAS-Port =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, Framed-Filter-ID =* ANY, Tunnel-Type == VLAN, # Tunnel-Type =* ANY, Tunnel-Medium-Type == IEEE-802, # Tunnel-Medium-Type =* ANY, Trapeze-VLAN-Name == VISITEUR, Trapeze-VLAN-Name == SIRC, # Trapeze-VLAN-Name =* ANY, Tunnel-Private-Group-Id == VISITEUR, Tunnel-Private-Group-Id == SIRC # Tunnel-Private-Group-Id =* ANY When i test the connexion with my account (my attribute Tunnel-Private-Group-Id = Trapeze-VLAN-Name = VISITEUR), the authentification is OK but radius server do not send this attribute to the NAS: they are filtered and they should not. When I set those attributes to * ANY, every thing works well. I don't understand this behaviour. Thanks for any ideas/help -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

3 5