- Freeradius-Users - lists.freeradius.org

ntlm_authentication for multiple supplicants
by splintered thoughts 23 Jul '08

23 Jul '08

Hello, I've trying to get ntlm_auth to authenticate several supplicants using freeradius 1.1.6, specifically with MacOS and Windows XP SP3, and I've attempting to inspect the contents of variables while doing the ntlm_auth authentication. My ntlm_auth command is: ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-%{mschap:User-Name}}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} Is there a way to use regular expressions or otherwise to inspect the Stripped-User-Name to adjust which radius attribute is used in the ntlm_auth command, in other words look for a value Stripped-User-Name =~ /^value(.*)$/ and then use, for instance, the %{mschap:User-Name}in its place to authenticate? Is there a better approach? Thanks, John

2 1

User-Profile per user per NAS via LDAP?
by Stephen Bowman 23 Jul '08

23 Jul '08

Running version 2.0.5, with LDAP backend for authentication/authorization. Needed functionality: A single user account needs a different ldap/radius profile depending on which huntgroup the request is coming in on... the reason is that each user has a different Framed-IP-Address for each VPN concentrator they are coming in on. So each user needs a profile per NAS, I believe. I have separated out each NAS into its appropriate huntgroup, and am matching on that in the users file. Also trying to dynamically set the User-Profile. DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net` Fall-Through = no (entire users file at the end of this message). The user is authenticated successfully (so the group matching and the %{Huntgroup-Name} expansion are working fine), but the User-Profile is not being set. If I hard code in the value for uid, it works, so the problem is in the variable. radiusd -X output: rad_recv: Access-Request packet from host 192.168.17.1 port 57383, id=124, length=121 User-Name = "sbowman" User-Password = "XXX" Acct-Session-Id = "NS-00000035" NAS-IP-Address = 192.168.17.1 NAS-Port = 24824 NAS-Port-Type = Virtual Called-Station-Id = "75.145.224.194" Calling-Station-Id = "140.32.244.99" Netscreen-Attr-10 = 0x00000003 +- entering group authorize expand: %{Packet-Src-IP-Address} -> 192.168.17.1 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "sbowman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: Entering ldap_groupcmp() expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.domain.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt rlm_ldap: starting TLS request done: ld 0x84e1340 msgid 1 rlm_ldap: bind as uid=redpillradius,ou=Clients,dc=domain,dc=net/XXX to ldap.domain.net:389 rlm_ldap: waiting for bind result ... request done: ld 0x84e1340 msgid 2 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman) request done: ld 0x84e1340 msgid 3 rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (&(cn=disabled)(|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet)))) request done: ld 0x84e1340 msgid 4 rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group disabled not found or user is not a member. expand: cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=domain,dc=net -> cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net rlm_ldap: Entering ldap_groupcmp() expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))) request done: ld 0x84e1340 msgid 5 rlm_ldap::ldap_groupcmp: User found in group cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 209 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for sbowman WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman) expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman) request done: ld 0x84e1340 msgid 6 rlm_ldap: performing search in uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=domain,dc=net, with filter (objectclass=radiusprofile) request done: ld 0x84e1340 msgid 7 rlm_ldap: object not found or got ambiguous search result rlm_ldap: default_profile/user-profile search failed rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = LDAP rlm_ldap: user sbowman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "sbowman" with password "XXX" rlm_ldap: user DN: uid=sbowman,ou=People,dc=domain,dc=net rlm_ldap: (re)connect to ldap.domain.net:389, authentication 1 rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt rlm_ldap: starting TLS request done: ld 0x8572fe0 msgid 1 rlm_ldap: bind as uid=sbowman,ou=People,dc=domain,dc=net/XXX to ldap.domain.net:389 rlm_ldap: waiting for bind result ... request done: ld 0x8572fe0 msgid 2 rlm_ldap: Bind was successful rlm_ldap: user sbowman authenticated succesfully ++[ldap] returns ok Login OK: [sbowman] (from client jup-rtr-xauth port 24824 cli 140.32.244.99) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 124 to 192.168.17.1 port 57383 Finished request 1. ------ users ----- DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == jup-rtr-xauth, Auth-Type := Reject Reply-Message = "Not authorized for XAuth access. Please call the helpdesk.", Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." -----------------

2 1

Re: Freeradius 2.0.5 - configure to use mysql radacct table instead of file
by Vidar Hatlemark 23 Jul '08

23 Jul '08

2 1

Cannot login with freeradius 2.0.5
by Asep Samsul 23 Jul '08

23 Jul '08

Hi, I'm using freeradius 1.1.7 , and now i want to try for the other machine to 2.0.5. I'm sure about configuration, : - Using Opensuse 10.2 - Using mysql and freeradius 2.0.5 - NAS from VPN Mikrotik Please help me,.... a'm using default configuration from installer. +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "asul", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry DEFAULT at line 175 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for asul with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> asul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 17 to 202.159.24.1 port 1025 Finished request 3. Going to the next request

3 4

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 22 Jul '08

22 Jul '08

log: http://tinypaste.com/5b99b I am wondering something: some more questions: as i encounterd problem with included script for certificate files (bootstarp!! am i the one?), i created my own certificate... as I could! the fact is that running bootstrap, client certificate is on error cause it says that server certificate is not valid or not allowed to sign other certificate files... i created and imported my own on XP for the test: the one DER format of the CA, and the other one p12 format with EKU(of the client). it means, only two! so my question is, if the certificate (with server extension) is missing on the client, could it interfer in EAP-PEAP authentication success? thank you ----- Message d'origine ---- De : Reveal MAP <revealmapp(a)yahoo.fr> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mardi, 22 Juillet 2008, 12h02mn 26s Objet : Re : Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Hello Alan (and all the others too) I am sory about the delay! here is the entire log: http://tinypaste.com/5b99b EAP PEAP still don't work without giving an error message understandable by me! hope it will be clearer for you! I precise: NTLM_AUTH authenticate successfully against AD, same with winbind. and EAP-TLS runs Ok thank you ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 19h05mn 33s Objet : Re: Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: >> "f you want to authenticate PEAP users via SQL (which you seem >> to be saying), then don't configure the mschap module to use ntlm_auth." > > my mistake: i didn't know... Huh? You are aware that AD is not the same as SQL? > back to Users based on AD. >... > in etc/raddb/module/mschap, i have this for ntlm_auth: ... And then nothing for "radiusd -X". If you can't follow repeated instructions, I think it's impossible for me to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Freeradius 2.0.5 - configure to use mysql radacct table instead of file
by Vidar Hatlemark 22 Jul '08

22 Jul '08

Hi After a long week of reading every config file, how-to's (old, outdated, new, faulty and what not) and reading this mailing list archive and tried many test installs of freeradius I now ask for some help. Short version: How to configure freeradius to populate the radacct mysql table. (need help) And based on the info in the table, make a php page to list online user with the ability to kick them off. (will be able to do this by my self, if radacct table is the right place to do this) Am I supposed to send extra parameters to the server when logging in to get it to populate this table? Long version: My system is Slackware 12.1 Kernel 2.6.24.5 mysql 5.0.51b php 5.2.5 Apache 2.2.8 And FreeRadius 2.0.5 from tar.gz source. What I've done so far: Extracted and doing the configure, make, make install. mysql -uroot -p CREATE DATABASE radius; GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "radpass"; exit But in 2.0.5 I can't find the next two steps, cd /usr/share/doc/packages/freeradius/doc/examples/ mysql -uroot -p radius < mysql.sql In fact I can't find either the mysql.sql or the db_mysql.sql stated in the schema.sql header. So I imported the schema.sql from /usr/local/etc/raddb/sql/mysql/ folder. This gives me the radius tables that I need so far I guess. (or is this wrong?) Next up was sql.conf, added mysql credentials. Followed by editing the /usr/local/etc/raddb/sites-available/default, adding sql to the authorize and accounting. And added my pfSense to the client list aswell as my client pc (for NRradPing tool test). client 192.168.1.1 { secret = testing123 nastype = other } client 192.168.1.11 { secret = testing123 nastype = other } Then manually added a user to the radcheck table. id= 1 UserName= testuser Attribute= Cleartext-Password Value= testpasswd Op= := Testing this from pfSense' captive portal with radius support works. (And the NTradPing tool from my client pc) I'm also able to kick out the user from pfSense captive portal status page. And now to my problems/questions. I'm building this into a small webtool for admin the users (daloRadius only gave me plenty of sql errors and since I'm able to write my own in php I will). So far, adding the users to the radcheck table is easy. What's not - is understanding how the radacct table gets populated. All I get is new entries in the /usr/local/var/log/radius/radacct/192.168.1.1/auth-detail-yyymmdd As shown here : Tue Jul 22 14:06:55 2008 Packet-Type = Access-Request NAS-IP-Address = 88.88.54.181 NAS-Identifier = "router.local.lan" User-Name = "testuser" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.1.11 Called-Station-Id = "00:0d:9d:xx:xx:xx" (masked out to hide the mac) Calling-Station-Id = "00:50:8d:xx:xx:xx" (masked out to hide the mac) How do I redirect this (and more info) to populate the radacct table? (See the short version question on top of this post) Thank you for reading this long post. Feel free to ask any question about my setup, sorry if I've not included enough already. Kind regards

2 1

EAP-SIM authentication / Supplicant
by Geoffroy Arnoud 22 Jul '08

22 Jul '08

Hi all, I try to use FreeRADIUS to authenticate a wireless device using EAP-SIM. Currently, my SIM card can be authenticated using a Cisco supplicant (eap-sim-draft-v5) with a Cisco Access Registrar RADIUS server (eap-sim-draft-v5) that gets SIM triplets from an ITP and a HLR simulator. I extracted the triplets from the HLR and injected them into FreeRADIUS rlm_sim_files module. I use another laptop, with centrino chipset with Intel EAP-SIM supplicant. The FreeRADIUS server receives the EAP message and sends back a Challenge. The supplicant answers to the challenge. FreeRADIUS then sends back the same challenge. The supplicant stops I would like to know whether someone uses EAP-SIM, and which supplicant is used. Regading RFC compliancy, I assume that FreeRADIUS is eap-sim-draft-v12 compliant (present in RFC directory). The Intel supplicant can be RFC compliant. Here is my config : sites-enabled/default : authorize { eap { ok = return } sim_files } authenticate { eap } preacct { } accounting { } session { } post-auth { } pre-proxy { } post-proxy { } ************************ simtriplets.dat : 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 1102030405060708@ims.mnc030.mcc102.3gppnetwork.org,00000000000000000000000000000000,01234567,89ABCDEFFEDCBA98 I know that triplets are identical, but it is the exact content of my HLR ************************ FreeRADIUS debug output : rad_recv: Access-Request packet from host 10.67.141.66 port 1647, id=18, length=282 User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xc30522798ef5169cf5e0c3807650d0ca EAP-Message = 0x02010037013131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f7267 Cisco-NAS-Port = "611" NAS-Port = 611 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323234 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3432 +- entering group authorize rlm_eap: EAP packet type response id 1 length 55 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_sim_files: authorized user/imsi 1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim rlm_eap: Underlying EAP-Type set EAP ID to 23 ++[eap] returns handled Sending Access-Challenge of id 18 to 10.67.141.66 port 1647 EAP-Message = 0x01170014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 Proxy-State = 0x535347 Proxy-State = 0x323234 Proxy-State = 0x3432 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.67.141.66 port 1647, id=19, length=333 User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xd4899c4bcc876e21712e13b045ea773f EAP-Message = 0x02170058120a00000e0e00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f726700001001000107050000e05543a4f8463a935b25152720718715 Cisco-NAS-Port = "611" NAS-Port = 611 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323235 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3433 +- entering group authorize rlm_eap: EAP packet type response id 23 length 88 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_sim_files: authorized user/imsi 1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/sim rlm_eap: processing type sim +++> EAP-sim decoded packet: User-Name = "1102030405060708(a)ims.mnc030.mcc102.3gppnetwork.org" Framed-MTU = 1400 Called-Station-Id = "001a.6cf3.fd90" Calling-Station-Id = "0013.ce0d.e627" Cisco-AVPair = "ssid=MySSID" Service-Type = Login-User Message-Authenticator = 0xd4899c4bcc876e21712e13b045ea773f EAP-Message = 0x02170058120a00000e0e00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f726700001001000107050000e05543a4f8463a935b25152720718715 Cisco-NAS-Port = "611" NAS-Port = 611 State = 0x9ef748f79ee05ae75aadbce935e2f4b8 NAS-Identifier = "AP4" Proxy-State = 0x535347 Proxy-State = 0x323235 NAS-IP-Address = 10.67.106.62 Event-Timestamp = "Jul 22 2008 07:58:15 GMT" NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "unknown" Proxy-State = 0x3433 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-IDENTITY = 0x00323131303230333034303530363037303840696d732e6d6e633033302e6d63633130322e336770706e6574776f726b2e6f72670000 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000e05543a4f8463a935b25152720718715 rlm_eap: Underlying EAP-Type set EAP ID to 24 ++[eap] returns handled Sending Access-Challenge of id 19 to 10.67.141.66 port 1647 EAP-Message = 0x01180050120b0000010d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b05000045eec452c1f4a185a68788b07e757a52 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ef748f79fef5ae75aadbce935e2f4b8 Proxy-State = 0x535347 Proxy-State = 0x323235 Proxy-State = 0x3433 Finished request 3. Going to the next request Waking up in 4.9 seconds. ********************** Thanks in advance for any feedback. Geoff. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 22 Jul '08

22 Jul '08

Hello Alan (and all the others too) I am sory about the delay! here is the entire log: http://tinypaste.com/5b99b EAP PEAP still don't work without giving an error message understandable by me! hope it will be clearer for you! I precise: NTLM_AUTH authenticate successfully against AD, same with winbind. and EAP-TLS runs Ok thank you ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 19h05mn 33s Objet : Re: Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: >> "f you want to authenticate PEAP users via SQL (which you seem >> to be saying), then don't configure the mschap module to use ntlm_auth." > > my mistake: i didn't know... Huh? You are aware that AD is not the same as SQL? > back to Users based on AD. >... > in etc/raddb/module/mschap, i have this for ntlm_auth: ... And then nothing for "radiusd -X". If you can't follow repeated instructions, I think it's impossible for me to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Duplicated accounting records
by Marinko Tarlac 22 Jul '08

22 Jul '08

Hi I searched throw Internet and all I found was similar questions without detailed answer. :( FR1.1.7 and MT as a NAS. I constantly receive these error logs. I'm using Mysql as a database and AcctUniqueId has unique attribute so as I can see during debugging process, mysql rejects duplicated AcctUniqueId. Is there any chance to figure out why NAS send this trash? >Mon Jul 21 22:10:07 2008 : Info: rlm_radutmp: Login entry for NAS private-network port 26190 duplicate >Mon Jul 21 22:10:07 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting START record - Duplicate entry '25e543b830223c20' for key 2 >Mon Jul 21 22:10:39 2008 : Error: Dropping conflicting packet from client private-network:50188 - ID: 161 due to unfinished request 7165

2 1

Updated HOWTO's on deployingradius.com
by Alan DeKok 21 Jul '08

21 Jul '08

I've added a few more HOWTO's for EAP, certificates, etc. on my web page. See: http://deployingradius.com The main page now lists: (1) PAP (2) EAP (3) Certificates (4) Importing the certificates If you've ever wondered how to get EAP working with FreeRADIUS && client machines, these documents should help. They are a short series of simple steps that need to be performed. The total effort is limited to running 3-4 commands, some multiple times. The key to getting it *right* is the rest of the explanations on the web pages: Why those commands are used, and in what order they should be used. The documents also recommend running the same tests over and over again, each time the server configuration is changed. This process means that you can easily pinpoint *which* step doesn't work. The web pages then explain *why* it doesn't work, along with some common problems and solutions. This is the first step in putting the rest of my book online. Alan DeKok.

3 4