- Freeradius-Users - lists.freeradius.org

freeRADIUS and Cisco switch errors, the server replies but the switch does not seem to authorise the login
by David Bradley 04 Feb '08

04 Feb '08

Hi, I'm hoping you can help! I have a server running FreeRADIUS and I'm trying to authorize exec sessions. If I remove the authorize line in the cisco config the authentication works fine, but once it starts to authorise it fails. There are 4 sections here: relevant parts of the cisco switch The users file, the freeRADIUS log and the cisco switch log. The bit that seems to fail is where the cisco switch recieves the radius reply, it just doesn't act on the reply.... aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius radius-server host 192.168.100.201 auth-port 1812 acct-port 1813 key 7 xxxxxxx radius-server source-ports 1645-1646 Users-file DEFAULT Service-Type = shell Cisco-AVPair = "shell:priv-lvl=15" ----------------------- rad_recv: Access-Request packet from host 192.168.100.254:1645, id=26, length=82 NAS-IP-Address = 192.168.100.254 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "dave" Calling-Station-Id = "192.168.100.109" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "dave", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 users: Matched DEFAULT at 228 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Login OK: [djbrad2/password] (from client rafmh port 2 cli 192.168.100.109) Sending Access-Accept of id 26 to 192.168.100.254:1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 -------- *Mar 1 02:05:01.335: RADIUS(00000000): Send Access-Request to 192.168.100.201:1812 id 1645/26, len 82 *Mar 1 02:05:01.335: RADIUS: authenticator 90 85 F6 37 C3 2C A4 BE - 97 44 D1 81 A4 DD 0F 2D *Mar 1 02:05:01.335: RADIUS: NAS-IP-Address [4] 6 192.168.100.254 *Mar 1 02:05:01.335: RADIUS: NAS-Port [5] 6 2 *Mar 1 02:05:01.335: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 02:05:01.335: RADIUS: User-Name [1] 9 "dave" *Mar 1 02:05:01.335: RADIUS: Calling-Station-Id [31] 17 "192.168.100.109" *Mar 1 02:05:01.335: RADIUS: User-Password [2] 18 * *Mar 1 02:05:01.339: RADIUS: Received from id 1645/26 192.168.100.201:1812, Access-Accept, len 45 *Mar 1 02:05:01.339: RADIUS: authenticator A7 47 9F 4C 58 BC CA A5 - E5 6B E4 9E 64 9F FB C9 *Mar 1 02:05:01.339: RADIUS: Vendor, Cisco [26] 25 *Mar 1 02:05:01.339: RADIUS: Cisco AVpair [1] 19 "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: saved authorization data for user 1DF88C8 at 2238960 *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Port='tty2' list='' service=EXEC *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: tty2 (606283324) user='djbrad2' *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV service=shell *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV cmd* *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): found list "default" *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Method=radius (radius) *Mar 1 02:05:01.343: RADIUS: cisco AVPair "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: no appropriate authorization type for user. *Mar 1 02:05:01.343: AAA/AUTHOR (606283324): Post authorization status = FAIL *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: Authorization FAILED

2 3

inner/outer Tunnel attributes of TTLS/MS-CHAPv2
by Vincent Magnin 04 Feb '08

04 Feb '08

Hello All, I've an issue with passing attributes from EAP TTLS MS-CHAPv2 to outer: My /etc/raddb/users contains: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name := `%{User-Name}`, Fall-Through = yes And my eap ttls module contains: > copy_request_to_tunnel = yes > use_tunneled_reply = yes The user-name and Tunnel-* are not rewiten/copied to the outer. This isssue is only with MS-CHAP, not PAP. Running version: freeradius-1.0.1-3.RHEL4.5 radius -X : rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/127.0.0.1/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 TTLS: Got tunneled reply RADIUS code 2 User-Name := "vmagnin(a)unil.ch" Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "16" Tunnel-Medium-Type:0 = IEEE-802 MS-CHAP2-Success = 0x5b533d31464345343644464444343239353838433043363243464630463638363938363532333336314637 MS-MPPE-Recv-Key = 0xcf199064e5ce16501ad868646e8e7b3c MS-MPPE-Send-Key = 0x053e079625529879fe9f4f1cb9b7ad47 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/130.223.222.60/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/130.223.222.60/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 Sending Access-Accept of id 60 to 130.223.222.60:1645 MS-MPPE-Recv-Key = 0xc9abc77f52aa954231989e3bc26c35b2b6f6578dec2fe6b1bf06e9fb1b75740f MS-MPPE-Send-Key = 0xe940dd6f47a1a7102d876dacf2f36385a5e717f96372d87256b5e6c1c3ba962b EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Finished request 39

3 3

RE: Freeradius-Users Digest, Vol 34, Issue 16
by aziz yucelen 04 Feb '08

04 Feb '08

---------------------------------------------------> > What do you want to do? What do you want to achieve? What authentication are> you planning to use ? ---------------------------------------------------< Hi. Principally sorry for my bad english.I am setup freeradius .I want chain all network client.My problem is - ı am setup freeradius server - I am setup layer2 switch - Iam configure switch and client pc - and start -but client pc sending access request to switch, switch request to server ,server message is "access challenge" what is this I dont know and what I do? ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched ! entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request _________________________________________________________________ Helping your favorite cause is as easy as instant messaging. You IM, we give. http://im.live.com/Messenger/IM/Home/?source=text_hotmail_join

4 3

How to connect to mySql
by johnson elangbam 04 Feb '08

04 Feb '08

hi, I am a new user in free radius server, i wanted to keep the username/password in mySql database. I've read almost all the radiusd.conffile to make through, but it doesn't help, please help me to configure to connect the database to make it work. Thanks, with regards, Elangbam Johnson

4 3

CRL signature failure
by zz zz 04 Feb '08

04 Feb '08

Hello, I have a lot of strange messages in radius.log regarding CRL signature failure (randomly). When this message occur in the log, users can't be authenticated on EAP-TLS -> Login Incorrect. Problem is solved with full restart of freeradius service (service freeradius restart). I'm running the latest version 1.1.7 of freeradius compiled from sources on RHEL3 with RHEL openssl-0.9.7a-33.24 (openssl is installed by up2date from RHEL3 repository). Every hour is CRL updated by external cron script together with c_rehash. Mon Feb 4 09:13:24 2008 : Error: --> verify error:num=8:CRL signature failure Mon Feb 4 09:13:24 2008 : Error: TLS Alert write:fatal:decrypt error Mon Feb 4 09:13:24 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Mon Feb 4 09:13:24 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Mon Feb 4 09:13:24 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Mon Feb 4 09:13:24 2008 : Auth: Login incorrect: [Kris Jacob] (from client BEBRU765CZ101 port 1 cli 00-16-6F-61-5E-09) eap.conf -------- eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { CA_path = ${raddbdir}/certs/ check_crl = yes CA_file = ${raddbdir}/certs/CA.pem crl_file = ${raddbdir}/certs/crl.pem certificate_file = ${raddbdir}/certs/radius.pem private_key_file = ${raddbdir}/certs/radius.key dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } } I can't found any similar problem in the radius discussion. Thanks --- Cajt ------------------------------------------ http://search.atlas.cz/

1 0

EAP-ttls tunnel inner outer authentication credential management
by theSnail 04 Feb '08

04 Feb '08

Is there a way to manage in a different way the inner and the outer authentication credential in a EAP-ttls + PAP tunnel? for example authenticate the outter credential against a file and the inner against ldap dir. thanks arjuna -- View this message in context: http://www.nabble.com/EAP-ttls-tunnel-inner-outer-authentication-credential… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Help me please!!
by aziz yucelen 04 Feb '08

04 Feb '08

Hi.. I am receiving this "Access-Challenge " message.I dont know what I do.Please help me. Thanks... ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request> Thread 2 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=162> Cleaning up request 0 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 3 got semaphore> Thread 3 handling request 1, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> EAP-Message => 0x0202005019800000004616030100410100003d030147ac558d77684de77a5d4e927a0c8abbd79d3e8c289aa3006aa63ea402fae95c00001600040005000a000900640062000300060013001200630100> Message-Authenticator = 0xb38e6c9574648ff3b9b43230ab24f470> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 2 length 80> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> TLS Length 70> rlm_eap_tls: Length Included> eaptls_verify returned 11> (other): before/accept initialization> TLS_accept: before/accept initialization> rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello> TLS_accept: SSLv3 read client hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello> TLS_accept: SSLv3 write server hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0589], Certificate> TLS_accept: SSLv3 write certificate A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone> TLS_accept: SSLv3 write server done A> TLS_accept: SSLv3 flush data> TLS_accept: Need to read more data: SSLv3 read client certificate A> In SSL Handshake Phase> In SSL Accept mode> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x0103040019c0000005e6160301004a02000046030147a319d725ef54f7b8675834e99662060c8f0d046180fc473283e66e4672c67a205ba7f2ccb2f755a847a0e47c06522a98b521b9d02fe5a07f13bc49b5cb49637800040016030105890b00058500058200029730820293308201fca003020102020101300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564> EAP-Message => 0x752e7472301e170d3038303230313132353931325a170d3039303133313132353931325a30818d310b3009060355040613025452310d300b0603550408130454524e43311330110603550407130a646979617262616b697231153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100b45cb01aaa76827408cd147b1e395998e31ce1fb2124f5f199f8bf9ba98c85b87dc6f425eafd260829153b36> EAP-Message => 0x1ed91744ac08f259793c02c6033d4bcb7c443b5d01e179b81f19182a4f6fbe212616e54184512b813d0f7fa7b71cd0a0b8f479a3841e079339f070594cc15799cb20cb370aa6ad5e1bb607676186a80c40145e1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003e369a0269de8132e852e07c3e8d41ca9a8feabbddbec18ba7d87c8a93c8f711d84485d528c1e52db85d6d233eae7f08fc9d45579ba7dd8b7eb0a9864dfd88eda4d5eead488dddb371af95a81d786abd18a1950fce63c9872c6c6e874983090b85578bba6a2a4fc523b36e463b78cd5d9de64abbf462ef0a> EAP-Message => 0x18c65cf0625345740002e5308202e13082024aa003020102020100300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e7472301e170d3038303230313132343535315a170d3131303133313132343535315a3078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a> EAP-Message = 0x060355040b130342494d3110> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> Finished request 1.> Going to the next request> Thread 3 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 1 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 5 got semaphore> Thread 5 handling request 2, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> EAP-Message = 0x020300061900> Message-Authenticator = 0xf30dca65a4d02ac05f72f49a8c603c32> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 3 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x010401f61900300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100c74f8084794bb5e24142b92ed730c80507ff7a16fbb013b222787dd18b7d1f9d19d72ba7c41da18a32b32db41ae6de80c3113a615ff7016120b14dddbc5f2a5b696e501ff9f317a000448de5c9e60ab6f6ce295538591c208504cc3f9ec6dc0703c92372b4f98189b57c20a7a78edc18ef58627aa1e789fad4f7f7a8bccbd5910203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d> EAP-Message => 0x4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0301f0603551d23041830168014a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0300d06092a864886f70d010105050003818100a53c167b89b48d0b030926b38a337e7ac9e65f3bd4f788f2e7d132859059ddd63ca436149dd929ff168de011bf53e5b5a51189c44467589c4eabfef504c25507510a3749e2e8fa3189f5a571260458fbf2d4e58b3857a1726a0af4a21c5539472e24e96f7678256e32141babf86921d8c7f57a5b92790a5782c7d232fadbd3bc16030100040e000000> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> Finished request 2.> Going to the next request> Thread 5 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 2 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 4 got semaphore> Thread 4 handling request 3, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> EAP-Message = 0x020400061900> Message-Authenticator = 0x7011b465e9976763874b73745ac1d791> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 4 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message = 0x010500061900> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f47cff0d3d2c202f1c7a8b9c> Finished request 3.> Going to the next request> Thread 4 waiting to be assigned a request> Waking up in 4.0 seconds. _________________________________________________________________ Need to know the score, the latest news, or you need your Hotmail®-get your "fix". http://www.msnmobilefix.com/Default.aspx

2 1

UserName, Password + MAC authentication using Cisco's BBSM 5.3
by javkhlanbaatar＠newcomsystems.mn 04 Feb '08

04 Feb '08

Hello, I'm using Freeradius 1.1.17 version with Cisco's BBSM. With MySqL database too. I've storing username, passwords in mysql db. For now, authentication is OK. I want to check MAC address of users while they are authenticating. Inmy radcheck table: | id | UserName | Attribute | op | Value | +----+-------------+--------------------+----+-------------------+ | 3 | java | Password | == | password | | 18 | java | Calling-Station-Id | == | aa-bb-cc-dd-ee-ff | Also, BBSM's snmp is enabled. So I can get users' MAC addresses. I want Radius server checks username, password and MAC addresses at the same time when the user authenticate. Without Calling-Station-Id, authentication is OK. When I add Calling-Station-Id, the user cannot authenticate. In which table, do I enter this attribute? Also i cannot close or deactivate user session when I want to. When i removing from BBSM Mysql db, session is still open. Or can I put expiration time at every 03 o'clock? Could someone help me abt these?

6 10

ascend data filters not being returned
by Don James 04 Feb '08

04 Feb '08

Hi, When I run radtest, I get the following response: Sending Access-Request of id 64 to 192.168.1.41 port 1645 User-Name = "donjames(a)hendersonisp.com" User-Password = "donjames" NAS-IP-Address = 255.255.255.255 NAS-Port = 5 rad_recv: Access-Accept packet from host 192.168.1.41:1645, id=64, length=20 As you can see, the data from the ascend data filters is not being returned. I suspect that I have somehow turned on encryption. How do I set "plain text" communication? Sincerely, Don James

3 4

802.1x Authentication
by Devinder Singh 03 Feb '08

03 Feb '08

Hi Does Free Radius has support for 802.1x authentication such as providing Certificate. Can it also integrate with MIcrosoft Active Direcrtory, Regards -- Devinder

3 2