- Freeradius-Users - lists.freeradius.org

LDAP problem - How to set attribute where the extracted user password will be stored to.
by Tomasz Zieleniewski 24 Jan '08

24 Jan '08

Hi, I use radius 2.0.0-beta When I make an LDAP search by radius it puts the extracted user password into the User-Password attribute. How to change this? I want to have it stored in the Cleartext-Password. I configured ldap module password_radius_attribute = "Cleartext-Password" but it didn't help. Thank You for any help regards tomasz

5 6

freeradius 2.0.1 and xtradius
by John Joe 24 Jan '08

24 Jan '08

Hy, I am trying to proxy with freeradius 2.0.1 the requests to an xtradius. The problem is that it doesn't works how it should. rad_recv: Access-Request packet from host 127.0.0.1 port 35640, id=136, length=67 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "aol123", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound expand: %{User-Name} -> aol123 users: Matched entry DEFAULT at line 136 ++[files] returns ok ++[pap] returns noop Sending Access-Request of id 201 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP Service-Type = Framed-User Proxy-State = 0x313336 Proxying request 3 to home server 9.0.0.2 port 1812 Sending Access-Request of id 201 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP Service-Type = Framed-User Realm = "AOL" Proxy-State = 0x313336 Going to the next request Waking up in 0.9 seconds. WARNING: Insecure packet from host 213.157.176.7: Packet does not contain required Message-Authenticator attribute Waking up in 0.8 seconds. Waking up in 13.9 seconds. After this the client is authentificated by xtradius but I don't get the output of what the xtradius server says(the attributes.), and radtest give me this: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=136, length=20 The auth and acct on the xtradius are some scripts made in phyton. This give's me if I radtest directly the xtradius server: radtest aol123 test 9.0.0.2 10 testing1232 19 10.0.0.2 Sending Access-Request of id 80 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP radclient: received bad packet: WARNING: Insecure packet from host 9.0.0.2: Packet does not contain required Message-Authenticator attribute Sending Access-Request of id 80 to 9.0.0.2 port 1812 User-Name = "aol123" User-Password = "test" NAS-IP-Address = 10.0.0.2 NAS-Port = 10 Framed-Protocol = PPP radclient: received bad packet: WARNING: Insecure packet from host 9.0.0.2 : Packet does not contain required Message-Authenticator attribute And also I don't get the attributes. I must say that i haven't try to authentificate thru freeradius with a real client only with radtest it is posible to work even if I get thoes warnings and no attribute displayed? --------------------------------- Looking for last minute shopping deals? Find them fast with Yahoo! Search.

2 1

Customize messages from radiusd - possible?
by Spam Eater 24 Jan '08

24 Jan '08

Hi, I would like to know if it is possible to customize the messages that radiusd sends to the client. For example, I would like to translate the "You are already logged in - access denied" message to another string. Can this be done using Reply-Message in radiusd.conf? Thank you!

2 1

Unable to run radclient - libfreeradius-radius-2.0.0.so not found
by David W Bell 24 Jan '08

24 Jan '08

Trying to run radclient to test if I have things set up correctly and I get this. Only similar thing I could find on the net was libcrypt being missing which was pointed at being an incorrect installation of openLDAP (I think). I downloaded the src and compiled from there with ./configure, make and then make install. Any suggestions? belld@Trigger:~> sudo radclient --help radclient: error while loading shared libraries: libfreeradius-radius-2.0.1.so: cannot open shared object file: No such file or directory belld@Trigger:~> sudo find / -noleaf -name libfreeradius-radius-2.0.1.so /usr/local/lib/libfreeradius-radius-2.0.1.so /home/belld/src/freeradius-server-2.0.1/src/lib/.libs/libfreeradius-radius-2.0.1.so

3 2

authenticating with PIN only not username and password.
by Goke Aruna 23 Jan '08

23 Jan '08

hi all, Can someone give me an insigth into how a user can authenticate from hotspot with 10digit PIN number not username and password. Thanks goksie

5 6

rlm_chap Reply-Message on Access-Reject
by Spam Eater 23 Jan '08

23 Jan '08

Hello everyone, Can anyone tell me if it is possible to send the Reply-Message attribute in the Access-Reject packet when using rlm_chap? Or any other rlm_* by the way... Thank you.

3 2

Odd device PPP connections to my Cisco
by michael＠tradepage.co.za 23 Jan '08

23 Jan '08

Good Day all, I wonder anybody has come across something like this before, I have a device which establishes two PPP links to my cisco router. Now 1 PPP link works 100% and the other not, I switched debugging on the cisco and this is what I got: I apologise for posting on this list, but im guessing anybody that has seen this kind of thing would be on this list. It seems to be rejecting ever authentication protocol? Any ideas? Jan 23 19:48:20 10.201.203.251 3992: Jan 23 19:48:04.873 utc: ppp283 LCP: TIMEout: State REQsent Jan 23 19:48:20 10.201.203.251 3993: Jan 23 19:48:04.873 utc: ppp283 LCP: O CONFREQ [REQsent] id 7 len 24 Jan 23 19:48:20 10.201.203.251 3994: Jan 23 19:48:04.873 utc: ppp283 LCP: MRU 1352 (0x01040548) Jan 23 19:48:20 10.201.203.251 3995: Jan 23 19:48:04.873 utc: ppp283 LCP: ACCM 0x00000000 (0x020600000000) Jan 23 19:48:20 10.201.203.251 3996: Jan 23 19:48:04.873 utc: ppp283 LCP: AuthProto PAP (0x0304C023) Jan 23 19:48:20 10.201.203.251 3997: Jan 23 19:48:04.873 utc: ppp283 LCP: MagicNumber 0x0B478259 (0x05060B478259) Jan 23 19:48:20 10.201.203.251 3998: Jan 23 19:48:04.901 utc: Vi2.26 PPP: I pkt type 0x0021, datagramsize 59 link[ip] Jan 23 19:48:20 10.201.203.251 3999: Jan 23 19:48:05.017 utc: Vi2.26 PPP: I pkt type 0x0021, datagramsize 59 link[ip] Jan 23 19:48:20 10.201.203.251 4000: Jan 23 19:48:05.033 utc: ppp283 LCP: I CONFREQ [REQsent] id 3 len 8 Jan 23 19:48:20 10.201.203.251 4001: Jan 23 19:48:05.033 utc: ppp283 LCP: MRU 1500 (0x010405DC) Jan 23 19:48:20 10.201.203.251 4002: Jan 23 19:48:05.037 utc: ppp283 LCP: O CONFACK [REQsent] id 3 len 8 Jan 23 19:48:20 10.201.203.251 4003: Jan 23 19:48:05.037 utc: ppp283 LCP: MRU 1500 (0x010405DC) Jan 23 19:48:20 10.201.203.251 4004: Jan 23 19:48:05.037 utc: ppp283 LCP: I CONFREJ [ACKsent] id 7 len 20 Jan 23 19:48:20 10.201.203.251 4005: Jan 23 19:48:05.037 utc: ppp283 LCP: ACCM 0x00000000 (0x020600000000) Jan 23 19:48:20 10.201.203.251 4006: Jan 23 19:48:05.037 utc: ppp283 LCP: AuthProto PAP (0x0304C023) Jan 23 19:48:20 10.201.203.251 4007: Jan 23 19:48:05.037 utc: ppp283 LCP: MagicNumber 0x0B478259 (0x05060B478259) Jan 23 19:48:20 10.201.203.251 4008: Jan 23 19:48:05.037 utc: ppp283 LCP: O CONFREQ [ACKsent] id 8 len 13 Jan 23 19:48:20 10.201.203.251 4009: Jan 23 19:48:05.037 utc: ppp283 LCP: MRU 1352 (0x01040548) Jan 23 19:48:20 10.201.203.251 4010: Jan 23 19:48:05.037 utc: ppp283 LCP: AuthProto CHAP (0x0305C22305) Jan 23 19:48:20 10.201.203.251 4011: Jan 23 19:48:05.073 utc: ppp283 LCP: I CONFREJ [ACKsent] id 8 len 9 Jan 23 19:48:20 10.201.203.251 4012: Jan 23 19:48:05.073 utc: ppp283 LCP: AuthProto CHAP (0x0305C22305) Jan 23 19:48:20 10.201.203.251 4013: Jan 23 19:48:05.073 utc: ppp283 LCP: O CONFREQ [ACKsent] id 9 len 12 Jan 23 19:48:20 10.201.203.251 4014: Jan 23 19:48:05.073 utc: ppp283 LCP: MRU 1352 (0x01040548) Jan 23 19:48:20 10.201.203.251 4015: Jan 23 19:48:05.073 utc: ppp283 LCP: AuthProto EAP (0x0304C227) Jan 23 19:48:20 10.201.203.251 4016: Jan 23 19:48:05.113 utc: ppp283 LCP: I CONFREJ [ACKsent] id 9 len 8 Jan 23 19:48:20 10.201.203.251 4017: Jan 23 19:48:05.113 utc: ppp283 LCP: AuthProto EAP (0x0304C227) Jan 23 19:48:20 10.201.203.251 4018: Jan 23 19:48:05.113 utc: ppp283 LCP: O CONFREQ [ACKsent] id 10 len 13 Jan 23 19:48:20 10.201.203.251 4019: Jan 23 19:48:05.113 utc: ppp283 LCP: MRU 1352 (0x01040548) Jan 23 19:48:20 10.201.203.251 4020: Jan 23 19:48:05.113 utc: ppp283 LCP: AuthProto MS-CHAP (0x0305C22380) Jan 23 19:48:20 10.201.203.251 4021: Jan 23 19:48:05.165 utc: ppp283 LCP: I CONFREJ [ACKsent] id 10 len 9 Jan 23 19:48:20 10.201.203.251 4022: Jan 23 19:48:05.165 utc: ppp283 LCP: AuthProto MS-CHAP (0x0305C22380) Jan 23 19:48:21 10.201.203.251 4023: Jan 23 19:48:05.165 utc: ppp283 LCP: O TERMREQ [ACKsent] id 11 len 4 Jan 23 19:48:21 10.201.203.251 4024: Jan 23 19:48:05.193 utc: ppp283 LCP: I TERMACK [TERMsent] id 4 len 4

2 1

Patch for rlm_ldap to use mozilla sdk (e.g. on Solaris)
by Markus Moeller 23 Jan '08

23 Jan '08

Find attached a patch to use the mozilla sdk instead of openldap for rlm_ldap. Use -DHAVE_LDAPSSL_ADVCLIENTAUTH_INIT and change ldap_r to ldap in configure. Markus

1 0

Re: Re: Authentication Problem with EAP-PEAP
by debug afone 23 Jan '08

23 Jan '08

Hi Arran, Thanks for your response. How What can I do to match User-Name attribute and EAP Identity ? Regards, Nicolas.

3 3

Virtual Server and Ldap-Group
by Robin Gruyters 23 Jan '08

23 Jan '08

Hi ya, Today I have installed the *new* Freeradius 2.0 release and tested the virtual server setup. I was just wondering what will be the best solution to check on LDAP Groups. (Ldap-Group) Check them (as before) in the users file, or somewhere in the virtual server configuration with a switch/case statement. .. switch "%{control:Ldap-Group}" { case "WebUsers" { update reply { NS-User-Group = WebUsers } } case "MailUsers" { update reply { NS-User-Group = MailUsers } } case ... { } } ... Kind regards, -- Robin Gruyters Network and Security Engineer Betronic Nederland B.V. I: http://yirdis.com I: http://betronic.nl P: +31 (0)20 5659191 F: +31 (0)20 5659190

2 1