- Freeradius-Users - lists.freeradius.org

802.1x machine authentication patch help
by Marco Casulli 01 Oct '07

01 Oct '07

Hi Jamie, Marco from BBC in london. I have read your message (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048576 .html related to the error when the radius is trying to authenticate in AD and I am getting exactly the same message. "No logon workstation trust account (0xc0000199)". The article is dated Nov 2005 so I hope you have the solution by now! ;-) How did you fix the problem? I cant find any resolution on the net. Thanks Marco This email may contain confidential information. If you receive it in error please immediately advise the sender and delete it from your system without copying, distributing or taking any action in reliance upon it. Red Bee Media Limited has taken precautions in respect of its email communications to preserve confidentiality and to ensure that any attachment has been checked for viruses. However, we cannot accept liability for any damage sustained as a result of interceptions and software viruses and you should take your own precautions before responding to us by email and carry out your own virus checks before opening any attachment. Red Bee Media Limited Registered No: 04257461 England Registered Office: BC2 A1 Broadcast Centre, 201 Wood Lane, London W12 7TP

3 5

Possible FreeBSD Jail problem, or other bug in/with FreeRADIUS 2.0.0-pre2
by Scott Lambert 01 Oct '07

01 Oct '07

I have an issue with getting my new FreeRADIUS 2.0.0-pre2 server to proxy requests to my old production RADIUS servers. I would appreciate any assistance you might have the time to provide. I am recieving the replies from the old server, but freeradius is throwing them out for some reason. I didn't notice anything more detailed in the radiusd -X output, so here are the log entries. Mon Sep 3 01:52:21 2007 : Proxy: No outstanding request was found for proxy reply from home server old.old.old.old port 1645 - ID 15 Mon Sep 3 01:52:24 2007 : Proxy: No outstanding request was found for proxy reply from home server old.old.old.old port 1645 - ID 15 Mon Sep 3 01:52:27 2007 : Proxy: No outstanding request was found for proxy reply from home server old.old.old.old port 1645 - ID 15 Mon Sep 3 01:52:30 2007 : Proxy: No outstanding request was found for proxy reply from home server old.old.old.old port 1645 - ID 15 Mon Sep 3 01:52:33 2007 : Proxy: No outstanding request was found for proxy reply from home server old.old.old.old port 1645 - ID 15 Mon Sep 3 01:52:41 2007 : Error: Rejecting request 0 due to lack of any response from home server old.old.old.old port 1645 If you want the radiusd -X logs, let me know. I decided to simplify and try just using radclient from the new server and leaving the FreeRADIUS daemon out of it. That also gets replies but radclient throws them out because it doesn't think it sent the request. In the archive, the only prolems I have found with the "radclient: received response to request we did not send." error are due to the reply coming from a different IP or port than that to which the request was sent. That doesn't seem to be the case here. As far as I've been able to tell, all the information appears to be the same between the request and the reply. The new FreeRADIUS server is running under a FreeBSD 6.2 jail configuration, halfway between a chroot and a virtual machine. I don't suspect the system's firewall, but ... There is a stateful firewall on the jail host system, without NAT or redirection. Each jail has it's own routable IP address. I suspect that the jail has a lot to do with the problem. If it can't be worked around, I'm in trouble. In that case I'll try to take it up with the FreeBSD developers to see if they have any ideas, while I scrounge up some seperate hardware to run FreeRADIUS on. newserver$ radclient -f ~/testuser.radclient -r 2 -s -x old.old.old.old:1645 auth pqr7s4z3 Sending Access-Request of id 9 to old.old.old.old port 1645 User-Name = "tstuser" User-Password = "secretpassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP rad_recv: Access-Accept packet from host old.old.old.old port 1645, id=9, length=336 radclient: received response to request we did not send. (id=9 socket 3) Sending Access-Request of id 9 to old.old.old.old port 1645 User-Name = "tstuser" User-Password = "secretpassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP rad_recv: Access-Accept packet from host old.old.old.old port 1645, id=9, length=336 radclient: received response to request we did not send. (id=9 socket 3) radclient: no response from server for ID 9 socket 3 Total approved auths: 0 Total denied auths: 0 Total lost auths: 1 tcpdump of the request: oldserver# tcpdump -i fxp0 -s 1500 -l host new.new.new.new tcpdump: listening on fxp0 02:29:42.098188 new.new.new.62513 > old.old.old.radius: rad-access-req 65 [id 9] Attr[ User{tstuser} Pass NAS_ipaddr{255.255.255.255} NAS_port{2} Framed_proto{PPP} ] 02:29:42.132898 old.old.old.radius > new.new.new.62513: rad-access-accept 336 [id 9] Attr[ Service_type{Framed} Framed_proto{PPP} Framed_ipnet{255.255.255.255} Vendor_specific{....."................................} Vendor_specific{.....".........=... ..................} Vendor_specific{....."........E.p.. ..................} Vendor_specific{....."........E.p.. ..................} Vendor_specific{....."........AD... ..................} Vendor_specific{....."................................} Vendor_specific{....."................................} Session_timeout{09:00:00 hours} Port_limit{1} Framed_mtu{1500} ] 02:29:45.970121 new.new.new.62513 > old.old.old.radius: rad-access-req 65 [id 9] Attr[ User{tstuser} Pass NAS_ipaddr{255.255.255.255} NAS_port{2} Framed_proto{PPP} ] 02:29:46.024013 old.old.old.radius > new.new.new.62513: rad-access-accept 336 [id 9] Attr[ Service_type{Framed} Framed_proto{PPP} Framed_ipnet{255.255.255.255} Vendor_specific{....."................................} Vendor_specific{.....".........=... ..................} Vendor_specific{....."........E.p.. ..................} Vendor_specific{....."........E.p.. ..................} Vendor_specific{....."........AD... ..................} Vendor_specific{....."................................} Vendor_specific{....."................................} Session_timeout{09:00:00 hours} Port_limit{1} Framed_mtu{1500} ] -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

2 16

Billing Account Management
by Pratchaya Chatuphian 30 Sep '07

30 Sep '07

Billing Account Management ======================= I 've successful about installation freeradius + mysql + dd-wrt ( using chillispot ). Now, i need you help. Would you like to suggestion me about "Hotspot Billing Account Management" ? that can provide postpaid/prepaid and register/sign up new user and can be refill internet time . Anybody have experience about this ? Thank you very much Best Regards., Pratchaya Ps. have it a opensource ?

1 0

TNCC warning
by 翔李 29 Sep '07

29 Sep '07

Hi, I am sorry for my carelessness.Here is the running infor attachment. Thanks for your reply. --------------------------------- 雅虎邮箱，终生伙伴！ --------------------------------- @yahoo.cn 新域名、无限量，快来抢注！ # radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type tnc rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 25.20.227.141:1645, id=19, length=125 NAS-IP-Address = 25.20.227.141 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "Lumpy" Called-Station-Id = "00-15-62-BE-79-03" Calling-Station-Id = "00-15-58-7B-83-9D" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000a014c756d7079 Message-Authenticator = 0x1b8dac18a5669da950a5b9f024458a3d rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rad_recv: Access-Request packet from host 25.20.227.141:1645, id=19, length=125 Sending Access-Reject of id 19 to 25.20.227.141 port 1645 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000

2 3

Failed obtain IP address after authenticated using EAP-MD5
by Chiu Luk 29 Sep '07

29 Sep '07

Note: forwarded message attached. --------------------------------- Catch up on fall's hot new shows on Yahoo! TV. Watch previews, get listings, and more!

3 5

Re: [OpenSER-Users] Failed to compile openser with freeradius support
by Live Great 29 Sep '07

29 Sep '07

Hi, I have downloaded the software, but got an error: core:freeradius-client-1.1.5 # ./configure checking whether to enable maintainer-specific portions of Makefiles... no configure: error: cannot run /bin/bash ./config.sub core:freeradius-client-1.1.5 # What am I missing? Thanks SW ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Saturday, September 29, 2007 6:31:33 PM Subject: Re: [OpenSER-Users] Failed to compile openser with freeradius support http://wiki.freeradius.org/Radiusclient On Sat 29 Sep 2007, Live Great wrote: > Hi, where can I get freeradius-client? I searched the source in > freeradius, couldn't find it. > > Thanks > SW > > ----- Original Message ---- > From: ram <talk2ram(a)gmail.com> > To: Live Great <livegreat007(a)yahoo.com> > Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > users(a)openser.org Sent: Friday, September 28, 2007 11:09:17 PM > Subject: Re: [OpenSER-Users] Failed to compile openser with freeradius > support > > > > > On 9/28/07, Live Great <livegreat007(a)yahoo.com> wrote: > > > > HI, > > In FreeBSD 6.2, I got this error when I compiled openser with freeradius > support. > > ../../radius.h:36:32: freeradius-client.h > > : No such file or directory > > install freeradius client before compiling > > > > ram -- Peter Nixon http://peternixon.net/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Failed obtain IP address after authenticated using EAP-MD5
by Chiu Luk 29 Sep '07

29 Sep '07

After the supplicant authenticated successfully from the FreeRadius server, my notebook fails to obtain an IP address from the Access Point (router) and end up getting a 169.254.198.216 IP address. here is my setup : Supplicant = WIRE1x ( a windows port of Open 1x ) Authenticator = D-Link DIR-655 Router Authentication Server = FreeRadius the setup diagram of 3 components http://www.oniva.com/upload/1356/diagram.jpg capture of EAP-MD5 protcol successfully get authenticated http://www.oniva.com/upload/1356/success.jpg but after a while, the notebook fails to obtain an IP from the D-link wireless router and end up getting 169.254.198.216 IP address. the setup of 802.1x inside D-link wireless router is like the following http://www.oniva.com/upload/1356/dlink.jpg so is there anything is missing on the setup so my notebook cannot get IP address from Dlink wireless router after authenticated successfully? Thank you! --------------------------------- Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more.

2 1

Not everything is getting logged via Radius - very odd
by Patrick M. 29 Sep '07

29 Sep '07

Hi all, First time poster here - go easy on me :) We use freeradius for our O1 dialup customers, as well as our SuperNews customers. Our freeradius server authenticates via LDAP. We had a customer come in today mentioning they could not log in to their dialup account, so I went to the logs and did some testing. I tried logging in with his username and I received the invalid login. So I then tried another username, and was able to authenticate just fine, however I did not see anything in the logs to indicate a successful or unsuccessful login. I am running freeradius 1.0.1-3.RHEL4.5 on CentOS 4.5. I'm not sure what will be useful to provide you, since freeradius has so many configs. Please excuse me as radius is still a bit greek to me. Please let me know what will help you help me troubleshoot, and I will be more than happy to provide. Thanks in advance! Patrick

3 2

Re: [OpenSER-Users] Failed to compile openser with freeradius support
by Live Great 29 Sep '07

29 Sep '07

Hi, where can I get freeradius-client? I searched the source in freeradius, couldn't find it. Thanks SW ----- Original Message ---- From: ram <talk2ram(a)gmail.com> To: Live Great <livegreat007(a)yahoo.com> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; users(a)openser.org Sent: Friday, September 28, 2007 11:09:17 PM Subject: Re: [OpenSER-Users] Failed to compile openser with freeradius support On 9/28/07, Live Great <livegreat007(a)yahoo.com> wrote: HI, In FreeBSD 6.2, I got this error when I compiled openser with freeradius support. ../../radius.h:36:32: freeradius-client.h : No such file or directory install freeradius client before compiling ram

3 2

TNCC warning
by 翔李 29 Sep '07

29 Sep '07

Hi, I built TNC-Client and NAA-TNCS according to the steps introducing in "How To build TNC-Client including IMCHostScanner" and "How To build TNCS including IMVHostScanner" respectively.Then I run TNCC.exe to connect to the PDP server(run by executing command radius -X) but it warns that authentication may fail.The warning info is "rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this." The whole running info is appended to this mail. Would you please tell me why the warning occured and how to solve the problem? Thank you very much. --------------------------------- @yahoo.cn 新域名、无限量，快来抢注！

2 2