- Freeradius-Users - lists.freeradius.org

simultaneous login
by Michael Ziemann 24 Sep '07

24 Sep '07

Hi ! I have a problem with simultaneous login. The user connects to the RADIUS Server, then the user appears in the MySQL-DB in the table radacct. But if the user disconnect, the user doesn't disappear in the table. If I remove the entry by myself, the user can connect again. In the table radreply i added an Idle-Timeout in the Attribut field with the value 5 and op = . I added also Idle-Timeout to radgroupreply to the group of user with the value 5. Regards Michael

2 1

RE: Vista Authentication
by Josh Howlett 24 Sep '07

24 Sep '07

Ensure that you're using a recent version of samba. Search the list for a value of 'recent'. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: 23 September 2007 14:26 > To: FreeRadius users mailing list > Subject: Re: Vista Authentication > > Iain Ellis wrote: > > Are there any known gotcha's concerning Vista clients > authenticating? > > Not that I know of. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RE: Support for SSO Active Directory & PEAP-MS-CHAP-v2
by Rakesh Jha 24 Sep '07

24 Sep '07

Can you please send steps, I am also trying to so the same. Rakesh ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of rick wiltshire Sent: Sunday, September 23, 2007 4:48 PM To: freeradius-users(a)lists.freeradius.org Subject: Support for SSO Active Directory & PEAP-MS-CHAP-v2 Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation? Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

[newbie] radutmp question
by Cheng-Lin Yang 23 Sep '07

23 Sep '07

Hi all, I have encountered a problem with radutmp. The information of my environment is a vpn service and auth with freeradius 1.1.7. The problem happened as below: 1. start up the radiusd 2. user "abc" connect to vpn, and I can use radwho to see "abc" user 3. shutdown radiusd 4. user disconnect from vpn server (radiusd not start yet) 5. start up radiusd, and radwho still shows "abc" is connected Is there any way to solve this problem? any suggestion is extremely welcomed. Thank you. :) Regards, clyang

3 4

Re: EAP (PEAP) MS-CHAPv2b how to
by Piero Giobbi 23 Sep '07

23 Sep '07

Hi riky. I had exactly the same problem, upgrading to 1.1.7 solved my problem (debian package is only at 1.1.3, didn't get Cleartext-Password to work there either). Just upgrade, all of you whos not running 1.1.7!! : ) And why use :=? Not == (more secure)? Thx. On Sep 21, 2007, at 4:36 PM, freeradius-users- request(a)lists.freeradius.org wrote: > From: "riky.none" <riky.none(a)email.it> > Date: September 21, 2007 3:03:18 PM GMT+02:00 > To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > Subject: Re: EAP (PEAP) MS-CHAPv2b how to > Reply-To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > > > Alan DeKok ha scritto: >> riky.none wrote: >> >>> I configure freeradius on basic autentication mode (using file >>> /etc/freeradius/users) >>> >>> paperino Auth-Type := Local, User-Password == "paperino" >>> >>> topolino Auth-Type := EAP, User-Password == "topolino" >>> >> >> (1) DO NOT SET AUTH-TYPE >> (2) Use Cleartext-Password := ... >> NOT User-Password == >> >> >>> rlm_eap: No such EAP type peap >>> >> >> Read eap.conf. >> >> >>> I want use autentication without certificate >>> >> >> If you're using PEAP, you need a server certificate. >> >> >>> HOW TO configuration WIFI (cliente xp) and freeradius using EAP/ >>> PEAP ??? >>> >> >> See the Wiki. This is covered there. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> >> . >> >> > not hangry Alan > > I feel really stupid now... > > i insert in users file: > > myuser Cleartext-Password := "somepass" > > run freeradius -X > /etc/freeradius/users[219]: Parse error (check) for entry myuser: > Unknown attribute "Cleartext-Password" > > eap config is not easy to read (for newbie) > > There is one basic howto to configure freeradius using TTLS??? > > in wiki i not find one basic howto EAP-TTSL

2 1

Support for SSO Active Directory & PEAP-MS-CHAP-v2
by rick wiltshire 23 Sep '07

23 Sep '07

Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation?

2 1

Vista Authentication
by Iain Ellis 23 Sep '07

23 Sep '07

Hello Are there any known gotcha's concerning Vista clients authenticating? I'm running 1.1.7 with my certificates compiled with xpextensions and I can't get a Vista client to go beyond Sending Access-Challenge when authenticating. XP clients are authenticating OK, just not Vista. I'm authenticating to NDS via LDAP. Any suggestions\thoughts gratefully received Rgds, Iain --------------------------------------------------------------------------- This email and any attachment(s) is intended for and confidential to the addressee. If you are neither the addressee nor an authorised recipient for the addressee please notify us of receipt, delete this message from your system and do not use, copy or disseminate the information in, or attached to it, in any way. Our messages are checked for viruses but please note that we do not accept liability for any viruses which may be transmitted in or with this message. --------------------------------------------------------------------------- The College of Law of England and Wales. Registered charity No 271297 ---------------------------------------------------------------------------

2 1

Configuration for Cisco DSL Users
by DFN Systems Office 22 Sep '07

22 Sep '07

I'm new both to freeradius and the *nix operating system. I have successfully implemented freeradius for users dialing in through Portmaster3 Access Servers using FreeRadius 1.0.1-1 on Fedora. I am currently authenticating DSL users locally on a Cisco 7206VXR Router. I would like to authenticate the DSL users on the FreeRadius Server, but attempts have been unsuccessful. The Accounting works. Even now with DSL Users set to Auth locally on the Router, Radius is faithfully logging the activity. With Radius Auth, the DSL modem will not connect and I get no entry in the Radius accounting log. AAA Debug is virtually Identical to the Local Auth output! The only difference was the line "Method=local" changed to "Method=Radius". Both log entry sets have Status = PASS and both show the virtual-access change to up! So now I'm thinking the AAA/Radius is working but I have a communications issue. When a DSL user authenticates locally, he then gets an IP address from the local pool on the Cisco. When the same DSL User authenticates on Radius, all communication seems to stop. Here are the relevant config sections from the Cisco. aaa new-model aaa authentication login default line [*currently set to local] aaa authentication ppp default group radius local [see*above] aaa authorization network default group radius local aaa accounting delay-start aaa accounting network default start-stop group radius interface Loopback1 description DSL ip address 206.206.89.1 255.255.255.0 secondary ip address 206.206.88.161 255.255.255.240 secondary ip address 206.206.86.1 255.255.255.0 interface Virtual-Template2 description DFN NEW Template ip unnumbered Loopback1 ip mroute-cache peer default ip address pool OsoGranDSL OsoGranDsl2 ppp authentication pap radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server key [omitted] Heres an example entry from my users file: username Auth-Type := Local, User-Password == "omitted" User-Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP I think I'm close, and I have a hunch the users file settings that work for PortMasters may not be good for Cisco. Any suggestions or sample configs would be appreciated. Bill Green Dfn Systems

2 1

about FreeRADIUS password encrypt
by yangcuilin 22 Sep '07

22 Sep '07

Hello， I will appreciate it very much, if you do me a favour. My customer asks us to store the encrypted password into the FreeRADIUS (DB has Configured Mysql). The password I have passed to FreeRADIUS is clear text. Can the FreeRadius be configured like that? Pls give me some advice . Rock

2 1

Sending Cisco AV Pairs per realm
by Dan Goscomb 21 Sep '07

21 Sep '07

Hi I have a number of realms on my radius server (FreeRADIUS Version 1.1.6). All users are valid in both realms (one is for dialup, one for broadband). e.g. dang(a)dsl.realm dang(a)dial.realm All realm's are stripped so that the user (dang in the examples above) is authenticated. However, on dial.realm I need to return a couple of Cisco-Avpair attributes; how can this be done? I have tried a hints file, however although I get the message on debug: hints: Matched DEFAULT at 17 The data specifies is not sent back in the RADIUS reply. Any help would be greatly appreciated! Cheers Dan

3 3