- Freeradius-Users - lists.freeradius.org

proxy and attribute overrides
by Emmanuel Dreyfus 08 Aug '07

08 Aug '07

Hello Sorry if this is a FAQ, but I have not found the answer, so here I am: I use freeradius-1.1.6. The server do authorization and authentication for a few NAS. Some users have logins in the local realm and others have logins in proxied realms. When a user passes authorization, the server returns a Framed-IP-Address to the NAS. The address depends of the NAS and is selected using huntgroups. I have a problem with users in proxied realms: after proxy authentication is successful, radiusd sends a packet to the NAS with no Framed-IP-Address, or with a Framed-IP-Address taken from the proxy RADIUS server. I want my radius server to choose the Framed-IP-Address and ignore what proxied servers send. This can be acheived uwing the attr_filter module, but that module will only allow selection the address based on the realm. I cannot select through huntgroups, which is what I'm looking for. The workaround I found is to add post_proxy_authorize = yes in the server secion of proxy.conf. That causes the proxied reply to go to the authorization stage again and to have a correct Framed-IP-Address added. That post_proxy_authorize option is documented as depreacted and scheduled for future removal. How can I acheive my setup without it? I'm pretty confident there is a way of doing it, but I have not been able to find it. -- Emmanuel Dreyfus manu(a)netbsd.org

3 8

MySql Data base and FreeRadius
by User for Free Radius mail list 08 Aug '07

08 Aug '07

Hello, We are just setting up 2 new FreeRadius boxes to handle DSL radius authentication. This is nothing new to us. What is new is using a MySql data base with the FreeRadius. Anyway we have most everything working as should be. We are running the MySql databases as master and slave for replication on the backup FreeRadius server. This we have setup and running. One problem we ran into was on the backup server (slave MySql) in the radiusd.conf file we had set: post-auth { sql } We found this would change the radius->radpostauth table on the slave and then we would get "Slave: Error 'Duplicate entry" errors. So we commented out the "sql" line in the post-auth section of the radiusd.conf file and that solved the problem. My question?????? Should I be looking for any other got-yas before putting these servers into production? Thanks, Ken

1 0

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 08 Aug '07

08 Aug '07

Hi Claudiu, Thanks for your response, Wed, 8 Aug 2007 12:24:57 +0300, you wrote: >For Cisco, please be sure that you have in your config > >radius-server vsa send accounting >gw-accounting aaa > >(or "gw-accounting h323 aaa" for an older IOS) > > >Best regards, > >Claudiu Filip >@: claudiu(a)globtel.ro >Http://www.globtel.ro >T:+40344880100 >F:+40344880113 Yes, in my CISCO config I already have: radius-server vsa send accounting gw-accounting aaa Regards Timothy

1 0

Problems with DBM and MS-CHAP
by Tom Griffin 08 Aug '07

08 Aug '07

Hello, I am having a problem with Freeradius v1.1.6. We have one server (running v1.0.1) which works as we want it to, but when trying to build a new v1.1.6 server to act in the same way is proving to be difficult. All our users are stored in a local DBM database and authentication is either by MS-CHAP (when coming via a Cisco VPN 3000 concentrator) or by EAP (when coming via Cisco Aironet 1200). Using the Cisco client (and also the VPN concentrator test function) the authentication is successful, the same is true with EAP (ie. the DBM module is working). But when using MS-CHAP authentication is rejected. Here is the debug output; rad_recv: Access-Request packet from host xx.xx.xx.xx:1044, id=176, length=154 User-Name = "cs1tg" NAS-Port = 4054 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "xx.xx.xx.xx" MS-CHAP-Challenge = 0xd1076979a50becf0731656741b3a469a MS-CHAP2-Response = 0x0200ca320fdd144e34edc132ba42560c4619000000000000000064a36039b976de05bc0e340fbd2b5b0b1bff37a302ccc3f2 NAS-IP-Address = xx.xx.xx.xx NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "cs1tg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_dbm: try open database file: /usr/local/etc/raddb/../usradmin/users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add cs1tg to user list sm_parse_user: start parsing: user: cs1tg parse buffer: <<Auth-Type := Local, User-Password == "BLANKED">> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Service-Type = Framed-User, Framed-Protocol = PPP, Class = "OU=Unishef">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove cs1tg from user list modcall[authorize]: module "dbm" returns ok for request 1 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [cs1tg] (from client vpn2 port 4054) My main concern is the apparent incorrect Auth-Type of 'mschap' rather than 'MS-CHAP' that I would have expected to see (which is most likely why rad_check_password is falling back to Local). The interesting thing is that when I disable DBM and add a test user locally, the MS-CHAP module successfully authenticates the user, suggesting there is some incompatibility between newer versions of freeradius, dbm and mschap (since we are using this combination on another server with v1.0.1) Here are the main sections of the config; modules { mschap { authtype = MS-CHAP # I have tried with this line blanked also } dbm { usersfile = ${confdir}/../usradmin/users } } authorize { preprocess suffix dbm mschap eap } authenticate { Auth-Type MS-CHAP { mschap } eap } I have tried many different orderings of the authorize section as well as combinations of variables in the mschap module config, but these have all given the same result. The config shown above is the version that is working on the older server. Any help would be greatly appreciated. Regards, Tom Griffin

2 4

Additional functionality of rlm_sql
by Pshem Kowalczyk 08 Aug '07

08 Aug '07

Hi, We use freeradius mainly to proxy requests for wholesale customers of ours. For some of them we provide additional services such as session tracking and ip allocation. Currently we do it with our modified version of rlm_sql. The modification is just an extension of the module (no changes to existing procedures). We've added handling for 'preaccounting' (which is an exact copy of 'accounting') and post-proxy, which runs a single sql query for all 'Access-Accept' packets (we allocate ip here, using a stored procedure in postgresql). The patch is against the 1.1.6 version, but it shouldn't be too difficult to get it against the current one. Is anyone interested? And a question to maintainers - what are the odds of incorporating that functionality in the HEAD version? kind regards Pshem

2 4

authentication problem with mysql integration
by ram 07 Aug '07

07 Aug '07

I have installed freeradius-1.1.6 configured as mentioned http://wiki.freeradius.org/SQL_HOWTO when i do test radtest 12345 12345 x.x.x.x 1645 secret Sending Access-Request of id 2 to x.x.x.x port 1812 User-Name = "12345" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host x.x.x.x:1812, id=2, length=20 rad_verify: Received Access-Reject packet from client x.x.x.x port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) rad_recv: Access-Request packet from host x.x.x.x:32772, id=2, length=57 User-Name = "12345" User-Password = "\234\312\252Q\312\261\202\354\227X\364A\271\277" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 modcall[authorize]: module "digest" returns noop for request 9 rlm_realm: No '@' in User-Name = "12345", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 radius_xlat: '12345' rlm_sql (sql): sql_set_user escaped user --> '12345' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '12345' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '12345' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '12345' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '12345' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): No matching entry in the database for request from user [12345] modcall[authorize]: module "sql" returns notfound for request 9 modcall: leaving group authorize (returns ok) for request 9 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 9 for 1 seconds Finished request 9 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to x.x.x.x port 32772 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 9 ID 2 with timestamp 46b896e7 Nothing to do. Sleeping until we see a request. any suggestions. ram

5 5

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 07 Aug '07

07 Aug '07

Hello Ivan, Mon, 06 Aug 2007 16:45:09 +0100, you wrote: >>rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, >>unique ID MAY be inconsistent >This is the source of the errors in log entries. >These are accounting start (VoIP and telephony) and stop requests. They >will use accounting_start_query and accounting_stop_query. In your >previous post you showed what you have done to >accounting_update_query_alt: > >accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, >AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, >AcctSt >artTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, >AcctInputOctets, >AcctOutputOctets, CalledStationId, CallingStationId, >ServiceType,FramedProtocol, FramedIPAddress, AcctStartDelay) >values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', >'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', >'%{Cisco-NAS-Port}', >'%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + >%{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', >'%{Acct-Authentic}','', '%{Acct-Input-Octets}', >'%{Acct-Output-Octets}', >'%{Called-Station-Id}', '%{Calling-Station-Id}', >'%{h323-remote-address}', >'%{Framed-Protocol}', '%{h323-remote-address}', '0')" >That query is not getting executed. You need to alter >accounting_start_query and expand it with those attributes. >Ivan Kalik >Kalik Informatika ISP Here are my accounting_start and accounting_stop queries. The attributes were already included: accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPor tType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-T ype}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{h323-r emote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '%{Acct-Delay-Time}', '0')" accounting_start_query_alt = "UPDATE ${acct_table1} SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_s tart = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address} '" accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acc t-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIP Address = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into ${acct_table2} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, Calle dStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Ac ct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Caus e}', '%{h323-remote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '0', '%{Acct-Delay-Time}')"

2 1

Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5Authentication...
by rick norman 07 Aug '07

07 Aug '07

Found the problem. I drilled down and looked at the rlm_eap_md5.c code and realized my client was building the challenge response improperly. Thanks for your help. Rick Norman rnorman(a)ikaika.com Thanks for your help. > ----- Original Message ----- > From: tnt(a)kalik.co.yu > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5Authentication... > Date: Mon, 06 Aug 2007 21:20:53 +0100 > > > Send a (PAP) request with radtest. Does that work? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 6/8/2007, "rick norman" <gumbo_2007(a)bsdmail.com> piše: > > > I'm using freeradius version1.1.0_2 on freebsd 6.1. > > The radius client is running locally and talks to radiusd through > > loopback. > > The users file in raddb contains the line > > > > con_d User-Password == con_d Following is radiusd -X output. I > > don't understand the failure. > > > > rad_recv: Access-Request packet from host 127.0.0.1:56788, id=190, length=63 > > User-Name = "con_d" > > NAS-Identifier = "rick" > > Message-Authenticator = 0x8427e9ce00df09446ca9130a3ade1de8 > > EAP-Message = 0x0200000a01636f6e5f64 > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: EAP packet type response id 0 length 10 > > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > > modcall[authorize]: module "eap" returns updated for request 0 > > users: Matched entry con_d at line 138 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns updated) for request 0 > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_eap: EAP Identity > > rlm_eap: processing type md5 > > rlm_eap_md5: Issuing Challenge > > modcall[authenticate]: module "eap" returns handled for request 0 > > modcall: leaving group authenticate (returns handled) for request 0 > > Sending Access-Challenge of id 190 to 127.0.0.1 port 56788 > > EAP-Message = 0x010100160410223177b20b1d22da8c79e2c0a8562196 > > Message-Authenticator = 0x00000000000000000000000000000000 > > State = 0x93fe786c1b3d77b98c0e87dc406bbd88 > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 127.0.0.1:56788, id=191, length=93 > > User-Name = "con_d" > > NAS-Identifier = "rick" > > State = 0x93fe786c1b3d77b98c0e87dc406bbd88 > > Message-Authenticator = 0xf3b427506614646b12ec161a2be00033 > > EAP-Message = 0x02010016041037ab0f881c1fa98e477b0a5ad546b160 > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 1 > > modcall[authorize]: module "preprocess" returns ok for request 1 > > modcall[authorize]: module "chap" returns noop for request 1 > > modcall[authorize]: module "mschap" returns noop for request 1 > > rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 1 > > rlm_eap: EAP packet type response id 1 length 22 > > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > > modcall[authorize]: module "eap" returns updated for request 1 > > users: Matched entry con_d at line 138 > > modcall[authorize]: module "files" returns ok for request 1 > > modcall: leaving group authorize (returns updated) for request 1 > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 1 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/md5 > > rlm_eap: processing type md5 > > rlm_eap: Freeing handler > > modcall[authenticate]: module "eap" returns reject for request 1 > > modcall: leaving group authenticate (returns reject) for request 1 > > auth: Failed to validate the user. > > Delaying request 1 for 1 seconds > > Finished request 1 > > Going to the next request > > Waking up in 6 seconds... > > --- Walking the entire request list --- > > Cleaning up request 0 ID 190 with timestamp 46b76f06 > > Sending Access-Reject of id 191 to 127.0.0.1 port 56788 > > EAP-Message = 0x04010004 > > Message-Authenticator = 0x00000000000000000000000000000000 > > Cleaning up request 1 ID 191 with timestamp 46b76f06 > > Nothing to do. Sleeping until we see a request. > > > > > > -- _______________________________________________ > > Get your free email from http://bsdmail.com > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Get your free email from http://bsdmail.com

2 1

Re: EAP-MD5client"rlm_eap_md5 : Password is required for EAP-MD5 Authentication...
by rick norman 06 Aug '07

06 Aug '07

I'm using freeradius version1.1.0_2 on freebsd 6.1. The radius client is running locally and talks to radiusd through loopback. The users file in raddb contains the line con_d User-Password == con_d Following is radiusd -X output. I don't understand the failure. rad_recv: Access-Request packet from host 127.0.0.1:56788, id=190, length=63 User-Name = "con_d" NAS-Identifier = "rick" Message-Authenticator = 0x8427e9ce00df09446ca9130a3ade1de8 EAP-Message = 0x0200000a01636f6e5f64 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry con_d at line 138 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 190 to 127.0.0.1 port 56788 EAP-Message = 0x010100160410223177b20b1d22da8c79e2c0a8562196 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93fe786c1b3d77b98c0e87dc406bbd88 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:56788, id=191, length=93 User-Name = "con_d" NAS-Identifier = "rick" State = 0x93fe786c1b3d77b98c0e87dc406bbd88 Message-Authenticator = 0xf3b427506614646b12ec161a2be00033 EAP-Message = 0x02010016041037ab0f881c1fa98e477b0a5ad546b160 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "con_d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry con_d at line 138 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 190 with timestamp 46b76f06 Sending Access-Reject of id 191 to 127.0.0.1 port 56788 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 1 ID 191 with timestamp 46b76f06 Nothing to do. Sleeping until we see a request. -- _______________________________________________ Get your free email from http://bsdmail.com

2 1

how to use LDAP for authorization and authentication while using EAP method!!!!!!
by shantanu choudhary 06 Aug '07

06 Aug '07

hello all, i have ldap server installed, i am using it to cross check user-name and password provided by the client!! now for doing this i have to configure my radius server for using LDAP for authorization and authentication. Now when i configure accordingly server cant understand any EAP method. But my client is windows which i am cant configure for methods other that eap, either i have to use ttls, peap, tls. now i configures it for PEAP while disabling verification of server certificate i cant dissable option of using MSCHAP for second phase of authetication. now here my server is not able to understand that that encrypted password. can anyone help me out with this, my server is working fine i tested it using radtest command from same local host. i just cant fix it, can u tell me what is the way out of this, what else can i do, i want to use those ldap accounts and passwords with this but not able to figure it out!! thanks and regards shantanu --------------------------------- 5, 50, 500, 5000. Store N number of mails in your inbox. Click here.

3 8