- Freeradius-Users - lists.freeradius.org

(no subject)
by Frost, Benjamin M. 05 Aug '07

05 Aug '07

Hello again, I have the newest version of freeradius up and running. I am using rlm_perl and have setup to use Username and password. I was wondering if it's possible to initiate a challenge/response in order to prompt for another piece of data. Example. Domain Username / Domain password and then come back with a request for a one-time password. I tried to return 11; even though it's not listed as a viable return value. Any idea on if this is possible? Thanks, Ben Confidentiality Notice: This message, and any attachments, may contain information that is confidential, privileged, and/or protected from disclosure under state and federal laws that deal with the privacy and security of medical information. If you received this message in error or through inappropriate means, please reply to this message to notify the Sender that the message was received by you in error, and then permanently delete this message from all storage media, without forwarding or retaining a copy.

2 1

"Conditional" LDAP Profile
by CJ 05 Aug '07

05 Aug '07

Using 1.1.6 out of FreeBSD ports (no 1.1.7 yet). Looking to use LDAP-stored attributes conditionally based on hints: I start here in hints: DEFAULT Prefix == "static:", Strip-User-Name = Yes Hint = "STATIC", Service-Type = Framed-User, Framed-Protocol = PPP DEFAULT Service-Type = Framed-User, Framed-Protocol = PPP That works fine. Then we go to users: DEFAULT Auth-Type = LDAP Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Fall-Through = Yes DEFAULT Hint == "STATIC", User-Profile := `uid=%u,ou=dialup,ou=radius,domain=example.com,dc=example,dc=com` Reply-Message = `%u` It appears that my User-Profile := `DN` does not go through radius_xlat and my %u variable in the check item is never expanded. Is this expected behavior? If I hard-code the DN with the user-name instead of %u it works great, but won't solve my problem. I got the idea from the rlm_ldap doc: ...it can be set through the hints file in the authorize section: DEFAULT Ldap-UserDN := `uid=%{User- Name},ou=people,dc=company,dc=com` Any thoughts or guidance or clarity on LDAP profile usage appreciated.

2 1

Re: EAP-MD5 client "rlm_eap_md5 : Password is required for EAP-MD5 Authentication"
by rick norman 05 Aug '07

05 Aug '07

> ----- Original Message ----- > From: "Arran Cudbard-Bell" <A.Cudbard-Bell(a)sussex.ac.uk> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP-MD5 client "rlm_eap_md5 : Password is required for EAP-MD5 Authentication" > Date: Sun, 05 Aug 2007 19:48:09 +0100 > > > rick norman wrote: > > Hi, > > I'm building a radiusd client using libradius and trying to get > > eap-md5 authentication > > working. My code sends a radius request with a user name, and an > > eap message with > > the username. > > I receive a challenge from radiusd. I return the challenge > > response, md5(id,passwd,challenge), and radius state variable > > but time out waiting for authentication. > > The output from radiusd indicates "rlm_eap_md5 : Password is > > required for EAP-MD5 Authentication". > > When I add the password to the users file, I no longer receive > > the challenge and timeout earlier. Where is radiusd supposed to > > get the passwd, and in what format ? > > > > > Cleartext for md5 challenge, and from any authentication source you wish > ... sql , ldap , users file. I don't follow. Where does the cleartext go ? I tried including the password in the radius user password type. The eap-md5 response is md5 hash. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Get your free email from http://bsdmail.com

3 2

EAP-MD5 client "rlm_eap_md5 : Password is required for EAP-MD5 Authentication"
by rick norman 05 Aug '07

05 Aug '07

Hi, I'm building a radiusd client using libradius and trying to get eap-md5 authentication working. My code sends a radius request with a user name, and an eap message with the username. I receive a challenge from radiusd. I return the challenge response, md5(id,passwd,challenge), and radius state variable but time out waiting for authentication. The output from radiusd indicates "rlm_eap_md5 : Password is required for EAP-MD5 Authentication". When I add the password to the users file, I no longer receive the challenge and timeout earlier. Where is radiusd supposed to get the passwd, and in what format ? -- _______________________________________________ Get your free email from http://bsdmail.com

2 1

Re : New to Linux
by Eshun Benjamin 05 Aug '07

05 Aug '07

Download freeradius and follow the instructions. There are a lot of info on the wiki and faq pages. ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.7.tar.bz2 http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html http://www.missl.cs.umd.edu/wireless/eaptls/ http://wiki.freeradius.org/WPA_HOWTO You may also upgrade the red hat ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Mudigonda Chaitanya <mchaitan(a)nortel.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Vendredi, 3 Août 2007, 17h04mn 07s Objet : New to Linux  Hi I am using Red hat 9, I am pretty new to Linux field. Can someone suggest me how show I be proceeding so that I can use EAP authentication, for the user connected to my switch. I am very much familiar with the configuration on the switch. It would be helpful if some one can send me a link or doc that could help me to proceed further. Warm Regards Chaitanya Nortel Certified Support Specialist GNTS-Nortel E:mail::mchaitan@nortel.com Working Hours :: 8 - 5 EST Phone :: 800 4NORTEL (667 835) option 1 # ERC then Case number _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Re : Is this possible
by Eshun Benjamin 05 Aug '07

05 Aug '07

You can setup pap authentication in freeradius and enable password authentication ( by setting $userpassword=1;) on your chillispot cgi login script. If you are using dd-wrt on your WRT54GL then you can also configure your box for firewall protection etc. You may have to ask this questions in chillispot forum. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : YvesDM <ydmlog(a)gmail.com> À : fred.zinsli(a)shooter.co.nz; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 5 Août 2007, 9h53mn 23s Objet : Re: Is this possible On 8/4/07, Fred Zinsli <fred.zinsli(a)shooter.co.nz> wrote: Hello everyone I am very new to freeradius and security type environments and I am feeling somewhat out of my depth at the moment. My current situation is that I have a chillispot WIFI setup. A diagram of the current network can be seen at http://www.shooter.co.nz/network.pdf Looks nice :-) The problem I have with this setup is that unscrupulous people are connecting to the unprotected APs without authenticating and playing games between themselves therefore bogging down our network with their traffic. Just wondering, that firewall (smooth1) is a smoothwall box? If yes, It's been a while since i've been playing with it, but I remember there was a chillispot mod for it.(check the homebrew forum) Just add an extra nic to that box and try it out. Your wireless will be completely seperated from the rest of the network too this way. Also, as already suggested, you can run chillispot directly from a WRT54GL (maybe WAP54G also, not sure) with alternative firmware, which is probably the most easy solution. ... Here is what I would like to do. When a user attempts to connect to the AP, the user is presented with a login screen (much like chillispot), the user logs on and they are connected to the AP and can use the network as expected. If a user cannot authenticate the attempt is logged and the connection attempt to the AP is dropped. That's easy, once you've set up everything, just enable auth. logging in radiusd.conf Kind regards, Yves _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

EAP-TLS Free Radius
by abhishek singh 05 Aug '07

05 Aug '07

Hi, I am using Free radius for EAP-TLS Session establishment. however before the TLS handshake is complete, my radius server asks for client certificates. Is there any way (some option in configuration file) i can complete the TLS handshake with Free radius server without client certificates. Thanks in advance,

3 2

radius with active directory
by HBA BOX 05 Aug '07

05 Aug '07

Hello, I'm knew to radius, I would like to use Free radius with windows 2003 server active directory for the authentication and authorization of the wlan users using smartcard (x.509 certificate ) and Mysql for accountting. can any one help me in how to configure both of the radius server and the active directory to achive my gool or forward me to any helpfull documentation. best regards --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

freeradius and mysql
by zahra bahar 05 Aug '07

05 Aug '07

Hi I am new in radius, I want to use sql for accounting in freeradius. for creating tables of radius I use # mysql -u root -p > mysql.sql after entering password there is this error: ERROR 1064(42000) at line 1:you have an error in your sql syntax,....... use the ql.sal rlm_sql Freeradius sql module. I don't know the reason of this error. --------------------------------- Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

5 8

Is this possible
by Fred Zinsli 05 Aug '07

05 Aug '07

Hello everyone I am very new to freeradius and security type environments and I am feeling somewhat out of my depth at the moment. My current situation is that I have a chillispot WIFI setup. A diagram of the current network can be seen at http://www.shooter.co.nz/network.pdf The problem I have with this setup is that unscrupulous people are connecting to the unprotected APs without authenticating and playing games between themselves therefore bogging down our network with their traffic. So what I am wanting to do is dispose of the chillispot server and authenticate the users directly from the APs (WAP54G) using WPA- Enterprise. WPA-Enterprise on the WAP54G is radius authentication with a WPA shared key between the AP and the radius server. I have got the APs talking to the radius server, but it seems the radius server is using the credentials from the PC to authenticate the users. Here is what I would like to do. When a user attempts to connect to the AP, the user is presented with a login screen (much like chillispot), the user logs on and they are connected to the AP and can use the network as expected. If a user cannot authenticate the attempt is logged and the connection attempt to the AP is dropped. This way a user cannot just blindly connect to our network and use bandwidth. Is that type of configuration possible? and if so where would I find information on how it is done? Many thanks in advance for you patience and comments. Regards Fred

3 2