- Freeradius-Users - lists.freeradius.org

Re : using EAP instead of chilli
by Eshun Benjamin 09 Jul '07

09 Jul '07

i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. Do this, The settings below will help: SETUP Internet connection: IP on WAN Under Optional Settings Host Name: MyWireless (Name of your client-AP) Domain Name: yourdomain.com (Your own domain) MTU: Auto Under Network Setup Router Local IP: 192.168.1.1 Subnet: 255.255.255.0 Gateway: 0.0.0.0 DHCP DHCP Server: enabled WIRELESS Under Basic settings; Wireless mode: AP wireless Network Mode: Mixed Wireless Network Name: MyWireless (Name of your client-AP) Wireless Channel: 11-2.462GHz Wireless SSID Broadcast: enable Sensitivity Range: 2000 Under Radius MAC Radius Client: enable MAC format : aabbcc-ddeeff Radius Server Address: your radius server IP Radius Server port: 1812 MUU: Password format: shared key Radius shared secret: the secret of your cliet (AP) Wireless Security Security Mode: WPA Radius WPA Algorithms: TKIP+AES Radius Server Address: Your radius server IP Radius Server port: 1812 WPA shared key: the secret of your client (AP) key renewal interval: 3600 ADMINISTRATION management Routing: enable 802.1x : enable Make sure you have your client(AP) information in radius: client.conf ( AP IP , MyWireless, Shared Key) configure eap.conf and radius.conf as well. All the best. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Carl aniams <aniamss(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 7 Juillet 2007, 19h15mn 51s Objet : using EAP instead of chilli hi all i'm using freeradius with a mysql database to authenticate users through chillispot, and it's working fine. i would like to authenticate my user using EAP instead of using chilli that already grant them access through dhcp to the network i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. thanks a lot -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Login /logout script hooks
by Steven J Lamb 09 Jul '07

09 Jul '07

I have been looking for a good example of a way to execute scripts when there is a login or logout. I haven't yet found a good example and unfortunately all of my attempts have failed to do anything. Any help or suggestions as to where I can find a good example of running a shell script when someone logs in or logs out. I would much appreciate it. Thanks in advance. Steven Lamb

2 1

Freeradius 2.0 - vmps feature, inaccuracies on FreeNAC
by Sean.Boran＠swisscom.com 09 Jul '07

09 Jul '07

Hi, I just came across your blog post commenting on the release of the 2.0 version of freeradius. I was kind of surprised by the upcoming support of VMPS. While trying to know more, I also found a post commenting on OpenVMPS (http://lists.cistron.nl/pipermail/freeradius-users/2007-May/063152.html ) and I have to say that I've been really dissapointed by what you wrote. I really didn't expect that animosity or that amount of FUD coming from you. Quote, from Alan Dekok, Mon May 28 14:21:56 CEST 2007 " 2.0.0-pre2 has "Magic feature number one" :)" > Arran Cudbard-Bell wrote: > > Neat , unfortunately only Cisco switches seem to support it, and we run > > entirely on HP Procurves. > > Guess it means people will no longer have to use OpenVMPS to proxy :) > > Plus, OpenVMPS is not under active development, so there's no > maintainers. It claims it's part of another project (that I won't > name), but that project includes the *binary* of OpenVMPS, and not the > source. GPL concerns may apply... > > On top of that, the project is funded by a commercial company, as a > loss-leader for their commercial support, and the "community" that works > on it is limited to the employees of that company. Good luck getting > patches added if they conflict with the corporate agenda... > > Alan DeKok. The project in question that you did not want to name is "FreeNAC" and I'm the lead developer. You'll understand that I cannot let those things stay uncorrected, so I'll quickly make some issues clear : - This project has been, from the start, a GPL project, sources have always been published. Just because an OpenVMPS binary is there doesn't mean there's no source : look into the contrib directory. - The main sponsor is effectively Swisscom Innovations, but there's no need to put quotes around community. Even if it's small (70 registered users), I let you check our forums to verify that it is not limited to Swisscom. We received some contributions (patches, documentation) that we accepted and we don't have any hidden agenda. [FreeNAC is GPL, and we respect the GPL of OpenVMPS too]. - "Good luck getting patches added if they conflict with the corporate agenda" The community are free to change FreeNAC themselves, and submit patches, if we don't do it fast enough. That is what OpenSource is about. The core team is not closed to Swisscom Innovation people either. I'll welcome anyone with the motivation, skills and time. This is, I repeat, a GPL - OpenSource project. But, at the end, I'd really like to close this misunderstanding and move further. There's no point in arguing or flaming each other as we're both working on closely related opensource project. In fact, FreeRADIUS was always in our mind, we announced FreeNAC on the "freeradius-user" mailing list in 2006 and we also integrated it. This is natural because the core value of FreeNAC is in at the "policy level", and not in the support of underlying protocols like VMPS or 802.1x. We've also closely followed the development in the NAC area and contacted other opensource projects (SecureW2, NAC@FHH) for that purpose. We would enjoy a collaboration that would lead to create _the_ opensource NAC framework. Regards, Sean Boran, www.FreeNAC.net

3 3

Freeradius Auth via LDAP against Active Directory Server 2003
by Jacob Jarick 09 Jul '07

09 Jul '07

I have been at this for awhile now, so I thought I would share a summary of what I have figured out so far for anyone else that decides to try this. 1 - Documentation for this particular configuration is either out of date / incomplete / both. There are no howtos that will get from start to end (if you do know of one or wrote one yourself please share - I will myself when I figure it all out). 2 - Most the trouble is due to the fact we are making a linux service talk to a windows service (AD LDAP). Freeradius talking to the linux passwd file is a breeze by comprassion. 3 - Windows 2003 LDAP implementation will not provide a password when a user/ service preforms a ldap search, the proper way If I understand correctly is to supply plain text username / password then freeradius preforms a bind with the provided credentials against your ADS server, success means the password was correct. 4 - Installing "Services For Unix" on 2003 will make AD LDAP provide a password hash attribute among other unix LDAP attributes. The user has have posix enabled. 5 - Anonymous searchs can be preformed on 2003 AD LDAP if you set dSHeuristics to 0000002 using adsiedit.msc. 6 - Microsofts LDAP is different to Novells (big surprise) and so unfortunately their documentation isnt to helpfull as a reference for people trying to use ADS in the same fashion.

6 17

Plug-in Question
by George Beitis 08 Jul '07

08 Jul '07

Hi Everyone i have a question regarding freeradius. I am trying to write a plugin and i was wondering what the postauth section is for. I want to be able to alter the authentication decision of freeradius, once it is made but before the ok response is sent. I will use a policy engine to do that and i want to overwrite the final decision if the user is not authorized based on my policy. Is postauth the right place to do this? regards George

8 29

Block wiki spammer.
by Arran Cudbard-Bell 08 Jul '07

08 Jul '07

Hi Peter, Can you block Ce3Wre <http://wiki.freeradius.org/index.php?title=User:Ce3Wre&action=edit> Spamming Run-time-Variables page. And could I have edit rights to the start page, pretty please :) Thanks, Arran

3 5

NAS Reboot
by gaopeng 08 Jul '07

08 Jul '07

Hi,I try to implement the EAP-TLS by Freeradius, but the authentication stoped. From the log, I guess the reason is "NAS Reboot". I wonder if you know why it happend. Thanks a lot in advance! Enclosed please find the part of the log. Paul... ...Finished request 23Going to the next requestWaking up in 6 seconds...rad_recv: Access-Request packet from host 192.168.1.120:32778, id=33, length=219 User-Name = "host/cn1njxac.cn001.siemens.net" NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" NAS-Port = 0 Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Calling-Station-Id = "00-16-6F-58-2D-4B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x022400061900 State = 0xc22b0aa9baefeb0a401d5bfb77355856 Message-Authenticator = 0xcbe38495618ee3a8a7d15dc8d088b68d Processing the authorize section of radiusd.confmodcall: entering group authorize for request 24 modcall[authorize]: module "preprocess" retu! rns ok for request 24 modcall[authorize]: module "chap" returns noop for request 24 modcall[authorize]: module "mschap" returns noop for request 24 rlm_realm: Checking for suffix after "@" rlm_realm: Looking up realm "cn1njxac.cn001.siemens.net" for User-Name = "host/cn1njxac.cn001.siemens.net"XXL:enter realm_find realm =cn1njxac.cn001.siemens.net,accounting =0 Start to compare realm 2:config ream is :LOCAL,sta ream is :cn1njxac.cn001.siemens.net rlm_realm: No such realm "cn1njxac.cn001.siemens.net" modcall[authorize]: module "suffix" returns noop for request 24 rlm_eap: EAP packet type response id 36 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 24 users: Matched entry host/cn1njxac.cn001.siemens.net at line 95 modcall[authorize]: module "files" returns ok for request 24XXL: enter pap_authorize,vp->attribute =1000XXL: vp->lvalue =6XXL: enter pap_authorize,vp->attribu! te =2XXL: enter PW_USER_PASSWORD,found_pw should be truerlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 24modcall: leaving group authorize (returns updated) for request 24 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 24modcall: leaving group authenticate (returns handled) for request 24Sending Access-Challenge of id 33 to 192.168.1.120 port 32778 EAP-Message = 0x012500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8810d4afb824cb4c9026f9697c25f35cFinished r! equest 24Going to the next requestWaking up in 6 seconds...--- Walking the entire request list ---Cleaning up request 20 ID 29 with timestamp 468e087eCleaning up request 21 ID 30 with timestamp 468e087eCleaning up request 22 ID 31 with timestamp 468e087eCleaning up request 23 ID 32 with timestamp 468e087eCleaning up request 24 ID 33 with timestamp 468e087eNothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32779, id=34, length=101 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 25 modcall[preacct]: module "preprocess" returns noop for request 25rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: W! ARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 25 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 25 modcall[preacct]: module "files" returns noop for request 25modcall: leaving group preacct (returns ok) for request 25 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" retu! rns ok for request 25 modcall[accounting]: module "unix" returns noop for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 25modcall: leaving group accounting (returns ok) for request 25Sending Accounting-Response of id 34 to 192.168.1.120 port 32779Finished request 25Going to the next request--- Walking the entire request list ---Cleaning up request 25 ID 34 with timestamp 468e08a3Nothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32781, id=0, length=101 Acct-Status-Type = Accounting-On Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Rebo! ot Processing the preacct section of radiusd.confmodcall: entering gr oup preacct for request 26 modcall[preacct]: module "preprocess" returns noop for request 26rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 26 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 26 modcall[preacct]: module "files" returns noop for request 26modcall: leaving group preacct (returns ok) for request 26 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 26radius_xlat: '/usr/local/fre! eradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 26 modcall[accounting]: module "unix" returns noop for request 26radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 restarted (Accounting-On packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 26modcall: leaving group accounting (returns ok) for request 26Sending Accounting-Response of id 0 to 192.168.1.120 port 32781Finished request 26Going to the next request--- Walking the entire request list ---Cleaning up request 26 ID 0 with timestamp 468e08a7Nothing to do. Sleeping until we see a request.rad_recv: Accounting! -Request packet from host 192.168.1.120:32781, id=1, length=101 Acct-S tatus-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 27 modcall[preacct]: module "preprocess" returns noop for request 27rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 27 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suff! ix" returns noop for request 27 modcall[preacct]: module "files" returns noop for request 27modcall: leaving group preacct (returns ok) for request 27 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 27 modcall[accounting]: module "unix" returns noop for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 27modcall: leaving group accounting (returns ok)! for request 27Sending Accounting-Response of id 1 to 192.168.1.120 po rt 32781Finished request 27Going to the next request--- Walking the entire request list ---Cleaning up request 27 ID 1 with timestamp 468e0abeNothing to do. Sleeping until we see a request. _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

2 1

User not found using LDAP
by Amr el-Saeed 08 Jul '07

08 Jul '07

Dear all, i'm using freeradius-1.1.0-1 i need to make a default action if a user is not found . i need to make this action ( allow) for a while, i mean if the radius searched the LDAP and didn't find the user reply to the router with OK. i didn't find anything in the docs. any ideas ?? Regards Amr Ali

3 7

sql auth problems with 2.0.0-pre
by Alexander Serkin 07 Jul '07

07 Jul '07

Gurus, may be i'm pulling some common mistake with my configuration being tested against cvs snapshot, but no idea which one. I've an sql profile telling: some.dotted.user Cleartext-Password = cisco NAS-IP-Address =~ "xxx.xxx.97.(85|86)" authentication request: User-Name = "some.dotted.user" User-Password = "cisco" Calling-Station-Id = "000000000000000" Framed-Protocol = PPP Service-Type = Framed-User NAS-IP-Address = xxx.xxx.97.85 gives the access-reject for unknown (for me) reason: rlm_sql (sqlauth): sql_set_user escaped user --> 'some.dotted.user' rlm_sql (sqlauth): Reserving sql socket id: 3 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id' SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id ... rlm_sql (sqlauth): Released sql socket id: 3 modcall[authorize]: module "sqlauth" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [some.dotted.user/cisco] (from client localhost port 0 cli 00000000000000) auth: Failed to validate the user. I've checked the authorization sql query shown in debug - it properly returns the profile configured -- Sincerely Yours, Alexander

5 21

Re: pool-key issue in rlm_sqlippool
by Hugh Messenger 07 Jul '07

07 Jul '07

[Changed the subject back again. I have a bad habit of forgetting to change it from the digest subject when I respond. Time to switch lists, I guess.] Peter Nixon <listuser(a)peternixon.net> said: > > if ("%{control:Pool-Name}") { > > if ("%{control:Huntgroup-Name" == "dialup") { > > sqlippool_dialup > > } > > elsif ("%{control:Huntgroup-Name" == "wireless") { > > sqlippool_wireless > > } > > } > > Nope. Accounting does not know which Pool-Name was used, or even IF a pool > was used or not.... Doh! And I'd just finished explaining how I set the Pool-Name up in the authorize section. Slaps forehead. Does the Huntgroup-Name get set during accounting? I may not know the pool name, but if I know the Huntgroup, I know which instance of sqlippool I'll need. > Just list them both. Yup. That's how I've been testing it so far. I was just trying to find a way that would avoid unnecessary db queries. > Even just fixing existing pages that you feel are unclear is helpfull as > you > are a new comer and have found by trial and error which bits are difficult > to understand. That was years ago for many of the wiki authors :-) Okie Dokie. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1