- Freeradius-Users - lists.freeradius.org

Proxy and clear-text password
by Luis Galan 04 Jul '07

04 Jul '07

Hello! I have set up my freeradius 1.1.3 server to use proxy feature. User@domain1 are redirected to the radius2 which store the usernames and password for that user. It seems that my nas is sending encrypted passwords but radius2 only accept clear text passwords. And my radius1 is proxying the request of the user@doamin1 with encrypted passwords to radius2. What can I do to send the clear-text passwords to radius2? Thanks. Luis

5 6

Build a custom module
by baki＠enternet.hu 04 Jul '07

04 Jul '07

Hello! I am developing a custom module for Debian 4.0 with preinstalled FreeRADIUS 1.1.3, but if I build and install my module I get a segmentation fault. Is there a way to build a custom module, and use it with a preinstalled FreeRADIUS? Thank you. Best regards, Baki

4 7

PEAP (EAP-TLS) support
by Miłosz Modrzewski 04 Jul '07

04 Jul '07

Does FreeRadius (I have version 2.0.0-pre1) support PEAP(EAP-TLS)?? I want to use certificates on both sides - client and server.. If so, what must I modify in eap.conf file?? Currently I'm using PEAP(EAP-MSCHAPv2) it work fine.. I can post my eap.conf file when someone interested..

2 1

disappearing configuration items in unlang
by Hugh Messenger 04 Jul '07

04 Jul '07

I'm using the latest and greatest 2.0.0 HEAD. If I wrap an 'if' statement round something (in this case a query in mysql_dialup.conf), any config items seem to get blown away. So for instance: authorize_reply_query = "\ SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ AND (Huntgroup = '%{Huntgroup-Name}' OR Huntgroup = '') \ ORDER BY id" ... is just fine, but as soon as I wrap an 'if' round it ... # hugh - huntgroup test if ("${use_huntgroup}" == "yes") { authorize_reply_query = "\ SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ AND (Huntgroup = '%{Huntgroup-Name}' OR Huntgroup = '') \ ORDER BY id" } else { authorize_reply_query = "\ SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" } ... radiusd barfs on startup with: config: No such configuration item authreply_table in section if when expanding string "SELECT id, UserName, Attribute, Value, op FROM ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER BY id" I'm setting 'use_huntgroup' in sql.conf, if that makes any difference. But using "if (1)" has the same effect. I am at a loss. -- hugh

2 1

Re: Build a custom module
by Hugh Messenger 04 Jul '07

04 Jul '07

<baki(a)enternet.hu> said: > I am developing a custom module for Debian 4.0 with preinstalled > FreeRADIUS 1.1.3, Baki - unless you have some utterly compelling reason to be working on the Debian distro version, you really should upgrade to at least 1.1.7. Depending on your schedule, you might even want to look seriously at the 2.0.0 beta. <flame> I'm just wondering why some of the major Linux releases are still shipping 1.1.3. It's getting ridiculous. We're about to move to 2.0 ("real soon now"), and folk like RH, Debian and friends are still distributing a way out of date 1.x, perpetuating all the usual legacy support headaches for Alan et al. Is there anything the freeradius community can do about this? Can we write our /Congressmen|Member of Parliament|Dictator|Oligarch/? Threaten to scream and scream until we're sick if we don't get our own way? </flame> > Best regards, > Baki -- hugh

4 3

RE: RADIUS & PEAP
by Josh Howlett 03 Jul '07

03 Jul '07

What you're attempting to do is impossible because MS-CHAP is a mutual authentication protocol. If the RADIUS server does not demonstrate knowledge of the password to the supplicant, a well-behaved the supplicant *should* refuse the connection. (I also wouldn't be surprised if the RADIUS server barfs because it can't get a valid user-password in order to construct the authentication response but I can't comment authoritatively on this). Finally, you can't authenticate MS-CHAP against /etc/passwd or /etc/shadow; MS-CHAP requires access to the cleartext password or its NTLM hash. josh. > -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Adrienne Rau > Sent: 03 July 2007 19:30 > To: freeradius-users(a)lists.freeradius.org > Subject: RADIUS & PEAP > > I am configuring a wireless network with EAP Authentication. > I can connect successfully with the following line in my users file. > > testuser User-Password == "testing" > > I would like to be able to authenticate with ANY password. I > tried using the "!=" operand, but that causes an MS-CHAP > incorrect response error. Is there any way to make EAP > authenticate with any password. If not, how can I have it > authenticate against the /etc/passwd and /etc/shadow files? > > Thank you for your help, > Adrienne Rau > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

RADIUS & PEAP
by Adrienne Rau 03 Jul '07

03 Jul '07

I am configuring a wireless network with EAP Authentication. I can connect successfully with the following line in my users file. testuser User-Password == "testing" I would like to be able to authenticate with ANY password. I tried using the "!=" operand, but that causes an MS-CHAP incorrect response error. Is there any way to make EAP authenticate with any password. If not, how can I have it authenticate against the /etc/passwd and /etc/shadow files? Thank you for your help, Adrienne Rau

2 1

Requesting CVS checkin
by Roy Walker 03 Jul '07

03 Jul '07

Back in April the following post was sent out and it is still not in CVS as of July 2nd. Is it possible to get this checked in? http://readlist.com/lists/lists.freeradius.org/freeradius-users/2/11069. html Here is a patch someone posted: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg346 52.html Thanks, Roy

1 0

misconfigured adsl modems hammering my freeradius
by Tom De Wispelaere 03 Jul '07

03 Jul '07

Hello, we are using freeradius (with mysql backend) in an isp environment for authentication and accounting of adsl modems. Some of these modems are misconfigured with a wrong password and try to authenticate every 5 secs or so, so i was wondering if there is a simple way to tell radius not to do a lookup every 5 secs for these particular modems... As the number of modems is growing, it seems that these misconfigured modems are putting more and more strain on the radius..... Any advice greatly appreciated, Tom

3 2

RE:Freeradius + LDAP + EAP-TTLS with PAP cannot login
by Arjuna Scagnetto 03 Jul '07

03 Jul '07

I've take a look at your radius.conf. I can only say that i have a Radius+LDAP+EAP-ttls (pap) configuratio working in authorize section ldap is uncommnet in authenticate section Auth-Type LDAP { ldap } is uncommented, i have no ldap_1x modules enabled. this way it works with crypt (md5) hash password. Bye

2 1