- Freeradius-Users - lists.freeradius.org

re: users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

hi now the authentication type is local with the message user supplied user-password does not match local user-password see attached file thanks -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

How to pass attributes from EAP-TTLS outer to inner?
by Jason Murray 26 Jun '07

26 Jun '07

I have a situation where I need to pass the "Called-Station-Id" from the outer "anonymous" EAP Authentication-Request to the inner-authentication request. Is this possible? The problem is all my inner authentication requests look like this: Tue Jun 26 10:55:03 2007 User-Name = "me@realm" User-Password = "somepass" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Everything looks like it is coming from localhost. I need the Called-Station-Id in order to limit who has access to certain wireless SSIDs Is there a better way to authorize a user on a specific SSID using EAP-TTLS, since all the valuable information is in the outer anonymous authentication request? Thanks in advance, --Jason

2 2

RE: FreeRadius 1.1.6 Segmentation Fault with LDAP
by Joe Vieira 26 Jun '07

26 Jun '07

You need to compile with ldap depricated option. Joe -----Original Message----- From: "Robert E. Toense" <rtoense(a)nist.gov> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Sent: 6/25/2007 6:03 PM Subject: FreeRadius 1.1.6 Segmentation Fault with LDAP I am attempting to setup FreeRadius 1.1.6 to do PEAP authentication to an LDAP backend on another server. PEAP is working just fine to local Radius passwords. However, I get a segmentation fault whenever I try to use LDAP. Output from radiusd -X follows (sensitive information sanitized). OpenLDAP 2.3.30 is also installed. This is a Fedora Core 5 system. I see no network traffic between the Radius server and the LDAP server. Any hints? Robert .... rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'ou=AAAA,dc=BBBB,dc=CCCC,dc=DDD' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to lappgen.nist.gov:636, authentication 0 Segmentation fault - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 3

daemon mode and debug mode
by Diana Robert 26 Jun '07

26 Jun '07

hi what is the difference between running the server in deamon and debug mode. thanks --------------------------------- Did you know? You can CHAT without downloading messenger. Click here

2 1

Re:users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

In the users file i commented the authtype=system for user:DEFAULT now the authentication is done through PAP but pap rejects user look the joint file No user can be authenticate whether in database or an account user. -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

hi all thanks for assistance i apreciate i put in attached the result of radiusd -X so as to make my problem really understandable i used 2 users; carl pass: aniam and akim pass:willy carl failed to login and akim was successful Something new i discovered is that when i create user carl as a sytem account he is accepted by the radius so it seems my radius server checks it users elswhere than the database. what can i do? regards -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

"Clear text password not available"
by Flavio Silvestrone 26 Jun '07

26 Jun '07

Hello list, For me it's the first time with freeradius; i try to find a solution or a way to solve my problem but i have not found anything. I have this message on the log of the freeradius server when a wireless client try to estabilish a pppoe session. Auth: Login incorrect (rlm_chap: Clear text password not available): [flavio/<CHAP-Password>] (from client Erri port 1511 cli 00:35:00:04:60:99) The message is clear but i don't know where to solve. The configuration is: - two wireless client with pppoe profile - one wireless Access Point - one freeradius server If i enable the same pppoe profile (user: flavio, password: flavio) on the Access Point all work fine; When i disable the profile on the Access Point and i configure the radius client on the Access Point i have the problem This is the configuration on the file /etc/raddb/users for the user "flavio" : Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.1.1.8, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP Any idea to find out the prob ? Than's a lot Flavio

5 11

Re: terminating EAP tunnels, proxy and realms
by Josh Howlett 26 Jun '07

26 Jun '07

Gah, my message bounced owing to change of email address... Arran wrote: > Can you clear something up for me with inner/outer identity. > The outer identity is in the User-Name attribute , it's a standard > RADIUS attribute... Inner identity is encoded in the EAP message, and > is pulled out by the EAP module prior to internal proxying and set as > the User-Name attribute (which should overwrite the User-Name > attribute in the request) ? Correct. > And it's standard practice to leave the outer identity as anonymous, > as the only communication between the NAS and the Supplicant is EAP > based when using EAPOL, and so the NAS would have to understand EAP to > be able to extract the User-Name string and write it into the > Access-Request packet ? Nope; see RFC 3579 for the gory details: "the NAS MUST copy the contents of the Type-Data field of the EAP-Response/Identity received from the peer into the User-Name attribute" The use of "anonymous" is simply to preserve privacy; it's not a technical requirement of any EAP method (that I know of). An interesting tangent: note that "end-user identity hiding" is simply a "requirement" of RFC 4017 ("EAP Method Requirements for Wireless LANs"), which I think is a shame. > So although the NAS must send an EAP-Identity-Request when the client > connects it's not required to understand the EAP-Identity-Response ? For the reason given above, it *does* need to understand the EAP-Identity-Response. But that's about it! The NAS is a pretty dumb device. josh.

3 6

FreeRadius 1.1.6 Segmentation Fault with LDAP
by Robert E. Toense 26 Jun '07

26 Jun '07

I am attempting to setup FreeRadius 1.1.6 to do PEAP authentication to an LDAP backend on another server. PEAP is working just fine to local Radius passwords. However, I get a segmentation fault whenever I try to use LDAP. Output from radiusd -X follows (sensitive information sanitized). OpenLDAP 2.3.30 is also installed. This is a Fedora Core 5 system. I see no network traffic between the Radius server and the LDAP server. Any hints? Robert .... rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'ou=AAAA,dc=BBBB,dc=CCCC,dc=DDD' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to lappgen.nist.gov:636, authentication 0 Segmentation fault

2 1

XLAT Parsing error.
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Hi, Another small xlat parsing error, alternate values arnt being parsed correctly in xlat strings involving modules. update request { Supplicant-Flags = "%{sql_clients:SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null}" } expands to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null when should expand to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1 What would be really cool is if one query returned a null string a second query could be executed as an alternate, but i'm not sure how hard that would be to do. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 2