- Freeradius-Users - lists.freeradius.org

Machine account authentication progress?
by Peter Savage 17 May '07

17 May '07

Has anything happened in this area, to allow machine authentication against AD? From reading the mailing list I believe it was a problem with ntlm_auth, is this any closer to getting fixed, if not, how do people work around it. We have laptops here that authenticate against the domain if it's available, or locally if not. There is a logon script if they are at the site. How best I work round this? -- Pete Savage - cbx33::silentk wiki.ubuntu.com/PeteSavage

3 16

expiration doesn't work in freebsd + mysql
by Richard Cotrina 17 May '07

17 May '07

Hello : I'm getting a weard error using expiration with mysql backend in FreeBSD. The same configuration works fine in linux (centos) but not in FreeBSD 6.1 In Linux, all works fine (freeradius 1.1.6 + mysql 5.0), I've tried both "==" and ":=" operators and everything goes well. In FreeBSD 6.1 (freeradius 1.1.6 + mysql 4.1) everything works fine until I enable Expiration in the user's attributes. Despite the fact that I use the same configuration, I got the following message, whatever the operator be : **************************************************************************** ************************ Invalid operator for item Expiration: reverting to '==' rlm_sql (sql): No matching entry in the database for request from user [test(a)test.com] **************************************************************************** ************************ Has anyone had a similar experience ? Kind Regards Richard Cotrina

1 1

Re: Pool-Name from Called-Station-Id
by Hugh Messenger 17 May '07

17 May '07

Hugh Messenger (that's me!) said: > Alan DeKok said: > > > DEFAULT Called-Station-Id =~ "^(\w+_pppoe_\d+)$", Pool-Name := > `%{1}` > > > > \w && \d may not be supported by the regex library on your system. You > > may have to use [a-fA-F] etc. explictely. > > I don't seem to be able to get this to work. This is my DEFAULT entry: > > DEFAULT Called-Station-Id =~ "^([A-z0-9]+_pppoe_[0-9]+)$", Pool-Name := > `%{1}` > Framed-IP-Netmask = 255.255.0.0, > Fall-Through = 1 > > ... and it seems to be matching on authentication requests, as per this -X > fragment: > > users: Matched entry DEFAULT at line 162 > > ... where line 162 is the above DEFAULT. And I've triple checked my > regexp > using my IDE's RX toolkit. But sqlippool isn't picking up that pattern > match as the pool name: > > rlm_sql_mysql: query: SELECT FramedIPAddress FROM radippool WHERE > pool_name = '' AND expiry_time < NOW() ORDER BY pool_name, (UserName <> > 'radiustest'), (CallingStationId <> '00:60:B3:45:6A:98'), expiry_time > LIMIT 1 FOR UPDATE > sqlippool_query1: SQL query did not return any results > > If I replace the regexp version with a specific one, like ... > > DEFAULT Called-Station-Id == "brantley_pppoe_141", Pool-Name := > "brantley_pppoe_141" > > ... it all works fine. *bump* I hate to bump my question like this, but I think it may have gotten lost in a flurry of activity that day. And I really would like to get this working. TIA for any suggestions. -- hugh

2 1

freeradius <=> MS IAS passthrough
by Ian Savoy 17 May '07

17 May '07

Does anyone have any specific tweaks to get MS IAS and freeradius "talking"? We're trying to share resources with another isp in the area - their IAS server needs to be able to auth against our freeradius server, and visa versa with our freeradius to their IAS. A link to a tutorial would be sooooo nice :) I've looked in the dictionaries, but i'm afraid i don't know enough about IAS to really make any sense out of it...other than the fact that it "just doesn't work." So, hints, tips, tricks, and/or tutorials would be oh so lovely :) Thanks in advance -Ian Savoy -- Ian Savoy Webforce Systems, Inc Operations Support/UNIX Engineer CompTIA A+ Certified Professional Tech. Support: 614-899-9257 x22 Website: http://www.ewebforce.net

6 10

radius+ldap+peap
by Arjuna Scagnetto 17 May '07

17 May '07

can someone tell me a good tutorial about making work freeradius with ldap and peap on a 802.1x architecture ? For the moment my freeradius server dies with a Segmentation Fault, i think it's caused by a misunderstanding between peap and ldap but i'm not sure. radius.conf{ ldap { server = "127.0.0.1" #identity = "cn=manager" #password = prova basedn = "dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectClass=radiusprofile)" password_attribute = userPassword } } user in ldap database { dn: uid=wclient,ou=dot1x,dc=example,dc=com objectClass: top objectClass: radiusprofile objectClass: inetOrgPerson cn: wclient sn: wclient uid: wclient description: 802.1x user userPassword: {SSHA}xxxxxxxxxxxxxxxxxxx } Now when i try to authenticate the wireless station freeradius die with a Segmentation Fault: ... _realm: No '@' in User-Name = "wclient", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for wclient radius_xlat: '(uid=wclient)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=wclient) rlm_ldap: Added password {SSHA}tymOzgljNoVkhZT+K1+jUIW7HKkX3Epe in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value {SSHA}tymOzgljNoVkhZT+K1+jUIW7HKkX3Epe & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user wclient authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 Segmentation fault thanks for helping Arjuna -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

SQL query in Pre-Proxy
by Ashraf Al-Basti 17 May '07

17 May '07

Dear all, i want to use freeradius as a proxy server for more than domain, but i need to do some query from the DB before doing proxy. i have a DB that contain the username and the telephone number and the domain for that user. i want to do a query to check if for that data, if matched to do proxy if not to cancel the proxy. please advice...

4 8

free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 17 May '07

17 May '07

Dear all My EAPTLS is working with free radisu 1.1.6 as i did every installation starts from zero Thanks for all for the help. I have few quires for free radius as i was using navis radius. 1 Where will i find the log of the authentication like.... username login ok...or login failed 2 One user\'s certificate if I installed in other user\'s laptop it works.I want one user certificate should work in one laptop only. 3 In users file i havn\'t added any certificate name as it is eap-tls.So if i want to remove the user from n/w i don\'t have control.Is ther any method like i can add the certificate names in users file then only it should work Regards Anoop

3 2

Problem with windows 802.1x client freeradius & digicert wildcard certificate
by Phil Brown 17 May '07

17 May '07

-----BEGIN PGP SIGNED MESSAGE----- I have a problem with getting freeradius 116 to work with our digicert wildcard certificate from winxp & vista 802.1x clients. Everything works fine with other clients & everything works fine if I use a self signed certificate. I have trawled through the list history & have taken all the actions that I found suggested (applying hotfixes) but have made no progress, any suggestions would be appreciated. rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 Phil Brown Lan support Room 2-04 Halpern House ISO department University of Portsmouth -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: PGP 5.0 for OS/2 Charset: cp850 wsBVAwUBRkwbkx8HY4rdc96FAQH4ggf/QSiD/5v30HOSGQwRPLcTYq8deJWjlNKl V3qtLrq6JiPRbPxPoQqrq5//euqec1Az8WgC8VJLzcgU6pBa9+OLp+CXBseHDU2N MyCz0vXFD4MdKCDzVt5fPcobhyCULS72pUiTG/GN/BUKdMBzi45lHTM7A2iI9k5V q5VSK7PRG5TKXu7uNW157VGhxKx7ATo3ghlgIVBbTta/qgjz42wyL9m/pzX22UrB NVJFfBJD2JvvxMHZXGOMhLer5Bi26s4lCiIEO3dgym7pqbXW+k8egjX6H0EKdseQ LCPvGLIobaYLGCRgqOR+XrVgK9dgUnPqTId6AihpOmKFJ0xntPSfUw== =ToEW -----END PGP SIGNATURE-----

2 1

users are sending CHAP passwords
by vik 17 May '07

17 May '07

Sorry for the double post before. I'm still stuck with that problem: How to tel the user not to send CHAP-Password ? As to the server version i will update to 1.1.6 later on today. Thx a lot. ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Get your own web address. Have a HUGE year through Yahoo! Small Business. http://smallbusiness.yahoo.com/domains/?p=BESTDEAL

2 1

Cisco Access Points
by Christian Ejlertsen 17 May '07

17 May '07

Hello to all I'm very new at this whole radius deal so I hope I can find a kind soul that could help me with this setup. I'm sorry if this is described somewhere I've been looking around and I don't seem to find this. For now i'm trying to get a very simple setup to work I have a Cisco 1121G AP which I want to use with my freeeradius server EAP/PEAP Nothing fancy just a user local on the freeradius server I can't get the user credentials to authenticate It's a Windows machine that I trying to authenticate with and the wireless netcard is set to use EAP (PEAP), no certificates and EAP-MSCHAPv2 as authentication method. I have a user in the radius users file called wifiuser User-Password := "SomePasswordHere" MS-CHAP-Use-NTLM-Auth := 0 In the clients.conf I have client 192.168.150.250 { secret = SomePasswordHere shortname = CiscoAP1121 nastype = cisco } In the eap.conf I unmarked default_eap_type = mschapv2 Then I read this in the eap.conf # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } Does this apply to my setup and if so what is an alternative to what I'm trying todo? When I debug on the cisco AP I get the following lines that are odd (Full log in bottom of the mail) *Apr 23 19:50:57.298: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.299: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.299: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.299: RADIUS: 33 It's a pretty standard Freeradius config havn't done anything to it but added some users and one other client. Thank you in advance Christian -------- LOGS BELOW --------- All I get in radius.log is Mon May 14 19:50:20 2007 : Info: rlm_eap_md5: Issuing Challenge --------------- CISCO DEBUG RADIUS ----------------------- *Apr 23 19:50:57.288: RADIUS/ENCODE(000000D3):Orig. component type = DOT11 *Apr 23 19:50:57.288: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.288: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.288: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.288: RADIUS: 33 [3] *Apr 23 19:50:57.288: RADIUS(000000D3): Storing nasport 336 in rad_db *Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.289: RADIUS/ENCODE(000000D3): acct_session_id: 82 *Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.289: RADIUS(000000D3): sending *Apr 23 19:50:57.290: RADIUS(000000D3): Send Access-Request to 192.168.150.1:1812 id 1645/33, len 135 *Apr 23 19:50:57.290: RADIUS: authenticator EA B6 33 72 6C 09 8E CF - 84 B1 60 BB 54 B8 55 BF *Apr 23 19:50:57.290: RADIUS: User-Name [1] 10 "wifiuser" *Apr 23 19:50:57.290: RADIUS: Framed-MTU [12] 6 1400 *Apr 23 19:50:57.290: RADIUS: Called-Station-Id [30] 16 "0017.0e86.2cb0" *Apr 23 19:50:57.290: RADIUS: Calling-Station-Id [31] 16 "000e.35e6.0bd0" *Apr 23 19:50:57.290: RADIUS: Service-Type [6] 6 Login [1] *Apr 23 19:50:57.291: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.291: RADIUS: EAP-Message [79] 15 *Apr 23 19:50:57.291: RADIUS: 02 02 00 0D 01 77 69 66 69 75 73 65 72 [?????wifiuser] *Apr 23 19:50:57.291: RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19] *Apr 23 19:50:57.292: RADIUS: NAS-Port [5] 6 336 *Apr 23 19:50:57.292: RADIUS: NAS-IP-Address [4] 6 192.168.150.250 *Apr 23 19:50:57.292: RADIUS: Nas-Identifier [32] 10 "VOICE-AP" *Apr 23 19:50:57.293: RADIUS: Received from id 1645/33 192.168.150.1:1812, Access-Challenge, len 80 *Apr 23 19:50:57.294: RADIUS: authenticator F9 A4 EE 6B E1 5A 8A AB - F5 BD 19 CA 96 33 48 CA *Apr 23 19:50:57.294: RADIUS: EAP-Message [79] 24 *Apr 23 19:50:57.294: RADIUS: 01 03 00 16 04 10 41 8F DB 50 B7 94 9A 30 DF CE [??????A??P???0??] *Apr 23 19:50:57.294: RADIUS: 60 DA D1 51 EB 08 [`??Q??] *Apr 23 19:50:57.294: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.294: RADIUS: State [24] 18 *Apr 23 19:50:57.295: RADIUS: DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54 FB [?SV????????F?!T?] *Apr 23 19:50:57.295: RADIUS(000000D3): Received from id 1645/33 *Apr 23 19:50:57.296: RADIUS/DECODE: EAP-Message fragments, 22, total 22 bytes *Apr 23 19:50:57.298: RADIUS/ENCODE(000000D3):Orig. component type = DOT11 *Apr 23 19:50:57.298: RADIUS: AAA Unsupported [263] 12 *Apr 23 19:50:57.299: RADIUS: 57 49 46 49 5F 50 52 49 56 41 [WIFI_PRIVA] *Apr 23 19:50:57.299: RADIUS: AAA Unsupported [156] 3 *Apr 23 19:50:57.299: RADIUS: 33 [3] *Apr 23 19:50:57.299: RADIUS(000000D3): Using existing nas_port 336 *Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.300: RADIUS/ENCODE(000000D3): acct_session_id: 82 *Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250 *Apr 23 19:50:57.300: RADIUS(000000D3): sending *Apr 23 19:50:57.300: RADIUS(000000D3): Send Access-Request to 192.168.150.1:1812 id 1645/34, len 146 *Apr 23 19:50:57.300: RADIUS: authenticator 56 F3 92 78 A7 7A 09 FA - 99 29 51 99 7D E0 9F B3 *Apr 23 19:50:57.301: RADIUS: User-Name [1] 10 "wifiuser" *Apr 23 19:50:57.301: RADIUS: Framed-MTU [12] 6 1400 *Apr 23 19:50:57.301: RADIUS: Called-Station-Id [30] 16 "0017.0e86.2cb0" *Apr 23 19:50:57.301: RADIUS: Calling-Station-Id [31] 16 "000e.35e6.0bd0" *Apr 23 19:50:57.301: RADIUS: Service-Type [6] 6 Login [1] *Apr 23 19:50:57.302: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:50:57.302: RADIUS: EAP-Message [79] 8 *Apr 23 19:50:57.302: RADIUS: 02 03 00 06 03 19 [??????] *Apr 23 19:50:57.302: RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19] *Apr 23 19:50:57.302: RADIUS: NAS-Port [5] 6 336 *Apr 23 19:50:57.302: RADIUS: State [24] 18 *Apr 23 19:50:57.302: RADIUS: DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54 FB [?SV????????F?!T?] *Apr 23 19:50:57.302: RADIUS: NAS-IP-Address [4] 6 192.168.150.250 *Apr 23 19:50:57.303: RADIUS: Nas-Identifier [32] 10 "VOICE-AP" *Apr 23 19:51:02.527: RADIUS: no sg in radius-timers: ctx 0xC2506C sg 0x0000 *Apr 23 19:51:02.527: RADIUS: Retransmit to (192.168.150.1:1812,1813) for id 1645/34 *Apr 23 19:51:02.527: RADIUS: Received from id 1645/34 192.168.150.1:1812, Access-Reject, len 44 *Apr 23 19:51:02.528: RADIUS: authenticator 27 C2 B4 DD 14 F9 C3 C0 - DF 88 BD B5 DC 0D 6C 63 *Apr 23 19:51:02.528: RADIUS: EAP-Message [79] 6 *Apr 23 19:51:02.528: RADIUS: 04 03 00 04 [????] *Apr 23 19:51:02.528: RADIUS: Message-Authenticato[80] 18 * *Apr 23 19:51:02.529: RADIUS(000000D3): Received from id 1645/34 *Apr 23 19:51:02.529: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes ------------------------ CISCO DEBUG RADIUS END ---------------------

3 4