- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 24, Issue 2
by Arran Cudbard-Bell 01 Apr '07

01 Apr '07

>> Does anyone have a draft list of which clients actually support the >> Reply-Message and by which methods they can recieve them? >> > > All clients will accept it. Very few will do anything useful with it. > > >> The reason why I ask , it during initial tests (using chap) the built in >> windows CHAP supplicant would display the reply-messages being sent back >> from the server. >> Now we've moved on from CHAP to using EAP and the windows supplicant no >> longer displays the messages. >> > > Yes. > > >> Am I right in assuming that with EAP attributes from the access-accept >> packet only get to the NAS and that the NAS will strip out of the EAP >> message >> and pass it on to the supplicant and thats all the supplicant will ever get? >> > > Yes. > > >> In which case, although the Reply-Message attribute is also supported in >> PoD the client will never actually recieve it when using EAP ? >> > > Yes. > > Alan DeKok. > Ahh, Thanks for clearing that up ! Don't suppose EAP supports encoding the equivalent of a Reply-Message ? P.S Well done for understanding my poorly punctuated morning ramblings :) Arran

1 0

Multipls IP Pools
by Azher Amin 01 Apr '07

01 Apr '07

Hi, I have different Wireless Access Points across the students campus. Each of them support Radius Authentication for users. My question is: Based on Client (i.e. AP) IP address, can i assign different ip pools to them ?? Plz suggest. Regards -Azher -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Reply-Message in various clients & EAP vs CHAP.
by Arran Cudbard-Bell 01 Apr '07

01 Apr '07

Hi, Does anyone have a draft list of which clients actually support the Reply-Message and by which methods they can recieve them? The reason why I ask , it during initial tests (using chap) the built in windows CHAP supplicant would display the reply-messages being sent back from the server. Now we've moved on from CHAP to using EAP and the windows supplicant no longer displays the messages. Am I right in assuming that with EAP attributes from the access-accept packet only get to the NAS and that the NAS will strip out of the EAP message and pass it on to the supplicant and thats all the supplicant will ever get? In which case, although the Reply-Message attribute is also supported in PoD the client will never actually recieve it when using EAP ? Thanks, Arran

2 1

Anyone using dd-wrt for AP?
by Ian Truelsen 01 Apr '07

01 Apr '07

I am trying to set up dd-wrt to use freeradius for authentication with EAP-TLS, however, I have run into a problem: there doesn't seem to be an option under the WPA encryption system for entering the freeradius secret. If anyone has got this working, can you let me know the where and how? The dd-wrt forums have been pretty silent on the issue. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 3

Authorization/SER problems
by Dariusz Dwornikowski 31 Mar '07

31 Mar '07

HI, I managed to do password checking for user, it works. Now i would like to return soem things in Access-Accept when SER sends packet : rad_recv: Access-Request packet from host 10.240.0.144:35694, id=160, length=64 User-Name = "foo(a)sip2.foo.pl" Service-Type = SIP-Caller-AVPs NAS-Port = 0 NAS-IP-Address = 10.240.0.144 but i get Access-Reject : modcall: leaving group authorize (returns ok) for request 3 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [foo(a)sip2.foo.pl/<no User-Password attribute>] (from client openser2 port 0) I juest ant to return some parameters. -- Dariusz Dwornikowski tdi(a)vercom.pl

1 1

Joshua Borsman is out of the office.
by Joshua Borsman 30 Mar '07

30 Mar '07

I will be out of the office starting 03/30/2007 and will not return until 04/09/2007.

1 0

chap rlm_sql authentication problem
by Andrew Long 30 Mar '07

30 Mar '07

I am adding a new MSC to our list of clients and trying to verify the config with -X and ntradping. I keep getting rejected. I have the following in clients.conf: client 192.168.10.100 (MY LAPTOP IP FOR NOW) { secret = HIEg@l1er1a shortname = cn3200_hiegalleria nastype = other In NTRADPING, I am using: username: bufhiegall_cn3200 secret: HIEg@l1er1a password: password1 (same as in radius.radcheck) I note the "could not find clear text password" at bottom of reply, but am not sure why this is so; The password is present in radcheck. The -X out put is as follows: rad_recv: Access-Request packet from host 192.168.10.100:49424, id=11, length=58 User-Name = "bufhiegall_cn3200" CHAP-Password = 0x8f98ab538676182e04964979e34fbc0580 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bufhiegall_cn3200", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'bufhiegall_cn3200' rlm_sql (sql): sql_set_user escaped user --> 'bufhiegall_cn3200' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bufhiegall_cn3200' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bufhiegall_cn3200' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bufhiegall_cn3200' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bufhiegall_cn3200' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [bufhiegall_cn3200] modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "daypasscounter" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "bufhiegall_cn3200" with CHAP password rlm_chap: Could not find clear text password for user bufhiegall_cn3200 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 1 I have run all the queries manually on the server, and they all return results as expected (except the query to radgroupreply, as there is nothing configured there). Regards, Andrew Long ****** CONFIDENTIALITY NOTICE ****** NOTICE: This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system. Thank you.

3 10

Performance testing
by Murray Hooper 30 Mar '07

30 Mar '07

Are there any performance statistics available for freeradius? I am using 1.1.5 and mysql 5 and trying do determine if there will be a bottleneck in radius packet processing. The makers of my NAS are saying that this could become an issue and I am just trying to see what type of numbers people believe this solution should handle. Is it 10 transactions / second or 10,000. Thanks in advance murray

4 3

Freeradius Login
by robinson santos 30 Mar '07

30 Mar '07

My freeradius is working, the thing is that the computer that logged in, every time that it is turned off it remembers the user and do not ask for it. Can someone help me???

3 4

Re: load balancing 802.1x auth requests
by Arran Cudbard-Bell 30 Mar '07

30 Mar '07

> Message: 4 > Date: Fri, 30 Mar 2007 09:04:40 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: load balancing 802.1x auth requests > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <460CB688.2060804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alison Lee wrote: >> We would like to load-balance 802.1X wireless authentications on >> multiple radius servers. The problem is that EAP methods require a >> series of requests and replies between the client and the same radius >> server, but a normal radius proxy will treat each request as a new one >> and forward them to different servers. With the latest release of >> FreeRADIUS, is it possible to keep states in the proxy server so that it >> can distinguish new requests from current outstanding requests? > > No. > > Coincidentally, though, I've been working on upgrading the server core > in preparation for 2.0. > > I *believe* it's possible to add that load-balancing of EAP as a > module. Not as part of EAP, because other methods use State, too. But > it looks to be pretty simple. > > If you're willing to run the CVS head, there may be this capability > next week. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Id be more than willing to help test this too :) -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

1 0