- Freeradius-Users - lists.freeradius.org

Is this hack possible?
by Erling Paulsen 17 Nov '06

17 Nov '06

Hi. I'm using FreeRADIUS to authenticate Wireless users (WPA) to an LDAP backend. FreeRADIUS also rewrites attributes for dynamic Vlan assignments. Works like a charm. Is it possible to make FreeRADIUS rewrite/force an "Access Denied" reply into an "Access Accept" reply? Why on earth would I want this? Well, I would like to i.e. give a guest-net Vlan back to users that actually fail authentication, so that when they try to access the web they will instead get connected to a redirected guest-information webpage. - or does anyone have an idea of how such a functionality can be achieved through some kindof magic? We're using lightweight AP's connected to Cisco WISM controllers. - Erling Paulsen

5 5

Prompting for credentials
by sak 17 Nov '06

17 Nov '06

I have installed FreeRADIUS 1.1.3 on RHEL4. I want to authenticate clients who use the wireless network. Clients are connected to server via Linksys Wireless Router. Linksys Wireless Router is configured to have security mode as RADIUS. Protocol being used is Protected EAP (PEAP). So the RADIUS Configuration files are updated accordingly. Now RADIUS is working fine but the problem is "user is prompted for username and password for the first time only". When user tries to connect next time it does not prompt for the credentials but uses the same username and password. What I want is user should be asked everytime he tries to connect to the network, not for the first time only. is it possible that the information is being cached on the client system? So can anyone help me? -- View this message in context: http://www.nabble.com/Prompting-for-credentials-tf2635726.html#a7356712 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RE: Prompting for credentials
by Garber, Neal 17 Nov '06

17 Nov '06

>Is it possible that the information is being cached on the >client system? So can anyone help me? Windows XP caches credentials for PEAP. If you want it to reprompt, you'll need to delete a registry key (HKCU\Software\Microsoft\Eapol\UserEapInfo). See http://support.microsoft.com/kb/823731 for more info. Vista has the ability to control caching of credentials (i.e., you can tell it not to do so).

2 1

radcheck entry issue
by Sri 17 Nov '06

17 Nov '06

Hi, I need to add two users with same name, from different NASes/stations. I added the two groups for them in usergroup and corresponding entries in radcheck and radreply tables. So they look like this: usergroup: ----------------------------------- 1 Ronrobert dialup 2 Ronrobert conference ----------------------------------- radcheck ---------------------------------------- 1 Ronrobert Password == value 2 Ronrobert Password == value2 ---------------------------------------- radreply --------------------------------------------- 1 Ronrobert Reply-Message := value1 2 Ronrobert Reply-Message := value2 . . . ---------------------------------------------- But the authentication failed for both users as FR not able identify which user to consider? Is there any other way to address this problem? Thanks in advance.

1 0

redundant block in CVS 2006-11-16
by freeradius＠list.coretech.ro 17 Nov '06

17 Nov '06

hello, I am trying to switch from cvs version 2006-08-24 to cvs version 2006-11-16 and my accounting redundant group is processing the second module even if the first one is returning ok. why is detail_fail processed if sql returns ok ? Is something (I do not find in doc / changelog) changed ? thanks, Razvan Radu radiusd.conf: accounting { detail redundant { sql detail_fail } } radiusd -X Processing the accounting section of radiusd.conf modcall: entering group accounting for request 14 radius_xlat: '/acct/freeradius/accounting_full/192.168.0.1/20061116' rlm_detail: /acct/freeradius/accounting_full/%{Client-IP-Address}/%Y%m%d expands to /acct/freeradius/accounting_full/192.168.0.1/20061116 radius_xlat: 'Thu Nov 16 19:15:44 2006' modcall[accounting]: module "detail" returns ok for request 14 modcall: entering group for request 14 radius_xlat: ' ... LONG SQL QUERY ...' rlm_sql (sql): Reserving sql socket id: 46 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released sql socket id: 46 modcall[accounting]: module "sql" returns ok for request 14 radius_xlat: '/acct/freeradius/accounting_fail/192.168.0.1/1163697344' rlm_detail: /acct/freeradius/accounting_fail/%{Client-IP-Address}/%l expands to /acct/freeradius/accounting_fail/192.168.0.1/1163697344 radius_xlat: 'Thu Nov 16 19:15:44 2006' modcall[accounting]: module "detail_fail" returns ok for request 14 modcall: group returns ok for request 14 modcall: group accounting returns ok for request 14 Sending Accounting-Response of id 85 to 192.168.0.1 port 23148 Finished request 14

2 2

ldap attributes and spaces
by Stefan Winter 17 Nov '06

17 Nov '06

Hi, I'm trying to retrieve some replyItems from an AD backend. It works fine as expected with most attributes, but there are some string attributes which contain spaces like displayName = aaa Restena, Fondation with ldap.attrmap RESTENA-Full-Name displayName (RESTENA-Full-Name properly defined as dictionary item, in two tries once as string, once as octets) This gets picked up by rlm_ldap as RESTENA-Full-Name = aaa I.e. processing stops after the first space. I can work around this entering quotes literally in the appropriate AD attribute, like displayName = "aaa Restena, Fondation" then FR picks up the whole string, but without the quotes (which is what I want). Unfortunately, the AD is not mine and changes on their end are a no-go. Is there anything I can do on the FR side that gives me the whole attribute? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

freeradius with active directory integration
by Karthik R 16 Nov '06

16 Nov '06

In my setup am trying to authenticate wifi users using PEAP with TLS against the active directory using freeradius. i m using linksys wap54g AP. i may be going somewhat out of this forum related to, but as am using freeradius i thought of posting it here. I was able to successfully configure the freeradius v1.1.1 on a RHEL 4 box and integrated with windows 2003 active directory. I was able to pull the users and groups from active directory using getent group and getent passwd command and ntlm_auth also work great. I configured the windows XP supplicant as mentioned in this link: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO The issue is when i try to connect the wireless client, i dont see any traffic hitting the freeradius server unless i enable "Authentication as computer when computer info is available" in client. Does anyone faced this issue or pour some light ?

1 0

logging to normal radius.log and syslog
by Michael Messner 16 Nov '06

16 Nov '06

hey @all, for testing we write the complete debugging messages to syslog into a special file but with this method the loggin to the normal radius.log file won't work anymore! We start radiusd with daemontools and with these parameters: loggeropt="logger -p local6.info -t radiusd -s" ARGS="-Afxyz" NICELEVEL="-10" exec nice -n $NICELEVEL $RADIUSD $ARGS | $loggeropt this works quite good but there are nomore messages in the radius.log - file. the radiusd.conf: 15:09:45 Xradius ~ [root]grep radius.log /etc/raddb/radiusd.conf log_file = ${logdir}/radius.log the detail logs are working! any ideas what can I do? thanks mIke

3 5

Mysql and usage of radgroupcheck
by Anne-Mie Vandermeeren 16 Nov '06

16 Nov '06

I have set up Freeradius working fine with a users-file. I did some tests to change to Mysql and all was ok, until I want to add some conditions for users in more than one group. This looks like a simple setup for Mysql, but it's not working as I thought it would: mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | user1 | Group1 | 1 | | user1 | Group2 | 2 | +----------+-----------+----------+ 2 rows in set (0.00 sec) mysql> select * from radcheck; +----+----------+---------------+----+------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+------------+ | 1 | user1 | User-Password | == | paswoordje | +----+----------+---------------+----+------------+ 1 row in set (0.00 sec) mysql> select * from radreply; Empty set (0.00 sec) mysql> select * from radgroupcheck; +----+-----------+----------------+----+--------------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+--------------+ | 1 | Group1 | NAS-IP-Address | == | 172.16.224.1 | | 2 | Group2 | NAS-IP-Address | == | 172.16.224.2 | +----+-----------+----------------+----+--------------+ 2 rows in set (0.01 sec) mysql> select * from radgroupreply; +----+-----------+-----------+----+----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+----------+ | 1 | Group1 | Class | := | groepje1 | | 2 | Group2 | Class | := | groepje2 | +----+-----------+-----------+----+----------+ 2 rows in set (0.00 sec) I use ntradping to check the setup. When I use NAS-IP-Address = 172.16.224.1 I get the correct class (groepje1), but when I use the NAS-IP-Address = 172.16.224.2 I get a reject and not as I was expecting the class-attribute groepje2. I can't figure out why this is the case. The debug output is not helping me, either. Anyone a suggestion on solving this? ---- DEBUG output for NAS-IP-Address = 172.16.224.1-------------- rad_recv: Access-Request packet from host 157.193.39.138:3674, id=65, length=51 User-Name = "user1" User-Password = "paswoordje" NAS-IP-Address = 172.16.224.1 Tue Nov 14 16:37:17 2006 : Debug: Processing the authorize section of radiusd.conf Tue Nov 14 16:37:17 2006 : Debug: modcall: entering group authorize for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 37 Tue Nov 14 16:37:17 2006 : Debug: rlm_realm: No '@' in User-Name = "user1", looking up realm NULL Tue Nov 14 16:37:17 2006 : Debug: rlm_realm: No such realm "NULL" Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 37 Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'user1' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'user1' Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): Released sql socket id: 2 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall: leaving group authorize (returns ok) for request 37 Tue Nov 14 16:37:17 2006 : Debug: auth: type Local Tue Nov 14 16:37:17 2006 : Debug: auth: user supplied User-Password matches local User-Password Tue Nov 14 16:37:17 2006 : Auth: Login OK: [user1] (from client ntradping port 0) Sending Access-Accept of id 65 to 157.193.39.138 port 3674 Class := 0x67726f65706a6531 ---- DEBUG output for NAS-IP-Address = 172.16.224.2-------------- rad_recv: Access-Request packet from host 157.193.39.138:3675, id=66, length=51 User-Name = "user1" User-Password = "paswoordje" NAS-IP-Address = 172.16.224.2 Tue Nov 14 16:45:11 2006 : Debug: Processing the authorize section of radiusd.conf Tue Nov 14 16:45:11 2006 : Debug: modcall: entering group authorize for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 38 Tue Nov 14 16:45:11 2006 : Debug: rlm_realm: No '@' in User-Name = "user1", looking up realm NULL Tue Nov 14 16:45:11 2006 : Debug: rlm_realm: No such realm "NULL" Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 38 Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'user1' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'user1' Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): Released sql socket id: 1 Tue Nov 14 16:45:11 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [user1] Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "sql" returns notfound for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall: leaving group authorize (returns ok) for request 38 Tue Nov 14 16:45:11 2006 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Nov 14 16:45:11 2006 : Debug: auth: Failed to validate the user. Tue Nov 14 16:45:11 2006 : Auth: Login incorrect: [user1] (from client ntradping port 0) Tue Nov 14 16:45:11 2006 : Debug: Delaying request 38 for 1 seconds Tue Nov 14 16:45:11 2006 : Debug: Finished request 38 Tue Nov 14 16:45:11 2006 : Debug: Going to the next request Tue Nov 14 16:45:11 2006 : Debug: --- Walking the entire request list --- Tue Nov 14 16:45:11 2006 : Debug: Waking up in 1 seconds... Tue Nov 14 16:45:12 2006 : Debug: --- Walking the entire request list --- Tue Nov 14 16:45:12 2006 : Debug: Waking up in 1 seconds... Tue Nov 14 16:45:13 2006 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 66 to 157.193.39.138 port 3675 Anne-Mie

2 3

Tsunami MP.11 5054-R base station and Tsunami MP.11 5054-R
by Cameron Cowie 16 Nov '06

16 Nov '06

Hi all Is there anyone out there that works or has worked with the Tsunami base station / subscriber unit combo. I can get the base station to authenticate against my free radius server and it works beautifully, but when I get the subscriber unit to try to authenticate through the b/s it skips it and looks for the next available b/s that is not running radius authentication. Now is this a limitation of the hardware or am I missing a clue on the radius server? Trouble shooting I have done so far. Boot the radius server with raidusd -XX turn on the basestation have it authenticate. turn on the subscriber unit and nothing. Thanks all: Cameron

1 0