- Freeradius-Users - lists.freeradius.org

mysql and Auth-Type:=Reject Problem
by Norbert Wegener 13 Oct '06

13 Oct '06

I am using a mysql database with user information and simulate an 802.1x authentication via eapol_test. In special situations I want to send an Auth-Type:=Reject from the table radreply, although the EAP authentication succeeded. This does not seem to work for me with freeradius 1.1.3. freeradius -AX .... modcall: leaving group authenticate (returns ok) for request 21 Sending Access-Accept of id 9 to 127.0.0.1 port 1226 Framed-IP-Address = 1.2.3.4 MS-MPPE-Recv-Key = 0xd8a5e8adaa368def127716024634cf6d7633ed034d8206e376ab21f408771f31 MS-MPPE-Send-Key = 0x7e67cb055071a333c28c7e462914bcfba12208c6a547ef8740c939f9c3be5173 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/de7018tc.ww901.siemens.net" Finished request 21 Going to the next request Waking up in 6 seconds... where the ip 1.2.3.4 is definitely from that table and the select freeradius starts, gives the correct result in mysql client itself: mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'host/de7018tc.ww901.siemens.net' ORDER BY id; +----+---------------------------------+-------------------+---------+----+ | id | UserName | Attribute | Value | op | +----+---------------------------------+-------------------+---------+----+ | 32 | host/de7018tc.ww901.siemens.net | Auth-Type | Reject | := | | 33 | host/de7018tc.ww901.siemens.net | Framed-IP-Address | 1.2.3.4 | = | +----+---------------------------------+-------------------+---------+----+ The operator ==,+= or = do not work either. The database contains the following: mysql> select * from usergroup; +----------+---------------------------------+-----------+---------------------+---------------------+---------+ | id | UserName | GroupName | loaddate | validto | konftyp | +----------+---------------------------------+-----------+---------------------+---------------------+---------+ | 16148296 | HOST/de7018tc.ww901.siemens.net | vl1 | 2006-10-12 14:17:22 | 2006-10-13 00:00:00 | NULL | +----------+---------------------------------+-----------+---------------------+---------------------+---------+ 1 row in set (0.00 sec) The following entry is only there to get the attributes from radreply later: mysql> select * from radcheck; +----------+---------------------------------+--------------+----+-------+---------------------+ | id | UserName | Attribute | op | Value | validto | +----------+---------------------------------+--------------+----+-------+---------------------+ | 12131722 | HOST/de7018tc.ww901.siemens.net | Idle-Timeout | += | 12345 | 2006-10-13 00:00:00 | +----------+---------------------------------+--------------+----+-------+---------------------+ 1 row in set (0.00 sec) mysql> select * from radreply; +----+---------------------------------+-------------------+----+---------+------------+--------------+---------+ | id | UserName | Attribute | op | Value | ra_nasname | ra_GroupName | validto | +----+---------------------------------+-------------------+----+---------+------------+--------------+---------+ | 32 | host/de7018tc.ww901.siemens.net | Auth-Type | := | Reject | 4711 | NULL | NULL | | 33 | host/de7018tc.ww901.siemens.net | Framed-IP-Address | = | 1.2.3.4 | 0815 | NULL | NULL | +----+---------------------------------+-------------------+----+---------+------------+--------------+---------+ 2 rows in set (0.00 sec) The complete logfile can be found at http://www.wegener-net.de/fr/ What do I have to change to make that work? Thanks Norbert Wegener

2 1

TRAPs with radius
by Kshitij Korde 13 Oct '06

13 Oct '06

When I try to monitor radius server with SNMP Manager I find 1. When the radius server goes down the snmp agent generates the trap which is seen by the SNMP manager (snmp management console). 2. When the snmp agent comes up it generates a trap ( Cold start LINK UP trap ). How should I configure the snmpd.conf file so that a trap is generated by the snmp agent when the radius server comes up. Thanks Kshitij ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

Active Directory with NTLM_AUTH
by duckeo 13 Oct '06

13 Oct '06

Okay I've been following the Wiki for Active Directory Integration but now I'm stuck. I'm successful at getting the machine to join the AD with Samba3, I have NTLM_AUTH working from the command line to challenge for the user and return successful. Next part is getting FreeRadius to use this information. The end result is that I am using a Dial Up adapter within Windows to talk to radius, so I want the default Windows settings of MSCHAP to work first (means I have to customise the client end less). What (if anything) do I need to do to the users file? I also need to check that the user is a member of a particular group in Active Directory before Access-Accept is sent - do I fall back to LDAP for this? I have had LDAP only working with PAP, but am stuck with getting it to work with MS-CHAP.

1 0

RE: Help: How to authenticate additional attribute
by Garber, Neal 13 Oct '06

13 Oct '06

> I would like to authenticate the client with its location coordinate You didn't provide much information about what a "location coordinate" is and how you would determine whether you would allow/deny access. Is this where the user is located geographically? Do you want them to enter it or should it be derived?

1 0

Help: How to authenticate additional attribute
by Chew, Heng Hui (Andy) FORNATL, SN 12 Oct '06

12 Oct '06

Hi, I am running FreeRadius to authenticate with a WinXP SP2 client using PEAP on WPA2. However, in addition to the normal username and password authentication, I would like to authenticate the client with its location coordinate i.e. the authentication will be based on username, password and location coordinate. I understand that WinXP provides a dialog box that allows me to input the username and password. Can I use the domain field to input the location coordinate? If this is possible, what must be configured or done to the FreeRadius so that it may authenticate this additional attribute? Do I need to modify the source code? Is there anybody who may advice me on this? Thanks. With Regards, Chew Heng Hui Andy

1 0

Help returning multiple values for attrbute (rlm_ldap)
by Owen DeLong 12 Oct '06

12 Oct '06

OK... The suggestion I got here last night allowed me to get basic auth working as desired, however, I have another problem. I need to return in the reply a series of values for a given attribute, such as: dn: uid=foo,ou=people,dc=zone,dc=example,dc=com uid: foo Attribute: first_value Attribute: second_value Attribute: third_value I have LDAP Attribute mapped to Radius-Attribute in the ldap.attrmap. However, when I query the server, I get back: Radius-Attribute: first-value And the second and third values are not returned. Is there a way to make this work? Thanks, Owen

2 2

RE: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ?
by Mak Moussa 12 Oct '06

12 Oct '06

Hi, I would appreciate any insight into the 802.1x authentication using TTLS with MSCHAPv2. Such auth scheme is constantly failing in my wireless setup with FreeRadius. I tried 3 versions v1.0.5, v1.1.2 and v1.1.3 with not much luck. The following authentication schemes worked fine: 1. TTLS w/ MSCHAP from my wireless client to freeradius v1.0.5, v1.1.2, v1.1.3 2. PEAP w/ MSCHAPv2 with same wireless client to same freeradius versions. 3. TTLS w/ MSCHAPv2 from the same wireless setup to an SBR v5.3 The freeradius debug does indicate successful auth and both MPPE keys sent to the client. modcall[authenticate]: module "mschap" returns ok for request 17 modcall: leaving group MS-CHAP (returns ok) for request 17 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 17 modcall: leaving group authenticate (returns ok) for request 17 Sending Access-Accept of id 21 to 172.16.10.254 port 32777 MS-MPPE-Recv-Key = 0x6a72b3417ed819d9e4d3e5fa8867d1d8211c41941fe2035d33f24b906b3b4406 MS-MPPE-Send-Key = 0x29098f385530c131460af68bc229719d9b5b1dea1e70a783f89acac8ea17aa17 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Moussa" Finished request 17 However, the client debug shows wpa msg 1 was dropped as follows: 22:53:12.156 ++ EAPOL message received 22:53:12.156 Message dequeued 22:53:12.156 [DTL] Received EAPOL packet 00000000: 01 03 00 5F FE 00 89 00 20 00 00 00 00 00 00 00 ..._.... ....... 00000010: 01 1F 74 D9 48 45 D8 28 4E 3C E4 B3 0B D4 59 3D ..t.HE.(N<....Y= 00000020: 04 C0 20 9B 00 3A 81 5D EE 4D 90 F1 96 63 98 7B .. ..:.].M...c.{ 00000030: E5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 ... 22:53:12.156 [NRM] Processing EAPOL-Key message 22:53:12.156 [DTL] Received replay counter is 0000000000000001 22:53:12.156 [DTL] EAPOL-Key message version = 1 22:53:12.156 [NRM] Processing EAPOL-Key 4-way handshake message 1 22:53:12.156 [NRM] Setting master session key(s) 22:53:12.156 [ERR] Cannot set master key: authentication not complete or method does not support session keys 22:53:12.156 [ERR] EAPOL-Key pairwise key message 1 discarded: no PMK If I made a freeradius configuration mistake, TTLS with mschap wouldn't work. Any help is very much appreciated. Mak

7 16

RE: windows login using freeradius?
by Garber, Neal 12 Oct '06

12 Oct '06

> if yes, can we guide me to some related materials? http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO

3 2

Securew2
by Alessandro Agostini 12 Oct '06

12 Oct '06

Hi to all, anybody know what's happening to securew2 site? It is down from a few of week ago. Does it disappeared? Thanks A.Agostini

3 2

RE: Securew2
by Garber, Neal 12 Oct '06

12 Oct '06

> anybody know what's happening to securew2 site? > It is down from a few of week ago. They sent an E-mail stating that it moved. Try: http://securew2.alfa-ariss.com/uk/index.htm

1 0