- Freeradius-Users - lists.freeradius.org

Help: How to authenticate additional attribute
by Chew, Heng Hui (Andy) FORNATL, SN 12 Oct '06

12 Oct '06

Hi, I am running FreeRadius to authenticate with a WinXP SP2 client using PEAP on WPA2. However, in addition to the normal username and password authentication, I would like to authenticate the client with its location coordinate i.e. the authentication will be based on username, password and location coordinate. I understand that WinXP provides a dialog box that allows me to input the username and password. Can I use the domain field to input the location coordinate? If this is possible, what must be configured or done to the FreeRadius so that it may authenticate this additional attribute? Do I need to modify the source code? Is there anybody who may advice me on this? Thanks. With Regards, Chew Heng Hui Andy

1 0

Help returning multiple values for attrbute (rlm_ldap)
by Owen DeLong 12 Oct '06

12 Oct '06

OK... The suggestion I got here last night allowed me to get basic auth working as desired, however, I have another problem. I need to return in the reply a series of values for a given attribute, such as: dn: uid=foo,ou=people,dc=zone,dc=example,dc=com uid: foo Attribute: first_value Attribute: second_value Attribute: third_value I have LDAP Attribute mapped to Radius-Attribute in the ldap.attrmap. However, when I query the server, I get back: Radius-Attribute: first-value And the second and third values are not returned. Is there a way to make this work? Thanks, Owen

2 2

RE: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ?
by Mak Moussa 12 Oct '06

12 Oct '06

Hi, I would appreciate any insight into the 802.1x authentication using TTLS with MSCHAPv2. Such auth scheme is constantly failing in my wireless setup with FreeRadius. I tried 3 versions v1.0.5, v1.1.2 and v1.1.3 with not much luck. The following authentication schemes worked fine: 1. TTLS w/ MSCHAP from my wireless client to freeradius v1.0.5, v1.1.2, v1.1.3 2. PEAP w/ MSCHAPv2 with same wireless client to same freeradius versions. 3. TTLS w/ MSCHAPv2 from the same wireless setup to an SBR v5.3 The freeradius debug does indicate successful auth and both MPPE keys sent to the client. modcall[authenticate]: module "mschap" returns ok for request 17 modcall: leaving group MS-CHAP (returns ok) for request 17 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 17 modcall: leaving group authenticate (returns ok) for request 17 Sending Access-Accept of id 21 to 172.16.10.254 port 32777 MS-MPPE-Recv-Key = 0x6a72b3417ed819d9e4d3e5fa8867d1d8211c41941fe2035d33f24b906b3b4406 MS-MPPE-Send-Key = 0x29098f385530c131460af68bc229719d9b5b1dea1e70a783f89acac8ea17aa17 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Moussa" Finished request 17 However, the client debug shows wpa msg 1 was dropped as follows: 22:53:12.156 ++ EAPOL message received 22:53:12.156 Message dequeued 22:53:12.156 [DTL] Received EAPOL packet 00000000: 01 03 00 5F FE 00 89 00 20 00 00 00 00 00 00 00 ..._.... ....... 00000010: 01 1F 74 D9 48 45 D8 28 4E 3C E4 B3 0B D4 59 3D ..t.HE.(N<....Y= 00000020: 04 C0 20 9B 00 3A 81 5D EE 4D 90 F1 96 63 98 7B .. ..:.].M...c.{ 00000030: E5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 ... 22:53:12.156 [NRM] Processing EAPOL-Key message 22:53:12.156 [DTL] Received replay counter is 0000000000000001 22:53:12.156 [DTL] EAPOL-Key message version = 1 22:53:12.156 [NRM] Processing EAPOL-Key 4-way handshake message 1 22:53:12.156 [NRM] Setting master session key(s) 22:53:12.156 [ERR] Cannot set master key: authentication not complete or method does not support session keys 22:53:12.156 [ERR] EAPOL-Key pairwise key message 1 discarded: no PMK If I made a freeradius configuration mistake, TTLS with mschap wouldn't work. Any help is very much appreciated. Mak

7 16

RE: windows login using freeradius?
by Garber, Neal 12 Oct '06

12 Oct '06

> if yes, can we guide me to some related materials? http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO

3 2

Securew2
by Alessandro Agostini 12 Oct '06

12 Oct '06

Hi to all, anybody know what's happening to securew2 site? It is down from a few of week ago. Does it disappeared? Thanks A.Agostini

3 2

RE: Securew2
by Garber, Neal 12 Oct '06

12 Oct '06

> anybody know what's happening to securew2 site? > It is down from a few of week ago. They sent an E-mail stating that it moved. Try: http://securew2.alfa-ariss.com/uk/index.htm

1 0

proxy realm
by Nicola Iotti 12 Oct '06

12 Oct '06

Hi all, sorry...another question we use freeradius as proxy. We configured a suffix realm based proxy with delimiter character "/". If there is a username like this : "user/test/server1" (I mean with more than one "/") which one of "/" does freeradius consider as suffix delimiter ? Thank you.

1 0

Dialupadmin Problems
by Andy Dixon 12 Oct '06

12 Oct '06

Hello, I am having problems getting dialupadmin to work on FreeBSD 6.1. If I go to any of the pages (eg add user) I just get a blank screen.. Also, if anyone could point me in the direction of where I can find some information on what needs to go into the tables in a postgres database for RADIUS users, I would be greatful. Thanks

3 7

Pam radius authentication
by danieldinu＠rdslink.ro 12 Oct '06

12 Oct '06

Hello! I try to authenticate ssh users logins using pam_radius_auth.so. On my RedHat 9 I have the following setup: - freeradius server - users file: test Auth-Type := Local, User-Password == "test" - clients.conf client 127.0.0.1 { secret = secret shortname = localhost } -pam radius module - cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_securetty.so auth sufficient pam_radius_auth.so debug auth required /lib/security/pam_unix_auth.so account required pam_radius_auth.so debug password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so -cat /etc/raddb/server 127.0.0.1 secret 1 - pam_radius_auth.so is copied in /lib/security -I created linux user test with home directory /home/test , without setting up a password - freeradius started with radiusd -X Problem is that, when I trie to connect to this machine using ssh, the radius server receives the request, processes it, sends access-accept, but the ssh session is ended, without the user being really logged in !!! I don't know the reason why the user gets rejected... tail -f /var/log/secure Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: Got RADIUS response code 2 Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: authentication succeeded Oct 12 11:06:27 D-Server sshd[26585]: Accepted password for test from 10.243.30.42 port 2847 ssh2 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got user name test Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Sending RADIUS request code 1 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got RADIUS response code 2 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: authentication succeeded Oct 12 11:28:30 D-Server sshd[26590]: Accepted password for test from 10.243.30.42 port 2881 ssh2 from radiusd -X : rad_recv: Access-Request packet from host 127.0.0.1:27615, id=253, length=97 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 26590 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "512wyse83.cosmote.rom" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 253 to 127.0.0.1 port 27615 Finished request 0 thank you!

1 0

Insert charactrer in username
by Nicola Iotti 12 Oct '06

12 Oct '06

Hi all, we use Freeradius as proxy. Is it possible to insert a character inside the username every time in the same position (i.e. before last six characters) using preproxy_users configuration file ?. For example : original username = Johnnyfavourite username after preproxy section = Johnnyfav@ourite So the server can use "ourite" as proxy realm.. And if it is possible, which is the right syntax of the instruction in preproxy_users file? If it is not possible, is there another way to do it? Thank you

1 0