- Freeradius-Users - lists.freeradius.org

users-file overruling anything else
by florian.prester 06 Oct '06

06 Oct '06

Hi, I am using freeradius+perl+ldap. Meaning for every request I get the users information from a LDAP-Server, run it through some perl-code to distinguish some users form others for some reason (:-)). Now my problem are users not listed in the ldap-system. I want to use the users-file to overrule the ldap-system. Meaning if a user is found in the users-file and the password matches, ignore everything else. I think I had it working already, but somehow it does not work anymore! :-( My authorization-section looks as follows: authorize { preprocess chap mschap eap # # Read the 'users' file files # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # needed to get user information perl # needed to twist the users a little bit :-) } my users-file is standard, containing: "help" Auth-Type := Local, User-Password == "support" Idle-Timeout := 30 Thanks for your help, Florian Prester

2 1

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> LAN MAC Address: 00:17:94:EE:D8:C6 > Radio 1 MAC Address: 00:17:0F:8C:25:C0 > Radio 2 MAC Address: 00:17:0F:90:25:C0 At the risk of this sounding like a stupid question... If you do a show run in enable mode, do you see a mac-address command after the radio interface (i.e., have you manually changed the MAC addr of the radio)? It is possible to manually change it: int d0 mac-address 0017.0f8c.25c1 Even if you do this, a "sh int" command will still show the real MAC address (I just tried this on one of my test APs).

1 0

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> Thanks. What version of IOS are you running? Most are at 12.3(7)JA2. Some of our newer AP's are at 12.3(8)JA.

1 0

Need a read Free Radius admin . . .
by Troy Bernier 06 Oct '06

06 Oct '06

I am looking for a real freeradius admin who knows exactly what they are doing? Should be experienced with some references. We need advise, Setup, some maint, and support. Please send me your details. -Troy msn via daknar(a)hotmail.com

1 0

RE: Called-Station-ID and Cisco AP's
by Walter Reynolds 06 Oct '06

06 Oct '06

> Date: Fri, 6 Oct 2006 09:13:20 -0400 > From: "Garber, Neal" <Neal.Garber(a)energyeast.com> > Subject: RE: Called-Station-ID and Cisco AP's > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <9ADFF45C77B84B4A8E1D1F671349CD8B01F03DE6(a)ROCMSGCL01.Energyeast.net> > Content-Type: text/plain; charset="us-ascii" > >> Called-Station-Id = "0017.0f8c.25c1" >> However, the cisco itself shows something slightly different: >> Mac Address 0017.0f8c.25c0 > > Does your AP have two radios? If so, is this the > MAC of the other radio? Yes it does, but this is not the mac address for the LAN interface nor either of the radios: LAN MAC Address: 00:17:94:EE:D8:C6 Radio 1 MAC Address: 00:17:0F:8C:25:C0 Radio 2 MAC Address: 00:17:0F:90:25:C0 > >> Have others seen/noticed this before? ... If not, can >> anyone else look and see if they are having a similar issue? > > We use Cisco 1232 AP's and I'm not seeing this problem. The > Called-Station-ID is the MAC of the AP and the Calling-Station-ID > is the MAC of my XP laptop that associated to the AP. > Thanks. What version of IOS are you running? > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 18, Issue 24 > ************************************************ > > > -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

1 1

Authentication problem
by Giuseppina Venezia 06 Oct '06

06 Oct '06

Hi all, I've wirte about this problem another time here http://lists.freeradius.org/pipermail/freeradius-users/2006-October/057153.… . The core of this problem is an error that returns with chillispot when I authenticate a client with WPA-EAP. .............................. chillispot[15816]: radius.c: 1634: Received unknown radius packet 11! chillispot[15816]: chilli.c: 4148: radius_proxy_ind() failed! ............................. I've seen the source code of radius.h in chilli at line 73, and I've seen that the packet 11 is RADIUS_CODE_ACCESS_CHALLENGE , so I've thinked that there is an error in EAP authentication. Someone has ideas about this problem? I must solve it . Thank you very much. Best regards. Giusy

2 2

users-file overruling anything else UPDATE
by florian.prester 06 Oct '06

06 Oct '06

Hi, I am using freeradius+perl+ldap. Meaning for every request I get the users information from a LDAP-Server, run it through some perl-code to distinguish some users form others for some reason (:-)). Now my problem are users not listed in the ldap-system. I want to use the users-file to overrule the ldap-system. Meaning if a user is found in the users-file and the password matches, ignore everything else. I think I had it working already, but somehow it does not work anymore! :-( My authorization-section looks as follows: authorize { preprocess chap mschap eap # # Read the 'users' file files # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # needed to get user information perl # needed to twist the users a little bit :-) } my users-file is standard, containing: "help" Auth-Type := Local, User-Password == "support" Idle-Timeout := 30 UPDATE: Maybe my perl-code is the problem, because I do a REJECT by the Perl-module if the user is not found in the LDAP! Hm, I should not do that, should I? I can grant access, but I should not deny it, if want to grant it later?! Thanks for your help, Florian Prester

1 0

mac and username
by Jean Pierre Dupont 06 Oct '06

06 Oct '06

Hi all, first time posting here. Is it possible to reject a user based on UserName and Calling-Station-ID. What I would like to do is reject specific users from logging in on specific machines. And if yes, if it`s possible, an example of the sql query or config would be appreciated. Thank you all JP -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.407 / Virus Database: 268.13.0/464 - Release Date: 2006-10-05

1 0

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> Called-Station-Id = "0017.0f8c.25c1" > However, the cisco itself shows something slightly different: > Mac Address 0017.0f8c.25c0 Does your AP have two radios? If so, is this the MAC of the other radio? > Have others seen/noticed this before? ... If not, can > anyone else look and see if they are having a similar issue? We use Cisco 1232 AP's and I'm not seeing this problem. The Called-Station-ID is the MAC of the AP and the Calling-Station-ID is the MAC of my XP laptop that associated to the AP.

1 0

free radius ntlm_auth problem
by Andris 06 Oct '06

06 Oct '06

**>have you tried something like > >--username=\"%{mschap:User-Name}\" > >you might be able to escape the characters in this way. > >alna yes :( , and \' too

1 0