- Freeradius-Users - lists.freeradius.org

Problem with secrets
by David Goodenough 19 Jul '06

19 Jul '06

I just hit a really odd problem with a secrets. We were asked to use FreeRadius to provide IP addresses to an Ericsonn NAS. We set up the server and have some test clients with simple secrets. If those are right it works, if they are wrong it fails. Then we put in the secret for the Ericsonn (I can not put it in this note as it is someone else's secret and I do not know what else it might be the secret for, but privately I could make it available for testing). This secret is 13 digits long, mixed numbers and letters, looks reasonably random, and in the proper secret all the letters were upper case. However somehow one of the letters (an O) got put into the server in lower case. The server happily accepts Access-Request packets with an authenticator built from the all upper case secret, even though its secret was different, it was only the client which rejected the Access-Accept. Diagnosing this however was very difficult as we had no access to the Ericsonn box and any console messages it might log (we could only see what went on the wire and whether the connection succeeded). A quick look at the code did not find anywhere where the secret gets folded to all upper case (but I might have missed it) and if there were such folding it would be unfortunate if this was only done on checking the received packet not on generating the reply. I am new to RADIUS, and I could not find any rules about case folding for secrets, but I might have missed them. It could simply be one of those freak places where the MD5 checksum happens to be the same for the request but not the response, but that does not feel right. I am using 1.1.1 (I am also using JRadius which last time I looked only produced patches for 1.1.1, not 1.1.2). David

3 5

3com problem with service-type
by Nuno Cervaens 19 Jul '06

19 Jul '06

Hi guys, I have a lot of hp switches and a lot of 3com switches. I have users that I want them to have Administrator privilege and others that will have NAS-Prompt privilege. So, my users files should be like this, so it can work for both brands: userA Password = pass Service-Type = 7, 3Com-User-Access-Level = 1 userB Password = pass Service-Type = 6, 3Com-User-Access-Level = 3 The problem is that 3COM doesnt accept a service-type =7! It only accepts Service-Type = 6! So the 3COM rejects the access-accept from RADIUS for userA. I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address). Does anyone has a solution for my problem? Thanks, Nuno

1 0

3com problem with service-type
by Nuno Cervaens 19 Jul '06

19 Jul '06

Hi guys, I have a lot of hp switches and a lot of 3com switches. I have users that I want them to have Administrator privilege and others that will have NAS-Prompt privilege. So, my users files should be like this, so it can work for both brands: userA Password = pass Service-Type = 7, 3Com-User-Access-Level = 1 userB Password = pass Service-Type = 6, 3Com-User-Access-Level = 3 The problem is that 3COM doesnt accept a service-type =7! It only accepts Service-Type = 6! So the 3COM rejects the access-accept from RADIUS for userA. I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address). Does anyone has a solution for my problem? Thanks, Nuno

1 0

3com problem with service-type
by Nuno Cervaens 19 Jul '06

19 Jul '06

Hi guys, I have a lot of hp switches and a lot of 3com switches. I have users that I want them to have Administrator privilege and others that will have NAS-Prompt privilege. So, my users files should be like this, so it can work for both brands: userA Password = pass Service-Type = 7, 3Com-User-Access-Level = 1 userB Password = pass Service-Type = 6, 3Com-User-Access-Level = 3 The problem is that 3COM doesnt accept a service-type =7! It only accepts Service-Type = 6! So the 3COM rejects the access-accept from RADIUS for userA. I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address). Does anyone has a solution for my problem? Thanks, Nuno

1 0

Cisco 7200 NAS-Port useless
by John Mylchreest 19 Jul '06

19 Jul '06

Hi Guys, Has anyone tried to use simultaneous use with l2tp tunnels on a 7200. For some reason the NAS-Port is sends back is the "Uniq" and not the virtual interface number so I have no way to track it with simultaneous-use. Any help appreciated, Regards, John -- John Mylchreest ioko T: +44 (0)1904 438000 x324 M: +44 (0)7730 529047 F: +44 (0)1904 435450 E: john.mylchreest(a)ioko.com Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Operation of a radius server
by Dave 19 Jul '06

19 Jul '06

I was just hoping someone here could explain to me how the radius server process works. My situation will be authorizing for DSL. I think the process is: My DSL wholesaler gets requests for a logins under my realm to their NAS, then sends it to me, then I send back a yes or no answer. My question is what information do I have to supply to my DSL wholesaler and what information do I need from them? regarding authorization types or encryption? Any info would help a lot. Thanks

2 1

proxy request when database is referering to ldap server
by sumi thra 18 Jul '06

18 Jul '06

Hi All, Im trying to authenticate a user(a)realm.com The same realm is found in the realm list & the request got proxyed. But the freeradius server is still trying to do ldap_groupcmp(). When 2-3 ldap servers are configured the radius server is busy in connecting to those.. & fails in case of non-reachable condition. Mean while the server says: Reply from home server x.y.z.a:1812 - ID: 0 arrived too late for request 0. Try increasing 'retry_delay' or 'max_request_time' Waking up in 5 seconds... Do anyone have an idea of why is it trying to do ldap_grpcmp() during proxy state?? Please let me know if you have any idea. Thanks Sumi

2 3

802.1x with mschap-radius-ldap with ssha-1 passwords
by Matt Ashfield 18 Jul '06

18 Jul '06

Hi All I'm trying to do 802.1x authentication using freeradius against an LDAP directory which stores the userPassword in an ssha-1 hash. My question is, is this possible? If so, how do I configure mschap for ssha-1 passwords? Thanks for your time/advice, Cheers Matt

4 8

Error on startup: undefined symbol: SSL_set_ex_data
by Dave 18 Jul '06

18 Jul '06

Hi all, this is my first post to the list. I am getting some startup errors now after upgrading to 1.1.1, although I never had 1.1.0 working in a real environment either. I get this error during startup in the logs: Error: radiusd.conf[10] Failed to link to module 'rlm_eap': /usr/lib/libeap-1.1.1.so: undefined symbol: SSL_set_ex_data Ive tried using the value in radiusd.conf about library paths to no avail. Ive not found a solution to this anywhere :(

2 8

RE: error unknown host, but it is configured in clients.conf
by Greg Hartung 18 Jul '06

18 Jul '06

That's what I was wondering too, but I haven't been able to figure out how to tell. So the only thing I could think of was to mv the clients.conf file. It didn't show up as an error on restart, so I would suspect it is not reading it. Why would that be? Thanks, Greg -----Original Message----- From: freeradius-users-bounces+ghartung=photobucket.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ghartung=photobucket.com@lists.freeradi us.org] On Behalf Of Alan DeKok Sent: Wednesday, July 12, 2006 5:34 PM To: FreeRadius users mailing list Subject: Re: error unknown host, but it is configured in clients.conf "Greg Hartung" <ghartung(a)photobucket.com> wrote: > Wed Jul 12 15:29:05 2006 : Error: Ignoring request from unknown client > 10.1.10.1 Is the server reading the clients.conf file you're editing? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2