- Freeradius-Users - lists.freeradius.org

rlm_sqlippool - try sql if not try sql1
by RobertB 25 May '06

25 May '06

Hi All At present it is not possible to do something like: try sql, if not available try sql1. Are there any planes to add this functionality in the future? Regards, Robert

2 1

EAP-SIM compliancy
by Geoffroy Arnoud 25 May '06

25 May '06

Hi all, I have a question regarding EAP-SIM authentication, in the case where authentication is performed by an external AAA system. We already perform LEAP and EAP-TLS authentication against an external AAA system authentication through FreeRADIUS (FreeRADIUS acts as a proxy for EAP authentication). Regarding EAP-SIM, is FreeRADIUS compliant with the latest EAP-SIM version that became a RFC (RFC 4186), in the case where authentication is performed by an external AAA system? Thank you for you answers Geof.

6 10

Error: Unexpected trailing comma in User file
by sumi thra 25 May '06

25 May '06

Hi All, I am getting some error like: Module: Loaded files files: usersfile = "/var/etc/raddb/users" files: acctusersfile = "/var/etc/raddb/acct_users" files: preproxy_usersfile = "/var/etc/raddb/preproxy_users" files: compat = "no" /var/etc/raddb/users[4]: Parse error (check) for entry DEFAULT: Expected end of line or comma Errors reading /var/etc/raddb/users radiusd.conf[201]: files: Module instantiation failed. radiusd.conf[311] Unknown module "files". radiusd.conf[299] Failed to parse authorize section. The users file looks like this.. # WLAN Allow policy for the groups # WLAN Deny policy for the groups DEFAULT Group-Name == "group1", Symbol-Wlan-Index =~ "\`\-\=\\[\]\;\'\,\.\/\~\!\@\#\$\%\^\&\\*\_\+\\{\}\|\:\"\<\>|dksljf\\{\}\\[\]\\{\\{\\{\\{\\{\\{\\{\\{\\{\\{\\{|103|sdhghd|dsfdfd|106|107|108|109|110|111|112|113|114|115|116|117|118|119|120|121|122|123|124|125|126|127|128|129|130|131|132",Auth-Type:=Reject anonymous Anonymous DEFAULT Realm != "NULL" DEFAULT Auth-Type := Reject The dictionary file is defined as : # # dictionary.mine. # VENDOR me 388 # # Vendor Specific Attributes. # # Attribute for Wlan Index of the authenticating mobile unit. ATTRIBUTE Symbol-Wlan-Index 2 String me Please help me in resolving this issue. Thanks Sumi "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

1 0

RE: Using PEAP and WinXP
by King, Michael 25 May '06

25 May '06

> -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of simon(a)434canada.com > Sent: Wednesday, May 24, 2006 3:02 PM > To: freeradius-users(a)lists.freeradius.org > Subject: Using PEAP and WinXP > > Hi, > > I have a question regarding the setup for the WinXP client > when using PEAP. Does one always need to go into the > properties for the AP and configure which servers to connect > to or which root certification authorities are trusted? What > I mean is, whether you produced a server certificate yourself > and imported that CA onto the client machine, or whether you > had a certificate signed by someone like Verisign, you would > need to check the corresponding CA within the list. It's my understanding that this is to prevent a man in the middle attack. Someone could easily setup a rouge AP, with a RADIUS Server. Since your requiring the server to identify itself (Via the Cert) you could detect this, and prevent it.

2 1

could not determine local IP address
by Italo Morellato 24 May '06

24 May '06

Hi, my freeradius work fine with HotSpot but when I check ppp I've one error. Freeradius 1.1.1 Log is paste below... _______________________________________________________ 14:16:43 pppoe,info PPPoE connection established from 00:15:D6:02:03:54 14:16:43 pppoe,ppp,info <pppoe-0>: waiting for call... 14:16:46 radius,debug new request 53:22f code=Access-Request service=ppp called-id=PPPoE 14:16:46 radius,debug sending 53:22f to 10.10.0.3:1812 14:16:46 radius,debug,packet sending Access-Request with id 107 to 10.10.0.3:1812 14:16:46 radius,debug,packet Signature = 0xe32e234bcf749c15d2afd34a9230f93c 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet NAS-Port = 2336 14:16:46 radius,debug,packet NAS-Port-Type = 15 14:16:46 radius,debug,packet User-Name = "bar.sport" 14:16:46 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:46 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:46 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:46 radius,debug,packet User-Password = 0x70717971616c7862 14:16:46 radius,debug,packet NAS-Identifier = "nas1" 14:16:46 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:46 radius,debug,packet received Access-Accept with id 107 from 10.10.0.3:1812 14:16:46 radius,debug,packet Signature = 0x1be3b01ec0d51d96708eb74a61ae07dc 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet Framed-MTU = 1488 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:46 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:46 radius,debug,packet MT-Rate-Limit = "192k/64k 1024k/100k 10/5 15/10" 14:16:46 radius,debug,packet Framed-Route = "10.0.0.210 10.0.0.1 1" 14:16:46 radius,debug received reply for 53:22f 14:16:46 radius,debug new request 53:00 code=Accounting-Request service=ppp called-id=PPPoE 14:16:46 radius,debug sending 53:00 to 10.10.0.3:1813 14:16:46 radius,debug,packet sending Accounting-Request with id 108 to 10.10.0.3:1813 14:16:46 radius,debug,packet Signature = 0xd55b07590e70cb5bda1a1d4b0b164b52 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet NAS-Port = 2336 14:16:46 radius,debug,packet NAS-Port-Type = 15 14:16:46 radius,debug,packet User-Name = "bar.sport" 14:16:46 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:46 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:46 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:46 radius,debug,packet Acct-Session-Id = "81b000bb" 14:16:46 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:46 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:46 radius,debug,packet Acct-Authentic = 1 14:16:46 radius,debug,packet Acct-Status-Type = 1 14:16:46 radius,debug,packet NAS-Identifier = "nas1" 14:16:46 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:46 radius,debug,packet Acct-Delay-Time = 0 14:16:46 pppoe,ppp,info <pppoe-bar.sport>: authenticated 14:16:46 radius,debug,packet received Accounting-Response with id 108 from 10.10.0.3:1813 14:16:46 radius,debug,packet Signature = 0x27de569383671ca089573c7ae29f3f82 14:16:46 radius,debug received reply for 53:00 14:16:46 radius,debug request 53:00 processed 14:16:49 pppoe,ppp,info,account bar.sport logged out, 3 84 66 9 9 14:16:49 radius,debug new request 53:00 code=Accounting-Request service=ppp called-id=PPPoE 14:16:49 radius,debug sending 53:00 to 10.10.0.3:1813 14:16:49 radius,debug,packet sending Accounting-Request with id 109 to 10.10.0.3:1813 14:16:49 radius,debug,packet Signature = 0xd9902db18247432350accc014c13615a 14:16:49 radius,debug,packet Service-Type = 2 14:16:49 radius,debug,packet Framed-Protocol = 1 14:16:49 radius,debug,packet NAS-Port = 2336 14:16:49 radius,debug,packet NAS-Port-Type = 15 14:16:49 radius,debug,packet User-Name = "bar.sport" 14:16:49 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:49 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:49 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:49 radius,debug,packet Acct-Session-Id = "81b000bb" 14:16:49 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:49 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:49 radius,debug,packet Acct-Authentic = 1 14:16:49 radius,debug,packet Acct-Session-Time = 3 14:16:49 radius,debug,packet Acct-Input-Octets = 84 14:16:49 radius,debug,packet Acct-Input-Gigawords = 0 14:16:49 radius,debug,packet Acct-Input-Packets = 9 14:16:49 radius,debug,packet Acct-Output-Octets = 66 14:16:49 radius,debug,packet Acct-Output-Gigawords = 0 14:16:49 radius,debug,packet Acct-Output-Packets = 9 14:16:49 radius,debug,packet Acct-Status-Type = 2 14:16:49 radius,debug,packet Acct-Terminate-Cause = 9 14:16:49 radius,debug,packet NAS-Identifier = "nas1" 14:16:49 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:49 radius,debug,packet Acct-Delay-Time = 0 14:16:49 radius,debug,packet received Accounting-Response with id 109 from 10.10.0.3:1813 14:16:49 radius,debug,packet Signature = 0x10f27bb799de8887cb49f8239f5446de 14:16:49 radius,debug received reply for 53:00 14:16:49 radius,debug request 53:00 processed 14:16:49 pppoe,ppp,info <pppoe-bar.sport>: terminating... - could not determine local IP address 14:16:49 pppoe,ppp,info <pppoe-bar.sport>: disconnected Question: local IP address are determine automatically? Is an error of radiusd.conf? from the log I see accounting terminate successfully (user & password with sql databse) an error occurred with NAS ?? many thanks for any suggestion..

2 2

MAC authentication
by simon＠434canada.com 24 May '06

24 May '06

Hi, I am wondering if it is possible (and if so, how) to set up the clients.conf file to have clients recognized by their MAC address instead of their IP address (or an IP range). Not sure if this is possible, or the proper file to try in, but would love to hear some feedback. Thanks, Simon

2 1

Using PEAP and WinXP
by simon＠434canada.com 24 May '06

24 May '06

Hi, I have a question regarding the setup for the WinXP client when using PEAP. Does one always need to go into the properties for the AP and configure which servers to connect to or which root certification authorities are trusted? What I mean is, whether you produced a server certificate yourself and imported that CA onto the client machine, or whether you had a certificate signed by someone like Verisign, you would need to check the corresponding CA within the list. Thanks, Simon

1 0

Freeradius AD, LDAP, MYSQL
by fvt3 24 May '06

24 May '06

Is it possible to configure freeradius to authenticate off from active directory, ldap and mysql? I am looking to configure freeradius to hit active directory to see if user exist, if not hit ldap and mysql database for authentication. Since we can set it to hit ldap then mysql, I think it is possible for radius to hit AD then ldap then mysql. If this is true, how can I configure it to do so? Any help would be appreciate. Thanks. Ferno __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Multiple EAP types
by gARetH baBB 24 May '06

24 May '06

According to the docs: "Once EAP-Identity response is received by the server, based on the default_eap_type, the server will send a new request (MD5-Challenge request incase of md5, TLS-START request incase of tls) to the supplicant. If the supplicant is rfc2284 compliant and doesnot support the EAP-Type sent by the server then it sends EAP-Acknowledge with the supported EAP-Type. If this EAP-Type is supported by the server then it will send the respective EAP-request." But I can't get it to work ! I want to be able to support PEAP and TTLS. I set a default_eap_type of peap or ttls and a client (wpa_supplicant or Windows XP+SecureW2) can authenticate using that default type. But if I try to authenticate not using the default type it fails - the above described mechanism doesn't seem to kick in. What am I doing wrong ? [default type of ttls, trying to authenticate with peap using wpa_supplicant] rad_recv: Access-Request packet from host 10.1.1.7:1812, id=134, length=176 User-Name = "x@x" Cisco-AVPair = "ssid=x" NAS-IP-Address = 10.1.1.7 Framed-MTU = 1400 Called-Station-Id = "x" Calling-Station-Id = "x" NAS-Identifier = "DINKITCH" NAS-Port = 37 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x020100150174657374406c696c79686f7070696e67 Message-Authenticator = 0x8f0581d54ae3940c3e9b0bf7bd1297ad Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.7/auth-detail-20060524' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.1.1.7/auth-detail-20060524 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'x@x' rlm_sql (sql): sql_set_user escaped user --> 'x@x' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'x@x' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'x@x' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'x@x' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'x@x' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 134 to 10.1.1.7 port 1812 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfedb2ff2bb0d24ab41c48f3ab7eba8b9 Finished request 0 Going to the next request And that is that, the client claims authentication has failed.

2 3

Please ignore Quick mysql query help
by Jeremy ohara 24 May '06

24 May '06

---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

1 0