- Freeradius-Users - lists.freeradius.org

Proxy Question
by Reynold McGuire 24 Apr '06

24 Apr '06

How's everyone doing? I have a proxy question / problem. I am attempting to get freeRadius to basically proxy via realm. This one radius server is going to be the proxy to all other radius servers... I am able to proxy correctly using the following in proxy.conf ---CUT--- Realm ad.domain.com { type = radius authhose = ias.server.ad.domain.com:1812 accthost = ias.server.ad.domain.com:1813 secret = testing123 nostrip } ---CUT--- This works great for the apps that need / allow "username(a)domian.com" style authentication. My problem is when using programs like MS PEAP authentication that wants to pass the info as "domain.com\username" I have read thru proxy.conf and radius.conf and looked at the ntdomain realm and I can not seem to get it to see the "domain.com\username". I am using IAS on an AD member server for authentication for another project and it wants to authenticate users via "username(a)domain.com" as it is sitting in the root of the AD (no users there) so you have to give it the FQDN. Long story short, How can I get freeRadius to see "domain.com\username" and convert that to "username(a)domain.com" and proxy that off? Thanks in advance. - Reynold

3 7

TTLS/PEAP seg faults
by João Mamede 24 Apr '06

24 Apr '06

can I do something about this? I'm using ldap in authorize{}(just uncommented it and not using in it in authenticate{}(I don't need it for EAP-TTLS right?) Do I need to add the auth-type ldap in users? I'm around this for a week now :( rad_recv: Access-Request packet from host 192.168.5.1:2048, id=0, length=247 User-Name = "forevertheuni" NAS-IP-Address = 192.168.5.1 Called-Station-Id = "000ea65b5239" Calling-Station-Id = "0011f547e038" NAS-Identifier = "000ea65b5239" NAS-Port = 31 Framed-MTU = 1400 State = 0x729d931bc6bfa59612707c69d4ac0269 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201006c150016030100610100005d0301444ac484048c1ded0c6a1a0ff213c2e6a1632cd26d6c89501a7f6d10461f815300003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 Message-Authenticator = 0xbaf1f6903393341b2e2cddff9dc928d4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "forevertheuni", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 1 length 108 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for forevertheuni radius_xlat: '(uid=forevertheuni)' radius_xlat: 'ou=Users,dc=cartoons,dc=buh' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Users,dc=cartoons,dc=buh, with filter (uid=forevertheuni) rlm_ldap: checking if remote access for forevertheuni is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user forevertheuni authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization Segmentation fault: 11 (core dumped) [root@T4 /home/forevertheuni]#

2 1

connection problems
by Pelusa Vali 24 Apr '06

24 Apr '06

hi list, well i use debian etch, kernel 2.6.15.6, madwifi-ng-r1475, freeradius 1.1.0, hostapd 0.5.2 and a linksys wmp55ag as wireless adaptor. i can put it as access point, but have a big problem. if only set access point without security or using wep, clients disconnect after 2-8 minutes and cann't reconnect, only if ap is reseted. so i used hostapd to set WPA-PSK and link was very stable for hours. now set WPA-EAP and using freeradius configured PEAP. it worked very well for 8 days. stable, only connection delay was too large, but it worked. after 8 days, clients deauthenticate and reauthenticate each 3-5 minutes. i think it's related to madwifi, because of first problem i described. any body has same behavior?? if so, how could it be solved?? it's an annoying, clients are working and suddenly they lost connection and must wait until it was re-established, it takes from 1 to 10 minutes to complete, if so. do you have any idea?? thanks for your help _______________________________________________________________ Halloween Trivia: What is 'Samhainophobia' a fear of? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=118

1 0

Authentification with: login, password, SSID
by ludovic cailleau 24 Apr '06

24 Apr '06

Good morning, I wish to realize an authentication 802.11x for a wireless network. I use a switch wireless Symbol, and Freeradius under fedora 5. The authentication will have to verified 3 parameters: the login, the password, and the SSID. The switch Symbol with the Vendor Specific Attribute (Symbol-SSID) transmits the SSID. I have then creates a Freeradius's dictionary for this attribute (Symbol-SSID). # # dictionary.symbol # VENDOR Symbol 388 ATTRIBUTE Symbol-SSID 2 string Symbol \n \n \nI use the users files of Freeradius. \nFor validate the authentication I use the entry: \n \n"vlan4"\n Auth-Type :\u003d eap, User-Password \u003d\u003d "vlan4", Symbol-SSID \u003d\u003d \'CRTguest\' \n Reply-Message \u003d "Hello, %u"\n \n \n \nI start freeradius, and when I want to connect me with a client PC I\'m reject.\n \nLogs indicates me: \n \nFri Apr 21 09:01:34 2006 : Info: Using deprecated naslist file.\n Support for this will go away soon. \nFri Apr 21 09:01:34 2006 : Info: rlm_exec: Wait\u003dyes but no output defined. Did you mean output\u003dnone?\n \nFri Apr 21 09:01:34 2006 : Info: Ready to process requests.\n \n",1] ); //--> I use the users files of Freeradius. For validate the authentication I use the entry: "vlan4" Auth-Type := eap, User-Password == "vlan4", Symbol-SSID == 'CRTguest' Reply-Message = "Hello, %u" I start freeradius, and when I want to connect me with a client PC I'm reject. Logs indicates me: Fri Apr 21 09:01:34 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Apr 21 09:01:34 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Apr 21 09:01:34 2006 : Info: Ready to process requests. Length Included \nFri Apr 21 09:01:49 2006 : Error:\n TLS_accept:error in SSLv3 read client certificate A \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message\n \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls:\n Length Included \nFri Apr 21 09:01:49 2006 : Info:\n (other): SSL negotiation finished successfully \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message\n \nFri Apr 21 09:01:50 2006 : Info: rlm_eap_mschapv2: Issuing Challenge\n \nFri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client localhost port 0)\n \nFri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \nFri Apr 21 09:01:52 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request\n \nFri Apr 21 09:01:52 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \nFri Apr 21 09:01:54 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request\n",1] ); //--> Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Length Included Fri Apr 21 09:01:49 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Length Included Fri Apr 21 09:01:49 2006 : Info: (other): SSL negotiation finished successfully Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Apr 21 09:01:50 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Fri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client localhost port 0) Fri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Fri Apr 21 09:01:52 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Fri Apr 21 09:01:52 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Fri Apr 21 09:01:54 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request \nFri Apr 21 09:01:54 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \n \n \nBut if I delete the VSA Symbol-SSID, I can connect me. \n \nThank you for your help. -- ",1] ); D(["mb","Ludovic \n\n ",0] ); //--> Fri Apr 21 09:01:54 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) But if I delete the VSA Symbol-SSID, I can connect me. Thank you for your help. --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

3 4

rlm_exec does not change already existing attributes
by Dmitry Lyubimkov 24 Apr '06

24 Apr '06

In the rlm_exec module for change of attributes according to result of script it is used if (output_pairs) pairmove(output_pairs, &answer); in function static int exec_dispatch(void *instance, REQUEST *request) But function pairmove in valuepair.c does only the following /* * Move attributes from one list to the other * if not already present. */ void pairmove(VALUE_PAIR **to, VALUE_PAIR **from) I.e. if such attribute does not exist that it will be added, and if already exists, will take place nothing. As result using an external script we can only add new attributes, but we can not change existing attributes! How to change User-Name in Radius request? Is it possible to change existing attributes in the simple way without change of the module rlm_exec code? Dmitry

2 1

Redundant ldap server with freeradius 1.0.5
by sumi thra 24 Apr '06

24 Apr '06

Hey All, I want to configure freeradius server to use redundant ldap servers. My configuration is: authorize { preprocess #etc_passwd #etc_group chap mschap suffix_oblic prefix_oblic suffix_at prefix_at suffix_percent prefix_percent files redundant{ ldap_primary ldap_secondary } eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } #unix eap } ldap ldap_primary { .... .. } ldap ldap_secondary { .. .. } The free radius server is keep on sending the request to secondary server, even though the primary server is reachable. Could you plz guide me where am i missing the configuration ? Any other attribute needs to be defined inside redundant module ? Awaiting for your earliest reply. Thanks, Sumi

1 0

automated response
by Olaf Becker 24 Apr '06

24 Apr '06

I am not in the office and have no access to my e-mails. I will be back from holidays till the 29nd of April 2006. Thank you for your understanding that your e-mail will be answered after my return to the office. This e-mail will not be forwarded. Best regards Olaf Becker

1 0

Redundant ldap server with freeradius 1.0.5
by sumi thra 24 Apr '06

24 Apr '06

- Hey All, I want to configure two ldap server's for fail over conditions. My configuration in the radiusd.conf is... ldap { redundant { ldap_primary ldap_secondary } } .... ldap_primary { .. .. } ldap_secondary { .. .. } .. When the server gets any access-request packet, it tries to connect to the secondary server. Even though the primary server is reachable, the secondary server is contacted first. How can i make the radius server to contact primary ldap server first & then the next ldap server ?? Am i missing any configuration?? Could please help me in this regard. Thanks in advance. Sumithra.

2 3

RE: Bugzilla account creation broken?
by Jonathan De Graeve 23 Apr '06

23 Apr '06

Its now been 12hours ago that I requests a password for the bugzilla. I still didn't receive any email. Is there something wrong with it? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Nicolas > Baradakis > Verzonden: zaterdag 22 april 2006 18:09 > Aan: FreeRadius users mailing list > Onderwerp: Re: Changes to dialupadmin > > Jonathan De Graeve wrote: > > > I want to publish my enhancements to dialupadmin to the freeradius > > devels. > > > > How can I do this? > > Please post your patches to the bugzilla. > http://bugs.freeradius.org/ > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: How to patch dialupadmin
by Jonathan De Graeve 23 Apr '06

23 Apr '06

>Van: Mordor Networks [mailto:mordor.networks@gmail.com] >Verzonden: zondag 23 april 2006 5:39 >Aan: Jonathan De Graeve >Onderwerp: Hello > >can you tell me please how to use your patch with dialup admin? i mean how to patchh it? >thanks > Put the patch into the location where freeradius-dialupadmin is installed (or in the source dir of freeradius-1.0.5/) and go into that directory. Do patch -p0 < dialup_admin-1.0.5.diff Only tested it against 1.0.5 so I don't know what happens on >1.0.5 -- Jonathan De Graeve

1 0