- Freeradius-Users - lists.freeradius.org

Set environnement variable
by Alexandre DELAY 26 Mar '06

26 Mar '06

Hi guys, I'm using freeradius to authenticate users against PPP (Poptop and PPPOE). After connection, i start a few processes from /etc/ppp/ppp.linkup and need to set some user dependent variable. I would like to get those informations from the same database as for auth. Here is my question: Is it possible to set environnement variables during authentication process? Wth this, I will use them to launch my processes. (my other solution is to setup a secured connection to the sql database, but I would like to use freeradius if possible). Thanks for the help cheers Alex

2 2

Still having issue with radtest
by Atkins, Dwane P 25 Mar '06

25 Mar '06

A couple questions I have not asked about this issue? Do both the user@localhost and localhost need access to the Sql database. I am at a loss as to why everytime I run this process, it tells me that I have an invalid preshare key. Do they preshare keys need to be in quotes. If I have a user called radius with a password of radiustest and my localhost preshare is BASEBALL, then would my syntax be, radtest radius radiustest localhost 1645 BASEBALL ? Or woudl I need to put quotes around the alpha characters. I cannot move on until I get this resolved obviously and I am not sure where to try. I can get issues resolved with the SQL portion, but to get it to see the local host, I am at a loss. If anyone can think of anything else I can possibly try, please let me know. If not, I appreciate all your efforts. Dwane

2 1

RE: PEAP ntlm_auth strange behaviour
by King, Michael 25 Mar '06

25 Mar '06

Try running the server in Debug mode /path/to/freeradius -X -A from the command line, and ask that user to login. It might give more info than just "External Script Failed" > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Jérémy Cluzel > Sent: Saturday, March 25, 2006 8:41 AM > To: freeradius-users(a)lists.freeradius.org > Subject: PEAP ntlm_auth strange behaviour > > Hello, > > I used a FR 1.1.0 under FreeBSD 6.0 > I configure it to PEAP auth against a windows 2003 AD > through ntlm_auth (samba 3.0.21b). > Everything works fine, user auth, machine auth... > > The problem is that for some obscur reasons, some users > ("jpbrunain" in this case) are unable to log in. > As I saw in the radius.log, I got "rlm_mschap: External > script failed.". > Moreover, if I run "ntlm_auth --request-nt-key --domain=CHRT > --username=jpbrunain" with the good password, I got this message: > "NT_STATUS_OK: Success (0x0)"... > This problem concerns only 2 users out of 20... and I don't > see anything "special" concerning them on the 2003 AD... > > Does anyone have the problem ? Is there a way to solve it ? > > Regards, > > Jeremy >

1 0

can't get ip address
by Magnus Willigens 25 Mar '06

25 Mar '06

hi... in the past 3 week's ive tried to configurate a freeradius for my exam of my apprenticeship. I used 1.1.0 under suse 9.2. There were many problems on my way binding the includes and libs of openssl and creating the certs. because this was my first excourse in linux (shame on me). But in my oppinion i did it well. I hope i've understood the eap_tls section so when you get these mppe messages it should work, right? I am using XP with SP2 as supplicant, the certs are also installed. And now the problem: When i try to connect with the AP everything works fine (reading certs, eap-tls handshake and the transmission of the mppe parameters) but i do not get a propper ip address. "oh, thats no problem" make it static..... but this doesn't work too. but ist is a funny fact, that windows then says "connected", but there ist no one to ping!??? If there is anyone who knows something about... p.s: it is a TEKLOGIX 9150 AP Basestation p.p.s: without the 8021x config it transmits all the ip data :) :( ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

2 1

How to export or install the certification to Windows XP pc
by Keithy 25 Mar '06

25 Mar '06

Hi, Can someone share with me on how to export or install the certification to Windows XP and MAC-apple from Freeradius server? Thanks, Timolthy For Win2kserver or Win2003 IAS, on WinXP system we can http://IP-Srv/certsrv and install the certification. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 25 Mar '06

25 Mar '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > We have made a small fix to the ldap-module (as seen in the > link to the > > mailing list archive). I don't know if this has been fixed > in 1.1.0. I > > once had a quick look at the ldap-module of 1.1.0, it > should be quite > > easy to test if it still fails. > > The password issue is also in FR 1.1.0. Thats weird. The bug is so easy to spot and should be trivial to fix. And I think it will affect many FR installations. -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 7

RE: Table radacct is empty
by Vincent MARGUERIE 25 Mar '06

25 Mar '06

Hi, There's some progression on this friday night !! After the connection was OK for my client, radacct table was always empty and it is always the same if I do not change the following : Rename "accounting_start_query" by "postauth_query" in my sql.conf. It means that "accounting_start_query" is not started. So, is there something to setup for this ? In other words....Why "postauth_query" starts and not "accounting_start_query" ? Be sure that sql is specified in the accounting section of my radiusd.conf....of course :-) Thanks a lot for your help..it will work ! Regards, Vincent

1 0

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

> > I read a post from a long time ago about putting the > > attribute (set to any value) in the response list, but that does not > > seem to work (unless I did it wrong): > > > > /etc/raddb/preproxy_users: > > > > DEFAULT > > Message-Authenticator = 1 > > You're adding it to the proxied packet. Read the docs. Right, because FreeRADIUS is acting as a proxy -- but it wasn't even a problem, so I didn't really need to put that in there. Correct me if I'm wrong, but EAP should be doing Message-Authenticator stuff without me needing to tell it to add the attribute, right? It seems to be doing just that. > > Anyway, I think I am running into a problem with not having this in the > > packets. I am proxying requests from my Windows XP SP2 supplicant to my > > Cisco 1310 AP > > That's not proxying. The supplicant doesn't do RADIUS. Yeah, I suppose I could have worded that a bit more technically accurate. The supplicant is sending the EAP requests to the Cisco, which is sending RADIUS stuff to the router running FreeRADIUS, which is proxying those RADIUS requests to the IAS machine. Sound right now? > > When the proxied reply (Access-Challenge) goes out of the router back > > towards the Cisco 1310 AP and the supplicant, the Cisco or the > > supplicant (can't tell which) is ignoring the reply and then sending a > > new request. > > That's most likely the "extended key" oid nonsense that Microsoft needs. Since you seem to know something about this, can you either: A) Explain what the "extended key oid nonsense" is? B) Point me to some place I can read about it? I appreciate your help. Thanks, Eliot Gable

2 1

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

It would seem that I have been able to answer my own question for this. After doing an Ethereal dump, I noticed that the Message-Authenticator is indeed set to a valid value. This means that is simply isn't displayed with a value (it gets printed before it is computed). I also figured out that the Cisco was dropping the authentication packets because it was sending to a .6.1 address (the virtual IP for that interface) and receiving the response from the .6.2 address (the primary IP for that interface). Doh! Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. -----Original Message----- From: freeradius-users-bounces+support8=greatlakes.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+support8=greatlakes.net@lists.freeradiu s.org] On Behalf Of Eliot, Wireless and Server Administrator, Great Lakes Internet Sent: Friday, March 24, 2006 3:54 PM To: freeradius-users(a)lists.freeradius.org Subject: Message-Authenticator Attribute Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1