- Freeradius-Users - lists.freeradius.org

PAP Question
by Alex M 12 Mar '06

12 Mar '06

Hi I want to use PAP protocol; do I have to set it in Authorization section? Because there is no commented line for PAP while there is every other module included. Thanks!

1 0

will this work?
by Pelusa Vali 12 Mar '06

12 Mar '06

hi everybody, i use debian sarge, madwifi-ng-r1457, hostapd 0.4.8 and freeradius 1.1, i want to use eap-tls, is there any special configuration or patch should be applied to any of this programs to get them work? i tried configurations from madwifi users docs and many tutorials, but nothing works. simply clients cann't authenticate, always get: Access-Reject. these are my conf files: MADWIFI: modprobe ath_pci autocreate=ap wlanconfig ath0 create wlandev wifi0 wlanmode ap ifconfig ath0 up iwpriv ath0 mode 3 iwconfig ath0 essid MYWLAN iwconfig ath0 channel 2 iwconfig ath0 bitrate 54M iwconfig ath0 frag 512 iwconfig ath0 rts 250 iwpriv ath0 ar 1 echo 1 > /proc/sys/net/ipv4/ip_forward /etc/init.d/networking restart IPTABLES=/sbin/iptables $IPTABLES -F -t nat $IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE /etc/init.d/dhcp stop /etc/init.d/dhcp start DHCP: subnet 192.168.10.0 netmask 255.255.255.0 { range 192.168.10.2 192.168.10.30; option subnet-mask 255.255.255.0; option broadcast-address 192.168.10.255; default-lease-time 600; max-lease-time 7200; } HOSTAPD: interface=ath0 driver=madwifi logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 debug=4 dump_file=/tmp/hostapd.dump ctrl_interface=/var/run/hostapd ctrl_interface_group=0 ssid=MYWLAN macaddr_acl=0 auth_algs=3 ieee8021x=1 eap_message=hello eapol_key_index_workaround=0 own_ip_addr=127.0.0.1 nas_identifier=www.server.com auth_server_addr=127.0.0.1 auth_server_port=1812 auth_server_shared_secret=whatever acct_server_addr=127.0.0.1 acct_server_port=1813 acct_server_shared_secret=whatever wpa=1 wpa_key_mgmt=WPA-EAP wpa_pairwise=TKIP wpa_strict_rekey=1 wpa_gmk_rekey=86400 DEFAULT HOSTAPD: #RUN_DAEMON=yes RADIUS USERS: "pupis" DEFAULT Auth-Type = System Fall-Through = 1 here i tried too: DEFAULT Auth-Type = EAP Fall-Through = 1 each one alone, and together. RADIUS CLIENTS.CONF: client 127.0.0.1 { secret = whatever shortname = www.server.com } RADIUS EAP.CONF: default_eap_type = tls tls { certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } when i run, get this: hostapd logs: Sending RADIUS message to accounting server RADIUS message: code=4 (Accounting-Request) identifier=0 length=88 Attribute 40 (Acct-Status-Type) length=6 Value: 7 Attribute 45 (Acct-Authentic) length=6 Value: 1 Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 32 (NAS-Identifier) length=14 Value: 'www.server.com' Attribute 30 (Called-Station-Id) length=30 Value: '00-0F-66-11-C1-97:MYWLAN' Attribute 49 (Acct-Terminate-Cause) length=6 Value: 11 Next RADIUS client retransmit in 3 seconds Flushing old station entries running locally radtest: radtest pupis whatever localhost 0 whatever Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "pupis" User-Password = "whatever" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=178, length=20 by the way, i cann't run radclient or radeapclient, when use it, don't get any response. but now, winxp clients don't detect this wlan as activated with wpa, only wlan without security, and don't get any ip direction, even i'm using dhcp. if i don't run radius and hostapd then client do get ip direction and can use wlan. so, my question again is, what should i do to get eap-tls working?? i heard that may be this won't work with debian, could it be a possible explanation?? i'm really tired , i tried everything i think, and don't know what more should do. thanks in advance for your patience. _______________________________________________________________ Halloween Humour: What kind of girl does a mummy go out with? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=154

2 1

Freeradius + Xp Client problem
by BoRa 12 Mar '06

12 Mar '06

When i trying connect radius server with wireless over access point i get this error : rad_recv: Access-Request packet from host 10.10.0.10:2048, id=110, length=163 User-Name = "ibm" NAS-IP-Address = 10.10.0.10 NAS-Port = 0 Called-Station-Id = "00e098be8e15" Calling-Station-Id = "000cf138bb81" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000080169626d Message-Authenticator = 0x8c249d2c90720d71e84717a58070eaae Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "ibm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 0 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry ibm at line 80 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 15 modcall: group authenticate returns handled for request 15 Sending Access-Challenge of id 110 to 10.10.0.10:2048 Reply-Message = "Hello, %u" EAP-Message = 0x01010016041094b82f52b0da67bfb8de368e6d9bd919 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4756a5552099f5c02b869e15b923300c Finished request 15 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.10.0.10:2048, id=111, length=173 User-Name = "ibm" NAS-IP-Address = 10.10.0.10 NAS-Port = 0 Called-Station-Id = "00e098be8e15" Calling-Station-Id = "000cf138bb81" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x4756a5552099f5c02b869e15b923300c Message-Authenticator = 0x6629ec8f043cf6353e8707d3a5854a4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "preprocess" returns ok for request 16 modcall[authorize]: module "chap" returns noop for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_realm: No '@' in User-Name = "ibm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 16 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry ibm at line 80 modcall[authorize]: module "files" returns ok for request 16 modcall: group authorize returns updated for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: No such EAP type peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 16 modcall: group authenticate returns invalid for request 16 auth: Failed to validate the user. Login incorrect: [ibm/<no User-Password attribute>] (from client wireless port 0 cli 000cf138bb81) Delaying request 16 for 1 seconds Finished request 16 Going to the next request users file contains : ibm Auth-Type := EAP, User-Password == "test" Reply-Message = "Hello, %u" I'm try also Radius Test (Radutils) program connect successful. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Realms allowed to some huntgroup
by Walter Reynolds 11 Mar '06

11 Mar '06

I am not quite finding the setup I am looking for and hope someone can point me to the files I should be updating. Currently I am running version 1.0.4 Hopefuly I can describe what I want to do and you can let me know if it is doable, and if so what files I should modify. I have questions. 1. How can I authenticate realms differently. 2. Can I set up logging based on Realm I will simplify this and say we have two service types I want to authenticate. 1. Wireless 2. VPN I currently have Wireless and VPN set up so we do some proxy. If a user signs in with either the following they can log in: waltr - no domain (us NULL realm to authhost = local in proxy.conf) waltr(a)xxx.edu - xxx.edu domain has realm defines and proxies to remote radius server at other campus Well this works and Wireless and VPN can sign in. The thing is I want wireless to work this way, but I want VPN to only work with no domain logins. But how do I define a domain/realm to a group so I can put that into the huntgroup file. We are currently using Merit radius and it works this way (I am adding this for example only) Clients.conf (using old style for clarity) =========================== #Clients Name Key [type] [version] [prefix] #---------------- --------------- --------------- --------- -------- # iLab Radius servers vpn.xxx.edu secretvpn type=Merit:PROXY vpn wirelessAP1.xxx.edu secretwireless type=PROXY wireless wirelessAP2.xxx.edu secretwireless type=PROXY wireless ============================ The prefix would tell it to use a specific users file and authfile. So I have the following 4 files: vpn.users vpn.authfile wireless.users wireless.authfile With those files I can have users connecting to wireless clients (ie huntgroup) go to a specific user and authfule. I can set the vpn service to authenticate Null realms and drop all others while at the same time I can set wireless to authenticate Null locally and proxy the defined realms to another radius server. Question number two is can I separate the accounting for the realms to different logfiles? -- Walter Reynolds University of Michigan

2 2

help
by toni 11 Mar '06

11 Mar '06

1 0

NAS MAC Addres Atribute
by Alex M 11 Mar '06

11 Mar '06

Hi Is the attribute for NAS MAC address is: "NAS-Identifier"? Thanks!

3 2

HOW TO ATTACH A USER TO A SPECIFIC MAC ADDRESS
by Aime 11 Mar '06

11 Mar '06

Hello, How do I define a user in users file so that the user can only be accepted from a given mac address ? In the following exemple , what must I replace <.....> with in the check items ? : user1 User-Password == passwd <.....> Thanks in advance. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

password rejected when CHAP is not used
by Alex M 11 Mar '06

11 Mar '06

When I do not use CHAP my password gets rejected, and when I do use it everything goes OK; but not all my NAS support chap! So what should I do to configure radius to support NAS that doesn't send CHAP passwords? THANKS!

1 0

CVS down
by Thor Spruyt 11 Mar '06

11 Mar '06

http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/ -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

4 4

multiple constraints
by kimmi raikonen 11 Mar '06

11 Mar '06

Hello all! Maybe I heaven't read ehough, but here is question: Is it possible to have two "if" for one rule in users file: DEFAULT NAS-IP-Address == 192.168.2.5, NAS-Port-Id == 0, Proxy-To-Realm := 'bla' If not, how can I do it?? TIA --------------------------------- Yahoo! Mail Bring photos to life! New PhotoMail makes sharing a breeze.

2 1