- Freeradius-Users - lists.freeradius.org

Wireless Card - user authentication - Freeradius
by ora 13 Mar '06

13 Mar '06

Hi, I have a Linksys Wireless-G Access Point (WAP54G). I am trying to configure the Access Point in order to have a user authentication by using the MAC address of wireless adapter. So, I installed my freeradius in a linux 9.0 server. My question is: where I have to put the MAC address of wireless adapters??? Into the file ?clients.conf? of my RADIUS server or in the ?users? file?? Do you know the sintaxis? In the other hand, I must to modify the file ?radiusd.conf?? If you have any document concernig this configuration, I'll be glad of any comments or information. Best Regards Octavio RAMIREZ ROJAS

2 1

Re: D-link and freeradius
by Christoforos Ntantogian 13 Mar '06

13 Mar '06

> OK...what you wrote in the naslist file in the TYPE field ? > > IF it worked with your D-link access point then whats the point of the > NASlist file? excuse me but how i answer to a thread without creating a new thread? > > thanks you for anwering Dave.. > > ----- Original Message ----- > From: "Dave Huff" <dbhuff(a)yahoo.com> > To: <freeradius-users(a)lists.freeradius.org> > Cc: <ntantogian(a)di.uoa.gr> > Sent: Monday, March 13, 2006 6:06 PM > Subject: Re: D-link and freeradius > > >> >>> Date: Mon, 13 Mar 2006 12:58:49 +0200 >>> From: "Christoforos Ntantogian" <ntantogian(a)di.uoa.gr> >>> Subject: D-link and freeradius >>> To: <freeradius-users(a)lists.freeradius.org> >>> Message-ID: <002d01c6468d$1eda3db0$b06486c3@noc> >>> Content-Type: text/plain; charset="iso-8859-7" >> >>> Hello, >> >>> I am going to setup an 802.1X wireless authentication with EAP-MD5, >> EAP-TLS and EAP-SIM. >>> I would like to ask if freeradius supports the D-link wireless access >> points. The NAS list > that freeradius support doesnt include D-link >> products. I have a D-link 900+ access point. > How can i make it work >> with >> freeradius or i cant? >> >> I'm using FR with a Dlink 624. I did have to download the latest >> firmware >> from Dlink before it would work. >> >> Dave H >> >> >> >> >> >> -- >> No virus found in this incoming message. >> Checked by AVG Free Edition. >> Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 10/3/2006 >> >> >

1 0

Re: D-link and freeradius
by Dave Huff 13 Mar '06

13 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Date: Mon, 13 Mar 2006 12:58:49 +0200 > From: "Christoforos Ntantogian" <ntantogian(a)di.uoa.gr> > Subject: D-link and freeradius > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <002d01c6468d$1eda3db0$b06486c3@noc> > Content-Type: text/plain; charset="iso-8859-7" > Hello, > I am going to setup an 802.1X wireless authentication with EAP-MD5, EAP-TLS and EAP-SIM. > I would like to ask if freeradius supports the D-link wireless access points. The NAS list > that freeradius support doesnt include D-link products. I have a D-link 900+ access point. > How can i make it work with freeradius or i cant? I'm using FR with a Dlink 624. I did have to download the latest firmware from Dlink before it would work. Dave H -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.5 (Build 5050) iQEVAwUBRBWYpiKWt8bugsEpAQiToAgAlX84Z+D2YHOUl+ZfYr25dUx3xYCKcJjY P+aEnUimIv1gpOCpU73DpgH+1LJP1ecdA/n1W9cBlf84Tu95pn0Hhj4JpVVqkhUh wBeemR+bdxBgMEVdLGoORQITtDXOgyp6rAx+oEa8KFMQEZm+VuEbSz4WNWawZ7o8 fse5qr7M9F+QRZJHZ1CQ9eafW/iBl3l8EMQN4mFibi/0M21NlZawqo4ymHey2mCQ 5ICQ2SrMKLMtdSnGKjZjiAw9EgV4OXsu3G7Ts5+R5IjetmHNmiv2fVK33Br2ycLT D3rdPpojdCwnvvbLQMU2B/NOOac3gH22ap41odNzaM3MStWljh1S0g== =N4A9 -----END PGP SIGNATURE-----

1 0

Expiration Dates
by Atkins, Dwane P 13 Mar '06

13 Mar '06

I was not sure if this got to mailing list or not. I have done some research and could not find where you can enter start and stop dates through freeradius. Is there a way that I can input the start and stop time for user as far as in like an expiration date? Let say you are a contractor and need access for the 5 duty days you are in town. Can I put a config in that says, start on the 1st, end on the 5th? Thanks for all you inputs. Truly helpful. Dwane

2 1

D-link and freeradius
by Christoforos Ntantogian 13 Mar '06

13 Mar '06

Hello, I am going to setup an 802.1X wireless authentication with EAP-MD5, EAP-TLS and EAP-SIM. I would like to ask if freeradius supports the D-link wireless access points. The NAS list that freeradius support doesnt include D-link products. I have a D-link 900+ access point. How can i make it work with freeradius or i cant? ---------------------------------------------------------------- Christoforos Ntantogian PhD student Communications Networks Laboratory Department of Informatics & Telecommunications University of Athens Panepistimioupolis, Ilisia, PC 15784 Athens, Greece Tel: +30 210 7275402 Fax: +30 210 7275601 E-mail: ntantogian(a)di.uoa.gr Home page: http://cnl.di.uoa.gr/ ----------------------------------------------------------------

1 0

Ignoring request from unknown client 1.2.3.4.:****
by yao guoxian 13 Mar '06

13 Mar '06

Having installed Mysql4.0, I recompile Freeradius 1.0.5. It seems Freeradius and Mysql works well when I enter : radiusd -X. However, when I use the 'UserName' and 'Password' in the 'radcheck' table to test , I get the following output from Radius Server: rad_recv: Access-Request packet from host 202.117.49.26:3978, id=12, length=47 Ignoring request from unknown client 202.117.49.26:3978 --- Walking the entire request list --- Any suggestions?

2 1

PAP Question
by Alex M 12 Mar '06

12 Mar '06

Hi I want to use PAP protocol; do I have to set it in Authorization section? Because there is no commented line for PAP while there is every other module included. Thanks!

1 0

will this work?
by Pelusa Vali 12 Mar '06

12 Mar '06

hi everybody, i use debian sarge, madwifi-ng-r1457, hostapd 0.4.8 and freeradius 1.1, i want to use eap-tls, is there any special configuration or patch should be applied to any of this programs to get them work? i tried configurations from madwifi users docs and many tutorials, but nothing works. simply clients cann't authenticate, always get: Access-Reject. these are my conf files: MADWIFI: modprobe ath_pci autocreate=ap wlanconfig ath0 create wlandev wifi0 wlanmode ap ifconfig ath0 up iwpriv ath0 mode 3 iwconfig ath0 essid MYWLAN iwconfig ath0 channel 2 iwconfig ath0 bitrate 54M iwconfig ath0 frag 512 iwconfig ath0 rts 250 iwpriv ath0 ar 1 echo 1 > /proc/sys/net/ipv4/ip_forward /etc/init.d/networking restart IPTABLES=/sbin/iptables $IPTABLES -F -t nat $IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE /etc/init.d/dhcp stop /etc/init.d/dhcp start DHCP: subnet 192.168.10.0 netmask 255.255.255.0 { range 192.168.10.2 192.168.10.30; option subnet-mask 255.255.255.0; option broadcast-address 192.168.10.255; default-lease-time 600; max-lease-time 7200; } HOSTAPD: interface=ath0 driver=madwifi logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 debug=4 dump_file=/tmp/hostapd.dump ctrl_interface=/var/run/hostapd ctrl_interface_group=0 ssid=MYWLAN macaddr_acl=0 auth_algs=3 ieee8021x=1 eap_message=hello eapol_key_index_workaround=0 own_ip_addr=127.0.0.1 nas_identifier=www.server.com auth_server_addr=127.0.0.1 auth_server_port=1812 auth_server_shared_secret=whatever acct_server_addr=127.0.0.1 acct_server_port=1813 acct_server_shared_secret=whatever wpa=1 wpa_key_mgmt=WPA-EAP wpa_pairwise=TKIP wpa_strict_rekey=1 wpa_gmk_rekey=86400 DEFAULT HOSTAPD: #RUN_DAEMON=yes RADIUS USERS: "pupis" DEFAULT Auth-Type = System Fall-Through = 1 here i tried too: DEFAULT Auth-Type = EAP Fall-Through = 1 each one alone, and together. RADIUS CLIENTS.CONF: client 127.0.0.1 { secret = whatever shortname = www.server.com } RADIUS EAP.CONF: default_eap_type = tls tls { certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } when i run, get this: hostapd logs: Sending RADIUS message to accounting server RADIUS message: code=4 (Accounting-Request) identifier=0 length=88 Attribute 40 (Acct-Status-Type) length=6 Value: 7 Attribute 45 (Acct-Authentic) length=6 Value: 1 Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 32 (NAS-Identifier) length=14 Value: 'www.server.com' Attribute 30 (Called-Station-Id) length=30 Value: '00-0F-66-11-C1-97:MYWLAN' Attribute 49 (Acct-Terminate-Cause) length=6 Value: 11 Next RADIUS client retransmit in 3 seconds Flushing old station entries running locally radtest: radtest pupis whatever localhost 0 whatever Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "pupis" User-Password = "whatever" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=178, length=20 by the way, i cann't run radclient or radeapclient, when use it, don't get any response. but now, winxp clients don't detect this wlan as activated with wpa, only wlan without security, and don't get any ip direction, even i'm using dhcp. if i don't run radius and hostapd then client do get ip direction and can use wlan. so, my question again is, what should i do to get eap-tls working?? i heard that may be this won't work with debian, could it be a possible explanation?? i'm really tired , i tried everything i think, and don't know what more should do. thanks in advance for your patience. _______________________________________________________________ Halloween Humour: What kind of girl does a mummy go out with? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=154

2 1

Freeradius + Xp Client problem
by BoRa 12 Mar '06

12 Mar '06

When i trying connect radius server with wireless over access point i get this error : rad_recv: Access-Request packet from host 10.10.0.10:2048, id=110, length=163 User-Name = "ibm" NAS-IP-Address = 10.10.0.10 NAS-Port = 0 Called-Station-Id = "00e098be8e15" Calling-Station-Id = "000cf138bb81" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000080169626d Message-Authenticator = 0x8c249d2c90720d71e84717a58070eaae Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "ibm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 0 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry ibm at line 80 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 15 modcall: group authenticate returns handled for request 15 Sending Access-Challenge of id 110 to 10.10.0.10:2048 Reply-Message = "Hello, %u" EAP-Message = 0x01010016041094b82f52b0da67bfb8de368e6d9bd919 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4756a5552099f5c02b869e15b923300c Finished request 15 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.10.0.10:2048, id=111, length=173 User-Name = "ibm" NAS-IP-Address = 10.10.0.10 NAS-Port = 0 Called-Station-Id = "00e098be8e15" Calling-Station-Id = "000cf138bb81" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x4756a5552099f5c02b869e15b923300c Message-Authenticator = 0x6629ec8f043cf6353e8707d3a5854a4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "preprocess" returns ok for request 16 modcall[authorize]: module "chap" returns noop for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_realm: No '@' in User-Name = "ibm", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 16 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry ibm at line 80 modcall[authorize]: module "files" returns ok for request 16 modcall: group authorize returns updated for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: No such EAP type peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 16 modcall: group authenticate returns invalid for request 16 auth: Failed to validate the user. Login incorrect: [ibm/<no User-Password attribute>] (from client wireless port 0 cli 000cf138bb81) Delaying request 16 for 1 seconds Finished request 16 Going to the next request users file contains : ibm Auth-Type := EAP, User-Password == "test" Reply-Message = "Hello, %u" I'm try also Radius Test (Radutils) program connect successful. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Realms allowed to some huntgroup
by Walter Reynolds 11 Mar '06

11 Mar '06

I am not quite finding the setup I am looking for and hope someone can point me to the files I should be updating. Currently I am running version 1.0.4 Hopefuly I can describe what I want to do and you can let me know if it is doable, and if so what files I should modify. I have questions. 1. How can I authenticate realms differently. 2. Can I set up logging based on Realm I will simplify this and say we have two service types I want to authenticate. 1. Wireless 2. VPN I currently have Wireless and VPN set up so we do some proxy. If a user signs in with either the following they can log in: waltr - no domain (us NULL realm to authhost = local in proxy.conf) waltr(a)xxx.edu - xxx.edu domain has realm defines and proxies to remote radius server at other campus Well this works and Wireless and VPN can sign in. The thing is I want wireless to work this way, but I want VPN to only work with no domain logins. But how do I define a domain/realm to a group so I can put that into the huntgroup file. We are currently using Merit radius and it works this way (I am adding this for example only) Clients.conf (using old style for clarity) =========================== #Clients Name Key [type] [version] [prefix] #---------------- --------------- --------------- --------- -------- # iLab Radius servers vpn.xxx.edu secretvpn type=Merit:PROXY vpn wirelessAP1.xxx.edu secretwireless type=PROXY wireless wirelessAP2.xxx.edu secretwireless type=PROXY wireless ============================ The prefix would tell it to use a specific users file and authfile. So I have the following 4 files: vpn.users vpn.authfile wireless.users wireless.authfile With those files I can have users connecting to wireless clients (ie huntgroup) go to a specific user and authfule. I can set the vpn service to authenticate Null realms and drop all others while at the same time I can set wireless to authenticate Null locally and proxy the defined realms to another radius server. Question number two is can I separate the accounting for the realms to different logfiles? -- Walter Reynolds University of Michigan

2 2