- Freeradius-Users - lists.freeradius.org

Re: Roaming with WPA-Enterprise/Radius
by David Mitton 04 Jan '06

04 Jan '06

802.11f is different than most IEEE 802 standards, in that it's a "Recommended Practice" not a standard. I'm not aware of any implementations, but I'd like to hear of them. Anyways, the IEEE 802 SA has withdrawn 802.11F as an RP as of 12/08/2005. Dave. ----- Original Message ----- From: "Artur Hecker" <hecker(a)wave-storm.com> To: z.ori(a)morehead-st.edu, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Roaming with WPA-Enterprise/Radius Date: Wed, 4 Jan 2006 14:16:08 +0100 > > hmmm, seriously though: > > - does anyone know of any APs on the market which support 802.11f? > - has anyone ever seen a reasonable non-proprietary definition of the > container content for the context transfer? > - has anyone ever thought of implementing the support for 802.11f into > freeradius? (i know alan hates its double-nested attributes :-) ) > - what about the preauthentication definitions in 802.11i? > > > ciao > artur > > > On 4 Jan 2006, at 14:07, Zoltan Ori wrote: > > > On Wednesday 04 January 2006 07:07, DI PAOLA ., VIERI wrote: > >> > >> Is there a way of "caching" or "pre-authenticating" or "propagating > >> authentication between APs"? > >> > >> Has anyone found a solution to this roaming problem in case one uses > >> WPA-Enterprise/Radius? > >> > > > > IAPP - IEEE 802.11F > > > > > > Zoltan Ori > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ > > users.html > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

802.1x, WinXP and LDAP
by Gary Algier 04 Jan '06

04 Jan '06

Hello: I am trying to get an HP Procurve 2650 Ethernet switch to use Freeradius 1.0.5 for 802.1x auth. The backend is Sun's directory server with all the necessary SambaNTPassword attributes, etc. to make Samba work. The client is a WinXP system. I am using the builtin supplicant. I can get it to work with the "Automatically use my Windows login..." box _unchecked_, but not with it checked. I would like to use the checked mode as then the user does not need to "click here to select a certificate or credentials for connection to the network". When the box is not checked, I get to type any value I want for the user ID and password. I can then get authenticated and the switch connects me to the proper VLAN. When the box is checked, I cannot get authenticated and the switch puts me on the "guest" VLAN. I should be able to authenticate, but the ID comes across as something like "MALACHITE\gaa". The first part is the netbios hostname and the second is the real ID. I have setup the hints, users and radiusd.conf files with: ---------------------------------------------------------------------------------------------- hints: ... DEFAULT NAS-IP-Address == 172.25.16.9, User-Name =~ "^(.*)\\\\(.*)" Hint = "8021XUSER", Stripped-User-Name = `${2}` ... users: ... DEFAULT Hint == "8021XUSER" Fall-Through = 1 ... radiusd.conf: ... ldap { server = "ldap.ulticom.com" basedn = "dc=ulticom,dc=com" filter = "(&(objectclass=person)(uid=%{Stripped-User-Name:-%{User-Name}}))" do_xlat = yes base_filter = "(objectclass=*)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ... ---------------------------------------------------------------------------------------------- The problem seems to be that the hostname is not always stripped. If I compare the output of "radiusd -X" between the two scenarios I see that the "unchecked" configuration does a lot of ldap lookups like: ---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 172.25.16.9:1025, id=208, length=193 Framed-MTU = 1480 NAS-IP-Address = 172.25.16.9 NAS-Identifier = "hp-50-9" User-Name = "gaa" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-85-40-71-ff" Calling-Station-Id = "00-14-22-dc-9b-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0201000801676161 Message-Authenticator = 0x29393306cb95a1c78586d546cf5eb462 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gaa radius_xlat: '(&(objectclass=person)(uid=gaa))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.ulticom.com:389, authentication 0 rlm_ldap: bind as / to ldap.ulticom.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa)) rlm_ldap: checking if remote access for gaa is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value ABABABABABABABABABABABABABABABAB & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value CDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCD & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user gaa authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 176 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 ---------------------------------------------------------------------------------------------- Eventually somebody is happy with this sequence and I am "in". With the "checked" configuration all the early lookups work, but the last lookup fails: ---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 172.25.16.9:1025, id=222, length=254 Framed-MTU = 1480 NAS-IP-Address = 172.25.16.9 NAS-Identifier = "hp-50-9" User-Name = "MALACHITE\\gaa" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-85-40-71-ff" Calling-Station-Id = "00-14-22-dc-9b-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" State = 0xe5aab6b483e09694dcbd98eb81ac64bf EAP-Message = 0x020600291900170301001ef47b2a4c59a72fa63123f178383e6518a535662859ed121d2819831f649f Message-Authenticator = 0x9b8b7d5de51ffffde87cfabe52688fbc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 hints: Matched DEFAULT at 36 radius_xlat: 'gaa' modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for MALACHITE\gaa radius_xlat: '(&(objectclass=person)(uid=gaa))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa)) rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value EFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEF & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value ABABABABABABABABABABABABABABABAB & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user MALACHITE\gaa authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 176 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - MALACHITE\gaa rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02060012014d414c4143484954455c676161 PEAP: Got tunneled identity of MALACHITE\gaa PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to MALACHITE\gaa PEAP: Sending tunneled request EAP-Message = 0x02060012014d414c4143484954455c676161 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MALACHITE\\gaa" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for MALACHITE\gaa radius_xlat: '(&(objectclass=person)(uid=MALACHITE))' radius_xlat: 'dc=ulticom,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=MALACHITE)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 5 modcall: group authorize returns notfound for request 5 ---------------------------------------------------------------------------------------------- So, why don't my regular expressions apply during the group authorize? How can I fix the group authorize? Perhaps I don't need it. Some day I may use it for controlling VLAN assignment, but for now I would be happy to just differentiate between "auth" and "not auth". -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

1 0

Roaming with WPA-Enterprise/Radius
by DI PAOLA ., VIERI 04 Jan '06

04 Jan '06

Hello, I have freeRadius version 1.0.5 on gentoo Linux (r3). I am using three Linksys WAP54G access points. I've managed to roam seamlessly both with Broadcom and Intel wireless laptops. However, this is true for open APs or with WEP encryption. If I use WPA-Enterprise with a Radius server, there's a long delay when switching between APs (10 seconds). The test environment is as follows: freeRadius.org Gentoo Linux server --- 3 Linksys WAP54G APs configured with WPA-Enterprise w/Radius --- 1 roaming laptop The delay seems to be due to re-authentication with the freeRadius server and that seems to be "expensive". Is there a way of "caching" or "pre-authenticating" or "propagating authentication between APs"? Has anyone found a solution to this roaming problem in case one uses WPA-Enterprise/Radius? Regards, Vieri

3 2

Doc's?
by Jonathan Carpenter 04 Jan '06

04 Jan '06

I am wanting to replace radiator radius with freeradius, but I can not find any documentation on how to setup and configure freeradius. I have visited the wiki page but do not see any howto's or anything. Can someone send me a link to the documentation on how to setup and configure freeradius and dialup_admin? Thanks, -- Jonathan Carpenter

2 1

CiscoAP->Freeradius->AD->ISA(ntlm authentication)
by Konne 04 Jan '06

04 Jan '06

hi @ all, is it possible to do following: my wireless-clients will authenticate through a ciscoAP. the client will be routed automatically to the chillispot login page. on the same server is freeradius installed. Freeradius looks in the ActiveDirectory if the user exists and has the rights to connect to the internet. if the authentication is ok, the user must surf over a ISA because there is installed websense. we have a windows domain and so we use a secure ntlm authentication. is it possible to have a transparent authentication through the isa-server. i mean if the client is in the condition that he can send the ntlm authentication, that he doestn't have to authenticate twice times. one time on the chillispot and the second on the isa server. is there any possibilty? my network, all cisco network devices (aironet 1424, catalyst 3750) (( )) wireless-clients (( )) AP - - - - - [routed network/VLANS]- - - - - freeradius/chillispot (( )) | | | | | ActiveDirectory/LDAP | ISA/Websense [ntlm authentation required] | | Firewall | Router | Internet thx

2 2

DNS non reachable
by Santiago Balaguer García 04 Jan '06

04 Jan '06

2 1

RE: wireless - freeradius - MS ldap
by Dickson, John 03 Jan '06

03 Jan '06

I am sorry. I received a request for the data I had already sent, and I ran the tests too. I will refrain. John -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Alan DeKok Sent: Tuesday, January 03, 2006 2:17 PM To: FreeRadius users mailing list Subject: Re: wireless - freeradius - MS ldap "Dickson, John" <JDickson2(a)mccneb.edu> wrote: > I sent this out earlier. Ah. Having been told that what you sent earlier is inadequate, your response is to re-send it. It's OK that you're a beginner. It's *not* OK to not read the FAQ or documentation which describe exactly how to test the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: wireless - freeradius - MS ldap
by Alhagie Puye 03 Jan '06

03 Jan '06

John, People are *trying* to help you but you helping us help you. Please follow these steps and produce the output: And please don't say *I have already sent it*....... - Run "radiusd -X -A" on the FreeRADIUS server - Run "radtest radtest Passw0rd localhost 1 testing123" Now copy and paste the response from FreeRADIUS. The setup you are trying to achieve WORKS. I have tried it before and does work. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 3, 2006 12:44 PM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > >I am sorry. I received a request for the data I had already > >sent, and I ran the tests too. I will refrain. > > > >John > > > >-----Original Message----- > >From: > >freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org > >[mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.f > >reeradius.o > >rg] On Behalf Of Alan DeKok > >Sent: Tuesday, January 03, 2006 2:17 PM > >To: FreeRadius users mailing list > >Subject: Re: wireless - freeradius - MS ldap > > > >"Dickson, John" <JDickson2(a)mccneb.edu> wrote: > >> I sent this out earlier. > > > > Ah. Having been told that what you sent earlier is > >inadequate, your response is to re-send it. > > > > It's OK that you're a beginner. It's *not* OK to not read > >the FAQ or documentation which describe exactly how to test > >the server. > > > > Alan DeKok. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Pix 535 Auth issues with Pix 7.0......
by Sills, Tripp 03 Jan '06

03 Jan '06

Folks, I am using a Pix 535 running version 7.0. I can authenticate when I run the aaa-server test command from the CLI on the Pix but when I use it through the VPN client it kicks back a reject. I noticed that one debug of the freeRADIUS server Says Auth type : System and the other says Auth type : Local. The local authentication happens when I go from the CLI. The system happens when I go from the client. Any help would be appreciated. Not sure why the force there. Tripp

1 0

RE: wireless - freeradius - MS ldap
by Dickson, John 03 Jan '06

03 Jan '06

I sent this out earlier. John [root@magellan john]# /usr/local/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ssotest.mccsso.mccneb.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "dmadmin1"" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "rDkf@mh" ldap: basedn = "ou=Metro users,dc=mccsso,dc=mccneb,dc=edu" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8d5c4d0 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Alhagie Puye Sent: Tuesday, January 03, 2006 1:16 PM To: FreeRadius users mailing list Subject: RE: wireless - freeradius - MS ldap John, Just run "radiusd -X -A" on the FreeRADIUS server and then try athenticating against it. You should see a lot of debug information. Send the output to the list.....that would be more helpful. Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 3, 2006 10:58 AM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > >I don't know. Ithought I was sending enouhg information. > > > >I was using this link to setup...it's my first. > >http://www.tldp.org/HOWTO/LDAP-Implementation-HOWTO/radius.html > > > >What is confusing me is where configuration is applied to receive > >requests (cisco router) and where applied to pass requests (MS ldap). > > > >-----Original Message----- > >From: > >freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org > >[mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.f > >reeradius.o > >rg] On Behalf Of Alan DeKok > >Sent: Tuesday, January 03, 2006 11:55 AM > >To: FreeRadius users mailing list > >Subject: Re: wireless - freeradius - MS ldap > > > >"Dickson, John" <JDickson2(a)mccneb.edu> wrote: > >> OK. In the radius.conf under module configuration I have "ldap" > >> information pointing to the LDAP server and the > >authentication fails. > > > > The debug log you posted doesn't show that. In fact, it shows > >pretty much nothing useful. You've taken care to > >*not* show the results from radtest, so all anyone can see is: > > > > a) your radius server starts > > b) radtest sends packets. > > > > They don't see: > > > > c) radiusd *receiving* packets > > d) radtest receiving a response > > > > How the heck can anyone help you without that information? > > > > Alan DeKok. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1