- Freeradius-Users - lists.freeradius.org

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Alhagie Puye 24 Nov '05

24 Nov '05

This is a great howto. Here is my scenario. I have a Windows2k DC that I would like to authenticate against. I have a Cisco VPN 3005 Concentrator that will be terminating VPN's. I would like to use FreeRADIUS to lock the users into groups and authenticate them against AD. I have followed the steps in the howto and everything seems to work fine but FreeRADIUS is ignoring "MS-CHAP". I'm using ntradping....maybe that's a wrong utility for this instance. Here is the output from the test given in the howto server ~ # ntlm_auth --request-nt-key --domain=DOMAIN --username=apuye password: NT_STATUS_OK: My question is...can I use Active Directory if I need to use attribute 25 on FreeRADIUS? If so, how do I make sure that FreeRADIUS uses on MS-CHAP for an authentication method? Output from debug mode: server ~ # /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host x.y.w.z:3998, id=17, length=45 User-Name = "user" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 17 to x.y.w.z:3998 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 17 with timestamp 4384fa04 Nothing to do. Sleeping until we see a request. Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Norbert Wegener > >Sent: November 22, 2005 11:51 AM > >To: charles schwartz; FreeRadius users mailing list > >Subject: Re: Freeradius How to integrate Active Directory > >[AD Integration WindowsXP NTLM Tutorial] > > > >Hi Charles, > >thank you for that howto. > >A typo, that you might want to correct: > >On page 9 it should be --request-nt-key -instead of > >--nt-request-key and --username instead of -username. > > > >Norbert Wegener > > > > > > > >charles schwartz wrote: > > > >>Hi list, > >> > >>A lot of people on this list would like to integrate Active > >Directory with FreeRADIUS in order to provide a transparent > >user authentication login process. > >> > >>There are at least 2 ways to integrate AD: LDAP and NTLM. > >>I've written a tutorial about how to do this with NTLM > >(winbind, ntlm_auth). The Windows supplicants are configured > >to work with PEAP and MSCHAPv2. > >> > >>You can download it from here: > >>http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tut > >orial.pdf > >> > >>Good luck! > >> > >>Regards, > >>Charles Schwartz > >>- > >>List info/subscribe/unsubscribe? See > >>http://www.freeradius.org/list/users.html > >> > >> > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 2

help with EAP MD5 wired authentication
by anup_parkhi＠hotmail.com 24 Nov '05

24 Nov '05

Hi, I am struggling with EAP-MD5 wired authentication for last couple of days. I checked the web and archives but to no avail. I am using XP supplicant. Tried with Funk's supplicant also but same result. Any help will be highly appreciated. Thanks Anup My users file has following towards the end # On no match, the user is denied access. a User-Password == "a" "test" User-Password == "test" "Administrator" User-Password == "pnbidm123!" aparkhi Auth-Type := System, User-Password == "aparkhi" DEFAULT Auth-Type := Accept Reply-Message = "All users are allowed, Welcome %u." Radiusd.conf has 1. modules section ... pap { encryption_scheme = crypt } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } ... $INCLUDE ${confdir}/eap.conf mschap { ... } files { ... } ... The console output of radiusd -X -s is Ready to process requests. rad_recv: Access-Request packet from host 10.11.12.107:1024, id=76, length=214 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" EAP-Message = 0x020200090174657374 Message-Authenticator = 0xb12214c2d6fb14f33c7cc758ccfb54b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 76 to 10.11.12.107:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0103001604100118f4899111b27fc08900284095e5e2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33fe6026586af730cd367983bb9ea8b6 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" State = 0x33fe6026586af730cd367983bb9ea8b6 EAP-Message = 0x0203001a04101c913399463bebf9f6dc2d0af18f0c7974657374 Message-Authenticator = 0x2592cd875d1068f5b16fe7999f451769 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 26 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Sending Access-Reject of id 77 to 10.11.12.107:1024 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 76 with timestamp 43826690 Cleaning up request 1 ID 77 with timestamp 43826690 Nothing to do. Sleeping until we see a request. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

freeradius SSLv3 probleme
by awal.mohamadou 24 Nov '05

24 Nov '05

can someone help me please?thanks a lot. Alan, thanks for your help. i've found out why my server isn't replying to the client. but unffortunately, i'm facing another probleme about certificate.such as this: TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A where will i go to resolve this option.And what will i have to do? ps: i have fedora 4 with freeradius 1.0.2 with MySQL 4.1.11 and a cisco Aironet 1120 AP. The client is WindowsXP PRO SP2. Here are my logs: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 6 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = yes proxy: default_fallback = no proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded realm realm: format = "prefix" realm: delimiter = "/" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (IPASS) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.47.50:21646, id=77, length=148 User-Name = "awal" Framed-MTU = 1400 Called-Station-Id = "00-40-96-A1-9F-C4" Calling-Station-Id = "00-12-F0-22-79-12" Message-Authenticator = 0x4e41037be4fc0ff2891b3885d2e66a5e EAP-Message = 0x02130009016177616c NAS-Port-Type = Wireless-802.11 NAS-Port = 283 State = 0x42f456107c2dc293d673e01397dabf75 Service-Type = Framed-User NAS-IP-Address = 172.16.47.50 NAS-Identifier = "venus" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.47.50/auth-detail-20051124' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.47.50/auth-detail-20051124 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '/' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "IPASS" returns noop for request 0 rlm_realm: No '@' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 19 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'awal' rlm_sql (sql): sql_set_user escaped user --> 'awal' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'awal' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awal' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'awal' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awal' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 77 to 172.16.47.50:21646 Framed-IP-Address := 255.255.255.255 Framed-MTU := 1500 Service-Type := Framed-User Framed-IP-Netmask := 255.255.255.255 Framed-Routing := Broadcast-Listen Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP EAP-Message = 0x011400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x608cd7476fe0c4584140f035bef51996 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 7 seconds... rad_recv: Access-Request packet from host 172.16.47.50:21646, id=78, length=219 User-Name = "awal" Framed-MTU = 1400 Called-Station-Id = "00-40-96-A1-9F-C4" Calling-Station-Id = "00-12-F0-22-79-12" Message-Authenticator = 0x2e98a63913826e800f9f79987e554cf4 EAP-Message = 0x0214005019800000004616030100410100003d030143859f2c2072df2904b2926d95c2d43b90a6e65ddc333074bf83d39c81784c8300001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 283 State = 0x608cd7476fe0c4584140f035bef51996 Service-Type = Framed-User NAS-IP-Address = 172.16.47.50 NAS-Identifier = "venus" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/172.16.47.50/auth-detail-20051124' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.47.50/auth-detail-20051124 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "digest" returns noop for request 1 rlm_realm: No '/' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "IPASS" returns noop for request 1 rlm_realm: No '@' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "awal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 20 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'awal' rlm_sql (sql): sql_set_user escaped user --> 'awal' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'awal' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awal' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'awal' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awal' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 78 to 172.16.47.50:21646 Framed-IP-Address := 255.255.255.255 Framed-MTU := 1500 Service-Type := Framed-User Framed-IP-Netmask := 255.255.255.255 Framed-Routing := Broadcast-Listen Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP EAP-Message = 0x0115040a19c0000006f1160301004a02000046030143859f1fd885f2f7bf4207405fbb2c38c90519c24bc33301c39ceeaead1db5d120b6dd52862d60cfd84aad04fb051092d71c130aebb5c6b5e0deb2173a1ddf25a700040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x125e69d665adbf679795495c50dc3678 Finished request 1 Going to the next request Waking up in 7 seconds... Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

2 1

Re: CHAP Problems
by radius＠kingmanaz.net 24 Nov '05

24 Nov '05

Taking it out stopped everything all together. ----- Original Message ----- From: "Mitchell, Michael J" <Michael.Mitchell(a)team.telstra.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, November 21, 2005 3:37 PM Subject: RE: CHAP Problems > There used to be a DEFAULT stanza in the "users" configuration file that > set Auth-Type := System which tells the RADIUS server to use /etc/passwd > for authentication. This has caused a few issues like this in the past, > though I thought it had been resolved for 1.0.5. > > If is still exists you may have more success if you comment that out. > > Hope that helps, > Mike > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 22 November 2005 9:13 AM > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Problems > > rad_check_password: Found Auth-Type Local > rad_check_password: Found Auth-Type System > Warning: Found 2 auth-types on request for user 'awarren' > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 14 > rlm_unix: Attribute "User-Password" is required for authentication. > Cannot > use "CHAP-Password". > modcall[authenticate]: module "unix" returns invalid for request 14 > modcall: group authenticate returns invalid for request 14 > auth: Failed to validate the user. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: CHAP Problems
by radius＠kingmanaz.net 24 Nov '05

24 Nov '05

Michael, I got it to work. What I found worked. I recall this was not the way to do this, but it worked until I get it worked out. I have two entries in the users file. DEFAULT Auth-Type := System Fall-Through = Yes DEFAULT Auth-Type := Local Fall-Through = Yes I did find if the := Local entry was first it would error out, but as long as it was second I get users logging in both ways PAP and CHAP. Thanks Bob ----- Original Message ----- From: "Mitchell, Michael J" <Michael.Mitchell(a)team.telstra.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, November 21, 2005 3:37 PM Subject: RE: CHAP Problems > There used to be a DEFAULT stanza in the "users" configuration file that > set Auth-Type := System which tells the RADIUS server to use /etc/passwd > for authentication. This has caused a few issues like this in the past, > though I thought it had been resolved for 1.0.5. > > If is still exists you may have more success if you comment that out. > > Hope that helps, > Mike > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 22 November 2005 9:13 AM > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Problems > > rad_check_password: Found Auth-Type Local > rad_check_password: Found Auth-Type System > Warning: Found 2 auth-types on request for user 'awarren' > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 14 > rlm_unix: Attribute "User-Password" is required for authentication. > Cannot > use "CHAP-Password". > modcall[authenticate]: module "unix" returns invalid for request 14 > modcall: group authenticate returns invalid for request 14 > auth: Failed to validate the user. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: tool for testing machine authentication
by freeradius＠caribsms.com 24 Nov '05

24 Nov '05

Robin Mordasiewicz wrote: >i just did a google on NTRadTest, but found nothing. Where can I download NTRadTest Try NTRadPing at: http://www.mastersoft-group.com/download/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: CHAP Problems
by Michael.Mitchell＠team.telstra.com 24 Nov '05

24 Nov '05

There used to be a DEFAULT stanza in the "users" configuration file that set Auth-Type := System which tells the RADIUS server to use /etc/passwd for authentication. This has caused a few issues like this in the past, though I thought it had been resolved for 1.0.5. If is still exists you may have more success if you comment that out. Hope that helps, Mike -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Sent: Tuesday, 22 November 2005 9:13 AM To: freeradius-users(a)lists.freeradius.org Subject: CHAP Problems rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Alhagie Puye 24 Nov '05

24 Nov '05

Actually, I believe the more important questions is to authenticate against Active Directory, do you need MS-CHAP or LDAP? Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Robin Mordasiewicz > >Sent: November 23, 2005 6:16 PM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >[AD Integration WindowsXP NTLM Tutorial] > > > >On Wed, 23 Nov 2005, Alhagie Puye wrote: > > > > > >> I have followed the steps in the howto and everything > >seems to work > >> fine but FreeRADIUS is ignoring "MS-CHAP". I'm using > >> ntradping....maybe that's a wrong utility for this instance. > >> > > > >I don't think you can properly test this with NTRadPing, but > >I have not been able to figure it out. > > > >I have set my wireless access point to use radius and the > >results I am getting are very different. I would suggest > >testing a tool that more closely resembles your production gear. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

More than one sentence in accounting_stop_query
by Jorge Pomoro 24 Nov '05

24 Nov '05

Hi, I use Freeradius with Mysql. I want to make 2 SQL consultations in the accounting_stop_query field. (in sql.conf) I proved all the possible alternatives, but it does not work, like: accounting_stop_query field = "sentence1, sentence2" or accounting_stop_query field = "sentence1; sentence2" or accounting_stop_query field = "sentence1" accounting_stop_query field = "sentence2" somebody knows how to do it? Regards, Jorge

2 1

RE: help with EAP MD5 wired authentication
by MINODIER David RD-RESA-LAN 24 Nov '05

24 Nov '05

Since you're using EAP-MD5, you should have in your users file: Xxx Auth-Type := EAP, User-Password == "whatever" David. > -----Message d'origine----- > De : freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] De la > part de Anup Parkhi > Envoyé : mardi 22 novembre 2005 01:54 > À : freeradius-users(a)lists.freeradius.org > Objet : help with EAP MD5 wired authentication > > Hi, > > I am struggling with EAP-MD5 wired authentication for last > couple of days. I checked the web and archives but to no avail. > > I am using XP supplicant. Tried with Funk's supplicant also > but same result. > > Any help will be highly appreciated. > > Thanks > Anup > > My users file has following towards the end > > # On no match, the user is denied access. > > a User-Password == "a" > > "test" User-Password == "test" > > "Administrator" User-Password == "pnbidm123!" > > aparkhi Auth-Type := System, User-Password == "aparkhi" > > DEFAULT Auth-Type := Accept > Reply-Message = "All users are allowed, Welcome %u." > > Radiusd.conf has > > 1. modules section > ... > pap { > encryption_scheme = crypt > } > > # CHAP module > # > # To authenticate requests containing a CHAP-Password > attribute. > # > chap { > authtype = CHAP > } > ... > $INCLUDE ${confdir}/eap.conf > > mschap { > ... > } > > files { > ... > } > > ... > > > The console output of radiusd -X -s is > > Ready to process requests. > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=76, > length=214 > Framed-MTU = 1480 > NAS-IP-Address = 10.11.12.107 > NAS-Identifier = "HP ProCurve Switch 2824" > User-Name = "test" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 24 > NAS-Port-Type = Ethernet > NAS-Port-Id = "24" > Called-Station-Id = "00-0f-20-8d-04-c8" > Calling-Station-Id = "00-c0-9f-0d-4a-1f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "1010" > EAP-Message = 0x020200090174657374 > Message-Authenticator = 0xb12214c2d6fb14f33c7cc758ccfb54b7 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_eap: EAP packet type response id 2 length 9 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 183 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 76 to 10.11.12.107:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > Framed-Protocol = PPP > Framed-Compression = Van-Jacobson-TCP-IP > EAP-Message = 0x0103001604100118f4899111b27fc08900284095e5e2 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x33fe6026586af730cd367983bb9ea8b6 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, > length=249 > Framed-MTU = 1480 > NAS-IP-Address = 10.11.12.107 > NAS-Identifier = "HP ProCurve Switch 2824" > User-Name = "test" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 24 > NAS-Port-Type = Ethernet > NAS-Port-Id = "24" > Called-Station-Id = "00-0f-20-8d-04-c8" > Calling-Station-Id = "00-c0-9f-0d-4a-1f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "1010" > State = 0x33fe6026586af730cd367983bb9ea8b6 > EAP-Message = > 0x0203001a04101c913399463bebf9f6dc2d0af18f0c7974657374 > Message-Authenticator = 0x2592cd875d1068f5b16fe7999f451769 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_eap: EAP packet type response id 3 length 26 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 183 > modcall[authorize]: module "files" returns ok for request 1 > modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/md5 > rlm_eap: processing type md5 > rlm_eap_md5: User-Password is required for EAP-MD5 authentication > rlm_eap: Handler failed in EAP/md5 > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 1 > modcall: group authenticate returns invalid for request 1 > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, > length=249 > Sending Access-Reject of id 77 to 10.11.12.107:1024 > EAP-Message = 0x04030004 > Message-Authenticator = 0x00000000000000000000000000000000 > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 76 with timestamp 43826690 Cleaning > up request 1 ID 77 with timestamp 43826690 Nothing to do. > Sleeping until we see a request. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 2