- Freeradius-Users - lists.freeradius.org

eap-sim
by Giorgos Kostopoulos 22 Oct '05

22 Oct '05

Hi all, I 'm trying to setup a radius server with eap-sim. 1)I tried freeradius and i have configured it (and messed around with the code, trying to avoid the server to get the rand from an gsm-operator/provider) I' have succesfully accepted the radius access request and i have succesfully send the radius access challenge (eap-sim start) .... The response i get though from the client is that the server is not authenticated... and so there is no radius access request(after eap-sim start) packet. Does this have to do anything with the rand ? 2)Supposed i have a virtual radius server who transmits the above packets. Can anyone tell me exactly the fields i need to create the buffer who is encrypted for the request authenticator and the message authenticator? (i need details about which attributes i need, the order of the bytes e.t.c. - the rfc is not very clear, especially about the message authenticator) thanks in advance

1 0

Question about mac address auth / dot1x / vlan assignement.
by Didier CONTIS 22 Oct '05

22 Oct '05

I apologize if the subject is a little bit off topic. I have what seems now to be a classic scenario where I am trying to do mac address auth / vlan assignment using Windows XP / Cisco Catalyst switch running IOS / FreeRadius 1.0.5 After reading several posts on the mailing list about the subject, I was wondering if someone could clarify a specific point: Can the Windows XP built-in supplicant send the host mac-address as the username / password (during EAP-MD5 or EAP-PEAP) ? Thanks in advance for any tips. Best regards - Didier.

1 0

Radlast and radwho fails
by Kevin Capwell 21 Oct '05

21 Oct '05

GIVEN: I can use both the test account and a laptop with an access point to access our wireless network via freeradius. However, I can not see who is currently online through radlast and radwho. Authentication Style: MAC address using the ${sysconfdir}/raddb/users file DETAILS Server OS: Mac OS X - 10.4.2 Darwin (fully qualified domain name) 8.2.0 Darwin Kernel Version 8.2.0: Fri Jun 24 17:46:54 PDT 2005; root:xnu-792.2.4.obj~3/RELEASE_PPC Power Macintosh powerpc radiusd - version 1.0.5 NAS: Netgear - Prosafe Wireless Access Point WG102 Firmware Version V1.0.31 ==Accounting is ON== Primary Accounting Server IP Address (suppressed) Port Number 1813 Shared Secret (suppressed) $ radlast last: /usr/local/var/log/radius/radwtmp: No such file or directory $ radwho radwho: Error reading /usr/local/var/log/radius/radutmp: No such file or directory $ /usr/local/sbin/radiusd -X ... Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. from /usr/local/etc/raddb/radiusd.conf ... radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "yes" } ... radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } ... accounting { detail unix radutmp } ... session { radutmp } ----------------------------------------- The views, opinions and statements contained in this transmission are not necessarily the views, opinions and statements of the School District of Onalaska. http://www.onalaska.k12.wi.us/ This e-mail, and any files transmitted with it may contain confidential material and is intended solely for the use of the individual to whom it is addressed. If you have received this e-mail in error, please discard the message and notify the sender directly.

3 5

ldap filter question
by Markus Krause 21 Oct '05

21 Oct '05

hi all! to verify some network devices which want to connect to a switch we want to use radius and store the mac-addresses in ldap. the switch passes the ethernet-mac-address to radius which should then be checked against the ldap entry for dhcp, there is an attribte dhcpHWAddress we already use successfully for dhcp. the dhcpHWAddress contains something like "ethernet 00:0e:35:c4:70:a8". how can i teach radius to use just the octect value (without the word "ethernet"=) of this attribute? i assume that i have to define something like 'filter = "dhcpHWAddress=%u" ', but how to strip of "ethernet"? thanks in advance for any tipps! regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

PEAP Machine Authentication
by Jérémy Cluzel 21 Oct '05

21 Oct '05

Hi, I looked in the samba 3.0.20 source code and I only found 2 calls to the "init_id_info2()" function in the "samba/source/rpc_client/cli_netlogon.c" file: In the "cli_netlogon_sam_logon()" function: 701 init_id_info2(&ctr.auth.id2, lp_workgroup(), 702 0, /* param_ctrl */ 703 0xdead, 0xbeef, /* LUID? */ 704 username, cli->clnt_name_slash, chal, 705 local_lm_response, 24, local_nt_response, 24); And in the "rpccli_netlogon_sam_network_logon()" function: 802 init_id_info2(&ctr.auth.id2, domain, 803 0, /* param_ctrl */ 804 0xdead, 0xbeef, /* LUID? */ 805 username, workstation_name_slash, (const uchar*)chal, 806 lm_response.data, lm_response.length, nt_response.data, nt_response.length); But nothing in the "cli_netlogon_sam_network_logon()" function... Regards, Jeremy

3 2

RE: recommended restart-wrapper for freeradius
by Tariq Rashid 21 Oct '05

21 Oct '05

but from the doc/supervide-radiusd.txt we have "Note: The radwatch script that used to be part of this distribution, is depreciated and SHOULD NOT BE USED." is it still safe to use? tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 21 October 2005 14:28 To: FreeRadius users mailing list Subject: Re: recommended restart-wrapper for freeradius Tariq Rashid wrote: > hi - we're having the freeradius 1.0.2 daemon dying occasionally for > mysterious reasons - we're still investuigating the cause. You should upgrade to 1.0.5. http://freeradius.org/security.html > running in the foreground in an infinite loop is also not ideal as > this means the daemon doesn't run in threaded mode. I don't understand. This shouldn't be a problem. > can anyone recommend a good way to monitor/restart the daemon. You could look at scripts/radwatch in the FreeRADIUS source tree. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Malformed RADIUS packet. Invalid attribute 0
by Ramon Barquier 21 Oct '05

21 Oct '05

2 1

SV: recommended restart-wrapper for freeradius
by Svein Hansen 21 Oct '05

21 Oct '05

I have the same problem.. I made a simple shell script that runs every 5 min.(crontab) #! /bin/bash if ! [ -n "`radtest username passwd localhost 10 secret | grep TRAPEZE`" ]; then service radiusd restart fi "TRAPEZE" i s the name of the user-assigned vlan.. rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=39, length=29 Tunnel-Private-Group-Id:0 = "TRAPEZE" Modify the line/word you want to grep if authentication works... Svein >>> tariq.rashid(a)uk.easynet.net 21.10.2005 11:56 >>> hi - we're having the freeradius 1.0.2 daemon dying occasionally for mysterious reasons - we're still investuigating the cause. however - when it dies the radiusd.pid file is not removed. this causes problems for most restart-wrappers ... running in the foreground in an infinite loop is also not ideal as this means the daemon doesn't run in threaded mode. can anyone recommend a good way to monitor/restart the daemon. tariq - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

mac address auth question
by kdr akm 21 Oct '05

21 Oct '05

Hi, i'm using freeradius 1.0.5. i make a pppoe server with rp-pppoe and freeradius without mysql and i make auth by username and password all i need to add to my configuration a check if mac address and if valid accept ( a mac address authentication but without mysql ) so how can i make this think and thanks in advanced . Sorry for my bad inglish --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

2 2

Freeradius and What's Up Gold Question
by Linda Pagillo 20 Oct '05

20 Oct '05

Hi everyone: I'm going to try to explain this as best I can. I'm using Freeradius 1.0.5 on a Linux Redhat 9 server. I have a network monitoring program on another computer called What's Up Gold. It is made by a company called Ipswitch. There is a setting in the WUG program that lets you monitor a radius server. This is how Ipswitch explains how it works: "What we specified for a test is an INVALID test for the userid TEST as it not encoded using the secret key. Then what we expect back is a response telling us the userid doesn't exist. The main key for making it work on Radius servers is to ensure the requesting workstation has permissions to send Radius requests. This seems to be the most common error in implementation by users. You will have to include the Monitor station (that is, the computer running WUG) in the /etc./raddb/clients file on the Radius server." I completely understand what it is saying and I have done this. Now that I have given you some background on how this works, here is my actual situation and question: I keep getting false positives on my WUG telling me that freeradius is down even though it's not. This does not happen everytime WUG sends a request to the radius. It happens at random. When I search in the radius logs it shows that the request is being sent to freeradius from WUG and the user TEST is indeed being rejected just like it's suppose to. The request is sent to the radius every 20 minutes and it makes it there every time. Now, the way I see it, it can be one of two things... The first... I have my WUG set at 5 seconds as a time out. Could freeradius, at times, be taking more than 5 seconds to respond to a sent request? if this is the case, I figure it would take my customers a few times to dial up and get authenticated at times, which is not a good thing since I work for an ISP. We haven't had any customers calling tech support about this, but still we can't rule it out just yet. The second... does freeradius lock out users after a certain amount of bad requests and if so, is there a configuration change that I can make to avoid this? I have looked all over for an answer to this question and I haven't found it, so I thought I'd post it here with the hope that someone would know. I'm sorry about the huge post. I just wanted to give enough information for the person/people that may help me with this. Thank you and I look forward to any response. By the way, I just wanted to say thanks to everyone that has helped me in the past, especially Mr. DeKok who has had much patience with me. I love your freeradius program. It's the best radius server I have used yet. Thank you for giving it to us for free and for all of your support because I do realize that you don't need to give any support if you didn't want to. You are much appreciated. Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

3 4