- Freeradius-Users - lists.freeradius.org

MPPE/PEAP support not in anything but CVS snapshots?
by Bill Carr 19 Aug '05

19 Aug '05

I have a quick question, I ran across a note in a document about 0.97 stating that MPPE support was only in the nightly snapshots and not in the normal releases. (http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html) If this changed since 2002, could someone let me know when? Otherwise I'm chasing my tail using a RHEL ES RPM which starts, runs but won't start the EAP piece, but a freshly compiled version works fine. I have a client who's a stickler for using the "vendor"-blessed versions and I've been trying to figure out why this has been more difficult to set up than most of my out-of-the-box configs. Thanks a bunch!

2 1

[solution] Received unexpected tunneled data after successful handshake
by Waba 18 Aug '05

18 Aug '05

Hello, I was stuck for a bit on this error message before finding the solution, so I thought I'd share and get it into the list archives for future reference. Context: Trying to get WindowsXP 802.1X supplicants to be authenticated on a FreeRADIUS server. After a successful TLS handshake, the rlm_eap_tls: Received unexpected tunneled data after successful handshake message would appear and abort the process. The solution is in http://www.freeradius.org/doc/EAPTLS.pdf - the client and server certificates must contain an Enhanced Key Usage. Look for "-extensions" in the generation script, and for the "OpenSSL extensions file" section. Taking this into account and regenerating the client & server certificates worked for me. I hope it helps, -Waba.

1 0

mod_auth_radius values
by Ayres G.J. 18 Aug '05

18 Aug '05

Hello all, I am developing a web system that authenticates users to a web site through free radius using the mod_auth_radius module for apache. It all works fine, but I would like to get the username of the user that has authenticated for use on pages once they have authenticated. I am not sure how to go about this. I guess that the values are set in a cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I could retrieve the values, either through HTML or PHP? Thanks, Gareth. - - - - - - - - - - - - - - - - Gareth Ayres Wireless Network Officer Library & Information Services University of Wales Swansea, Singleton Park, Wales, UK SA2 8PP e-mail: g.j.ayres(a)swansea.ac.uk

3 3

General Question..
by Behzad Barzideh 18 Aug '05

18 Aug '05

Hello, I am new to Radius and Free Radius, so forgave me if this question has been asked or it is crazy. We are in process of change all our authentication and authorization. At the moment every "service" has it's own user-id/password database. Thus authentication/authorization per service is simple. want to deny access to a given user, disable his/her password or that service. As you can imagine this has a big overhead and users have to remember many user-id/password per. Can we use Radius/LDAP to do this. What I was hope we can do is as follow: everyone will get one user-id/password But for every service we will create a boolean attribute. All services, dialup/wireless/vpn/etc will use one radius server for both Auth(authenticate/authorize). The question is can FreeRadius(or any radius) be configured to as the LDAP for the correct service attribute and give access both base on the user-id/password and what the value of the services? Thank you all for your help.

3 2

Dial-up admin
by Allan Borman 18 Aug '05

18 Aug '05

Hi All, I have freeradius operational on a new X86 dell server platform running LINUX ES. I am having issues with Dialup-admin and PHP. Has anyone installed this interface successfully on LINUX ES. Is there any docs on this. I have read the docs that comes with Dialup-admin. Any help is appreciated in advance. Best Regards, Allan Borman.

1 0

RadZap Still given (negative Port)
by Sarkis Gabriel 18 Aug '05

18 Aug '05

After installing the CVS although not the latest one as of today but it was suppose to have the fix for the Negative port. radwho -ZR -N 192.116.123.118 -u74347 User-Name = "74347" Acct-Session-Id = "80a0000d" Acct-Status-Type = Stop NAS-IP-Address = 192.116.123.118 NAS-Port = -2136997875 Service-type = Login-User Framed-IP-Address = 10.10.13.254 Acct-Session-Time = 21495 Calling-Station-Id = "00:11:43:79:E7:" radwho -r 74347,74347,shell,S2157969421,Tue 08:58,192.116.123.118,10.10.13.254 The difference now is that a simple radwho -r used to show the S-21... but now it doesnt and if you do a radwho -ZR................ it shows a negative port. Thanks SArky

2 2

about authentication with PAP
by Lee Bobby 18 Aug '05

18 Aug '05

hi,all, I wanna use PAP to authenticate the users.But I don't know how to change the radiusd.conf. Can any one help me? Bobby from Beijing.

1 0

Freeradius VLANID Question
by Armin Krämer 18 Aug '05

18 Aug '05

Hi, at the moment i´m planing to build a Network based out of 20 VLAN over 8 Nortel switches. Depending on the given Layout of the Network I need to add some PC´s to more than one Port based VLAN. Is it posible to give the VLAN ID over the Radius Server, and is it possible to send more than one VLAN ID for one Client to the Switch? Does this work? Armin

2 1

About nastype and Checkrad
by Felix Chang 18 Aug '05

18 Aug '05

Sorry.. just something very confuse. I am using a FreeBsd computer as my NAS, may I know what is the nastype for this NAS? Is it "other"? I know when the nastype is "other", the radius server won't call for the checkrad. Therefore, if I want to use the checkrad to check for the simultaneous-use, what should I do? Do I really need to modify the script in the checkrad?? Any reference on how to modify the script in the checkrad? I am seeking it for a long time already through the internet but nothing was found. It is not much information about the checkrad. Please knidly reply. Thanks! Regards Felix ___________________________________________________________ Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com

2 1

PPTP VPN with MPPE problem
by wangyan 18 Aug '05

18 Aug '05

Hi, I have a problem about Cisco PPTP VPN with MPPE Authentication. I use FreeRadius 1.0.4 with MySQL 4.1.10. I want to establish a PPTP VPN authenticated by FreeRadius. The problem is when I use pix525(os6.34), I can establish the PPTP VPN with MPPE 128, MS-CHAP. But when I use cisco7204(12.2-29), I can only establish the PPTP VPN without MPPE, MS-CHAP. When I use cisco7204 local db for authentication, I can establish the PPTP VPN with MPPE 128, MS-CHAP. I use the same configuration on radius server. I think the problem is freeradius. But it is strange. Because FreeRadius support mppe key and the pix test succeed. ----7204 configuration---- interface Virtual-Template1 ip unnumbered FastEthernet1/0 peer default ip address pool test ppp encrypt mppe auto stateful ppp authentication ms-chap chap ----windowsxp vpn client---- MS-CHAP, maximum strength encryption. It displayed the encrytion type is not match. 7204 debug ppp mppe event 5:41:33: Vi1 MS-CHAP: O SUCCESS id 29 len 4 15:41:33: Vi1 MPPE: don't understand all options, NAK 15:41:33: Vi1 MPPE: RADIUS keying material missing Any one can help me?

4 3