- Freeradius-Users - lists.freeradius.org

Message without subject. EAP-MD5
by Juan Daniel Moreno 12 Aug '05

12 Aug '05

Sorry for my last message without subject. I've already repared my problem. I had put in my users file: "test" User-Password := password # Auth-Type = Local Reply-Message = "Hello, %u" and this Reply-Message (which is included in users file as an example) was the reason for my server to don't work. I've only commented this line and the server functions again. Thank you!!! I will ask you something about LEAP protocol soon .

1 0

(no subject)
by Juan Daniel Moreno 12 Aug '05

12 Aug '05

I am doing a client interface for radius authentication. To test my progress I have installed a freeradius 1.0.4 in a SuSe 9.3. I have configured almost all of the protocols (PAP, CHAP, MS-CHAPv1, MS-CHAPv2), but wen I tried to configure EAP-MD5 I had a lot of problems, like "not password found", etc. I changed somethings in my program, then I tested it with WinRadius and it functionned; but when I tested it with my freeradius it didn't function. I would like to know how to configure my freeradius 1.0.4 so it function with EAP-MD5. I send you the error messages in "./radiusd -xxyz -l stdout": rad_recv: Access-Request packet from host 192.168.2.63:1594 <http://192.168.2.63:1594>, id=80, length=55*--- Walking the entire request list ---* Cleaning up request 7 ID 97 with timestamp 42fb4a13 Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 8, (2 handled so far) User-Name = "test" EAP-Message = 0x025200090174657374 Message-Authenticator = 0x3ad1dba850a6555f55e323c808b2acd0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 users: Matched entry test at line 91 modcall[authorize]: module "files" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 82 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 80 to 192.168.2.63:1594 <http://192.168.2.63:1594> Reply-Message = "Hello, %u" EAP-Message = 0x015300160410f37740423ba2a90d29911e943424e5a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78773e2f34d4b5159977be0ef3156654 Finished request 8 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.2.63:1594 <http://192.168.2.63:1594>, id=80, length=88 Waking up in 31 seconds... Thread 5 got semaphore Thread 5 handling request 9, (2 handled so far) User-Name = "test" EAP-Message = 0x0253001804105060ab97739328de2b67fa7930d8633e0008 State = 0x78773e2f34d4b5159977be0ef3156654 Message-Authenticator = 0x3ebc35a4d37c84a293d3a3d4eb0a21fb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 users: Matched entry test at line 91 modcall[authorize]: module "files" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 83 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 9 modcall: group authenticate returns reject for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Thread 5 waiting to be assigned a request*--- Walking the entire request list ---* Sending Access-Reject of id 80 to 192.168.2.63:1594 <http://192.168.2.63:1594> EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 Reply-Message = "Hello, %u" Cleaning up request 9 ID 80 with timestamp 42fb4a30 THANK YOU!

1 0

simultaneous check - MYSQL
by Rohaizam Abu Bakar 12 Aug '05

12 Aug '05

Dear all, FB: 4.11 FR: 1.0.4 mysql: 4.1 >From sql.conf file, I would to add one more checking for simul. use i.e NAS-Port-Type... and changes as below:- Seems working.. Just wanna confirmation regarding "simul_verify_query "... what exactly this line do? I know it do verification .. but for what purpose.. thanks.. # Simultaneous Use Checking Queries ####################################################################### # simul_count_query - query for the number of current connections # - If this is not defined, no simultaneouls use checking # - will be performed by this module instance # simul_verify_query - query to return details of current connections for verification # - Leave blank or commented out to disable verification step # - Note that the returned field order should not be changed. ####################################################################### # Uncomment simul_count_query to enable simultaneous use checking # simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND Acct StopTime = 0" ##simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND Acct StopTime = 0" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND NASPor tType = '%{NAS-Port-Type}' AND AcctStopTime = 0" ##simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPA ddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTi me = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAdd ress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND NASPortType = '%{NAS-Port-Type}' AND AcctStopTime = 0"

2 1

eap/tls access-accept without existing user?
by Markus Krause 11 Aug '05

11 Aug '05

hi all! first what i am using: - freeradius 1.0.4 (on debian sarge, package built with -disable-shared) - mac os x 10.3.9 - self-signed certificates built in a similar way than the ones in the package/tarball (just adapted the CA.certs script) my users file contains in addition to the unchanged standard the following lines: ---8< users 8<--- testuser1 User-Password == "testing" testuser2 Auth-Type := Local, User-Password == "testing" --->8 users >8--- the only changes i made in the configuration file radiusd.conf is to comment out "suffix", in eap.conf i uncommented the section with tls and ttls when trying to establish a connection from the mac powerbook using 802.1x and client certificate i get a working connection if i enter anything but "testuser2", even a wrong password or no pasword or username at all works! with "testuser2" i get an error and no connection. where am i missing the point? thanks in advance for any hint!! markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

seg. fault with eap/tls and wrong certificate
by Markus Krause 11 Aug '05

11 Aug '05

hi all! i am trying to set up eap/tls using freeradius (1.0.4, on debian sarge, built package with option -disable-shared) and ran in the following problem: if i am using the wrong certificate (both client and server certs were build like the ones in the freeradius package using adapted CA.certs) freeradius crashes! the last lines of the output from "freeradius -X -A -s" is: -----8<----- rad_recv: Access-Request packet from host 192.168.0.5:1028, id=35, length=167 User-Name = "test" NAS-IP-Address = 192.168.0.5 NAS-Identifier = "Hawalius" Framed-MTU = 1496 Called-Station-Id = "00-a0-c5-d1-03-15" Calling-Station-Id = "00-30-65-16-7d-49" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800250d800000001b1503010016cfbdb541e440865ba84b325309cdc5ad9d36af5784ff State = 0x0d56c72289ea3a6f6b45a070acc255db Message-Authenticator = 0x926e442107d8167882c136d983905804 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_eap: EAP packet type response id 8 length 37 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 060b], Certificate --> verify error:num=26:unsupported certificate purpose chain-depth=0, error=26 Segmentation fault ----->8----- actually i am not sure to have all configured correctly because i get an access-accept reply regardless of username and password but with the 'correct' certificate. btw: the client is a mac os x 10.3.9 any ideas anyone?? thanks in advance for any hint! markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0

Freeradius - LDAP Authenication
by Simon Barnes 11 Aug '05

11 Aug '05

Hi All, I'm rather new to radius and especially freeradius. I have the following need. Cisco VPN needs to authenticate users against a Radius server, which in turn needs to proxy the user authentication to our Sun One Iplanet LDAP server (running on another machine). I have the vpn talking successfully to freeradius, but I cannot get the onward connection to the LDAP to work. I have validated that the server running freeradius is able to talk to the ldap by using ldapsearch. The config I am using is based upon the ldap_howto.txt under /docs. I have searched the mailing list but to no avail. Many Thanks in advance Simon Barnes What follows is the radiusd output and the radius.conf Radiusd Output bash-3.00# /usr/local/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 512 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "198.100.0.18" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=directory manager" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "c0ntr01m3" ldap: basedn = "o=marymount.edu,o=marymount.edu" ldap: filter = "(&(objectClass=aRadiusAccount)(uid=%u))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x788780 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 38.118.63.2:1158, id=44, length=71 User-Name = "testuser" User-Password = "******" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 38.118.63.2 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser radius_xlat: '(&(objectClass=aRadiusAccount)(uid=testuser))' radius_xlat: 'o=marymount.edu,o=marymount.edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 198.100.0.18:389, authentication 0 rlm_ldap: bind as cn=account mgr/********* to 198.100.0.18:389 rlm_ldap: cn=directory manager bind to 198.100.0.18:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 38.118.63.2:1158, id=44, length=71 Discarding duplicate request from client vpn:1158 - ID: 44 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 44 with timestamp 42f37a00 Nothing to do. Sleeping until we see a request. Radius.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 512 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { ldap { server = "198.100.0.18" identity = "cn=account mgr" password = ********* basedn = "o=marymount.edu,o=marymount.edu" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" #filter = "(posixAccount)(uid=%u))" filter = "(&(objectClass=aRadiusAccount)(uid=%u))" # base_filter = "(objectclass=radiusprofile)" start_tls = no # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{clear}" password_attribute = userPassword # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obje ctClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no # access_attr_used_for_allow = yes } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } } instantiate { expr } authorize { preprocess suffix ldap } authenticate { authtype LDAP { ldap } } preacct { preprocess suffix } accounting { #radutmp #sradutmp } Simon Barnes System Administrator Marymount University

3 13

Re: EAP challenge gets ignored with some clients
by David Mitton 11 Aug '05

11 Aug '05

Could you be more specific about the fix? How about a KB article number? or keywords that hit on MSDN? Thanks, Dave. ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: EAP challenge gets ignored with some clients Date: Thu, 11 Aug 2005 12:40:47 -0400 > > Ian Chard <ian.chard(a)sers.ox.ac.uk> wrote: > > When a client fails to connect, the output of radiusd -X shows that > > the daemon sends the first EAP challenge, but never receives a reply > > (tcpdump on the OpenBSD box confirms this). The symptoms are the same > > regardless of the type of client. > > If this is happening when all clients are on the same AP, then the > only conclusion is that the problem is related to the clients. > > SP2 has a stupid problem where it won't talk to non-MS RADIUS > servers. There's a fix, though. > > Try doing tcpdump on the wireless side, to see what the traffic is there. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Migrating from one to another radius server
by Oleg Motienko 11 Aug '05

11 Aug '05

Hello, We are running billing system with radius auth and acct. We have to migrate our user database to another billing system but we can't migrate all users and reconfigure all routers simultaneously. Presumably we can migrate about 50-100 user of several thousands every day, and we want to make this process transparent for users. So, we have 3 radius servers: oldserver - running with olddatabase, newserver - running with newdatabase, freeserver - runing freeradius for transparent forwarding. Users enters their logins without @domain and it's unreal to request all users to change anything in their login configurations. Is it possible to make such algorithm? vvv Router request auth from freeserver and 1) freeserver forwards request to oldserver and if user is still in olddatabase, oldserver process request. 2) if user is not found in olddatabase, freeserver forwards request to newserver 3) if user is not found on newserver (so, users is unknow in both databases) or password incorrect or other error - freeserver returns error to router. If this algorithm is possible, is it possible to forward acct information same way? Thanks in advance. -- Regards, Oleg

2 3

freeradius+unixodbc problem
by Mykhaylo Tyulchenko 11 Aug '05

11 Aug '05

Hi, I'm having some problem with sending SQL query to MSSQL 7.0 Server through UnixODBC driver of FreeRadius (module rlm_sql_unixodbc) with error: rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' My SQL query is a stored procedure executed on MSSQL server with some parameters: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 FreeTDS and UnixODBC configured fine, so i have normal MSSQL server execution of that query testing by tsql and isql programms. But when i try to use that query as Authorization Query in mssql.conf i get next screen: radius_xlat: 'exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2' rlm_sql (sql): Reserving sql socket id: 4 query: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 radius_xlat: '' radius_xlat: 'exec sp_authenticate '' query: exec sp_authenticate ' rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' rlm_sql_getvpdata: database query error radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 Please help. FreeRadius 1.0.4, UnixODBC 2.2.11, MSSQL 7.0 Regards, Mykhaylo Tyulchenko

1 0

EAP challenge gets ignored with some clients
by Ian Chard 11 Aug '05

11 Aug '05

Hi, Firstly, sorry about the vague subject line! Here's the scenario: - FreeRADIUS 1.0.4 running on OpenBSD 3.7 - Netgear WAG302 access points (configured for WPA/TKIP) I'm using PEAP and MSCHAPv2 to authenticate wireless folk against our Windows domain controller with ntlm_auth. As things stand, it's all working... for some clients... some of the time. My testing shows that: - XP clients can always connect, although it sometimes takes them a few tries (those using the card vendor's software work better than those using the Windows client) - Windows Mobile/Pocket PC devices sometimes work, sometimes don't (mine worked until yesterday, now it refuses to connect) - Various other version of Windows have varying results. - Linux with wpa_supplicant _always_ works, and authenticates much faster than anything else. When a client fails to connect, the output of radiusd -X shows that the daemon sends the first EAP challenge, but never receives a reply (tcpdump on the OpenBSD box confirms this). The symptoms are the same regardless of the type of client. I'm tearing my hair out, and have run out of things to try... I'm hoping that this will all sound horribly familiar to someone who knows exactly what's happening! Many, many thanks for any advice (or just a shoulder rub :-) - Ian -- Ian Chard, Unix & Network Administrator | E: ian.chard(a)sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 204937

3 2