- Freeradius-Users - lists.freeradius.org

Re: EAP challenge gets ignored with some clients
by David Mitton 11 Aug '05

11 Aug '05

Could you be more specific about the fix? How about a KB article number? or keywords that hit on MSDN? Thanks, Dave. ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: EAP challenge gets ignored with some clients Date: Thu, 11 Aug 2005 12:40:47 -0400 > > Ian Chard <ian.chard(a)sers.ox.ac.uk> wrote: > > When a client fails to connect, the output of radiusd -X shows that > > the daemon sends the first EAP challenge, but never receives a reply > > (tcpdump on the OpenBSD box confirms this). The symptoms are the same > > regardless of the type of client. > > If this is happening when all clients are on the same AP, then the > only conclusion is that the problem is related to the clients. > > SP2 has a stupid problem where it won't talk to non-MS RADIUS > servers. There's a fix, though. > > Try doing tcpdump on the wireless side, to see what the traffic is there. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Migrating from one to another radius server
by Oleg Motienko 11 Aug '05

11 Aug '05

Hello, We are running billing system with radius auth and acct. We have to migrate our user database to another billing system but we can't migrate all users and reconfigure all routers simultaneously. Presumably we can migrate about 50-100 user of several thousands every day, and we want to make this process transparent for users. So, we have 3 radius servers: oldserver - running with olddatabase, newserver - running with newdatabase, freeserver - runing freeradius for transparent forwarding. Users enters their logins without @domain and it's unreal to request all users to change anything in their login configurations. Is it possible to make such algorithm? vvv Router request auth from freeserver and 1) freeserver forwards request to oldserver and if user is still in olddatabase, oldserver process request. 2) if user is not found in olddatabase, freeserver forwards request to newserver 3) if user is not found on newserver (so, users is unknow in both databases) or password incorrect or other error - freeserver returns error to router. If this algorithm is possible, is it possible to forward acct information same way? Thanks in advance. -- Regards, Oleg

2 3

freeradius+unixodbc problem
by Mykhaylo Tyulchenko 11 Aug '05

11 Aug '05

Hi, I'm having some problem with sending SQL query to MSSQL 7.0 Server through UnixODBC driver of FreeRadius (module rlm_sql_unixodbc) with error: rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' My SQL query is a stored procedure executed on MSSQL server with some parameters: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 FreeTDS and UnixODBC configured fine, so i have normal MSSQL server execution of that query testing by tsql and isql programms. But when i try to use that query as Authorization Query in mssql.conf i get next screen: radius_xlat: 'exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2' rlm_sql (sql): Reserving sql socket id: 4 query: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 radius_xlat: '' radius_xlat: 'exec sp_authenticate '' query: exec sp_authenticate ' rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' rlm_sql_getvpdata: database query error radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 Please help. FreeRadius 1.0.4, UnixODBC 2.2.11, MSSQL 7.0 Regards, Mykhaylo Tyulchenko

1 0

EAP challenge gets ignored with some clients
by Ian Chard 11 Aug '05

11 Aug '05

Hi, Firstly, sorry about the vague subject line! Here's the scenario: - FreeRADIUS 1.0.4 running on OpenBSD 3.7 - Netgear WAG302 access points (configured for WPA/TKIP) I'm using PEAP and MSCHAPv2 to authenticate wireless folk against our Windows domain controller with ntlm_auth. As things stand, it's all working... for some clients... some of the time. My testing shows that: - XP clients can always connect, although it sometimes takes them a few tries (those using the card vendor's software work better than those using the Windows client) - Windows Mobile/Pocket PC devices sometimes work, sometimes don't (mine worked until yesterday, now it refuses to connect) - Various other version of Windows have varying results. - Linux with wpa_supplicant _always_ works, and authenticates much faster than anything else. When a client fails to connect, the output of radiusd -X shows that the daemon sends the first EAP challenge, but never receives a reply (tcpdump on the OpenBSD box confirms this). The symptoms are the same regardless of the type of client. I'm tearing my hair out, and have run out of things to try... I'm hoping that this will all sound horribly familiar to someone who knows exactly what's happening! Many, many thanks for any advice (or just a shoulder rub :-) - Ian -- Ian Chard, Unix & Network Administrator | E: ian.chard(a)sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 204937

3 2

RE: Deploying certificates on XP
by King, Michael 11 Aug '05

11 Aug '05

Active Directory has this support. I'm not sure how it's used, but I know it's there. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of ksochack > Sent: Thursday, August 11, 2005 10:56 AM > To: FreeRadius users mailing list > Subject: Deploying certificates on XP > > Hi All, > > I was wondering of anyone knows of an automated utility for > importing certificates into the stores on XP instead of using > 'mmc'. I would like to set something up where the first time > an user logs on the utility import the certificate in to the > personal stores. > > TIA > Kevin Sochacki > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

problem in no digest module !
by zhu lizhong 11 Aug '05

11 Aug '05

Hello, Alan DeKok and other guys: I am trying to install radius and ser. i uncomment the digest in raiudsd.conf and create digest file and test in users file. now the problems are: 1) where should i put the digest file? 2) when run: radiusd -X and display can not find the digest modules. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) ERROR: Cannot find a configuration entry for module "digest". thanks lot! zhu thanks lot! zhu!

2 1

Deploying certificates on XP
by ksochack 11 Aug '05

11 Aug '05

Hi All, I was wondering of anyone knows of an automated utility for importing certificates into the stores on XP instead of using 'mmc'. I would like to set something up where the first time an user logs on the utility import the certificate in to the personal stores. TIA Kevin Sochacki

1 0

Pb with EAP/MD5
by Rafael DiazMaurin 11 Aug '05

11 Aug '05

Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950 I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap) The local tests are ok ! Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge Thanks, Rafael.

5 14

how to uninstall freeradius0.9.3 from Red hat linux?
by Lee Bobby 11 Aug '05

11 Aug '05

I wanna uninstall it and install another .tar freeradius. Can anyone tell howto?

1 0

Cannot find a configuration entry for module "digest"
by zhu lizhong 11 Aug '05

11 Aug '05

Hello, Alan DeKok and other guys: I am trying to install radius and ser. i uncomment the digest in raiudsd.conf and create digest file and test in users file. now the problems are: 1) where should i put the digest file? 2) when run: radiusd -X and display can not find the digest modules. ----------------- ---------------- --------------------------------------------------------- ERROR: Cannot find a configuration entry for module "digest". -------------------------------------------------------------------------------------------- thanks lot! zhu

1 0