- Freeradius-Users - lists.freeradius.org

authenticate machine accounts with ntlm_auth
by Jérémy Cluzel 30 Jun '05

30 Jun '05

Hi, Is it possible to authenticate a machine account with ntlm_auth ? When a machine tries to authencate itself, the username looks like this: "host/hostname.domain.org" I don't know if ntlm_auth is able to understand this format... Regards Jeremy

2 1

RE: radiusprofile entry don't work
by alan walters 30 Jun '05

30 Jun '05

Where is the ldif of the client file -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Dusty Doris Sent: 01 July 2005 13:42 To: FreeRadius users mailing list Subject: Re: radiusprofile entry don't work > I have tryed both solution but don't work!!! :'( > this is the output: > > #ldapadd -x -D "cn=Manager,dc=unime,dc=it" -W -f example.ldif > Enter LDAP Password: > adding new entry "ou=radius, dc=unime,dc=it" > > adding new entry "ou=profiles, ou=radius,dc=unime,dc=it" > > adding new entry "ou=users, ou=radius,dc=unime,dc=it" > > adding new entry "cn=WLAN, ou=profiles,ou=radius,dc=unime,dc=it" > ldap_add: Invalid syntax (21) > additional info: objectclass: value #0 invalid per syntax > > > > I have forgotten: > I have deleted the first entry: > > dn: dc=unime,dc=it > objectClass: dcObject > objectClass: organizationUnit > ou: Unime.it Radius > dc: unime > > > because don't work absolutely. > > wtithout this entry the entryes for ou=radius ou=profiles ou=users > works, and I have the error output above. > With this entry I have a error on the first entry . > > Anyone can help me?? > > > > > > -- > Email.it, the professional e-mail, gratis per te: http://www.email.it/f > > Sponsor: > Personalizza il tuo cellulare con le immagini più divertenti o con le foto di chi ami > * > Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3117&d=30-6 > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

[Q] Access-Reject logging
by Andrey Panin 30 Jun '05

30 Jun '05

Hello, I have rlm_perl module which performs some checks of Access-Request and if rlm_perl returns RLM_MODULE_REJECT freeradius sends Access-Reject, but this Access-Reject doesn't appear in detail log. is there any way to log Access-Reject's generated in authorize section ? Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

2 5

Certificate expired
by Albrecht, Robert-Manfred 30 Jun '05

30 Jun '05

Hello, I'm using a freeradius to secure my wlan. I`m using PEAP Authentification. The certificate was created at 28.06.2004 with a validity-time of two years (26.06.2006). Yesterday (28.06.2005) the radiusd stopped working and dropped the error "certificate expired". This is exactly one year before expiration. Is this a known bug ? Regards, Robert M. Albrecht

2 1

FW: Re: EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

Alan, Thanks for the response. > Do you mean EAP-MD5? I'm not sure what MD5-Challenge is... Yes - EAP-MD5, The windows side (supplicant) is set to MD5-Challenge >> I did get EAP to work when I supply the User-Password attribute in the users file, but I would like LDAP to fetch this if it is possible. > If you're using LDAP, it should be doing that already. I don't think it is configured right. So far I have been using LDAP for groupmembership searches only. How do you tell LDAP to fetch User-Password attribute? >> If I remove the User-Password attribute in the users file, the dubug out >> shows: User-Password is required for EAP-MD5 authenitication. Are you getting the User-Password attribute from LDAP? The debug log should show this. >> Username >> Password >> Domain >> >> If you supply all three values, the debug shows: >> >> Identity does not match user-name > You're re-writing the User-Name attribute somewhere. Again, the debug log will show this. I didn't see anything in the log. If I provide the domainname debug shows username as domain\\username, LDAP shows it as domain\username, and rlm_eap complains about Identity not matching. -Robert Graham

1 0

RE: [Q] Access-Reject logging
by Mitchell, Michael J 30 Jun '05

30 Jun '05

> > > > > Been here, done that. It doesn't help, looks like Access-Reject's > > > generated during authorize phase are never passed to > post_auth phase. > > > > Are you using the latest release of FreeRADIUS? It was a bug in > > version 1.0.2 and earlier. > > CVS snapshot. > Why is authorization failing? I know in 1.0.1 post-auth is not processed if the authorization module returns RLM_USERLOCK (eg in LDAP the access attribute has denied access). Not sure what the logic is for the latest versions though...

2 1

windows xp sp2 EAP and radius
by Sergey Velikanov 30 Jun '05

30 Jun '05

настраиваю работу EAP по [url=http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html]док…] проблема в том что если я выбираю Smart Card or other Certificate на [url=http://web.archive.org/web/20031206113912/http://www.impossiblereflex.c…] то на радиусе я никаких запросов не вижу, если выбираю PEAP то запросы начинают приходить, может у кого есть идеи? целый день над этим бьюсь так и не получается заставить работать hello I've setup my windows xp & freerafius to use EAP (http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html) but if I select on my windows machine use "Smart Card or other Certificate" I seen nothing on radius, if u choose PEAP on my radius I see Cisco AP1300 log Jun 30 11:12:38.947: RADIUS(00000035): Storing nasport 307 in rad_db Jun 30 11:12:38.947: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.948: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.948: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/56, len 157 Jun 30 11:12:38.950: RADIUS: Received from id 1645/56 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:38.950: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:12:38.986: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:38.986: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.986: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:38.986: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/57, len 156 Jun 30 11:12:38.988: RADIUS: Received from id 1645/57 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:38.988: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:12:39.007: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.007: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.007: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.008: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/58, len 230 Jun 30 11:12:39.047: RADIUS: Received from id 1645/58 192.168.11.2:1645, Access-Challenge, len 1100 Jun 30 11:12:39.048: RADIUS/DECODE: EAP-Message fragments, 253+253+253+253+22, total 1034 bytes Jun 30 11:12:39.131: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.131: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.131: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.132: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/59, len 156 Jun 30 11:12:39.134: RADIUS: Received from id 1645/59 192.168.11.2:1645, Access-Challenge, len 821 Jun 30 11:12:39.135: RADIUS/DECODE: EAP-Message fragments, 253+253+253, total 759 bytes Jun 30 11:12:39.147: RADIUS(00000035): Using existing nas_port 307 Jun 30 11:12:39.147: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.148: RADIUS(00000035): Config NAS IP: 192.168.10.100 Jun 30 11:12:39.148: RADIUS(00000035): Send Access-Request to 192.168.11.2:1645 id 1645/60, len 156 Jun 30 11:12:39.180: RADIUS: Received from id 1645/60 192.168.11.2:1645, Access-Challenge, len 64 Jun 30 11:12:39.180: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes Jun 30 11:13:09.172: %DOT11-7-AUTH_FAILED: Station 0060.1d1e.245c Authentication failedReceived disconnect from 192.168.10.100: Time-out activated and freeradius show the same, on every packet it say > modcall[authenticate]: module "eap" returns handled for request 8 it never say "ok" and never send Reject or Accept packet What is wrong? I use radiusd: FreeRADIUS Version 1.0.4, for host , built on Jun 30 2005 at 15:08:01

1 0

FreeRadius + Mysql + MAC address authentication + linksys WRT54GS
by Carlos Sobrinho 30 Jun '05

30 Jun '05

Hi there, I'm sorry if this questions was already answered but I searched all day today and didn't come up with anything usefull for this situation. This is what I need. There will be: * 20 hotspots with a Linksys AP and a modified firmware (OpenWRT) and maybe chilispot. * Freeradius server * apache2 webserver * free-HS (SSID) The objective is to have some free hotspots on a certain area and the user, as soon as he chooses free-HS network, will be redirected to a register page. Maybe using a proxy trick or a php redirect. This page will ask simple questions like age, how did he found this but never username and password. The authentication will be made by MAC address but I could only find some examples regarding AP's MAC address in the users file. My problem is to have this auth made by the mysql database. If he disconnects and connects again his mac address will be in the data-base, and radius will find it and authorize and the internet will be normal, No proxy, no redirect. Maybe a 15m timeout of no activity... So basically what we need is a way for radius to check for this MAC address in the mysql db. I have a working freeradius+mysql server and I can do a radtest with a user's/password and the shared pass and all was ok. rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=163, length=20 My problems: * We don't have any certificate store to sign our certificate, * We don't want people to install certificates Another questions. What type of protocols should we use? EAP, PEAP, CHAP, MSCHAP, EAP/TLS, WEP ? The most simple for the window's users to access. Thank you in advance for the help With best regards Carlos Sobrinho -- ############################################################################# # These PRESERVES should be FORCE-FED to PENTAGON OFFICIALS!! # #############################################################################

2 1

(no subject)
by mupota 30 Jun '05

30 Jun '05

help

1 0

EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

Hello list, I have freeradius configured to authenicate users against active directory with ms-chap and can also do ldap group searches, all that is working great. Now what I need to do is implement 802.1x port authenication on our foundry switches and I'm running into problems. This is our layout: W2K Pro (using MD5-Challenge) -----> Foundry Switch -------> Freeradius --------> AD I have read a lot of articles/post on the web and looked over the docs (I don't know how many times) and I think I'm more confused than ever. So the first question is: Is this setup even possible? I did get EAP to work when I supply the User-Password attribute in the users file, but I would like LDAP to fetch this if it is possible. I came across a post suggesting this, but the answer was not very clear. If I remove the User-Password attribute in the users file, the dubug out shows: User-Password is required for EAP-MD5 authenitication. Another question I would like to ask is: When you configure the workstation (supplicant) for MD5-Challenge, it prompts you for: Username Password Domain If you supply all three values, the debug shows: Identity does not match user-name But if you leave the domain field blank, it works (providing that User-Password attribute is in the user file). I hope these questions make sense and hopefully someone out there can help. -Robert Graham

2 1