- Freeradius-Users - lists.freeradius.org

strange DHCP behavior
by Igor Smitran 21 Feb '13

21 Feb '13

Server: up2date Centos 6.3 x64 Software: freeradius 2.2.0 configured by ./configure, generated by GNU Autoconf 2.61, with options \"'--prefix=/usr/local/freeradius' '--with-dhcp' '--with-rlm_mysql=no' '--with-rlm_perl=no' --enable-ltdl-install\" radiusd -X starts OK, and then, after first DHCP discover is received: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/freeradius/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on dhcp interface eth1 address * port 67 as server dhcp Listening on proxy address * port 1814 Ready to process requests. Received DHCP-Discover of id 08f11b15 from 10.21.192.1:67 to 0.0.0.0:67 Parse error Parse error or name in attributein attributein ode" Dropping packet without response. Going to the next request Waking up in 0.9 seconds. -------------------------- It is happening with default dhcp config. Only what is changed is: port = 67 ipaddr = ***** (ommited) interface = eth0 This is entirely new server, installed only for dhcp testing. Mysql and perl will be added later. Any idea?

1 1

Re: Free Radius 2.1.1 showing clear text password at the debug mode
by Danny Kurniawan 21 Feb '13

21 Feb '13

Hi Oliver, Thanks a lot. So could you please let me know how can i disabled the output (which conf file and what need to be added). Also by saying echo it do i need to put something into a config file or just echo command while i'm at radiusd - X debug mode? Thanks Danny -- Best Regards, Danny

3 2

Re: Free Radius 2.1.1 showing clear text password at the debug mode
by Danny Kurniawan 21 Feb '13

21 Feb '13

thank you for your reply. Yes i didn't just copy and paste, i did follow the instruction on Novell support page too and from community. So what i want to confirm here, are you saying that means in debug mode its "normal" for me "admin" to see the user password? I mean it's normal behaviour of radius 2.1.1? Thanks -- Best Regards, Danny

2 1

Free Radius 2.1.1 showing clear text password at the debug mode
by Danny Kurniawan 21 Feb '13

21 Feb '13

Hello, I'm new to Radius. So basically i tried to setup 2 Radius server, one runs on our SLES 10 PROD (Radius and Novell LDAP sit on the same server) - this is works fine using eap_mschapv2 authentication. Radius version is 1.X. We use Radius to authenticate our wireless and get LDAP authentication. So no issue with this. Second server - SLES 11 ; i get the installer directly from Novell and its use version 2.1.1. So it seems the config way is different but i did try match with the Radius 1.X config (just a dffierent module i guess). Everything works fine, except 1 things. In Radius 1.x - SLES 10 when i run radiusd -X ; i don't see the user password (which is good). but in Radius 2.1.1 i can see it clearly ... how can i eliminate this cleartext password being showed there? I'm new to this authentication method or eap_mschap protocol, so please bear with me :) *[peap] Got tunnled request EAP-Message = 0x020a00061a03 server (null) { PEAP: Setting User-Name to sdholakia2 Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sdholakia2" State = 0xf32f92c4f22588e5c2ccbfc052ff2f65 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[control] returns noop ++[mschap] returns noop ++[unix] returns notfound ++[control] returns notfound [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for sdholakia2 [ldap] expand: (uid=%u) -> (uid=sdholakia2) [ldap] expand: ou=Active,ou=Users,o=FSID -> ou=Active,ou=Users,o=FSID rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Active,ou=Users,o=FSID, with filter (uid=sdhoakia2) [ldap] Added the eDirectory password Test in check items as Cleartext-Passwrd [ldap] looking for check items in directory...* While at radiusd -X of the radius 1.X i can only see *Added the eDirectory password * *[ldap] looking for check items in directory... * Best Regards, Danny

3 2

Proxy Problem
by Muhammad Nadeem 21 Feb '13

21 Feb '13

Hi everybody,, I have configured a proxy server with 'type=client-port-balance'. I have configure two backed FR servers(192.168.0.109 and 192.168.0.112). I am sending requests from a PC to 192.168.0.102 ( acting as proxy server). But requests are forwarded to only one FR server (i-e 192.168.0.112). Why proxy server is not sending requests to other one. As each request has same IP but different PORT, So hashing mechanism of Proxy server should also choose other FR server (192.168.0.109) for requests entertaining. could anyone please tell me what's the issue. Thanks

1 0

simulate Point Access
by tabibel sami 20 Feb '13

20 Feb '13

Hello, i try to make a virtual infrastructure for testing wireless eap authtication via freeradius, so i created three virtual machine for supplicant, authenticator (point access), radius server i installed wpa_supplicant on first machine, freeradius on server, but i have no idea on how can i simulate a point access whith a linux virtual machine. please help me ! thank you.

2 1

Listing attributes in a request
by Adam Moffett 20 Feb '13

20 Feb '13

Does the output from radius -X display all of the attributes in a request from a client? If not, is there a way to see all of the attributes in the request? I'm looking for the value of a VSA and I'm not seeing it. I'm not sure if it's not being displayed in the debug output or just not there at all.

2 1

Ntlm_auth vs. Cleartext-password
by Óscar Remírez de Ganuza Satrústegui 20 Feb '13

20 Feb '13

Good afternoon everybody, We have configured freeradius to authenticate against Active Directory/Samba using ntlm_auth, following the instructions on: http://deployingradius.com/documents/configuration/active_directory.html Everything works as expected. Right now on our production server we are using LDAP to store the user credentials. We would like to achieve a smooth transition to the new authentication method. So want to configure freeradius to authenticate with ntlm_auth just in the cases when there is not ClearText-Password available, but we do not know how to do it. Using instructions from modules/mschap: # If ntlm_auth is configured below, then the mschap # module will call ntlm_auth for every MS-CHAP # authentication request. If there is a cleartext # or NT hashed password available, you can set # "MS-CHAP-Use-NTLM-Auth := No" in the control items, # and the mschap module will do the authentication itself, # without calling ntlm_auth. We were able to *bypass* the ntlm_auth on some users/groups defining on the users file the control item "MS-CHAP-Use-NTLM-Auth := No". But is there a way to configure freeradius such that if Cleartext-Password password is available it uses it, and otherwise it uses ntlm_auth to authenticate? Thank you so much for your help. Regards, * Oscar Remírez de Ganuza Satrústegui* Servicios Informáticos (Área de Infraestructuras) Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.es/SI/

2 2

EAP-TLS and OS X clients
by Jaap Winius 20 Feb '13

20 Feb '13

Hi folks, My WPA2-Enterprise configuration with Freeradius 2.1.0, EAP-TLS and 4096-bit SHA-1 certificates works great with wpaspplicant on Linux, but can anyone help me understand how to get this to work for OS X (Lion) clients? My Linux client uses a copy of the ca.pem file to establish the link (after which PAP is used to authenticate), but although the same ca.pem file can be imported into the OS X client's keychain, this certificate never shows up as a selectable identity when configuring EAP-TLS wireless access, like in this case (bottom of the page): https://wiki.thayer.dartmouth.edu/display/computing/Configuring+an+OS+X+Mac… In this example, the users are given a personalized *.cer certificate to add to their keychain. Since I don't have any client.cer files, I tried this approach with a client.csr file instead, which seemed personalized enough, but still I run into the same roadblock. Can anyone say what I should be doing differently? E.g. are *.cer certificates mandatory (if so, how can I make them?), or can I not use my self-signed certificates? Thanks, Jaap

3 5

Radius server failed to respond
by ahmed.sajid＠stfc.ac.uk 20 Feb '13

20 Feb '13

Hi, I can authenticate using Kerberos, by running radius in debugging mode. I can see that I get Access-Accept packet but SSH doesn't gets logged in. I get following in /var/log/messages pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -562132672. pam_radius_auth: RADIUS server 127.0.0.1 failled to respond pam_radius_auth: All RADIUS servers failed to respond. The file /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth sufficient pam_radius_auth.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth It seems to work fine but every now and then it just breaks. Regards, Ahmed. -- Scanned by iCritical.

3 7