- Freeradius-Users - lists.freeradius.org

EAP session for state problem
by Umut Arus 12 Jul '12

12 Jul '12

Hi, We are using freeradius2-2.1.12-3.el5 on RHEL 5.8 for eduroaming. Sometimes we are getting "EAP session for state ... did not finish!" warning as you can see on case 1. We can successfully login after every three or four tries without error (case 2). How can I overcome this problem? PS: I think it is more problem on windows 7. Case 1: rad_recv: Access-Request packet from host 10.200.0.2 port 32832, id=203, length=238 User-Name = "xxx(a)sabanciuniv.edu.tr" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C659DA0C84D" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a002401676f6b68616e67756e796f6c40736162616e6369756e69762e6564752e7472 Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x7bde0503caf078e16964c30bb649186a Thu Jul 12 08:50:06 2012 : Info: server eduroam { Thu Jul 12 08:50:06 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:06 2012 : Info: +- entering group authorize {...} Thu Jul 12 08:50:06 2012 : Info: ++[preprocess] returns ok Thu Jul 12 08:50:06 2012 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:06 2012 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:06 2012 : Info: [auth_log] expand: %t -> Thu Jul 12 08:50:06 2012 Thu Jul 12 08:50:06 2012 : Info: ++[auth_log] returns ok Thu Jul 12 08:50:06 2012 : Info: ++[mschap] returns noop Thu Jul 12 08:50:06 2012 : Info: [suffix] Looking up realm " sabanciuniv.edu.tr" for User-Name = "xxx(a)sabanciuniv.edu.tr" Thu Jul 12 08:50:06 2012 : Info: [suffix] Found realm "sabanciuniv.edu.tr" Thu Jul 12 08:50:06 2012 : Info: [suffix] Adding Stripped-User-Name = "xxx" Thu Jul 12 08:50:06 2012 : Info: [suffix] Adding Realm = "sabanciuniv.edu.tr " Thu Jul 12 08:50:06 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jul 12 08:50:06 2012 : Info: ++[suffix] returns ok Thu Jul 12 08:50:06 2012 : Info: [eap] EAP packet type response id 10 length 36 Thu Jul 12 08:50:06 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Jul 12 08:50:06 2012 : Info: ++[eap] returns updated Thu Jul 12 08:50:06 2012 : Info: ++[files] returns noop Thu Jul 12 08:50:06 2012 : Info: ++[expiration] returns noop Thu Jul 12 08:50:06 2012 : Info: ++[logintime] returns noop Thu Jul 12 08:50:06 2012 : Info: Found Auth-Type = EAP Thu Jul 12 08:50:06 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:06 2012 : Info: +- entering group authenticate {...} Thu Jul 12 08:50:06 2012 : Info: [eap] EAP Identity Thu Jul 12 08:50:06 2012 : Info: [eap] processing type tls Thu Jul 12 08:50:06 2012 : Info: [tls] Initiate Thu Jul 12 08:50:06 2012 : Info: [tls] Start returned 1 Thu Jul 12 08:50:06 2012 : Info: ++[eap] returns handled Thu Jul 12 08:50:06 2012 : Info: } # server eduroam Sending Access-Challenge of id 203 to 10.200.0.2 port 32832 EAP-Message = 0x010b00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x470f24c947043df52dda4e1a3d9334ec Thu Jul 12 08:50:06 2012 : Info: Finished request 61. Thu Jul 12 08:50:06 2012 : Debug: Going to the next request Thu Jul 12 08:50:06 2012 : Debug: Waking up in 4.9 seconds. Thu Jul 12 08:50:11 2012 : Info: Cleaning up request 61 ID 203 with timestamp +434 Thu Jul 12 08:50:11 2012 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Jul 12 08:50:11 2012 : Debug: WARNING: !! EAP session for state 0x470f24c947043df5 did not finish! Thu Jul 12 08:50:11 2012 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Thu Jul 12 08:50:11 2012 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Case2: rad_recv: Access-Request packet from host 10.200.0.2 port 32832, id=215, length=263 User-Name = "xxx(a)sabanciuniv.edu.tr" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C659DA0C84D" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0216002b190017030100205cd73791c5a16b72af7729c38c0070ead9b5365d5c59a3cbf94d2d04ab1c88f0 State = 0x933acfe09a2cd6ffa50d9682f870ed3a Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0xee1ce87a79d10bcd3aab616fdf41e564 Thu Jul 12 08:50:20 2012 : Info: server eduroam { Thu Jul 12 08:50:20 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group authorize {...} Thu Jul 12 08:50:20 2012 : Info: ++[preprocess] returns ok Thu Jul 12 08:50:20 2012 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:20 2012 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:20 2012 : Info: [auth_log] expand: %t -> Thu Jul 12 08:50:20 2012 Thu Jul 12 08:50:20 2012 : Info: ++[auth_log] returns ok Thu Jul 12 08:50:20 2012 : Info: ++[mschap] returns noop Thu Jul 12 08:50:20 2012 : Info: [suffix] Looking up realm " sabanciuniv.edu.tr" for User-Name = "xxx(a)sabanciuniv.edu.tr" Thu Jul 12 08:50:20 2012 : Info: [suffix] Found realm "sabanciuniv.edu.tr" Thu Jul 12 08:50:20 2012 : Info: [suffix] Adding Stripped-User-Name = "xxx" Thu Jul 12 08:50:20 2012 : Info: [suffix] Adding Realm = "sabanciuniv.edu.tr " Thu Jul 12 08:50:20 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jul 12 08:50:20 2012 : Info: ++[suffix] returns ok Thu Jul 12 08:50:20 2012 : Info: [eap] EAP packet type response id 22 length 43 Thu Jul 12 08:50:20 2012 : Info: [eap] Continuing tunnel setup. Thu Jul 12 08:50:20 2012 : Info: ++[eap] returns ok Thu Jul 12 08:50:20 2012 : Info: ++[files] returns noop Thu Jul 12 08:50:20 2012 : Info: ++[expiration] returns noop Thu Jul 12 08:50:20 2012 : Info: ++[logintime] returns noop Thu Jul 12 08:50:20 2012 : Info: Found Auth-Type = EAP Thu Jul 12 08:50:20 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group authenticate {...} Thu Jul 12 08:50:20 2012 : Info: [eap] Request found, released from the list Thu Jul 12 08:50:20 2012 : Info: [eap] EAP/peap Thu Jul 12 08:50:20 2012 : Info: [eap] processing type peap Thu Jul 12 08:50:20 2012 : Info: [peap] processing EAP-TLS Thu Jul 12 08:50:20 2012 : Info: [peap] eaptls_verify returned 7 Thu Jul 12 08:50:20 2012 : Info: [peap] Done initial handshake Thu Jul 12 08:50:20 2012 : Info: [peap] eaptls_process returned 7 Thu Jul 12 08:50:20 2012 : Info: [peap] EAPTLS_OK Thu Jul 12 08:50:20 2012 : Info: [peap] Session established. Decoding tunneled attributes. Thu Jul 12 08:50:20 2012 : Info: [peap] Peap state send tlv success Thu Jul 12 08:50:20 2012 : Info: [peap] Received EAP-TLV response. Thu Jul 12 08:50:20 2012 : Info: [peap] Success Thu Jul 12 08:50:20 2012 : Info: [peap] Using saved attributes from the original Access-Accept Cisco-AVPair = "ssid=sunet-staff-wpa2" User-Name = "xxx" Thu Jul 12 08:50:20 2012 : Info: [eap] Freeing handler Thu Jul 12 08:50:20 2012 : Info: ++[eap] returns ok Thu Jul 12 08:50:20 2012 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group post-auth {...} Thu Jul 12 08:50:20 2012 : Info: ++[exec] returns noop Thu Jul 12 08:50:20 2012 : Info: } # server eduroam Sending Access-Accept of id 215 to 10.200.0.2 port 32832 Cisco-AVPair = "ssid=sunet-staff-wpa2" User-Name = "xxx" MS-MPPE-Recv-Key = 0xaea8b6a844f0e161871649d32f4ead36d6441f8b878fe3e4052b2eb5a2ea7346 MS-MPPE-Send-Key = 0xb17c40cb6eed240c390bbe4ffbbe3ee66d5244b2b6390c3e2fe11844b239e89c EAP-Message = 0x03160004 Message-Authenticator = 0x00000000000000000000000000000000 Thu Jul 12 08:50:20 2012 : Info: Finished request 72. Thu Jul 12 08:50:20 2012 : Debug: Going to the next request Thu Jul 12 08:50:20 2012 : Debug: Waking up in 3.2 seconds. Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 62 ID 205 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 63 ID 206 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 64 ID 207 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 65 ID 208 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 66 ID 209 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 67 ID 210 with timestamp +446 Thu Jul 12 08:50:23 2012 : Debug: Waking up in 1.6 seconds. Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 68 ID 211 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 69 ID 212 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 70 ID 213 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 71 ID 214 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 72 ID 215 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Ready to process requests. thanks,

1 0

PEAP/EAP_GTC
by Carl Pierre 12 Jul '12

12 Jul '12

Hello: Are there any clients that actually display the EAP-GTC challenge? Essentially, I am trying to use EAP-GTC similarly to how PAP Access-Challenge works: Client: -------User/Pass---------------->Server Client: <--Challenge Message---------Server Client: -------Challenge Response--->Server Client: <-------Accept------------------>Server So far, I cannot seem to find documentation to suggest that I CANNOT do this, and the spec suggests that I can, but I cannot seem to find anything that will do this. In addition, are there any resources that thoroughly documents EAP-GTC? The RFCs do not provide much information. Regards.

4 3

sql returns fail for some stop requests
by Amir Tal 11 Jul '12

11 Jul '12

Freeradius ver 2.1.12, configured to use ldap for auth, sql for acct. Sometimes users' sessions get stuck and have to be closed manualy (simultaneous use is turned on for all users). After extensive debugging I have found the following in the logs (radius -X) [<thread>] # Executing section preacct from file /etc/raddb/sites-enabled/default [<thread>] +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 14117776,Client-IP-Address = xx.xx.xx.xx,NAS-IP-Address = xx.xx.xx.xx,Acct-Session-Id = "erx ip:109.226.0.9:147.235.234.115:1e47:6248:14c2:8b6a:5dac845:0060992452",Use r-Name = "xxxxxxxxx@ccc"' [acct_unique] Acct-Unique-Session-ID = "d49ba42fa077f5f0". ++[acct_unique] returns ok [suffix] Looking up realm "ccc" for User-Name = "xxxxxxxxx@ccc" [suffix] Found realm "ccc" [suffix] Adding Stripped-User-Name = "xxxxxxxxx" [suffix] Adding Realm = "ccc" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xx.xx.xx.xx [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.xx.xx/detail-20120711 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.xx.xx/detail-20120711 [detail] expand: %t -> Wed Jul 11 02:03:45 2012 Cleaning up request 12612249 ID 93 with timestamp +729235 ++[detail] returns ok [detail.moreshet] expand: /var/log/radius/radacct/moreshet.relay -> /var/log/radius/radacct/moreshet.relay [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [detail.moreshet] expand: %t -> Wed Jul 11 02:03:45 2012 ++[detail.moreshet] returns ok ++[unix] returns ok [sql] expand: %{Stripped-User-Name} -> xxxxxxxxx [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> xxxxxxxxx [sql] sql_set_user escaped user --> 'xxxxxxxxx' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 4001 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 8134 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-11 02:03:45', acctsessiontime = '517', acctinputoctets = '0' << 32 | '4001', acctoutputoctets = '0' << 32 | [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql Cleaning up request 12612250 ID 95 with timestamp +729235 ++[sql] returns fail Thread 20 got semaphore Thread 19 got semaphore It seems the last SQL query line is cut off for some reason, this only happens on some connections, while others are stopped correctly. Not specific to users or time of day. Versions information: cat /etc/issue : CentOS release 5.6 (Final) Kernel \r on an \m rpm -qa | grep radius : freeradius2-python-2.1.12-7 freeradius2-ldap-2.1.12-7 freeradius2-2.1.12-7 freeradius2-krb5-2.1.12-7 freeradius2-mysql-2.1.12-7 freeradius2-utils-2.1.12-7 freeradius2-postgresql-2.1.12-7 freeradius2-perl-2.1.12-7 freeradius2-unixODBC-2.1.12-7 additional logs and/or information can be provided if required. Help would be appreciated. The Cloud has no limit ! [cid:image001.jpg@01CD5F84.25487600]<http://www.ccc.co.il/> Amir Tal Systems Automation Expert Cloud Services Direct: 972-(0)3-9201471 Fax: 972-(0)-3-9201442 www.ccc.co.il<http://www.ccc.co.il/> [cid:image002.png@01CD5F84.25487600] <http://www.facebook.com/triplec.il>

2 1

Re: Secure Storage and Transport of User Credentials
by Marco Macala 11 Jul '12

11 Jul '12

Hello, is there a way to securely transport and store the Username/Password with freeradius? If I am informed correctly, you can use PEAP to ensure that the data is encrypted but the most supported PEAP mode is with MSCHAPv2 which implies that the passwords are stored in clear text or NT-Hash. Did I get something wrong here? I am fairly new to RADIUS and therefore I don't know that much about it... Thanks in advance! Best regards, Marco Macala

4 8

dalo(free)radius authentication problem
by Soul - 11 Jul '12

11 Jul '12

Dear ALL i was follow the guide from the following page with the command, but when testing, the Radius server is not responding. For the setup on the Ubuntu newest server.. -sudo apt-get update -sudo apt-get upgrade -sudo apt-get install mysql-server -sudo apt-get install php5-gd php-pear php-db -sudo apt-get install freeradius freeradius-mysql -sudo apt-get install phpmyadmin On the DaloRadius Setup -wget ...... 9-9.tar.gz -tar -zxvf daloradius-0.9-9.tar.gz -mv daloradius-0.9-9 daloradius -sudo cp daloradius/ /var/www -R -sudo chown www-data:www-data /var/www/daloradius -R -sudo chmod 644 /var/www/daloradius/library/daloradius.conf.php Database setup: -cd /var/www/daloradius/contrib/db/ - Ignored: -mysql -u root -p Enter 'mySqlPassword' mysql> CREATE DATABASE radius; mysql> quit - Ignored: -mysql -u root -p radius < fr2-mysql-daloradius-and-freeradius.sql Database connection setup: -cd /var/www/daloradius/library/ -sudo nano -w daloradius.conf.php $configValues['FREERADIUS_VERSION'] = '2'; $configValues['CONFIG_DB_PASS'] = 'mySqlPassword'; $configValues['CONFIG_DB_TBL_RADUSERGROUP'] = 'radusergroup'; Installation completed and login page to create user: -http://your ip address/daloradius username: administrator password: radius When i test it shown not respond from the server.. the NAS setting is matched, refer to the log file from the Daloradius, it shown "Error: Ignoring request to authentication address" could it be due to the setup error or? as refer to the guidance from the web, the setup everything is run well, using the freeradius -x, it shown.. ~Listening on authentication interface eth0 *port 1812 ~Listening on accounting *port 1813 ~Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel ~Ready to process request. what could be wrong and which part should i check on it? router debugging exsist: R1# *Mar 1 00:03:05.639: AAA/BIND(00000003): Bind i/f *Mar 1 00:03:05.643: AAA/AUTHEN/LOGIN (00000003): Pick method list 'default' *Mar 1 00:03:05.651: RADIUS/ENCODE(00000003): ask "Username: " *Mar 1 00:03:05.651: RADIUS/ENCODE(00000003): send packet; GET_USER R1# *Mar 1 00:03:07.359: RADIUS/ENCODE(00000003): ask "Password: " *Mar 1 00:03:07.363: RADIUS/ENCODE(00000003): send packet; GET_PASSWORD *Mar 1 00:03:08.795: RADIUS/ENCODE(00000003):Orig. component type = EXEC *Mar 1 00:03:08.799: RADIUS: AAA Unsupported Attr: interface [174] 5 *Mar 1 00:03:08.799: RADIUS: 74 74 79 [tty] *Mar 1 00:03:08.799: RADIUS/ENCODE(00000003): dropping service type, "radius-server attribute 6 on-for-login-auth" is off *Mar 1 00:03:08.803: RADIUS(00000003): Config NAS IP: 0.0.0.0 *Mar 1 00:03:08.803: RADIUS/ENCODE(00000003): acct_session_id: 1 *Mar 1 00:03:08.803: RADIUS(00000003): sending *Mar 1 00:03:08.807: RADIUS/ENCODE: Best Local IP-Address 192.168.44.1 for Radius-Server 192.168.44.129 *Mar 1 00:03:08.811: RADIUS(00000003): Send Access-Request to 192.168.44.129:1645 id 1645/1, len 84 *Mar 1 00:03:08.811: RADIUS: authenticator 7D F1 9D 12 60 81 DE 8C - FC 0B A4 96 E1 CD 71 E8 *Mar 1 00:03:08.811: RADIUS: User-Name [1] 6 "test" *Mar 1 00:03:08.815: RADIUS: User-Password [2] 18 * *Mar 1 00:03:08.815: RADIUS: NAS-Port [5] 6 98 *Mar 1 00:03:08.815: RADIUS: NAS-Port-Id [87] 7 "tty98" *Mar 1 00:03:08.815: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 00:03:08.819: RADIUS: Calling-Station-Id [31] 15 "192.168.44.10" *Mar 1 00:03:08.819: RADIUS: NAS-IP-Address [4] 6 192.168.44.1 R1# R1# *Mar 1 00:03:13.559: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:18.551: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:23.223: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:27.895: RADIUS: No response from (192.168.44.129:1645,1646) for id 1645/1 *Mar 1 00:03:27.895: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Mar 1 00:03:27.895: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL thanks and appreciate it..

2 1

ldap attribute
by sandmann＠uni-greifswald.de 11 Jul '12

11 Jul '12

Hello, i want to get different attribute from ldap. Something like "cn". Is this possible and where must be set it? Mit freundlichen Grüßen David Sandmann *************************************** Fachinformatiker für Systemintegration Ernst-Moritz-Arndt-Universität Rechenzentrum Felix-Hausdorff-Straße 12 17489 Greifswald www.rz.uni-greifswald.de +49 3834 86 1424 +49 3834 86791424 sandmann(a)uni-greifswald.de ***************************************

1 0

Not responding when a user is unknown
by perl-list 10 Jul '12

10 Jul '12

We have a couple customers whose FreeRADIUS servers do not respond if a user does not exist on their FreeRADIUS system. If a user authenticates using username: idontexist and password: notarealpass the FreeRADIUS server does NOT send an access denied response, and indeed sends no response at all. I vaguely remember that this may have been an available setting on FreeRADIUS, but can find no information about it on the internet. I have been unable to recreate this problem in our lab and the customers who administer these servers seem to be unable to find any explanation. Please note I have no access to the servers that this happens on. The servers are owned by customers of ours. So basically, is there a setting that causes the FreeRADIUS server to not respond to Access-Request packets if the username contained there-in is not found in whatever database it is using?

4 5

Active Directory Authentication problem with ppp
by madal 30 10 Jul '12

10 Jul '12

hello all, I am always getting this error, when I am trying to authenticate user against Active Directory ad_recv: Access-Request packet from host 127.0.0.1 port 54512, id=249, length=151 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "harry" MS-CHAP-Challenge = 0x7437d73ff6b61e500d046b77a88ecf34 MS-CHAP2-Response = 0x3f0098a0a16cb193cbb58c495977aa125765000000000000000073a5f468c08966d100e3963f8763bcb764d450f23800cade Calling-Station-Id = "192.168.1.1" NAS-IP-Address = 192.168.2.3 NAS-Port = 0# Executing section authorize from file /etc/raddb/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "harry", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop[files] users: Matched entry DEFAULT at line 172++[files] returns ok++[expiration] returns noop++[logintime] returns noop[mschap] No Cleartext-Password configured. Cannot create LM-Password.[mschap] No Cleartext-Password configured. Cannot create NT-Password.[mschap] Creating challenge hash with username: harry[mschap] Told to do MS-CHAPv2 for harry with NT-Password[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.[mschap] FAILED: MS-CHAP2-Response is incorrect Pacakages I have installed.samba.x86_64samba-client.x86_64samba-common.x86_64 samba-winbind.x86_64 samba-winbind-clients.x86_64 freeradius.x86_64radiusclient-ng-0.5.6-5.el6.x86_64 My /etc/pptp/option.pptpd is : name pptpdrefuse-paprefuse-chaprefuse-mschaprequire-mschap-v2require-mppe-128ms-dns 10.1.1.1proxyarpdebuglocknobsdcompnovjnovjccompnologfdauthnodefaultrouteplugin winbind.so#ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1"plugin radius.soplugin radattr.so And in /etc/radd/modules/mschap i have following mschap { use_mppe = yes require_encryption =yes require_strong = yes #with_ntdomain_hack = yesntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-none}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"} AD connection is working well, if I do wbinfo -u it returns users from the AD. Both samba, nmb and winbind services are running. If I use only winbind without radius plugin it work but when I try to use radius plugin it complains the error I mentioned above. I have following this :http://wiki.freeradius.org/PopTop#Setting-up-the-Poptop-server and this one :http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_8.htm All I am doing here is have a pptp server use radius and Active directory for authentication. I use freeraius so that I can do IP pool and other stuff. Any help or right direction would be great.

2 2

working with vouchers
by anmeyer＠anup.de 10 Jul '12

10 Jul '12

Hello! Without considering any security is it possible to hand out a voucher to a client with just the ESSID, the username and the password written down and this client can authenticate to the radiusserver over the authenticator? Please be patient with me! Andreas

5 7

(no subject)
by Stephane Brodeur 10 Jul '12

10 Jul '12

http://testfartu.yoyo.pl/pscda.html?utkk=qqapeu

1 0