Alan, Thanks for your reply. Our FreeRadius server is servering the WLAN authentication. For some reason, we need know the result for each authentication request, pass or fail. We know the post-authentication query can do something which we know who is pass. We don't have a method to log the rejected request. Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request@lists.freeradius.org>; Date: Fri, Apr 20, 2012 03:30 PM To: "freeradius-users"<freeradius-users@lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 84, Issue 63 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Alan Buxey) 2. Re: Perl, MySQL & auth (Alan Buxey) 3. Re: Freeradius Access Requet ID (Alan DeKok) 4. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 5. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha) 6. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 7. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha) ---------------------------------------------------------------------- Message: 1 Date: Fri, 20 Apr 2012 07:30:20 +0100 From: Alan Buxey <A.L.M.Buxey@lboro.ac.uk> To: "wassim.zaarour@navlink.com" <wassim.zaarour@navlink.com>, "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <9339D497-E840-42EF-A2D5-779F77E0F5D9@lboro.ac.uk> Content-Type: text/plain; charset="utf-8" Please read the mailing list archives, this very question and setup is often mentioned alan -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420/e4365248/attachment-0001.html> ------------------------------ Message: 2 Date: Fri, 20 Apr 2012 07:35:24 +0100 From: Alan Buxey <A.L.M.Buxey@lboro.ac.uk> To: "fabrifloresg@gmail.com" <fabrifloresg@gmail.com>, "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Re: Perl, MySQL & auth Message-ID: <EEA07012-72B5-438B-B5CE-039B6D237BA0@lboro.ac.uk> Content-Type: text/plain; charset="utf-8" Hi, Some interesting system problems. Did you compile FR with PERL support....or if using distros version do they have additional packages you need to install eg freeradius-perl ? We use PERL here...FR compiled with it supported and just 'use DBI;' at the top of the PERL script....no need to do ANYTHING with system libs or running parameters alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420/61a728b2/attachment-0001.html> ------------------------------ Message: 3 Date: Fri, 20 Apr 2012 08:50:56 +0200 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius Access Requet ID Message-ID: <4F910750.7040104@deployingradius.com> Content-Type: text/plain; charset=UTF-8 ?????? wrote:
What is the parameter name for freeradius access requet ID?
For example, Called-Station-Id = "46-E7-CF-62-78-11" Called-Station-Id is the parameter name for NAS MAC address.
You can't look at the access request ID. It doesn't mean anything, and there's no reason to look at it. Alan DeKok. ------------------------------ Message: 4 Date: Fri, 20 Apr 2012 10:09:18 +0300 From: Wassim Zaarour <wassim.zaarour@navlink.com> To: Alan Buxey <A.L.M.Buxey@lboro.ac.uk>, "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6E5E1.ECFF%wassim.zaarour@navlink.com> Content-Type: text/plain; charset="us-ascii" Hi Alan, I went through the archives and did some changes but still getting the error, appreciate of you can help me a bit here. I think I read that the ldap request must be proxied to the inner tunnel for it work, is that true? How can we do that? Thanks Wassim. From: Alan Buxey <A.L.M.Buxey@lboro.ac.uk> Date: Friday, April 20, 2012 9:30 AM To: Wassim Zaarour <wassim.zaarour@navlink.com>, "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Please read the mailing list archives, this very question and setup is often mentioned alan -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420/a4e6bd5e/attachment-0001.html> ------------------------------ Message: 5 Date: Fri, 20 Apr 2012 14:15:59 +0700 From: "Fajar A. Nugraha" <list@fajar.net> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CAG1y0scEv7ZrF9OkB5-FKEyJuKOiGW=mmAUQNjt=5AS6j4OnHw@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Fri, Apr 20, 2012 at 2:09 PM, Wassim Zaarour <wassim.zaarour@navlink.com> wrote:
Hi Alan,
I went through the archives and did some changes but still getting the error, appreciate of you can help me a bit here.
I think I read that the ldap request must be proxied to the inner tunnel for it work, is that true? How can we do that?
Short version: you won't be able to get PEAP-MSCHAPv2 (i.e. what windows use) to work with your LDAP. Period. Long version: MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: - Cleartext-Password or NT-Hash available (in LDAP, sql, users file whatever), OR - an active directory If you don't have either, then it won't work. -- Fajar ------------------------------ Message: 6 Date: Fri, 20 Apr 2012 10:22:30 +0300 From: Wassim Zaarour <wassim.zaarour@navlink.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6E904.ED05%wassim.zaarour@navlink.com> Content-Type: text/plain; CHARSET=US-ASCII On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list@fajar.net> wrote:
On Fri, Apr 20, 2012 at 2:09 PM, Wassim Zaarour <wassim.zaarour@navlink.com> wrote:
Hi Alan,
I went through the archives and did some changes but still getting the error, appreciate of you can help me a bit here.
I think I read that the ldap request must be proxied to the inner tunnel for it work, is that true? How can we do that?
Short version: you won't be able to get PEAP-MSCHAPv2 (i.e. what windows use) to work with your LDAP. Period.
Long version: MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: - Cleartext-Password or NT-Hash available (in LDAP, sql, users file whatever), OR - an active directory
If you don't have either, then it won't work.
Hi Farja, Passwords are stored as clear text in my LDAP, that should make MSCHAPv2 work right? Wassim ------------------------------ Message: 7 Date: Fri, 20 Apr 2012 14:30:42 +0700 From: "Fajar A. Nugraha" <list@fajar.net> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CAG1y0sch+7s+r9+G5Gp5oxhca6wAjbek=j9L6_4gqDWU_sEztg@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Fri, Apr 20, 2012 at 2:22 PM, Wassim Zaarour <wassim.zaarour@navlink.com> wrote:
On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list@fajar.net> wrote:
Long version: MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: - Cleartext-Password or NT-Hash available (in LDAP, sql, users file whatever), OR - an active directory
If you don't have either, then it won't work.
Hi Farja,
Passwords are stored as clear text in my LDAP, that should make MSCHAPv2 work right?
Yes, if FR can find them. This part of the log says it can't: [ldap] performing search in o=navbey.com, dc=navbey,dc=com, with filter (uid=pk) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? You might need to play around with the user used to login to LDAP, as some systems only give out passwords to admin accounts. Testing manual LDAP lookup using command line tool (e.g. ldapsearch) helps. If you CAN get your ldap server to return cleartext password with ldapsearch, then you should be able to configure FR to get that as well. -- Fajar ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 84, Issue 63 ************************************************