freeradius seeing anonymous identity as username
Hi; I am using FreeRadius 3.0.15. I am trying to make 802.1x with the HP 2530 switch. When I debug with radiusd -X command, I see anonymous in username field. That's why the server rejects me. How can i fix this? __________________________________________ Packet-Type = Access-Request Framed-MTU = 1480 NAS-IP-Address = 192.168.35.5 NAS-Identifier = "HP-2530-24G" User-Name = "anonymous" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 7 NAS-Port-Type = Ethernet NAS-Port-Id = "7" Called-Station-Id = "14-02-ec-ac-12-e0" Calling-Station-Id = "f4-30-b9-a8-74-25" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x0200000000000000000000000000000000 Message-Authenticator = 0xca73e90b5706a20d5d412373e07049a5 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 Event-Timestamp = "Dec 4 2017 13:08:55 UTC" CHAP-Challenge = 0x6bc8618647749d12e3e0995e3f0c556a Timestamp = 1512392935 _________________________________________________
On Dec 4, 2017, at 8:54 AM, osman tuzcu <osmantuzcu@gmail.com> wrote:
Hi; I am using FreeRadius 3.0.15. I am trying to make 802.1x with the HP 2530 switch. When I debug with radiusd -X command, I see anonymous in username field. That's why the server rejects me. How can i fix this?
Configure the client to *not* send "anonymous" as the User-Name. The packet comes from the client... no amount of poking FreeRADIUS will fix the client. Alan DeKok.
Sorry, there is no such setting on the device. I read something about the inner and outer EAP in an old writing. Could this be a solution? 2017-12-04 17:13 GMT+03:00 Alan DeKok <aland@deployingradius.com>:
On Dec 4, 2017, at 8:54 AM, osman tuzcu <osmantuzcu@gmail.com> wrote:
Hi; I am using FreeRadius 3.0.15. I am trying to make 802.1x with the HP 2530 switch. When I debug with radiusd -X command, I see anonymous in username field. That's why the server rejects me. How can i fix this?
Configure the client to *not* send "anonymous" as the User-Name.
The packet comes from the client... no amount of poking FreeRADIUS will fix the client.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Mon, 2017-12-04 at 17:49 +0300, osman tuzcu wrote:
Sorry, there is no such setting on the device. I read something about the inner and outer EAP in an old writing. Could this be a solution?
There isn't any EAP in that request... Client supplicant isn't configured/working and switch has fallen back to trying MAC auth? -- Matthew
I want to authenticate the user for accessing internet via switch. radius-server host 207.154.250.140 key "123" aaa authentication port-access eap-radius aaa port-access authenticator 7-11 aaa port-access authenticator active In all sources it is said that these commands are sufficient. When I run these commands and plug my computer between ports 7 and 11, the user confirmation screen appears. But when I enter the username and password, i see anonymous on the debug 2017-12-04 18:00 GMT+03:00 Matthew Newton <mcn@freeradius.org>:
On Mon, 2017-12-04 at 17:49 +0300, osman tuzcu wrote:
Sorry, there is no such setting on the device. I read something about the inner and outer EAP in an old writing. Could this be a solution?
There isn't any EAP in that request...
Client supplicant isn't configured/working and switch has fallen back to trying MAC auth?
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Dec 4, 2017, at 10:10 AM, osman tuzcu <osmantuzcu@gmail.com> wrote:
I want to authenticate the user for accessing internet via switch.
radius-server host 207.154.250.140 key "123" aaa authentication port-access eap-radius aaa port-access authenticator 7-11 aaa port-access authenticator active
That configures the switch, but doesn't configure the User-Name.
In all sources it is said that these commands are sufficient. When I run these commands and plug my computer between ports 7 and 11, the user confirmation screen appears. But when I enter the username and password, i see anonymous on the debug
When you enter a username on the switch, the switch MUST send that as the User-Name in the RADIUS packet. Again, no amount of poking FreeRADIUS will fix the switch. Contact the switch vendor, or read the switch documentation. Or, throw the switch in the garbage, and buy one that works... Alan DeKok.
hi, hangon, are you talking about logging into the switch, or using 802.1X on the switch ports that clients are connecting to? if the former then config is on switch, if the latter then you need to configure the clients that are connected to it. and in the latter case, if you dont like the anonymous outer id being used in accounting info then its up to you to tell the switch in the 802.1X reply what the real user name is (from the inner, copy the inner user to the outer reply in the access accept (which, if its all internal stuff and your own users etc you may do but this is not appropriate for your users wanting privacy if you enable remote authentication at other 802.1X places (eg federated access like eduroam). alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Matthew Newton -
osman tuzcu