problem with test aaa-server in ciscoasa

2012-11-23 Thread studyfordo
Hi,all I have install freeradius-server-2.2.0, and make test such as ./ratest test test 127.0.0.1 0 testing123. the result is ok. so i ass user tsb to users file as following format. tsb Auth-Type := Local, User-Password == 12345678 and add asa ip to clients. client X.X.X.X{

Re: problem with test aaa-server in ciscoasa

2012-11-23 Thread Matthew Newton
On Fri, Nov 23, 2012 at 06:47:44PM +0800, studyfordo wrote: I have install freeradius-server-2.2.0, and make test such as ./ratest test test 127.0.0.1 0 testing123. the result is ok. so i ass user tsb to users file as following format. tsb Auth-Type := Local, User-Password == 12345678

Re: problem with test aaa-server in ciscoasa

2012-11-23 Thread alan buxey
Hi, tsb  Auth-Type := Local, User-Password == 12345678 tsb Cleartext-Password := 12345678 thats all you need. dont use User-Password (as the docs and radiusd -X output will tell you!) and you dont set auth-type either - the server understands I debug it. the folloing is details.

Re: Git master branch Debian build

2012-11-23 Thread Olivier Beytrison
On 21.11.2012 14:52, Arran Cudbard-Bell wrote: On 21 Nov 2012, at 13:41, Olivier Beytrison oliv...@heliosnet.org wrote: Oh dear. That'd be why that's happening... I have the same output. But I can't see what you saw. Is there a libfreeradius-eap.so missing somewhere ? Yep. Can't

RE: Debian build the freeradius package with unixodbc support

2012-11-23 Thread Dominick Rivard
-Original Message- From: freeradius-users-bounces+drivard=datavalet@lists.freeradius.org [mailto:freeradius-users-bounces+drivard=datavalet@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: November-22-12 4:56 PM To: FreeRadius users mailing list Subject: Re: Debian

what about mac spoofing

2012-11-23 Thread pideil matthew
Hello all ! Please tell me, does radius auth over wifi (wpa2) affected by mac spoofing attack ? I think not because after successfull auth, exchange key mechanism is performed and all traffic become crypted. But my wifi laptop can already be disconnected by spoofed packet ? Regards, Matt

Re: what about mac spoofing

2012-11-23 Thread Alan Buxey
802.1X authentication ? (WPA2-RADIUS) If so , system is authenticated by user/pass and/or a certificate and the client and AP have a unique encryption key.. no other device can just come along with the same MAC and just start using the network. For WPA2 PSK, another client would need to know

Newbie question about rlm_exec usage

2012-11-23 Thread Hoggins!
Hello everyone, We're facing an issue with rlm_exec, or at least Ithink our problem comes from there. We use FreeRADIUS for a Wifi access point. We userlm_sql, and our clients authenticate using 802.1x, with a certificate and a pair of login/password credentials. Everything works just fine, and

Re: Git master branch Debian build

2012-11-23 Thread Arran Cudbard-Bell
On 23 Nov 2012, at 15:53, Olivier Beytrison oliv...@heliosnet.org wrote: On 21.11.2012 14:52, Arran Cudbard-Bell wrote: On 21 Nov 2012, at 13:41, Olivier Beytrison oliv...@heliosnet.org wrote: Oh dear. That'd be why that's happening... I have the same output. But I can't see what you

Re: Newbie question about rlm_exec usage

2012-11-23 Thread Alan Buxey
What EAP type? eg if using PEAP, the client never sends a password, instead its challenge-response which works because the SQL contains a copy of the password so MSCHAP can derive an agreement. Gmhow dies your curl do this? Are you trying thus in the authenticate section and feeding an

Re: Git master branch Debian build

2012-11-23 Thread olivier heliosnet
Le 23.11.2012 18:00, Arran Cudbard-Bell a écrit : On 23 Nov 2012, at 15:53, Olivier Beytrisonoliv...@heliosnet.org wrote: On 21.11.2012 14:52, Arran Cudbard-Bell wrote: On 21 Nov 2012, at 13:41, Olivier Beytrisonoliv...@heliosnet.org wrote: Oh dear. That'd be why that's happening... I

Re: Newbie question about rlm_exec usage

2012-11-23 Thread Hoggins!
OK, that explains a lot. I guess I need to find a method that lets the Cleartext-Password go through. I don't know how to do this, actually, as our passwords are now stored hashed. Any hint? Le 23/11/2012 19:18, Alan Buxey a écrit : eg if using PEAP, the client never sends a password, instead

Re: what about mac spoofing

2012-11-23 Thread Scott Armitage
On 23 Nov 2012, at 17:17, pideil matthew matthew.pid...@free.fr wrote: But my wifi laptop can already be disconnected by spoofed packet ? Not if you use protected management frames IEEE 802.11w regards Scott - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

dhcp/bootp server filename

2012-11-23 Thread Lev Bronshtein
FreeRadius 2.2.0 Redhat Linux 6.2 Please forgive me in advance if some of the things I say seem to be generalities and not per RFC, the firm where I work has recently decided to start using freeradius DHCP as DHCP server and I am the programmer/integrator/project lead for the entire thing. Our

Re: dhcp/bootp server filename

2012-11-23 Thread Lev Bronshtein
it appears I have solved that as well with dhcp-boot-filename as opposed to option 67 dhcp-boot-file-name. Will let you know once the device owner has a look at it On Fri, Nov 23, 2012 at 10:46 PM, Lev Bronshtein bronshtein@gmail.comwrote: FreeRadius 2.2.0 Redhat Linux 6.2 Please

Re: problem with test aaa-server in ciscoasa

2012-11-23 Thread studyfordo
firstly, thanks Mathew Newton and alan buxey. I run freeradius -X and run test in ciso asa5520. details as follows. rad_recv: Access-Request packet from host 192.168.30.254 port 1025, id=72, length=61 User-Name = tsb User-Password = 123456 NAS-IP-Address =