November 2005 - Freeradius-Users - lists.freeradius.org

Announce: ARA v.0.3 released.
by Dawid Ciężarkiewicz 11 Nov '05

11 Nov '05

ARA is OpenSource web application written in PHP. It's goal is to create simple but convenient solution for managing the FreeRADIUS server. It resides on web server and connects to FreeRADIUS' database to allow easy and efficient manipulation of users, groups, network access servers and more. Currently only MySQL backend is finished, but adding other should be easy. While being a PHP application ARA uses the Sigma templating engine, and it's code tries to be friendly and "developer inviting". Be sure to check out the 0.3 release screenshots: http://projects.asn.pl/ara/wiki/screenshots And grab ARA here: http://download.asn.pl/ara/ara-0.3.tar.gz md5: aaf0301668a82bc1e9dcfa026e2fe100 More on http://projects.asn.pl/ara/ . Waiting for your comments! -- Dawid Ciężarkiewicz

1 0

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks anyway!. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Fri 11/11/2005 4:18 PM To: FreeRadius users mailing list Subject: Re: freeradius wont let realms based auth "Andres Pazos" <andy(a)ferengi.com.ar> wrote: > My problem is that after reading the "users" file and getting a Match, > when Radius enters the authorize seccion it never read the subsection > "autz-Type SQL2 { sql2 }". what's wrong with that?. thanks alan! I think the problem is that your story keeps changing. I don't think I can help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

accounting question
by Chuck 11 Nov '05

11 Nov '05

we keep getting a lot of missed stop packets that we never had problems with when we ran icradius. I don't know what the problem could be but I am getting ready to turn accounting off for us. However I have a major concern with this. We are using the mysql option with freeradius including the nas table. We use a flat file, proxy.conf, for our remote realm configurations. We proxy for a number of remote realms running their own radius authentication and they receive accounting information we receive from our upstream passed on to them. If I turn accounting off, is there a way we can still pass accounting through to our remote realms, or is it a global on/off switch that affects everyone? I just don't want to keep track of it locally until we can figure out what is causing this. I do notice a number of error messages about 0 length stop packets being received and I assume they are rejected. I have also contacted our upstream provider and asked them to be sure all is well with what they pass us. We use 1645:1646 and have those ports in iptables to freely accept.. are there possibly other ports I should be putting in there? -- Chuck

2 3

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks again. im really sorry about mistakes i've made. i was trying to say "authorize" instead of "authenticate", then: if realm is "wireless", i want radius to authorize the user using MySQL. if realm is "dhcp", i want radius to authorize the user using the SQL server. ----- users file # Except these two lines of the file the rest is commented. line 155 - DEFAULT Auth-Type := System, Realm == "wireless", Autz-Type := SQL1 line 157 - DEFAULT Auth-Type := System, Realm == "dhcp", Autz-Type := SQL2 ------ radiusd.conf file $INCLUDE ${confdir}/sql1.conf $INCLUDE ${confdir}/sql2.conf authorize { ... Autz-Type SQL1 { sql1 } Autz-Type SQL2 { sql2 } } My problem is that after reading the "users" file and getting a Match, when Radius enters the authorize seccion it never read the subsection "Autz-Type SQL2 { sql2 }". what's wrong with that?. thanks alan!. should i add more files/data?. thanks!!!

2 1

radiusd.conf[9] Failed to link to module 'rlm_eap'
by Daniel Frankovic 11 Nov '05

11 Nov '05

Hi, I have a problem: radiusd.conf[9] Failed to link to module 'rlm_eap': /usr/local/lib/ rlm_eap-1.0.2.so: cannot make segment writable for relocation: Permission denied I have tried with freeradius 1.0.5 same problem Can anyone help me? Daniel

2 1

virtual domains as realms
by Marko Dinic 11 Nov '05

11 Nov '05

Hello, I have the following setup on my system: In LDAP i have: dc=mydomain,dc=com | |---ou=Virtual Domains | | |---dc=domain1.com | | | |---uid=john | |---uid=mike | |---uid=peter | |---dc=domain2.com | | | |---uid=john | |---uid=mike | |---uid=andrew | |---dc=domain3.com | | | |---uid=mike | |---uid=jack | |---uid=joe | etc. These are virtual domains and accounts for some mail service and they have to be arranged only in the above order. In addition to mail service, virtual users are supposed to have a dialup access, logging in as username(a)virtualdomain.com i.e. john(a)domain1.com, john(a)domain2.com, mike(a)domain3.com and so on... If I configure LDAP module like this: ldap ldap_vdomains { ... basedn = "dc=%{Realm},ou=Virtual Domains,dc=eunet,dc=yu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=posixAccount)" ... } and add each of these virtual domains to proxy.conf as realms, it works like a charm... However, these domains and accounts are independently created in LDAP through some web interface by our accounting officers in the sales department, so proxy.conf is not updated every time the domain is added or modified. Of course, it could be automatically updated by some script, but, still, I don't like the idea of HUPing radius every time virtual domain is added, removed or renamed. So, realm DEFAULT seems like an elegant solution, but, when it produces a match for any of these virtual domains realms, it sets Realm = DEFAULT and LDAP search is done with basedn = "dc=DEFAULT,ou=Virtual Domains,dc=eunet,dc=yu" Is there a way to make the DEFAULT realm preserve the original realm name from the request and set it as the Realm attribute's value instead of "DEFAULT" ? If not, is there some other solution to this ? It could help if I could at least set the DEFAULT realm not to strip the user name and then use regexp to extract the realm name from %{User-Name} in basedn= line in ldap module config, but I don't seem to find the working syntax for this. Simply put, I need a way of using the realm part of the User-Name in ldap module's configuration, while using only realm DEFAULT (or, perhaps, some other catch-all entry, if availabe) in proxy.conf. -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks again!. I already understand the diference between accounting and authentication. I have a freeradius server (1.0.5), a MySQL server and an SQL server (with different databases). what i need to do is, i.e.: User sends radius request (i.e.: radtest user@realm password server port secretkey). if realm is "wireless", i want radius to authenticate the user using MySQL. if realm is "dhcp", i want radius to authenticate the user using the SQL server. i've started redoing all the configuration. If you check the debug info from the "radiusd -X" you will see that before leaving the "authorize { ... }" section Radius never choose to use the "Autz-Type SQL { sql }" section, afterwards in the users file I've seted the Autz-Type to SQL. these are part of my files: users file:---------------- DEFAULT Auth-Type := System, Realm == "wireless", Autz-Type := MSSQL1 DEFAULT Auth-Type := System, Realm == "dhcp", Autz-Type := SQL --------------------------- radiusd.conf file:--------- modules { realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } $INCLUDE ${confdir}/sql.conf $INCLUDE ${confdir}/mssql1.conf } authorize { preprocess suffix files Autz-Type WIRELESS { mssql1 } Autz-Type SQL{ sql } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } --------------------------- radtest ------------------- # radtest fbrito@dhcp fbrito localhost 1812 testing123 Sending Access-Request of id 20 to 127.0.0.1:1812 User-Name = "fbrito@dhcp" User-Password = "fbrito" NAS-IP-Address = NanO NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=20, length=20 --------------------------- radiusd -X ---------------- Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32791, id=20, length=63 User-Name = "fbrito@dhcp" Password = "fbrito" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "dhcp" for User-Name = "fbrito@dhcp" rlm_realm: Found realm "dhcp" rlm_realm: Adding Stripped-User-Name = "fbrito" rlm_realm: Proxying request from user fbrito to realm dhcp rlm_realm: Adding Realm = "dhcp" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Sending Access-Accept of id 20 to 127.0.0.1:32791 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------- thanks in advance!

2 1

How to allow user login only from one ip?
by Tarasov Alexey 11 Nov '05

11 Nov '05

Hello! I'm using FreeRadius for accounting. For example we have user: test Auth-Type:=Local, User-Password == "test" How to allow user login only from one ip? -- Best regards, Tarasov Alexey.

1 0

RE: Freeradius for securing wlan in big installation
by Jonathan De Graeve 11 Nov '05

11 Nov '05

Its possible with SSL-VPN Just use your SSL-VPN appliance as the captive-portal page (with help from a router) In this way, clients with different oses can login (you always need authentication) and have a ssl-vpn where all traffic goes over J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be > -----Oorspronkelijk bericht----- > Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] Namens Josh Howlett > Verzonden: vrijdag 11 november 2005 14:18 > Aan: FreeRadius users mailing list; thomas.widhalm(a)sbg.ac.at > Onderwerp: Re: Freeradius for securing wlan in big installation > > Hi Thomas, > > What you're asking for is not possible, with any combination of existing > technologies. > > Drop the web portal, and use an 802.1X supplicant. FreeRADIUS does this > well :-) > > best regards, josh. > > Thomas Widhalm wrote: > > Hi everyone! > > > > I'm searching for a way to secure our wireless Lan with encryption, but > > we don't want any sort of authentication. This is, because we have > > another way of authenticating our users (a webportal, they have to log > > in, before getting access to the wlan) > > > > What we want is an encrypted wlan without our helpdesk installing > > software or passing keys to our users. They are using all kinds of OSs. > > > > Can freeradius actually provide us with that or do we have to search for > > another solution? > > > > Sorry if the answer is obvious, but we are running out of time and so I > > got to ask around a lot. > > > > Thanks and regards, > > Thomas Widhalm > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Freeradius for securing wlan in big installation
by Thomas Widhalm 11 Nov '05

11 Nov '05

Hi everyone! I'm searching for a way to secure our wireless Lan with encryption, but we don't want any sort of authentication. This is, because we have another way of authenticating our users (a webportal, they have to log in, before getting access to the wlan) What we want is an encrypted wlan without our helpdesk installing software or passing keys to our users. They are using all kinds of OSs. Can freeradius actually provide us with that or do we have to search for another solution? Sorry if the answer is obvious, but we are running out of time and so I got to ask around a lot. Thanks and regards, Thomas Widhalm -- Thomas Widhalm University of Salzburg, Austria IT- Services, ITS pgp/gpg Key: 6265BAE6

2 1