July 2005 - Freeradius-Users - lists.freeradius.org

Multiple realms: need help
by Normando Marcolongo 01 Jul '05

01 Jul '05

Hi! I would like to have freeradius behave like this: - realm 'alwaysok' would always accept authentication - realme 'checkthis' would always check against mysql Since now I'd have done this by telling freeradius to proxy one of the realms to another freeradius the would behave accordingly leaving the former to do the processing for the other realm. Is there a more elegant way of doing this? Thank you! Normando -- | Normando Marcolongo | Micso s.r.l. | | via Tiburtina, 318 | I-65128 Pescara, Italy| |tel/fax (+39)08554105 | mob. (+39)3386296362 |

2 1

Re: EAP problem
by Graham, Robert 01 Jul '05

01 Jul '05

>You _cannot_ read the unicodePwd attribute (where the actual passwd >lies) from AD. It can only be written to, and then only under certain >conditions (SSL/TLS connection, and if not written by an admin, then a >delete/add must be performed in the same operation). >This is why you should use ntlm_auth w/PEAP for AD auth. You could be >able to auth against LDAP (PAP) in a TTLS situation (not tried that yet, >so I don't know how it would work), but you will never retrieve the >unicodePwd attribute. >Hope this helps. OK. Back to the drawing board... I looked at my options regarding the authenitication method on the W2K client and noticed that I can also used Protected EAP (PEAP). So I switched the client to this. When I tried the authenitication again, this time I get: rlm_eap: Identity does not match User-Name, setting from EAP Identity I did more searches on this error, and tried several suggestions, from using the hints file: DEFAULT Prefix == "MEM\\", Strip-User-Name = Yes Hint = "MEM", Service-Type = Framed-User, Framed-Protocol = PPP I also ensured that use_with_nt_hack was set to "no" in the preprocessor section. I modified the proxy.conf file for the local domain: realm MEM { type = radius authhost = LOCAL accthost = LOCAL } and no matter what I do I still get this error... There was a post on the mailing list that mentioned that some patches were applied to freeradius in Nov 2004, I took a look at the freeradius version I was using on my Fedora Core 3 box and it shows: radiusd: FreeRADIUS Version 1.0.1, for host , built on Oct 6 2004 at 05:25:02 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I wonder if this is now my problem..... I have attached the debug output: rad_recv: Access-Request packet from host 172.16.5.71:1645, id=235, length=93 User-Name = "MEM\\RGraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.5.71 NAS-Port = 24 EAP-Message = 0x02000010014d454d5c5247726168616d Message-Authenticator = 0xeeeaea4ed86a064f533da57687432cb4 rad_lowerpair: User-Name now 'mem\rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 41 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.5.71/auth-detail-20050630' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.5.71/auth-detail-20050630 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mem-dc.mem-ins.com:389, authentication 0 rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/{secret} to mem-dc.mem-ins.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0

2 1

RFC Info
by Jeff Fern 01 Jul '05

01 Jul '05

Hello all, I am using freeRadius as a proxy server for requests, however instead of proxying with user@realm, I am using: DEFAULT User-Name =~ "12357.*", Proxy-To-Realm := "Realm" with a regular expression for the start of the username (there will be several of these lines). Can anyone advise me if (and where) the ability to do this is actually in the Radius RFC, and therefore must be supported by other Radius servers, or if it is an extra feature of freeRadius? Any info on this would be gratefully recieved, Regards, -Jeff Fern

2 1

dialup_admin problem
by Okka Radius 01 Jul '05

01 Jul '05

The problem is its not the sql server that's denying access but the config of the php and dialup_admin scripts that's not working. I can connect to the mysql database from anyother other method except via the web interface.

1 0

radiusprofile entry don't work
by Felice Pizzurro 01 Jul '05

01 Jul '05

hi all, excuse me for my bad english, I'm italian. i would to create a structure wich control the user's access on a WLAN by an auth-ldap. I have create a ldap directory witch basedn dc=unime,dc=it. now, like is write on the ldap_tutorial in the doc/ directory, i try to import this ldif file (modified for my interst). the authentication to be with the EAP-TLS protocol (it work fine) therefore I've deleted the sections of the passwords and for authentication. dn: dc=unime,dc=it objectClass: dcObject objectClass: organizationUnit ou: Unime.it Radius dc: unime dn: ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: radius dn: ou=profiles,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: profiles dn: ou=users,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: users dn: uid=WLAN,ou=profiles,ou=radius,dc=unime,dc=it objectclass: radiusprofile uid: WLAN radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=Felice,ou=users,ou=radius,dc=mydomain,dc=com objectclass: radiusProfile uid: Felice radiusGroupName: WLAN the entry with uid =WLAN don't work, this is the message returned is invalid syntax #0 approximately... I don't have my pc here. Anyone can help me? -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Migliaia di manuali e guide scaricabili su: Hacker, Reti, Webmaster, Windows e non solo...clicca qui Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3412&d=30-6

2 9

Fw: Logging authentication
by MHumphries＠delcomp.net 01 Jul '05

01 Jul '05

i was having problems with logging both good and bad logins and so i upgraded to Freeradius 1.0.4 but am still not seeing anything in radius.log i can send my config files if someone can help me i would be very grateful Michael J. Humphries Network Engineer Delcomp/SOFTEK 1431 N. 26th Street Escanaba, MI 49829 Phone: 906-786-3583, ext 39 Fax: 906-786-4300

1 0

RE: dialup_admin problem
by Rashad Rustamoff 01 Jul '05

01 Jul '05

Check mysql logs. If mysql server refuses connection by any reason you will see it in logs. Standard location of mysql logs in mysql data directory. Normal operations are logged in file your_machine_name.log, errors in your_machine_name.err.

1 0

using freeradius and chillispot
by yuniva wati 01 Jul '05

01 Jul '05

hello, I want to ask about using freeradius and chillispot in one PC. there is need to configure the freeradius to using chillispot?? thanks for your attention --------------------------------- Discover Yahoo! Have fun online with music videos, cool games, IM & more. Check it out!

1 0

dialup_admin problem
by Okka Radius 01 Jul '05

01 Jul '05

I've changed the following ... sql_server: 127.0.0.1 ( don't work ) sql_server: 1.2.3.4 ( where it is a substitute for the real ip address ) If I look at the fields below .... sql_type: mysql ( is the default ) and if I use that then get this error when clicking on statistics on the dialup admin homepage < Could not connect to the SQL database > If I change the string to sql_type: mysq ( another string ) and use that then I get the error when clicking on statistucs on the dialup admin homepage < Could not include SQL library functions. Aborting > I reckon the problem is something in the connection string because as mentioned connecting to mysql through a client works perfectly , its only the web interface that refuses to connect to the db with freeradius running no matter what the syntax , suggestions ?

1 0

Re: Freeradius-Users Digest, Vol 3, Issue 2 (Away from the office)
by Robert Wills 01 Jul '05

01 Jul '05

1 0