August 2005 - Freeradius-Users - lists.freeradius.org

using AND logic instead of OR logic with authorization?
by Michael Hare 31 Aug '05

31 Aug '05

Hello- I'd like to authorize users based on their Calling-Station-Id via a local users file and authenticate/authorize (simple access allowed flag) via an ldap server. The reason I need to double authorize is because I do not have rights to add/edit any data in the remote ldap server. I need the authorization to essentially be an "AND" (ie, I need both authorizations to return true in order to accept the user). Is this possible? I've tried doing this within a single radius instance, and I've also tried having the ldap interaction happen via a radius proxy without success. Here is my users file DEFAULT Calling-Station-Id =~ "^144\.92\." Service-Type = NAS-Prompt-User Here is what a debug looks like rad_recv: Access-Request packet from host 144.92.44.114:4447, id=30, length=123 User-Name = "mdhare" User-Password = "mypass" NAS-Port = 2905 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: No '@' in User-Name = "mdhare", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 it as at this point I'd like authorization to stop, but it continues. What am I doing wrong? modcall: group authorize returns updated for request 0 Sending Access-Request of id 0 to 144.92.254.243:1812 ... ... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=30 Service-Type = NAS-Prompt-User Proxy-State = 0x3330 I'd be happy to provide configuration and output that I have now for testing, but there's no sense in being verbose if this isn't possible in general. Thanks- -Michael -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188

1 0

krb5 documentation
by Joachim Selke 31 Aug '05

31 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I want to do user authentication by Kerberos 5. Therefore I was happy to see that FreeRADIUS contains the krb5 module. But I wasn't able to find the documentation for this module. Can somebody give me a link or an example on how to use this module? Thanks, Joachim - -- B. Sc. Joachim Selke Universität Hannover, Fachgebiet Theoretische Informatik Appelstraße 4, 30167 Hannover, Germany Web: <http://www.thi.uni-hannover.de/> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDFbdiq7fYj4TsIUwRAlgaAKC0ES/ZQodcsti6rVH17bSGHP3hRgCgt9Ji a3CQ0y4yfff4Wc8LW/W0kxg= =fUZH -----END PGP SIGNATURE-----

2 1

GPL
by Velikanov 31 Aug '05

31 Aug '05

I told my colleagues about the advantages of FREERADIUS+ORACLE. BUT, they say, that it is GPL violation. IS that true? Thanks.

2 1

Re: Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

MS-CHAP-Use-NTLM-Auth = No
by Jamie Crawford 31 Aug '05

31 Aug '05

Hi, I'm trying to have a local user in my users file called "guest" password "guest". If the user is not "guest" forward on the user to domain authentication. I'm having trouble when authenticating "guest" when it comes to the mchap authentication, although I have the "MS-CHAP-Use-NTLM-Auth = No", it still runs the ntlm_auth command against my domain controllers, which I don't have a "guest" account, and I don't want a "guest" account on my dc's, so it automatically rejects because I dont have a "guest" account on my domain. If I comment out the ntlm_auth command in radiusd.conf, it works fine, but of course my domain authentication doesn't work now. Any help is appreciated!!! Thanks, jamie guest User-Password == "guest", MS-CHAP-Use-NTLM-Auth = No, Filter-Id =Filter-Id =enterasys:version=1:policy=guest_basic" DEFAULT Auth-Type = System Filter-Id = "enterasys:version=1:policy=faculty_staff", Fall-Through = 1 Redhat AS4 Freeradius 1.0.4 Supplicants XP SP1,SP2 PEAP NT4 DOMAINS Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

1 0

Multiple VSA pairs
by Peter Hicks 31 Aug '05

31 Aug '05

Hello I'm using FreeRADIUS with MySQL for accounting and authentication. >From a Cisco 2651XM router, I have multiple Cisco-AVPair attributes send in accounting packets: rad_recv: Accounting-Request packet from host 192.168.167.14:1646, id=186, length=201 Acct-Session-Id = "00009E13" Cisco-AVPair = "isakmp-group-id=cg-ectvpn" Framed-IP-Address = 172.16.33.119 Cisco-AVPair = "isakmp-initator-ip=82.104.97.16" User-Name = "pwh" Cisco-AVPair = "connect-progress=Auth Open" Acct-Authentic = RADIUS Acct-Status-Type = Start Cisco-NAS-Port = "FastEthernet0/1" NAS-Port = 1 NAS-IP-Address = 192.168.167.14 Acct-Delay-Time = 0 When trying to refer to these in a SQL INSERT statement for accounting (where if the AVPair is 'isakmp-initiator-ip', it gets stripped and the address inserted), the AVPairs overwrite each other. Is there a workaround for this, or is the behaviour of a Cisco IOS router 'broken' for sending the same attribute twice in the same packet? Best wishes, Peter.

2 1

hi
by shruti kukkar 31 Aug '05

31 Aug '05

Hi all I am new to the freeRadius and wish to study the code of the server. Please tell me abt the code structure so as to be able to study and understand the code properly. Thanks Shruti --------------------------------- Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE! http://in.mail.yahoo.com

3 3

Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

All, I am using freeradiusd 1.0.4 on RedHat Linux 9 and have just run the digest test suggested in the doc area through radclient. As it stands, I receive a code 3 reply (Access-Reject). The instruction for the test tells me to do the following: 1. In the /etc/raddb/users file insert entry as below :- test Auth-Type := Digest, User-Password = "test" Reply-Message = "Hello, test with Digest" 2. Initiate radclient with a file called digest (i.e. radclient -f digest localhost auth testing123) User-Name = "test", Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7", Digest-Realm = "testrealm", Digest-Nonce = "1234abcd", Digest-Method = "INVITE", Digest-URI = "sip:5555551212@example.com", Digest-Algorithm = "MD5", Digest-User-Name = "test" The command line holds the shared secret as defined in clients.conf file. However for this test to work, I had to insert a User-Password = "xxxx" (where xxxx is the actual password), into the digest file. After this I get a code 2 reply (Access-Accept). A radiusd -X dump shows freerad trying to do a unix authentication via the rlm_unix module. I've tried to comment out any instances of unix authentication from the radiusd.conf file but with the same results. Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

New checkItem from LDAP
by Joe H 31 Aug '05

31 Aug '05

I am trying to create a new checkItem using an attribute stored in LDAP. I would like radius to check ldap to see if the attribute exists for a user and if it does, not assign a radiusPoolName. I have a radiusSNSEnable attribute setup in ldap and in the dictionary files as a check item. I have done lots of testing and googling and I have not found a clean solution that works. Below is the entry from my users file: DEFAULT SNS-Enable != "1" USR-Framed_IP_Address_Pool_Name = "BLACKHOLE1", Idle-Timeout := "120", Fall-Through = Yes Correct me if I'm wrong but that should mean, if the SNS-Enable attribute does not equal 1, assign the USR-Framed_IP_Address_Pool_Name and Idle-Timeout. I have SNS-Enable as a checkItem mapped to radiusSNSEnable in the ldap.attrmap. Does anyone have a solution for this? Could it be a processing order problem that I'm seeing? Does it process the users file and then LDAP so it's not checking or assigning the variable properly? If I set radiusSNSEnable as a replyItem I see it in the radius reply so I know it's getting the value. Thanks in advance for anyone that can help.

2 4

Re: concurrent TTLS and PEAP usage
by Stefan.Neis＠t-online.de 31 Aug '05

31 Aug '05

Hi, > what you are saying is that I should do something like this: > > user_ttls EAP-Type != PEAP > > that however only prohibits the usage of PEAP for user_ttls while i > would like to only enable TTLS for this specific user (which is not > quite the same). Yes, however you said yourself, that you do _not_ want to only enable TTLS for this specific user since you also obviously need to enable the inner protocol used inside the tunnel... Maybe something like if EAP-TYPE isn't EAP-TTLS and FreeRadius-Proxied-To is not set for user_ttls,t then reject as a first rule and as a second rule something like if FreeRadius-Proxied-To is set and AuthType isn't PAP then reject. And similar rules for user_peap. Regards, Stefan

1 0