August 2005 - Freeradius-Users - lists.freeradius.org

Different behaviour with LDAP
by Þórður Ívarsson 31 Aug '05

31 Aug '05

I am authorizing wireless network cards in "users file" with radius server (old cistron radius) and that is working fine entry like: 121212-232323 Auth-Type = Accept Only network card matching abov entry get access Now I am building new radius server with FreeRadius and users information and passwords are kept in Open-LDAP I have following entry in my "users file" DEFAULT Huntgroup-Name == "wireless", Service-Type == Framed-User, Autz-Type:=zldap-macaddr, Auth-Type := Accept Fall-Through = No and this is in "radiusd.conf" ldap ldap-macaddr { server = "localhost" identity = "cn=manager,dc=skrin,dc=local" password = kept_secret basedn = "ou=users,ou=internet,dc=skrin,dc=local" filter = "(&(macAddress=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=wireless))" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # password_attribute = userPassword # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes } I have also different sections for different huntgroups of the LDAP entry in radiusd.conf for other services and they work fine. The behaviour of the radius server is like that - authorize the client/user (match against huntgroup and ldap attribute search) then authenticate the user (trying to log into ldap server with user/password), but I have Auth-Type= accept, that I understand is allowing everyone that matces the authorize section. This breaks, it allows everyone that matches huntgroup but fails authorize. Is this normal or not? Þórður Ívarsson Skrín ehf

1 0

Windows Client Authentification bevore Domain logon
by Jérémy Cluzel 31 Aug '05

31 Aug '05

How can I add this OID to my machine certs ? using CA.certs script and xpextensions file ? Regards, Jeremy Ben Walding <ben.walding at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >/ /I also found using machine certificates to be hit and miss (some >/ /machines they'd be picked up, others they wouldn't - all XP SP2 with >/ /appropriate patches). >/ / >/ /And then I stumbled on this > / />/ ///http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html >/ / >/ /1.3.6.1.4.1.311.17.2 >/ / >/ /After I started adding that OID to my machine certs, everything >/ /started working wonderfully. >/ / >/ /I shook my fist at Microsoft that day! >/ / >/ /Cheers, >/ / >/ /Ben >/ /

1 0

urgent:problem with shared secret
by Geraldin Arthy 31 Aug '05

31 Aug '05

Hello, I am using free radius server for sending accounting request packets and receive accounting response packets.However it displays shared secret is incorrect.Could you let me know how to configured the free radius server for radius accounting or any special configuration has to be done apart from the naslist file and clients.conf file. Please let me know as soon as possible. --------------------------------- Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather

1 0

TTLS-PAP only option for LDAP backend?
by Cian Phillips 31 Aug '05

31 Aug '05

Thanks to Alan, Thor and Vladmir for getting me this far. <grin> I have TTLS-PAP working and authenticating against our OSX LDAP server. I was wondering if anyone has had any success getting Microsoft clients to use TTLS-PAP without installing additional software as suggested in this tutorial. http://vuksan.com/linux/dot1x/wpa-client-config.html#Windows_XP Is there a simpler way to accomplish the same thing? Cian Phillips Director Network & Systems California College of the Arts Phone: (510) 594-3745 Cell: (510) 719-0091 Fax: (510) 594-3758 email: cian(a)cca.edu

2 1

A cluster of freeradius servers
by Angel L. Mateo 30 Aug '05

30 Aug '05

Hi, I want to deploy the next configuration: I have a proxy radius server (freeradius) who redirect its requests to another freeradius server. I have another freeradius server with the same configuration as this last one. What I want is to configure the proxy radius to proxy requests to one of these servers. It this fail, then it should ask to the other one. If this posible with freeradius? How do I do it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

6 8

how to run sql query on radius startup
by Sergey Pariev 30 Aug '05

30 Aug '05

Hi All. I'm currently setting up freeeradius 1.0.4 with pgsql (8.0.3) backend, and I need to run an SQL query on radius server startup. Id like to know is it possible at all ? I've read the docs and *.sql config files but haven't found anything like this. Any suggestions ? I know I can run a query via psql from radius startup script, but I'd prefer another solution if such exists. Thanks in advance, Sergey Pariev.

3 6

ntlm_auth multiple nt4 domains peap xp
by Jamie Crawford 30 Aug '05

30 Aug '05

Hi, I have a two nt4 trusted domain infrastructure and am trying to setup freeradius to authenticate xp supplicants with peap. I have nmbd and winbindd running correctly, and can run the ntlm_auth program with no problems. But what I have found out is that my freeradius server is joined to the DOMAINA domain. So when running /usr/bin/ntlm_auth --username=domainatestuser it automatically validates the user against DOMAINA. But if I try to run /usr/bin/ntlm_auth --username=domainbtestuser it will fail. I have to add the --domain=DOMAINB for it to validate correctly. So when I use my xp supplicant to validate my user, domainatestuser (without typing in the DOMAINA), it works perfectly. If I put in DOMAINA in the domain box, I get rejected. If I try to validate the domainbtestuser using nothing for the domain box, I get rejected. If I put in DOMAINB in the domain box, I get rejected. I guess I am needing to setup realms for each domain. How do I setup DOMAINA users to go to the DOMAINA domain controllers, and how do I setup DOMAINB users to go to DOMAINB domain controllers. I shouldn't really have to setup to go do different domain controllers, I just need freeradius to pass on the "domain" in the ntlm_auth command. Thanks for any help!!!! rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:3076, id=85, length=181 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "DOMAINB\\domainbtestuser" Calling-Station-Id = "001217a8df41" Called-Station-Id = "0001f4449c4c" NAS-Identifier = "RoamAbout AP" State = 0x1ce29e6a91a9663ff39346a69f85748c EAP-Message = 0x020800261900170301001b4ca905292ffadaa855c356acd5417b6989915df2dd32ffdc0b08d3 Message-Authenticator = 0x6dca7a93ca473745cab0f6a063b66d0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "DOMAINB\domainbtestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_realm: Looking up realm "DOMAINB" for User-Name = "DOMAINB\domainbtestuser" rlm_realm: No such realm "DOMAINB" modcall[authorize]: module "ntdomain" returns noop for request 15 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: group authenticate returns invalid for request 15 auth: Failed to validate the user. Delaying request 15 for 1 seconds Finished request 15 Going to the next request Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

2 1

16 bit attr decoding..
by Wesley Spadola 30 Aug '05

30 Aug '05

I am currently working with the CVS (1.1.0) HEAD version of FreeRADIUS. It is using the SQL module with the Lucent 16bit atributes turned on. To make sure we have the most attributes available, I have merged the Ascend dictionary (more specifically, the just the VALUEs), because the CVS dictionary.lucent had none. Just attributes. I have been using Lucent-Modem-Modulation (code 305) and Lucent-Modulation (code 20106) in the SQL statements to discern which one would be coming from our NAS (MAX TNT running TAOS v11), and it looks as though Lucent-Modem-Modulation is currently being sent. Now, while I was testing this last week I was receiving: Lucent-Modem = v90/v34/v92/etc instead of this week: Lucent-Modem-Modulation = 1/2/18/etc Is there a possible reason it used code 20106 last week and now code 305? Also, is there a reason I'm being given numerical values back instead of what they represent? Here is the current state of the relevant portion of our dictionary.lucent: ATTRIBUTE Lucent-Modem-Modulation 305 integer ... ... ATTRIBUTE Lucent-Modulation 20106 integer .. .. VALUE Lucent-Modulation v90 1 VALUE Lucent-Modulation v34 2 VALUE Lucent-Modulation v17 3 VALUE Lucent-Modulation v23 4 VALUE Lucent-Modulation v21 5 VALUE Lucent-Modulation k56flex 6 VALUE Lucent-Modulation v22bis 7 VALUE Lucent-Modulation v32 8 VALUE Lucent-Modulation bell212 9 VALUE Lucent-Modulation bell103 10 VALUE Lucent-Modulation v22 11 VALUE Lucent-Modulation vFC 12 VALUE Lucent-Modulation v33 13 VALUE Lucent-Modulation bell208 14 VALUE Lucent-Modulation v29 15 VALUE Lucent-Modulation v27 16 VALUE Lucent-Modulation none 17 VALUE Lucent-Modulation v92 18 VALUE Lucent-Modem-Modulation v90 1 VALUE Lucent-Modem-Modulation v34 2 VALUE Lucent-Modem-Modulation v17 3 VALUE Lucent-Modem-Modulation v23 4 VALUE Lucent-Modem-Modulation v21 5 VALUE Lucent-Modem-Modulation k56flex 6 VALUE Lucent-Modem-Modulation v22bis 7 VALUE Lucent-Modem-Modulation v32 8 VALUE Lucent-Modem-Modulation bell212 9 VALUE Lucent-Modem-Modulation bell103 10 VALUE Lucent-Modem-Modulation v22 11 VALUE Lucent-Modem-Modulation vFC 12 VALUE Lucent-Modem-Modulation v33 13 VALUE Lucent-Modem-Modulation bell208 14 VALUE Lucent-Modem-Modulation v29 15 VALUE Lucent-Modem-Modulation v27 16 VALUE Lucent-Modem-Modulation none 17 VALUE Lucent-Modem-Modulation v92 18 Thanks, Wes

2 3

Re: multiple threads
by Artur Hecker 30 Aug '05

30 Aug '05

hi Alan >> context: on a Fedora Core 3 system (linux 2.6.9) I configured n=5 but FR would not start but one instance. also in the "radiusd -X" there is no notice of thread-pool config being read. > > > > FC4 uses a newer Linux kernel, which *correctly* shows only one > process via "ps", even when that process has multiple threads. ok. you are right. i found the thread info in /proc/$PID/status. > And "-X" means "don't start threads". See the "man" page. ok, no i meant the daemon mode. sorry, my comment was a bit misleading. it's just that i would expect FR to show every configuration token it has read. and thread pool seems to be ignored in the debug. thanks Alan. ciao artur

2 3

assign an ip pool for a user
by dinhan 30 Aug '05

30 Aug '05

Hello all ! I've just setup a radius server and it's working very good. thanks...god I have a question : can I assign an IP Pool to a user ? .Of course, I can do that by ACS server , but I have a lot users , and I want to set some policy for users... thanks and best regard __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1