September 2005 - Freeradius-Users - lists.freeradius.org

Authentication using LDAP on port 636
by Dany Cuyt 06 Sep '05

06 Sep '05

Hi, I installed freeradius 1.0.1 for RHEL4 from RedHat network. As an ldap server I have Sun Directory server 5.2 patch3 with SSL enabled. I have plenty of applications using port 636 to access LDAP (ypldapd from padl, /etc/ldap.conf on linux, Mozilla address book, etc..) . With freeradius as long as I use standard port 389 I don't have problems to use LDAP, but I have problems to use port 636 (Can't contact LDAP server). Or I missed something but I seem to be unable to find a procedure how to setup freeradius using SSL. Any help would be appriciated Thanks, Dany

1 0

Require realm suffix
by Ben Thompson 06 Sep '05

06 Sep '05

Hi I have set up FreeRADIUS so that I am using the relam format username@suffix. I have succesfully got this working by adding the relevent realm to proxy.conf and setting authhost and acchost to LOCAL. Currently when someone logs without specifying a realm, they are still authenticated and I would like to know if it is possible to change this behavoir so that users must specify the realm suffix. Thanks Ben Thompson

2 2

Can I add extra fields to the radius accounting database?
by Miguel Angel Quiles 06 Sep '05

06 Sep '05

Hi, I've got freeradius 1.0.2 on a SUSE 9.3. I was thinking if I could add a new field to the radius accounting. I'm using mysql. I already added the field to the radacct table in the radius database. And I've tried to modify the sql.conf file in the raddb directory. When I restart the service the freeradius won't start because off an error. I've created the field "TunnelType", and I added the values in the different queries, such as: accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, TunnelType) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Tunnel-Type:0}')" I hope somebody can help me. Thanks

2 2

Authenticating between a Cisco 3640 and radius server
by Amos Cottrill 06 Sep '05

06 Sep '05

I setup free radius on a linux box and am trying to authenticate a user from a cisco 3640 router. Below is the output I am receiving when using radiusd -xxyz -l stdout. The router will not let me login, so something isn't working properly. Any suggestions??? I set the radius server up to use port 1645, so it resembles the cisco settings. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 0 Going to the next request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 43171770 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 1, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 1 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 3 with timestamp 4317177a Nothing to do. Sleeping until we see a request. -- Amos Cottrill Assistant Network Coordinator - SEOVEC amos(a)seovec.org Ph:(740) 594-7663 ext 119 Fax:(740) 592-6251

1 0

linux newby attempts freeradius (unsuxesfull)
by Fred Zinsli 06 Sep '05

06 Sep '05

Rather that tell me what I an doing wrong (apart from attempting this) can someone point me to where I can find out what I need to know. Scenario: Debian sarge installed (no probs or errors) on i386 machine. Attempting to install freeradius-1.0.4.tar.gz will not ./configure without errors. As I don't know what I am ment to be looking for, I can't find what I am doing wrong. Trying to be smart, I went to the debian site and downloaded freeradius_1.0.4-2_i386.deb from http://packages.debian.org/testing/net/freeradius I can't find documentation for this, so don't know what to do with it now I have it. Given I am NOT familiar with linux at all, and have ventured into this reluctently, can someone point me to some really bullet proof documentation that doesn't assume people already have an extensive knowledge of linux before they start. I have been working on this for 3 weeks now, searched gallaxies far away for info, god is now refusing to take my calls, and my wife has threatened to lock me in my room so she doesn't have to put up with me. I have also learned some very colorful words. Someone please save me. Fred

3 2

PEAP TLS establishment and certificates
by Juan Daniel Moreno 06 Sep '05

06 Sep '05

Hi everyone, I would like to configure a freeradius 1.0.4 with PEAP protocol and OpenSSL certificates. My first question is where should I place the generated certificates with Openssl? As I am developing a client's interface, can anybody tell me how to "create" the Client_Hello packet? Thank you very much!! Juan Daniel MORENO

1 0

user authorization pam radius
by Pablo Rodriguez Dominguez 06 Sep '05

06 Sep '05

Hi all. Do yo now if its posible to do user authorization using pam radius and freeradius?. How can i do it. Tks -----Original Message----- From: Sam Njenga To: freeradius-users(a)lists.freeradius.org Sent: 05/09/2005 18:24 Subject: freeradius-mysql-clid Hi all I have downloaded the latest freeradius and compiled ok. I have tested it and it works fine. I would like to authenticate calls based on Caller-Id. What do I have to have in the tables. A small example will be highly appreciated. /Sam - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeraduis + pppoe-server on linux
by Wassim abbas 05 Sep '05

05 Sep '05

Hi i need help with how to setup freeradius + pppoe-server , i searched on the net but no good docs so if anyone can help or send me some docs thanks

2 1

Windows XP supplicant limitation ?
by Jérémy Cluzel 05 Sep '05

05 Sep '05

Hi, >/ /Hi, >/ / >/ />/ //- user auth after the doain controler has accepted logon. />/ />/ Does anybody know if the windows XP supplicant is able to do this ? />/ />/ Do I need a better supplicant ? aegis? secureW2? Funk Odissey ? / >/ /i believe it wont do anything useful or multifunctional like >/ /you require. a good option would be to use the supplicant >/ /so authenticate the system, then use something like pGina >/ /to do the user authentication - that can then authenticate >/ /the user against a RADIUS server >/ / >/ /pgina - http://pgina.xpasystems.com/info/ >/ / >/ / >/ /alan In fact, XP supplicant seems to allow only one auth method (EAP-TLS or PEAP). If I use TLS machine auth will be OK, so I can log on my domain and get my roaming profile. But If want to keep my network connection, I have to use a user cert too or do the registry hack (AuthMode set to 2). If I choose to use PEAP, computer auth, as far as I understood, will never work, so I won't be able to log on my domain... A solution may be a supplicant which first tries to make a network connection (using username/password), and then, if it succeeds, tries to authenticate user against the domain. I don't see how pgina will help me... sorry. Regards, Jeremy

1 0

[PEAP] Authenticate aigainst OpenLDAP Directory with NT Hashes
by Sebastian Mauer 04 Sep '05

04 Sep '05

Hello there, I just researched a little bit in the freeradius-users list and found out that there have to be clear passwords in the LDAP Direcotry to get FreeRADIUS to work with LDAP. However I think it's not very secure to store the passwords in clear in the Directory, even if there are ACLs in Place. Is it really not possible to do PEAP (w. MSCHAPv2) when I have NT-Hashes in the Directory? My target is to use LDAP as authentication source for my UNIX Workstations (trough pam_ldap), my Windows Workstations (trough Samba accessing LDAP, therefor I have the NT-Hashes in the Dir) and RADIUS for dialup and wireless users. Has someone done this before? Does someone know a good Howto to achieve this? Sincerely, Sebastian Mauer

3 2