January 2006 - Freeradius-Users - lists.freeradius.org

RES: VSA Problem
by Romao Izumi Ito 27 Jan '06

27 Jan '06

Thanks Guy, it was my mistake. I update the dictionary and i see the correct parameters. Romao. -----Mensagem original----- De: freeradius-users-bounces+romao.ito=gvt.com.br(a)lists.freeradius.org [mailto:freeradius-users-bounces+romao.ito=gvt.com.br@lists.freeradius.org]Em nome de Guy Davies Enviada em: quinta-feira, 26 de janeiro de 2006 17:59 Para: FreeRadius users mailing list Assunto: Re: VSA Problem Hi Romao, What are you using to view the packet? Many packet analysis and RADIUS check tools require their own dictionary (e.g. NTRadPing). If this is the case and you've not updated the dictionary for that tool, then that's exactly what I'd expect you to see. Rgds, Guy On 26/01/06, Romao Izumi Ito < romao.ito(a)gvt.com.br> wrote: Hello, I'm working with Nortel Network Passport and I'm trying to configure a new dictionary on the freeradius. In the vendors doc we have following VSA and Vendor-ID: VENDOR nortel 562 ATTRIBUTE Passport-Command-Scope 200 integer nortel ATTRIBUTE Passport-Command-Impact 201 integer nortel ATTRIBUTE Passport-Customer-Identifier 202 integer nortel ATTRIBUTE Passport-Allowed-Access 203 integer nortel ATTRIBUTE Passport-AllowedOut-Access 204 integer nortel ATTRIBUTE Passport-Login-Directory 205 string nortel ATTRIBUTE Passport-Timeout-Protocol 206 integer nortel ATTRIBUTE Passport-Role 207 string nortel ... I configure the file dictionary.nortel in /etc/raddb and include it in dictionary file. Also I tried it in /usr/share/freeradius/. I added this attributes in the users file but when I look at the radius packet I see: Vendor Specific(26), Vendor: Undefined(562) Unknown Type(200), Value: Unknown Value type What am I doing wrong? Thank you, Romao. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Configuring free radius to use Active directory service
by Stephen Walsh 27 Jan '06

27 Jan '06

>1. How to configure the freeradius1.0.5 version, to support Active >directory service for user authentication. > For ldap .. we have rlm_ldap module to configure it. Same kind of >configuration is there for ADS also ?? Sumithra; that part is quite easy. Here's what I've just done; ldap { server = "<serverip>" identity = "<full LDAP path to user who will perform initial bind" password = "<their password" basedn = "highest part of tree to start searching from" filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } authorize { preprocess suffix auth_log ldap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } If you're wanting to search multiple trees, that's another matter, but that should get you started. See my earlier post about problems with W2k3 trees and their behaviour with searches. VLAN's I'll leave to someone who understands that part of FR better. Regards Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

1 0

How to start a session
by San 27 Jan '06

27 Jan '06

Dear All, I have implemented freeradius-1.0.5 in Redhat box. And I have some questions about it. It have searched the web but still can't find a clue or i just missed it :(. Also my questions are: 1. How do we start the session? I have send the request to the server and got access_accepted. And as I know the session is start after we send the accounting_request and get response from the server. The problem is how to do that using command prompt? My Nas is Suse box (that should be fine right?). I use this command to send acct_request echo "User-Name= Anna"| radclient 10.1.0.76 acct -x testing123 Is that right? or is there any place I can refer to use the radclient command? 2. Do I need to write external script to run the command? Because I want to use the session time out but seems still not working.(because I don't know how to start the session) 3. Where should I put the acc_type. Is it in server side or nas side? I really hope someone can help me (please...) Thanks a lot in advance Best Regards, Santy __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

RE: Problems System Auth with FreeRadius (/etc/shadow)
by Min Qiu 27 Jan '06

27 Jan '06

You may read the doc wrong. The group you should look for is "radiusd". When you create user "radiusd", the group "radiusd" should also be created if you use adduser command to do the job. You don't what user "radiusd" belong to group "root". Do "chgrp radiusd /etc/shadow". Min > -----Original Message----- > From: > freeradius-users-bounces+mqiu=globalinternetworking.com@lists. > freeradius.org > [mailto:freeradius-users-bounces+mqiu=globalinternetworking.co > m(a)lists.freeradius.org] On Behalf Of Nataniel Klug > Sent: Thursday, January 26, 2006 3:57 PM > To: FreeRadius users mailing list > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > Alan, > > Now you have gived me a tip... At my Fedora there is no group > shadow, so I > put radius to run as group "root" so it could read > /etc/shadow only if I set > +r to group at shadow files. > > Att, > > Nataniel Klug > > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Thursday, January 26, 2006 3:37 PM > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > > "Nataniel Klug" <nata(a)cnett.psi.br> wrote: > > > I just have installed the package from Fedora Core 3, > nothing else. > > > > Then look at the configuration file. See how it's different from > > what is shipped with FreeRADIUS. > > > > And setting "a+rw" on /etc/passwd and /etc/shadow is probaby the > > single worst thing you can do to your system. EVER. Rather than > > doing that, read raddb/radiusd.conf, it talks about issues with > > reading /etc/shadow, and describes suggested fixes won't > destroy your > > system. > > > > Honestly, I don't understand why it's so hard to read the > > configuration files. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problems System Auth with FreeRadius (/etc/shadow)
by Nataniel Klug 27 Jan '06

27 Jan '06

Hello, I am having a big problem with FreeRadius server. It doesnt authenticate my clients using /etc/shadow and /etc/passwd. When I try to use "radlogin" or "radtest" this are the messagens I get: === radlogin === [root@ns2 radius]# radlogin ($Id: radlogin.c,v 1.3 1997/12/29 23:07:25 lf Exp $) ----------------------------------------------------- Linux 2.6.13.4 (ns2.cnett.com.br) (port 0) ----------------------------------------------------- login: nata Password: RADIUS: Authentication failure local: Authentication failure [root@ns2 radius]# tail radius.log -n 2 Tue Jan 24 01:24:02 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:24:02 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) === radtest === [root@ns2 radius]# radtest nata 1234 localhost:1812 0 local Sending Access-Request of id 126 to 127.0.0.1:1812 User-Name = "nata" User-Password = "1234" NAS-IP-Address = ns2.cnett.com.br NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=126, length=20 [root@ns2 radius]# tail -n 2 radius.log Tue Jan 24 01:26:41 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:26:41 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) I tryed everything I know and it still not working. If I compile and install Cistron Radius it works just fine, but I dont want Cistron... freeradius-1.0.1-1 Fedora Core 3 - Kernel 2.6.13.4 (compiled from source) Waiting for help. Att, Nataniel Klug

3 15

cisco nopassword username
by xhon 27 Jan '06

27 Jan '06

hello, I'm working with Cisco 3745 router, and I'm trying to move local AAA to radius. Local username database looks like this: username user_a nopassword noescape username user_a autocommand connect hostname...... In radius I did this: user_a Auth-Type = Accept cisco-avpair = "shell:autocmd=connect hostname.....", Fall-Through = 0 But it's no good. I need the router not to ask for password at all ! Is it possible with Cisco and freeradius ? regards Kuba

1 0

SV: radkill and a small question about radwho
by Torkel Mathisen 27 Jan '06

27 Jan '06

> "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > I read about the radkill program in the FAQ. However the link doesn't > > work so I was wondering if anyone had a new link to that program? > > google? Tried that. No luck. None of the links I found worked. Not the link in FAQ, not freshmeat.net and thats all i found. > > Also I got a simple question about radwho. It doesnt seem to output the > > last part of the AP ip-address: > > Because there's only so much room in that column. Ok. So its normal then. Just looked a bit strange to me. Couldn't see the whole ip-address. Guess I'll stick to radwho -r then. Regards, Torkel

1 0

How to modify attribute by rlm_exec
by roger 27 Jan '06

27 Jan '06

Dear All, I want to set NAS-Port=100 to proxy request packet. In my test, if the receive packet has not NAS-Port attribute, It will successful. If it have, it will fail. The value will not modify. Can anyone told me how to modify attribute by rlm_exec module? Regards, Roger

1 0

Configuring free radius to use Active directory service
by sumi thra 26 Jan '06

26 Jan '06

Hi All, I have some doubts.. 1. How to configure the freeradius1.0.5 version, to support Active directory service for user authentication. For ldap .. we have rlm_ldap module to configure it. Same kind of configuration is there for ADS also ?? 2. Assigning vlan id's to user group is possible ?? rather than configuring each user with a particular vlan id, can we give the vlan id's for the group so that the users part of that group will be assigned with the same vlan. Awaiting for your earliest reply. Thanks, Sumithra. -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

1 0

AD ldap bind works with 1.01, fails with 1.04
by Stephen Walsh 26 Jan '06

26 Jan '06

Hi Folks We're implementing freeradius with EAP/TLS for our wireless and have found a strange happening with 1.04. This will only happen when attempting to query our student domain (w2k3 AD tree), but not our staff (w2k3 AD tree). If I remove the section (below) for student, it will authenticate staff and log them on happily. At the moment, we have acu.edu.au | / \ staff student I have a test box with FC3/FreeRadius 1.01 which will search through both domains and authenticate the user. I copy the config over to the FC4/FreeRadius 1.04 box and it works on staff, but returns the following on student (the tree is laid out the same as staff); ldap_search() failed: Operations error Is this a bug (known or unknown) or have I just not allowed something like referrals to work. I don't want to have to put openldap on the radius box if I can help it, but if that's the only solution then we'll reassess 1.01 on FC3 Config is as below (some sanitisation done to protect the innocent networks involved). ldap student { server = "192.148.xxx.xxx" identity = "cn=xxxxxxxxx,cn=users,dc=student,dc=acu,dc=edu,dc=au" password = "xxxxxxxxx" basedn = "dc=student,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } ldap staff { server = "192.148.xxx.xxx" identity = "cn=xxxxxx,cn=users,dc=staff,dc=acu,dc=edu,dc=au" password = "xxxxxx" basedn = "dc=staff,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } <snip> authorize { suffix eap staff student } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { student staff } eap } many thanks Stephen Walsh Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

2 5