November 2006 - Freeradius-Users - lists.freeradius.org

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

Yes, I have just done it. You need to change the sql-statement in /etc/raddb/sql.conf That is the autorize_check_query.Depending on how you use your tables, the query that I am using may or may not work. If you want I can give you the one that works for me if you supply your table-layout. JOhn P.S> The statement I use does NOT check username/password !!! -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of banga Sent: 08 November 2006 11:37 To: freeradius-users(a)lists.freeradius.org Subject: Assign IP based on CallingStationID. Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 235317 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

how to NOT expand varaibles in a sql-query
by info＠w3welt.de 08 Nov '06

08 Nov '06

Hello, i need to pass the string '%d %b %Y %T' inside a query to mysql (as a date format). Unfortunately this gets expanded to '07 0 2006 2006-11-07-00.06.18.000000' which leads to an sql error and crashes freeradius with a segmentation fault. I found a post from Nicolas Baradakis who advises to double the percentage-signs. I tried this too, but this creates a string like this '%0d %0b %0Y %0T' which again leads to a sql error (but without crash) How can i pass this string literaly without any variable-substitution? I'm running "FreeRADIUS Version 1.0.0" Thanks in advance for your help... Yours Olaf Kolling -- ******************************************************************** W³Welt Web-Entwicklung -------------------------------------------------------------------- Olaf Kolling eMail: info#w3welt.de Mörikestraße 67 Tel.: +49 711 96666-200 70199 Stuttgart Fax: +49 711 96666-201 ********************************************************************

1 0

Windows-Domain login without local users
by Michael Messner 08 Nov '06

08 Nov '06

hey freeRADIUS users, PEAP auth. works now with *X and MS-clients, the backend is a freeradius server on centOS with active directory connection. Now, the user needs a local account to login to the clientmachine and then he is able to start the PEAP authentication process. A local login for every user is a big overhead! What is the normal way to handle this? thanks ca mIke

2 3

Assign IP based on CallingStationID.
by banga 08 Nov '06

08 Nov '06

Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

(no subject)
by Mike May 07 Nov '06

07 Nov '06

"Mike May" <mmay3(a)nd.edu> wrote: > Hello everyone, is it possible to have NAS entries for a subnet, if so > could someone give me an example raddb/clients.conf Alan DeKok. -- http://deployingradius.com <http://deployingradius.com/> - The web site of the book http://deployingradius.com/blog/ - The blog Thanks for example Alan, I thought it may be helpful for me to provide you some more information, I am not a Radius expert but have managed to keep a somewhat large client base using radius. I currently use the clients file to allow connections, but not to do any real authorization. Example of my clients file is below, this is only a small section as my radius servers handles modem pool, vpn, wireless, 802.1x etc and soon wired 802.1x. I use LDAP/ Kerberos as the authn backend I use huntgroup entries to point to matches in my users file see examples below. in the users file is where I am using ldaps.conf to connect to the directory servers, verifying what group the user is in and at the end authn to Kerberos store. After the authn I set some authz like Cisco-AVPair = "priv-lvl=15" used by Cisco routers and switches for network engineers who live in the proper LDAP group, here is where the problem is. PIX firewalls do not like me setting the priv lvl, and the reason is that the PIX will only accept authz from a tacacs server(it seems like). What I need to do is specify a "netauth" == NAS-IP-ADDRESS 192.168.20.0/23 subnet. Instead of "netauth" == NAS-IP-ADDRESS 192.168.20.15, this way I can use my users file and not set the Cisco priv lvl for those devices that live on the firewall subnets. Thank you for all your help Mike ========= clients.conf============================= #This are for network engineering devices (outside wireless and dialup) # 2/20/06 client 172.16.255.2/29 { secret shortname = devicenet-15 } client 172.16.240.0/20 { secret = shortname = devicenet-16 } client 172.17.240.0/20 { secret = shortname = devicenet-17 } client 172.18.240.0/20 { secret = shortname = devicenet-18 } client 172.19.240.0/20 { secret = shortname = devicenet-19 } client 172.20.240.0/20 { secret = shortname = devicenet-20 } client 172.21.240.0/20 { secret = shortname = devicenet-21 } client 172.22.240.0/20 { secret = shortname = devicenet-22 Huntgroups wireless-prime NAS-IP-Address == xxx.xxx.xxx.xxx wireless-backup NAS-IP-Address == xxx.xxx.xxx.xxx spam1 NAS-IP-Address == xxx.xxx.xxx.xxx spam2 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin NAS-IP-Address == xxx.xxx.xxx.xxx dialup8 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin2 NAS-IP-Address == xxx.xxx.xxx.xxx dialup9 NAS-IP-Address == xxx.xxx.xxx.xxx dialup10 NAS-IP-Address == xxx.xxx.xxx.xxx netautz NAS-Port-Type == "Virtual" netautz_fw NAS-IP-Address == xxxx netautz_fw1 NAS-IP-Address == xxxxx =================================================== Users file DEFAULT Huntgroup-Name == "netautz", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Cisco-AVPair = "priv-lvl=15", Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw1", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes # VPN Group Definition note please make additions at the begining of the stanza not the end DEFAULT Huntgroup-Name == "ciscovpnadmin", Hint =="NETENG", Ldap-Group == ndbx2jj5, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn CVPN3000-IPSec-Banner1 = "Welcome to VPN group NETENG!", Class = "OU=neteng;", Fall-Through = No

2 1

password header in ldap definition
by basile 07 Nov '06

07 Nov '06

hi is it possible to have multiple password header definition in an ldap section ( because we have differents encryption in our ldap directory ) thanks basile

2 1

multiline line values for Cisco-AVPair (in ldap.attrmap)
by Peter Param 07 Nov '06

07 Nov '06

hey, I've got Cisco-AVPair for an ldap.attrmap entry and it works ...but unfortunately only for the first occurence of that attribute from the LDAP schema (it will pick the first in the schema). How do I map and return four Cisco-AVPair entries? Is there a particular multiline separator that I should use ...or do I use the attribute re-entrantly? The device in question is a Cisco VPN3000 concentrator and I'm running ver 1.1.1 freeradius. cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Re: Failed to link EAP type EAP/TLS
by Chad Best 07 Nov '06

07 Nov '06

Alan DeKok <aland(a)deployingradius.com> wrote: > The TLS module wasn't built because you don't > have > OpenSSL > installed. (Or you're running debian). Install > OpenSSL, then > re-build and re-install the server. Thanks Alan. You are right, I am running Debian(Ubuntu). I checked and OpenSSL is installed. OpenSSL and Freeradius have both been installed with the Synaptic package manager. Is there anything else I can do? Any help would be greatly appreciated.

4 3

Multiple LDAP (Not failover) lookup...
by Eric Martell 07 Nov '06

07 Nov '06

Hi... I need to do multiple ldap lookups (2).. The purpose of both the ldaps are different so it does not abide with configurable_failover scenario in a way. ldap1. This ldap is solely used for authentication for given user. ldap2. This ldap is solely used for checking ldap attribute ex. productCode for given user. User exists in BOTH The ldaps but in ldap2 we don't store the password hash. So its just userid with given attributes. Here is what should happen for a given user. If(authentication in ldap1 success) { if(productCode attribute exists in ldap2 success) { return Access-Accept. } else { return Access-Reject. } } else { return Access-Reject. } Any inputs will be greatly appreciated. Thanks in advance. ____________________________________________________________________________________ Sponsored Link Try Netflix today! With plans starting at only $5.99 a month what are you waiting for? http://www.netflix.com/Signup?mqso=80010030

1 0

Problems with chained certificates and eap/tls
by s1008610＠mail.inf.tu-dresden.de 07 Nov '06

07 Nov '06

Hello, i have a problem with chained ca certificats and eap/tls. my former setup was with simple selfsigned certificates and everything went perfect, but now i have to change the setup for the certificates to a third party ca, they use a root ca and a signing ca signed by the root ca, this subca signed the server certificate. what i've done: i copied the 2 certificates of the root and signing ca together. the radius starts up fine, all certificates were loaded. but no client can connect the build in windows clients finds no client certificate for the chosen root ca. i've tested also the AEGIS Client, with the result, that he does the handshake, but never receives the accept. to point it out, everything run well, till i changed the certificates, does the radius in any point cannot deal right with this certifiactes? LOG of the radius with the winxp client Mon Nov 6 15:02:21 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:02:21 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:02:21 2006 : Error: --> verify error:num=20:unable to get local issuer certificate Mon Nov 6 15:02:21 2006 : Error: TLS Alert write:fatal:unknown CA Mon Nov 6 15:02:21 2006 : Error: TLS_accept:error in SSLv3 read client certificate B Mon Nov 6 15:02:21 2006 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Mon Nov 6 15:02:21 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. LOG of the radius with the aegis client Mon Nov 6 15:49:24 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:49:24 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:49:27 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:49:27 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:49:27 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:49:27 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:49:27 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:27 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:27 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:31 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:49:31 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:49:31 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:31 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:31 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:34 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Nov 6 15:49:38 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:49:38 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:49:38 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:50:08 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Nov 6 15:50:08 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Nov 6 15:50:08 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) debug of the radius with the aegis client Sending Access-Accept of id 220 to 141.76.5.1 port 20002 User-Name = "**" Session-Timeout = 640 Trapeze-VLAN-Name = "FRZWLAN" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 MS-MPPE-Recv-Key = 0x24db9d7012cfb4ca813bf63823b126e75415d30a13e9154bf24d916c529a68eb MS-MPPE-Send-Key = 0x835531ba6b327ee15cbe969e9d35a1a7ea0d571bc292e254b2f7856641492926 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 and after this message nothing happends, the client does a new request and the radius handles the request as a new one i have no idea where i should continue my search...... :( ciao Stephan

1 0