March 2006 - Freeradius-Users - lists.freeradius.org

Multiple NAS-Identifier
by DESETech - German P. Santillan 20 Mar '06

20 Mar '06

How I can configure multiples "NAS-Identifier" attributes in my "users" file? Thanks in advance Germán P. Santillán Administrador de Redes Responsable Dpto. Técnico DESETech Argentina S.A. San Martín 133 - CP: B8000FIC Bahía Blanca - Argentina Tel/Fax: +54 (291) 456-5642 gsantillan(a)desetech.com.ar http://www.desetech.com.ar

2 1

General question about authentication/authorization
by Florian Prester 20 Mar '06

20 Mar '06

Hi, 1.) in the users-file, I can only check for attributes provided by the request - correct? 2.) in the users-file, if an entry matches all check-attributes, I can specify an Auth/Autz-Type - correct? 3.) in the users-file, if I do not specify the Auth/Autz-Type the radius is taken the requested Type automatically - correct? 4.) Authentication is comparing a password - correct? 5.) Authorization is even if a password is correct, the user may not use/do something - correct? 6.) Authorization is done by providing appropriate reply-attributes - correct? Now the big question: If I have an user who is authenticate, meaning correct username + password whereas the password is stored in LDAP. I want to replay attributes according th some other information stored in LDAP - how can I do such a thing, like: IF ldap-attribute::xy == valid_1 THEN RETURN ldap-attribute::IP-good, ELSIF dap-attribute::xy == valid_2 THEN RETURN ldap-attribute::IP-better, ELSE RETURN ldap-attribute::IP-bad Thanks Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

5 18

Authentication Question
by fvt3 20 Mar '06

20 Mar '06

Hi, I'm pretty new to freeradius and need some help. In Freeradius, when a request is made can you used the supplied userid and password to authenticate off from LDAP and if the user does not exist in LDAP can force it to authenticate off from the local database? If this is possible, can you direct me to some links that can further assist me. Thanks in advance ... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_eap: identity does not match User-Name, setting from EAP identity
by Agent Smith 20 Mar '06

20 Mar '06

Hello group, I have FR configured for EAP/TLS for wireless but I ran into an interesting problem. When a user connectes, they are presented with a login box (username, password and domain name) if they put a domain name in the domain field, radius can't authenticate them and gives that error message. when the domain field is left empty, it works fine. I read some posting that talked about how you have to turn off ntdomain_hack off and I tried that, it didn't gave me that error but then the ntlm_auth failed saying 'NO SUCH USER' so my guess is that the user-name has to be exactly same as what gets sent into EAP message. has anyone else ran into this? any ideas on how to fix it? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 11

IP address with EAP authentication
by JVUVANT Yahoo 20 Mar '06

20 Mar '06

Hi all I'm using Freeradius to authenticate wifi customer with EAP and DHCP and it work well. But on accounting log, the is No IP address used by the customer. How can configure have also IP address on accounting log ? Thanks for any help. Jacques

2 1

Need help in setting up RADIUS for Server based AAA
by Venu Gopal 20 Mar '06

20 Mar '06

Hi All, I am new to this free -radius usage, wanna setup radius on my company network for authentication and defining privilege level access on the network. I have gone through several mailing lists,docs on free radius site, whenever i issue authorization commands on the router i will be locked out on my NAS. I am using users file where i want simple authentication for few users and privilege level access. Error condition.... Rmcrad#show ver Command authorization failed. Here is the details . 1. radiusd -x radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. locally tested AAA for authentication authorization and accounting on router it works fine. while authentication works for the defined users in the users file. checked for /etc/passwd /etc/group /etc/users in radiusd.conf i am able to login to the nas it authenticates the users n password . Users definition "Arul" Auth-Type := Local, User-Password == "cisco" Reply-Message = "Hello, %u", cisco-avpair ="shell:priv-lvl=15" "vdhar" Auth-Type :=system Reply-Message = "Hello, %u", cisco-avpair ="shell:priv-lvl=1" "test" Auth-Type := Local, User-Password == "test123" Reply-Message = "Hello, %u", cisco-avpair ="shell:priv-lvl=15" Router Configuration aaa new-model aaa authentication login default group radius local aaa authentication login NO_AUTHEN none If i issue any authorization command aaa authorization exec local or aaa authorization exec default radius aaa authorization exec default group radius if-authenticated radius-server host 172.16.85.135 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server key secret line con 0 exec-timeout 0 0 login authentication NO_AUTHEN transport input none line vty 0 4 exec-timeout 0 0 password cisco I will be locked out of the router and cannot perform any task. If any one helps me to figure out whtz the problem with authorization and any simple configuration which works out for the server based authentication would be highly appreciated. If need any more information from my side please let me know, which help you to figure out my problem. Please let me know if anybody helps me out on live chat on msn/yahoo Debug logs... 00:56:59: AAA: name=tty68 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=68 channel=0 00:56:59: AAA/MEMORY: create_user (0x81934100) user='' ruser='' port='tty68' rem_addr='172.16.85.100 ' authen_type=ASCII service=LOGIN priv=1 00:56:59: AAA/AUTHEN/START (169650279): port='tty68' list='' action=LOGIN service=LOGIN 00:56:59: AAA/AUTHEN/START (169650279): using "default" list 00:56:59: AAA/AUTHEN/START (169650279): Method=radius (radius) 00:56:59: AAA/AUTHEN (169650279): status = GETUSER 00:57:07: AAA/AUTHEN/CONT (169650279): continue_login (user='(undef)') 00:57:07: AAA/AUTHEN (169650279): status = GETUSER 00:57:07: AAA/AUTHEN (169650279): Method=radius (radius) 00:57:07: AAA/AUTHEN (169650279): status = GETPASS 00:57:09: AAA/AUTHEN/CONT (169650279): continue_login (user='cisco') 00:57:09: AAA/AUTHEN (169650279): status = GETPASS 00:57:09: AAA/AUTHEN (169650279): Method=radius (radius) 00:57:29: AAA/AUTHEN (169650279): status = ERROR 00:57:29: AAA/AUTHEN/START (151081203): port='tty68' list='' action=LOGIN service=LOGIN 00:57:29: AAA/AUTHEN/START (151081203): Restart 00:57:29: AAA/AUTHEN/START (151081203): Method=LOCAL 00:57:29: AAA/AUTHEN (151081203): status = GETPASS 00:57:29: AAA/AUTHEN/CONT (151081203): continue_login (user='cisco') 00:57:29: AAA/AUTHEN (151081203): status = GETPASS 00:57:29: AAA/AUTHEN/CONT (151081203): Method=LOCAL 00:57:29: AAA/AUTHEN (151081203): status = PASS 00:57:33: AAA/MEMORY: dup_user (0x81B00350) user='cisco' ruser='' port='tty68' rem_addr='172.16.85.1 00' authen_type=ASCII service=ENABLE priv=15 source='AAA dup enable' 00:57:33: AAA/AUTHEN/START (3234623993): port='tty68' list='' action=LOGIN service=ENABLE 00:57:33: AAA/AUTHEN/START (3234623993): non-console enable - default to enable password 00:57:33: AAA/AUTHEN/START (3234623993): Method=ENABLE 00:57:33: AAA/AUTHEN (3234623993): status = GETPASS 00:57:35: AAA/AUTHEN/CONT (3234623993): continue_login (user='(undef)') 00:57:35: AAA/AUTHEN (3234623993): status = GETPASS 00:57:35: AAA/AUTHEN/CONT (3234623993): Method=ENABLE 00:57:35: AAA/AUTHEN (3234623993): status = PASS 00:57:35: AAA/MEMORY: free_user (0x81B00350) user='' ruser='' port='tty68' rem_addr='172.16.85.100' authen_type=ASCII service=ENABLE priv=15 Regards Venugopal __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Optimizing freeradius for very high loads
by Ashwin Gobind 20 Mar '06

20 Mar '06

Good day. I have freeradius running on a Dual P4 server with 4GB Ram. I am using freeradius to service clients. I require performance of 200tps. I am having a problem where many clients do not get responses for authentication messages. Monitoring my cpu and memory load during busy periods, my cpu max utilization is only 10% used, 90%idle. There is also enough memory. How can I optimize freeradius to increase the tps handling capability ? Thanks Ashwin Gobind �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "

2 1

Re: Detail files
by nsinit 19 Mar '06

19 Mar '06

Peter Nixon£º ======= 2006-03-18 19:07:46 ======= >On Fri 17 Mar 2006 20:57, Lisa Casey wrote: >> Hi, >> >> Currently my Freeradius server writes new accounting detail files each day. >> In radiusd.conf if I were to change >> >> detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d >> >> to >> >> detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m >> >> Would it then write one detail file for each month? > >Yes > I have viewed the source code of rlm_detail, i really didn't found that which code is working on rotating the detail files... thanks = = = = = = = = = = = = = = = = = = = = ¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ nsinit ¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ 2006-03-20

1 0

perl scripts
by debik 19 Mar '06

19 Mar '06

Could somebody share with some scripts that authorize users in radius. Im trying to write my own script, but i don't find any docs. Could somebody help me.

5 13

Enterprise WPA
by Shahid Khan 19 Mar '06

19 Mar '06

Hi: I am planning to use FreeRadius to facilitate WLAN security and was looking for validation of the design which tries to leverage the current remote access security infrastructure - Crypto-CARD. Crypto-SERVER doesn't have EAP support at this time so I was thinking of doing something along the lines of .... EAP-TTLS/PAP PAP Wireless Client -----------------------> Wireless AP ------------------> FreeRadius -------------------------------> CryptoCard SERVER 802.1X Proxy Username/Passcode Username/Passcode Is this a viable option ? Thanks.

2 2