May 2006 - Freeradius-Users - lists.freeradius.org

Regarding on Freeradius in openser.
by raviprakash sunkara 08 May '06

08 May '06

Hello Everybody, I'm new to openser and also to freeradius. 1)how to insert the users in freeradius server 2) When I test with radiusd - X its show somes errors . The errors are mention below /usr/local/etc/raddb/users[64]: Unexpected trailing comma in check item list for entry test Errors reading /usr/local/etc/raddb/users radiusd.conf[1047]: files: Module instantiation failed. radiusd.conf[1791] Unknown module "files". radiusd.conf[1727] Failed to parse authorize section. 3) And also when tested the clients , by using "radclient -f digest localhost auth <shared_secret>" . It shows the following error radclient : no respones from server ID 134 4) And also when I tried with " radtest test test 192.168.2.55 5060 hyperion" its shows me below one Sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" radclient: no response from server for ID 233 5) when i also tried with "ps -aux | grep radiusd " it show a warning and errors Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.3 /FAQ root 13093 0.0 0.1 4276 696 pts/4 S+ 16:41 0:00 grep radiusd Please help me in 5 issues which are mention above. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

RE: win2003 Active Directory authentication
by Chris Liles 08 May '06

08 May '06

Yes you can do use the ldap module of freeradius to hit your AD, I am doing this now. Yes you can do ssl/tls for encryption between the radius server and AD. Windows server 2000 does not support tls, only ssl. It is similar to setting up mm_mod_auth_ldap for apache. You will need an ldap browser to browse your domain to find out the correct search filters for everything. The only thing I can't figure out is how to check for group membership. I posted to the mailing list, but no one has responded yet :-( There is good documentation on the wiki. Look for my previous post about not getting groups working to see my config files. -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 Tel: (404) 942-5334 Fax: (404) 815-7708 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Frank Smith Sent: Monday, May 08, 2006 11:55 AM To: freeradius-users(a)lists.freeradius.org Subject: win2003 Active Directory authentication I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain. I can authenticate using ldap, no? Also, is this insecure due to clear text? Any other ideas for what I want here? Thanks!

1 0

cisco ap350(WLAN) vs freeradius with PEAP
by Gabor Szelei 08 May '06

08 May '06

Hi, Ive been trying to get $subject working. My last state is the client has been authenticated, but no traffinc is going through. Does anyone have a working config for Cisco350 with PEAP? What kindof reply is CISCO expecting from radius? br, Gabor Szelei

2 1

Re: PLS Help I get no response for 2 monthe (missing
by Assa Tal 08 May '06

08 May '06

Hi Stepan 10x for your prompt respond I Used radrelay and it works fine the point is that I would like to do it without additional proccess Like u said with the hint file where can I get this patch for the hint file ? And how do I tell him not to look for User-Name 10x in adv Tal assa To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. PLS Help I get no response for 2 monthe (missing User-name attribute) (Assa Tal) 2. Re: PLS Help I get no response for 2 monthe (missing User-nameattribute) (Stefan Winter) 3. cisco ap350(WLAN) vs freeradius with PEAP (Gabor Szelei) 4. Re: Special characters in users file (sumi thra) 5. Re: FreeRadius + MySQL & Encrypted passwords (Miguel Angel Quiles) ---------------------------------------------------------------------- Message: 1 Date: Mon, 8 May 2006 09:50:45 +0300 From: "Assa Tal" <Tal.Assa(a)comverse.com> Subject: PLS Help I get no response for 2 monthe (missing User-name attribute) To: <freeradius-users(a)lists.freeradius.org> Message-ID: <FE225DCF1021F34FB2269676A45BB8814434AF(a)il-tlv-mail01.comverse.com> Content-Type: text/plain; charset="us-ascii" Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

problems with hints file
by wekz 08 May '06

08 May '06

Hi all, I use freeradius1.1.1 + ldap. And peap or eap-tls for authorization. I've been trying to use hints.file for changing the User-Name. When a laptop user which is in a domain tries to do a peap authentication, windows sends a User-Name that follows this pattern (at least the ones I've seen): DOMAIN\5c\5cLOGIN I'm trying to catch up the LOGIN name so the radius can perform a search in ldap. I've modify hints.file including this line: DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "%{2}" The problem is that this rule matches but it changes the User-Name for an empty string. If I put a string instead of %{2} it does change it right. DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "JOHNDOE" I don't know if that is a bug or if there's something I'm doing wrong and didn't realize. ¿? Thanks.

2 2

PLS Help I get no response for 2 monthe (missing User-name attribute)
by Assa Tal 08 May '06

08 May '06

Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

ldap group checking against active directory
by Chris Liles 07 May '06

07 May '06

Hello mailing list! I have tried to search the archive and the web for the answer to my question but I am unable to find the answer..... I'm sure someone here has run into this before. I am attempting to setup the good old freeradius + active directory + access point to get peap going scenario. I have freeradius setup fine to use ldap to auth the user, and it works. I am attempting to setup finer access control (well really simple) to check if the user is a member of a group before allowing access. Here are some configs: radiusd.conf ldap { server = "domaincontroller.my.domain.com" identity = "adreader" password = "test1234" basedn = "cn=users,dc=my,dc=domain,dc=com" filter = "(sAMAccountName=%u)" port = 636 start_tls = no tls_mode = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" timeout = 4 timelimit = 3 net_timeout = 1 } In my users file all I have is: DEFAULT Ldap-Group == "badgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have access" When I use NTRadPing to test with a user that is in "badgroup" I still get an Access-Accept back. I can do an ldap search using the groupmembership_filter and I get back all the groups my test user is in so I know that isn't the problem. Of course when I do my search I replace the %{Ldap-UserDn} with the actual "cn=username,<what I have for basedn>" Also I have the groupmembership_attribute defined because from what I gather from the docs, it is used if the groupmembership filter fails. Anywho, when I send an auth request while watching the debug output I don't see anything about checking for group/groupmembership/etc. If I change my filter "filter = "(sAMAccountName=%u)" to also check for the group name, everything will work, but of course I would like to use the users file. I've got TLS set to no and port set to 636 because I am using a crap-tacular windows 2000 domain, which doesn't support TLS :-( I think I am missing something or something isn't quite right. Anyone have any ideas, or has anyone gotten ldap group checking to work against active directory?? Thanks -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309

1 0

db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

cannot find db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

freeradius and IDLE time or sth like that
by Przemysław Backiel 06 May '06

06 May '06

hello, I want to kick of user when he is in idle for some time. I am using FreeRADIUS 1.1 and accounting in SQL how can I do that? I suppose that I will have to add something in radcheck or radreply table. So, what I have to add? -- Z powazaniem Przemyslaw Backiel

1 0