July 2006 - Freeradius-Users - lists.freeradius.org

removing domain data from user name
by Yedidia Klein 13 Jul '06

13 Jul '06

Hello list, I'm using freeradius server as a radius server that forward the auth to an LDAP server, on a RH enterprise system (freeradius-1.0.1-1.1.RHEL3) I want one of my service providers to authenticate against this radius, After enabling some debug option I found that it sends me the users in the form of user(a)domain.tld, that (of course) my ldap don't know and refuse to auth. Is there a way on freeradius to pass to the ldap server only the left site of the @ sign ? I tried to use "with_ntdomain_hack = yes" in my ldap section on radiusd.conf w/o success. thanks, --Yedidia

3 3

Freerad & routing problem
by Moustapha Ould Maouloud 13 Jul '06

13 Jul '06

Hello, I have in my LAN a Colubris Access Conroller (IP: 192.168.10.81, gw: 192.168.10.1/80.B.C.D) which I authenticate on a freeradius via Internet (IP of freerad server : 63.E.F.G). My server receives : rad_recv: Access-Request packet from host 80.B.C.D:10901, id=64, length=251 Acct-Session-Id = "7592eefb" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "noven-ac1" Calling-Station-Id = "00-03-52-01-FC-33" Called-Station-Id = "00-03-52-01-FC-33" Framed-IP-Address = 192.168.1.1 User-Password = "novenac1" NAS-Identifier = "noven.Vincennes.0" NAS-IP-Address = 192.168.10.81 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Administrative-User WISPr-Location-Name = "noven.Noven-WiFi" WISPr-Location-ID = "noven2/Noven-WiFi" Message-Authenticator = 0xa4619c3e1b4b1f7f5a877de95f208ab0 Processing the authorize section of radiusd.conf ..... and returns : Sending Access-Accept of id 64 to 80.B.C.D:10901 Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 Colubris-AVPair += "transport-page=https://192.168.10.82/Noven/transport.html" Colubris-AVPair += "session-page=https://192.168.10.82/Noven/session.html" ........ My problem is that the response from the radius server does not reach my AC (IP 192.168.10.81) although the answer was indeed turned over to my router (IP : 80.B.C.D) !!! Someone can help me ? Please Thanks; --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

1 0

Segfault when loading a module in rlm_perl?
by Nikola Pavkovic 13 Jul '06

13 Jul '06

Hello all, I'm expiriencing strange behaviour when starting freeradius using rlm_perl. When I include any module (for example DBI) inside my custom AAA script, i get a segfault. (Debian sarge, freeradius 1.1.2). Any hints are very welcome. Thanks a lot. Sincerely, Nikola Pavkovic

2 2

Re:- Authenticating user with FDS
by Hariharan R 13 Jul '06

13 Jul '06

Yes, that method is working fine. Thank you very much for your help. Hariharan R wrote: > Hi all, > > I am using FreeRADIUS1.1.1 with Fedora Directory server as a backend > data store. > > Let us consider the scenario.. > > I have two servers, one is a mail server and another one is a proxy > server. Both servers are configured to use RADIUS+FDS for user > authentication. In FDS i have two organizational unit under root domain. > > For Ex; > ou=mailusers,dc=example,dc=com > ou=proxyusers,dc=example,dc=com > > In the 'raddb/radiusd.conf' file i specified the base domain as > (In LDAP module) > > basedn = "dc=example,dc=com" > > So whenever a client request comes to the RADIUS server it will look > for the username in FDS. > > The problem is, how the RADIUS will identify that whether the request > is comes from the 'mail server' or from the 'proxy server'. Because for > mailserver users i have to look in the "ou=mailusers,dc=example,dc=com" > and for proxy users i have to look in the > "ou=proxyusers,dc=example,dc=com". Try this: /etc/raddb/huntgroups: mail NAS-IP-Address == the.mail.server.ip proxy NAS-IP-Address == the.proxy.server.ip /etc/radiusd.conf: modules { ldap { basedn = "ou=%{Huntgroup-Name},dc=example,dc=com" } } > > How i can change the LDAP basedn according to the request. Use any string expansion you like, as above. --- Regards, Hariharan.R

1 0

DHCP configuration on Free Radius
by Elie Hani 13 Jul '06

13 Jul '06

Hi; I've installed the Free Radius on FC4 OS, I need to know if it's possible to configure DHCP on this server. I want that the dial up users take an IP from a pool, dynamically configured on the Radius server itself. If it's possible, can you tell me the steps, otherwise, can you provide me with a solution? Thanks Elie

2 1

How to use Cisco VoIP specific bulk accounting
by Alberto Cruz 13 Jul '06

13 Jul '06

Hi could anybody give me a tip or clue where could I find information about the requirements to enable the "Cisco VoIP specific bulk accounting" (pgsql-voip)? Does it works with MySQL? Regards Alberto Cruz

1 0

error unknown host, but it is configured in clients.conf
by Greg Hartung 12 Jul '06

12 Jul '06

Hi, new guy here... I can't get a Juniper NAS to authenticate to FreeRadius. The first thing I tried was a radtest of the local host (against /etc/passwd), which worked: root@host:/home $ radtest username password 127.0.0.1:1812 1812 testing123 Sending Access-Request of id 122 to 127.0.0.1 port 1812 User-Name = "username" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=122, length=20 And then I tried munging the password to make sure it got rejected, which it did. root@host:/home $ radtest username wrong-password 127.0.0.1:1812 1812 testing123 Sending Access-Request of id 126 to 127.0.0.1 port 1812 User-Name = "username" User-Password = "wrong-password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=126, length=20 So then I tried it from the NAS and I get [root@aaa1 radius]# more radius.log Mon Jul 10 16:22:15 2006 : Info: Using deprecated naslist file. Support for thi s will go away soon. Mon Jul 10 16:22:15 2006 : Info: rlm_exec: Wait=yes but no output defined. Did y ou mean output=none? Mon Jul 10 16:22:15 2006 : Info: Ready to process requests. Tue Jul 11 09:25:29 2006 : Info: Reloading configuration files. Tue Jul 11 09:25:29 2006 : Info: Using deprecated naslist file. Support for thi s will go away soon. Tue Jul 11 09:25:29 2006 : Info: rlm_exec: Wait=yes but no output defined. Did y ou mean output=none? Tue Jul 11 09:25:29 2006 : Info: Ready to process requests. Wed Jul 12 15:29:05 2006 : Error: Ignoring request from unknown client 10.1.10.1 :12000 And [root@aaa1 raddb]# /usr/local/sbin/radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.1.10.1:12004, id=183, length=69 Ignoring request from unknown client 10.1.10.1:12004 rad_recv: Access-Request packet from host 10.1.10.1:12004, id=184, length=69 Ignoring request from unknown client 10.1.10.1:12004 Clients.conf has the following appended to the included file: client 10.1.10.1 { secret = password shortname = aaa } And I've tried both stop/start and kill 1 'cat the pid file' So... what am I doing wrong? Thanks! Greg

2 1

EAP-TTLS/PAP -> LDAP for WPA2
by John Allman 12 Jul '06

12 Jul '06

Hi All, Quite new to radius and struggling to get my head around things so forgive me if my assumptions are wrong. I appear to have the setup working but i'm concerned it's not doing what it think it is. I don't think the authentication requests are actually going over an encrypted channel. I'm using freeradius-1.1.2 on a freebsd server and i've compiled it against openldap-2.3.24 which all went well. I'm attempting to set up secure wireless with WPA2 using our ldap directory for authentication. We have a replica of our directory running on the freeradius server. Originally i had hoped to use some sort of web-redirect-to-an-authentication-page system like you sometimes see in hotels but i can't find anything about that (any information welcome). After reading around, the best form of authentication i can see would be eap-ttls with pap as the inner protocol. I believe (from comments in the radiusd.conf file) that i wouldn't be able to use md5 with ldap. Now, i've set it up in a way that appears to be mostly right and i *can* authenticate with my username/password in ldap but doing a tcpdump on the radius server worries me. I can see my username passed in the clear in the packets so i'm concerned it's not using tls at all. I told the wireless client to use ttls so i can't understand what's going on. The following is a summary of the main changes i made from the radiusd.conf and eap.conf files. If i dont mention an attribute it's because i didn't change it from the default setting: radiusd.conf: modules { ldap { server = "localhost" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap } } authorize { eap ldap } authenticate { Auth-Type PAP { pap } eap Auth-Type LDAP { ldap } } eap.conf: eap { default_eap_type = ttls tls { private_key_file = ${raddbdir}/certs/radius_key.pem certificate_file = ${raddbdir}/certs/radius_cert.pem CA_file = ${raddbdir}/certs/cacert.pem random_file = ${raddbdir}/certs/random } ttls { default_eap_type = md5 } } Now i know that default_eap_type setting looks wrong but i don't know what i *should* have there. On the server in /var/log/radiusd.log i see the following: Wed Jul 5 16:10:32 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jul 5 16:10:32 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Jul 5 16:10:32 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) I based my certificate generation on the instructions at: http://homepage.mac.com/andreaswolf/public/wpaeap.html including using the xpextensions mentioned there. I generated my random file using dd and /dev/urandom. I am a little lost and don't know what is best practice. Any advice would be appreciated. I've tried googling but haven't found a good guide that matches our setup.I can, of course, give more information if needed. Thanks, John Allman

4 12

freeradius with mac address authentication
by Carlos Rosero 12 Jul '06

12 Jul '06

Hi, I am new in this, I am looking for a tutorial that let me know how to configure freeradius with mac address authentication. Thanks, Carlos Rosero S. www.uaa.edu 787-834-9595 x2203 <mailto:crosero@uaa.edu> crosero(a)uaa.edu -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 3

Freeradius-1.1.1 with CRL configuration
by sumi thra 12 Jul '06

12 Jul '06

Hi All, I want to configure the CRL in freeradius-1.1.1 version. Followed the procedures given in the config file, but the result is not as expected. The configuration in eap.conf are, 1) Copy CA certificates and CRLs to same directory. I appended the crl into CA file 2) Execute 'c_rehash <CA certs&CRLs Directory>'. Is it necessary? But i did this too 3) Add 'CA_path=<CA certs&CRLs directory>' 4) enable the crl check check_crl = yes 5) Restart radiusd CRL says that the client certificate is revoked. But, the user is still able to get authenticated by the radius server. Please let me know if i am missing any configuration. Thanks for your kind help in advance.

2 1