August 2006 - Freeradius-Users - lists.freeradius.org

Autoreply: Setting up Radius
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

RE: AW: EAP identity - username check
by Carl Wahlin 09 Aug '06

09 Aug '06

This is not really an option since a user could possibly change the User-Name attribute to another user before sending to the Radius. The user could then make himself have the radius assign him the other users attributes (ie get onto that users network) since the user will be in the database, and the cert will be valid.I will give Alan DeKoks solution a try tomorrow. I can see how this would work, although I'm not sure about how it will interpret the / since MS uses \ for domain names!>> sql_user_name = %{mschap:User-Name:-%{User-Name}}/Carl From: Kraemer.Armin(a)web.deTo: freeradius-users(a)lists.freeradius.orgDate: Wed, 9 Aug 2006 17:43:29 +0200Subject: AW: EAP identity - username check I had the same problem here and my only solution was to turn off this check of the username. of the username. Ou only have to comment out the check_cert_cn Entry at the eap.conf to deaktivate this. Butt his turn of the check completely also for user certificates. I changed the username from „host/username“ to „username$“ which is mostly needed using the mschap Modul aktivating „with_ntdomain_hack“ and adding „mschap: “ to the needed authentication part like ldap section or mysql section like (mschap:User-Name) Maybe there is an other solution to fix that problem without deaktivate this feature? Armin Von: freeradius-users-bounces+kraemer.armin=web.de(a)lists.freeradius.org [mailto:freeradius-users-bounces+kraemer.armin=web.de@lists.freeradius.org] Im Auftrag von Carl Wahlin Gesendet: Mittwoch, 9. August 2006 17:09 An: freeradius-users(a)lists.freeradius.org Betreff: EAP identity - username check Hello, We are trying to get machine certificates to with freeradius for WLAN. Problem: We are using the sql user database plugin as we need to return attributes (which vlan the user belongs to, QoS etc) and it all works fine untill we install the certificates as machine certs. Windows changes the User-Name to host/username and that causes the username not to be correct according to what is in the database, and also the User-Name does not match the cn in the cert. We can change the attribute with search and replace, but then EAP gives us the error "identity does not match the User-Name, setting from EAP Identity". Is there a way around this? It would be nice to be able to turn off the EAP identity - User-Name check as we really do not think it is necesary in our solution (and do not really see a security benifit of having it). Any ideas? /Carl With MSN Spaces email straight to your blog. Upload jokes, photos and more. It's free! It's free! _________________________________________________________________ Try Live.com: where your online world comes together - with news, sports, weather, and much more. http://www.live.com/getstarted

1 0

Autoreply: Re: user auth against mysql
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

user auth against mysql
by richard lucassen 09 Aug '06

09 Aug '06

Hello list, I have 1 freeradius server doing 'authentication only' to different types of backends: user@realm1 -> freerad -> MS-AD1 user@realm2 -> freerad -> OpenLDAP user@realm3 -> freerad -> other_radius user@realm4 -> freerad -> MS-AD2 Now I want to add: user@realm5 -> freerad -> MySQL I do NOT administrate this MySQL database and I have just 'databasename + username field + password field' and I just have access to this db to authenticate. Nothing more than that. As I never played with the combination Freeradius/MySQL, I set up a test server according to this documentation: http://www.frontios.com/freeradius.html I set up a db with the db_mysql.sql file that comes with freeradius and this server works perfectly well. Two questions: 1) the sql.conf file is filled up with things I do not need, because the MySQL db has no structure that corresponds to the sql.conf file. Can I simply uncomment all lines I do not need? 2) in the accounting and authorize part of radiusd.conf there is an entry "sql", but not in "authenticate" as where I'd expect such an entry. Why is that? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+

3 4

Autoreply: acct_users Exec-Program causing defuct programs
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

Autoreply: Many simmultaneos connection with Mysql - VOIP
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

Autoreply: Re: EAP identity - username check
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

Autoreply: Re: Unresponsive child
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

EAP identity - username check
by Carl Wahlin 09 Aug '06

09 Aug '06

Hello,We are trying to get machine certificates to with freeradius for WLAN.Problem:We are using the sql user database plugin as we need to return attributes (which vlan the user belongs to, QoS etc) and it all works fine untill we install the certificates as machine certs. Windows changes the User-Name to host/username and that causes the username not to be correct according to what is in the database, and also the User-Name does not match the cn in the cert. We can change the attribute with search and replace, but then EAP gives us the error "identity does not match the User-Name, setting from EAP Identity". Is there a way around this? It would be nice to be able to turn off the EAP identity - User-Name check as we really do not think it is necesary in our solution (and do not really see a security benifit of having it).Any ideas?/Carl _________________________________________________________________ Try Live.com - your fast, personalized homepage with all the things you care about in one place. http://www.live.com/getstarted

3 2

several values check
by Ruslan N. Marchenko 09 Aug '06

09 Aug '06

Hi all. Maybe its a dummy question, but i wonder, if i can supply several values to check for Access-Request? I mean following: i create a user, add Framed-IP-Address to radcheck for this user (i realy mean this user should have fixed address) and then i include this user to two groups. Each group has Service-Type attribute in radgroupcheck table, one group has value == Call-Check, while other ==Login-User. Requests with Service-Type = Login-User passes authorize section(it has lower id so compares first), but Call-Check fails with "module "sql" returns notfound for request" Is this correct behaviour and i should not use such approach? Or i can make freeradius to do that? One more question is - how to use nas table for clients? i use postgresql as a backend. -- Olimp, System Administrator IT Dept. 8 062 381-34-28 ---- Looking forward to reading yours. MRN-RIPE RUFF-EUNIC RUFF-6BONE Ruslan N. Marchenko

1 0