August 2006 - Freeradius-Users - lists.freeradius.org

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 07 Aug '06

07 Aug '06

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" ### identity = "cn=Directory Manager" ### password = 1223 ### basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes ### } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

sql.conf
by fvt3 07 Aug '06

07 Aug '06

Question, How do you convert the SQL-User-Name sent to upper case? I have my mac address store in upper case but the client is sending its mac address in lower case. I'm trying to edit the sql.conf file but not successful. Username = '%{SQL-User-Name}' Thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 5

a question about settings for EAP-TLS authentication
by Yan Cai 07 Aug '06

07 Aug '06

Hi, All, I am a graduate student in University of Massachusetts Amherst. Now I am trying to set up a wireless environment with FreeRadius to realize secured access with EAP-TLS. I've generated the necessary CA files by openssl and done all necessary settings in FreeRadius. For more detailed operations and settings, please refer to the list below. Operations and Settings on openssl and freeradius, 1, installed openssl-0.9.7-stable-SNAP-20060731, which is downloaded from www.openssl.org. 2, completed the necessary settings in openssl, which is locaed in /usr/local/openssl/ssl. 3, installed freeradius-1.1.0, which is download from www.freeradius.org. 4, modified some settings in CA.all, which is located in /usr/src/802/radius/freeradius-1.1.0/scripts, and run it to generated the CA certificates for server, client as well as root. 5, added a NAS entry in clients.conf. 6, added a user entry in users. 7, started the radius server with the command "./radiusd -X" normally. 8, with default settings in radius.conf, star freeradius successfully, and it can accept the authentication-request from Windows XP client and return the authentication-accept message. This authentication request should belong to EAP-MD5, and the radius server could respond it correctly by default-settings. ---- the operations below are for realization of EAP-TLS ---- 9, copied the newly generated certificates files to the place so that the freeradius could find them. In my case, I moved them to /usr/local/radius/etc/raddb/certs as well as its subfolder /demoCA. 10, added a new user entry in users, which includes only the username attribute because it is said that EAP-TLS would automatically identify its password and other attributes from somewhere. 11, modified the default auth type to 'tls' in eap.conf. 12, uncommented all scripts related to EAP-TLS authentication in eap.conf, including modification of path to the certificate files in /usr/local/radius/etc/raddb/certs as well as ./demoCA. 13, tried to start the radius server with the command "./radiusd -X", but the error message below was returned always. **** log from terminal of linux where freeradius is running **** rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain Segmentation fault **** the end of log **** Now I worried that there is something wrong in the cert-srv.pem. I will appreciate all of you so much if anyone can help me take a look at these certificate files. I attached all of configuration files in the freeradius folder. Please refer to them if needed. Looking forward to your reply. Thanks a lot, Best wishes, Yan

3 3

Stripping User-Names with Regular Expressions
by Richard Cotrina 07 Aug '06

07 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi : I am trying to strip some sort of prefixes out of the usernames using regular expressions in the hints file with no success in some cases. I have two scenarios with prefixes, where usernames can be received in the following form : Case 1. KNOWN_PREFIX/user(a)mydomain.com Case 2. KNOWN_PREFIX/RANDOM_STRING/user(a)mydomain.com In any of those cases, the username must be stripped, and only user(a)mydomain.com must be processed for AAA. I am using the "hints" file with an entry with a regular expression like : DEFAULT User-Name =~ "^(KNOWN_PREFIX/(.*/)?)+(.*(a)mydomain\.com)$" User-Name := "%{3}", Hint = "Stripped User-Name" The problem I'm having is that entry only works in case username comes with a form like case 2, I mean when username comes like "KNOWN_PREFIX/RANDOM_STRING/user(a)mydomain.com", the regexp works very well. But, when usernames comes as shown in Case 1 (KNOWN_PREFIX/user(a)mydomain.com) it gets a match in the hints, but username referred as %{3} gets a void value ( shown in the debug as ' ' ). It seems as if the conditional group "(.*/)?" in the regexp is causing something wrong in the next group reference but I'm not sure. Is this kind of regexp (the conditional one) supported in freeradius ?. Any ideas of what could be wrong ? Thanks in advance for any help. Best Regards Richard Cotrina -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQA/AwUBRNeVmSQekFb/3FIhEQKYrACgvwUuyHg8wbacV3WePMMDOiRDdi8AoNyF JALaPXu58nrqskI/XLV2hp26 =Y3nH -----END PGP SIGNATURE-----

1 0

Need help on PHP and Radius
by raviprakash sunkara 07 Aug '06

07 Aug '06

Hi Guys... I need to integrate php and raadius... Actually i want to create the own user interface on OPENSER..... That on PHP 5 is having the radis integration . So i need it... Now , I'm using the Radius in openser for " AAA " purpose only... Now I need to develop web interface for my application with radius... plz help me.... on this............. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1

Re: Freeradius-Users Digest, Vol 16, Issue 18
by Phil Thompson 07 Aug '06

07 Aug '06

> Subject: > Re: Password Problem > From: "Alan DeKok" <aland(a)deployingradius.com> > Date: Fri, 04 Aug 2006 13:04:15 -0400 > PhilT <phil(a)yarwell.demon.co.uk> wrote: >> 1. In the MySQL database do you have the Attribute set to Password and not >> something else, for example "11 usernamehere PASSWORD == passwordhere" >> 2. In Freeradius users file DEFAULT Auth-Type := Local > > NO. Do NOT SET THAT. It's NOT NECESSARY. > > That point has been repeated again and again on this list. no doubt, however it is interesting that many people come to a point where they make such a setting, don't you find. If you could clarify why that is and fix it you wouldn't have to shout in mailing lists. I have just verified it is not necessary by commenting it out, thanks. I think you're saying at http://deployingradius.com/documents/configuration/auth_type.html that a default auth-type is not necessary and should not be set. Is that so ? In which case having DEFAULT Auth-Type = System in the users file in the FreeRADIUS tarball helps to get us off on the wrong foot :-) Phil

5 5

Question about RADIUS proxy
by Ali Majdzadeh 07 Aug '06

07 Aug '06

Hi I am new to freeRADIUS. I have a question about RADIUS proxies. Is it possible to configure a forwarding RADIUS server to broadcast a request to all remote RADIUS servers? (I mean, without paying attention to athentication realms) Best Regards Ali

2 2

Freeradius on connection / disconnect run commands
by Michael da Silva Pereira 07 Aug '06

07 Aug '06

Hi, I have currently got freeradius setup using a SQL database for authentication and accouting. Is there any way I can get freeradius to run a system command every time a new client connects and disconnects, also bearing in mind to pass information like username and clients ip address as arguments to my program. Thanks Michael

1 0

pam client ->password change packet problem
by 나종현 07 Aug '06

07 Aug '06

1 0

Need radius.log as SQL
by Gregory J. Marsh 06 Aug '06

06 Aug '06

I need to completely replace the radius.log file with SQL. I need this because I'm running multiple servers and I need the logs in a single location that can be watched by one helpdesk staffer. The current post auth logs only handle accept and reject - I need the complete log. For instance, when a shared secret is wrong, I need to know! My C programming skills are very rusty so I hope someone has this already so don't have to do it myself. I'm currently using Version 1.1.2. Greg.

1 0