September 2006 - Freeradius-Users - lists.freeradius.org

group based authentication
by srg krn 23 Sep '06

23 Sep '06

Hello: We want to design an AAA system with the following requisites: COMPONENTS THAT WE HAVE: A) NAS(es) B) freeradius frontend C) authenticators WHAT WE CAN DO IS: 1. The NAS send a radius "access-request" to the radius frontend. In the packet there is a username (in username@group) syntax and a password. 2. The frontend MUST decide the authentication method and the authenticator machine based ONLY in the group (string AFTER the @). 3. The frontend sends user and password (note that NOT user@group) to the authenticator machine (maybe another radius, ldap, mysql, ...). 4. Then authenticator machine answer's to the frontend only with "OK" or "NOT OK". 5. If "OK" from step(4), then the freeradius answer's the NAS with "access granted" and some attributes extracted from the "group" (ip pool, netmask, default gw, ... _AND_ THE GROUP THAT IS AFTER THE @). NOTE THAT: - The unique function of the authenticators is saying "OK" if the username and passwd are correct or "NOT OK" if not. - NO USERS are defined in the radius frontend (only GROUPS with their respective attributes). Is there any "intelligent" way of acomplishing this design with freeradius? Thanks in advance and best regards

2 5

clean stale sessions with radzap?
by YvesDM 23 Sep '06

23 Sep '06

I use FR + mysql I try to clean some stale sessions from NAS's with dynamic ip's. I 'm logged in on the server and use radzap this way: radius1:~# radzap Usage: radzap [options] server[:port] secret So i try: radius1:~# radzap -u john localhost:1812 mysecret But this doesn't seem to be the right way? tnx yves

1 0

RE: Authentication against Active Directory page
by Jonathan De Graeve 23 Sep '06

23 Sep '06

Indeed, in my own tests I had to setup a kerberos realm and recompile the standard debian packages with the extra --with-ads rule. Does somebody know when machine authentication is supported in samba and if there is a patch for the 3.0.14 (debian stable) version? Kind Regards, J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens King, > Michael > Verzonden: zaterdag 23 september 2006 4:47 > Aan: FreeRadius users mailing list > Onderwerp: RE: Authentication against Active Directory page > > Alan, > > What domain were you testing against? 2000 or 2003? (I ask, because I > was under the impression that KRB5 had to be setup as well) > > -----Original Message----- > From: freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.org > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] > On Behalf Of Alan DeKok > Sent: Friday, September 22, 2006 3:26 PM > To: FreeRadius users mailing list > Subject: Authentication against Active Directory page > > http://deployingradius.com/documents/configuration/active_directory.html > > It describes a minimal set of steps to take to get authentication > working against Active Directory. It works in my limited tests, but if > anyone runs into problems, please email me, and I'll update the page. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

debug for sqlippool
by Guilherme Franco 22 Sep '06

22 Sep '06

Hello! I've created a new sqlippool.conf customized for Oracle. The queries in there returns no error but I get this: modcall: entering group post-auth for request 0 Value Of the Pool-Name is [FOO] and its [3] Chars rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414518'' UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414518' radius_xlat: 'SELECT framedipaddress FROM radippool WHERE pool_name = 'SPW' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#118'), expiry_time FOR UPDATE' SELECT framedipaddress FROM radippool WHERE pool_name = 'SPW' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#118'), expiry_time FOR UPDATE So, radiusd -X just stops there (it does not quit), without any more messages (resulting in a time out for the BRAS). I know that the only place a BEGIN instance exists is in rlm_sqlippool.c. Even with sql_trace = yes, I can't see from where this error (ORA-06550: line 1, column 5: ) is coming from. As a result I don't know what is in line 1, column 5 to fix it. Any tips? After all this help you guys deserve to drink some beer here in Brazil :) Thanks a lot!

1 0

radius configuration error ?
by Federico Wenner 22 Sep '06

22 Sep '06

Hi friends, I am awfully worried about my radius configuration getting the following error. Could anybody help me with this real mess ? I can not find any hint in the freeradius.org/faq files. Version FreeRadius 1.0.5 MySQL 4.1.12 ERROR: rlm_sql (sql): No matching entry in the database for request from user [monkey] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejectin g the user auth: Failed to validate the user. Thanks and regards Federico.

1 0

No matching entry in the database
by Federico Wenner 22 Sep '06

22 Sep '06

Hi friends, I am awfully worried about my radius configuration getting the following error. Could anybody help me with this real mess ? ERROR: rlm_sql (sql): No matching entry in the database for request from user [monkey] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejectin g the user auth: Failed to validate the user. Thanks and regards Federico.

2 1

FW: Conditionally adding reply pair
by Garber, Neal 22 Sep '06

22 Sep '06

> You should be able to do this through the users file: >... > Just change the check and reply items where necessary. > If you don't expect to use the NetSensory huntgroup after > these lines, you may want to add the following after all > users file entries related to the NetSensory huntrgroup. Looking at the code for the files module, it appears that it is comparing check pairs against the request. Since the LDAP-Group is in the list of check pairs as opposed to the list of request pairs, I don't think this will work. In other words, I believe your example will look in the request pairs for attribute LDAP-Group and it won't be found. Can someone confirm or deny my analysis?

6 5

OpenSSL vulnerability may affect FreeRADIUS
by Alan DeKok 22 Sep '06

22 Sep '06

http://www.openssl.org/news/secadv_20060905.txt From my preliminary reading, this may only affect people using EAP-TLS. PEAP and EAP-TTLS do not validate certificates on the server side, so they may not be vulnerable. Still, it's probably worth upgrading OpenSSL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

automated response
by Olaf Becker 22 Sep '06

22 Sep '06

I am not in the office until 4th of Octorber 2006 and have limited access to my e-mails. Thank you for your understanding that your e-mail will be answered after my return to the office. This e-mail will not be forwarded. Kind regards Olaf Becker

1 0

Hiding Passwords in Debug Output
by Garber, Neal 22 Sep '06

22 Sep '06

I understand that it is sometimes useful to display the plain-text password in the debug output; however, I consider this a security exposure. I'd like to see a configuration option (e.g., debug_show_passwords or something similar) with a default of no, that when set to false/no would write "********" instead of a plain-text password in debug output. Currently, modules rlm_ldap, rlm_pap, and perhaps others write the plain-text password in debug output. Your thoughts? Neal

3 2