January 2007 - Freeradius-Users - lists.freeradius.org

ldap { fail=1}
by jerrrry＠voila.fr 10 Jan '07

10 Jan '07

Hi, i'm using freeradius 1.0.1 from Red Hat entreprise 4. my radius server is connected to a ldap directory to store users and to a mysql database to store NAS I want the radius server to authenticate users thanks to the "users" file even if the ldap directory is not reachable and the radius server to start even if the DB is not reachable I tried with ldap { fail =1} in the authorize section and sql { fail = 1 } in the instantiate section without any success. "fail" doen't seem to be know. Thank you for your help Thomas

2 1

freeRADIUS 1.1.3 and Cisco WLSE LEAP Authentication
by Mark Hollenbeck 09 Jan '07

09 Jan '07

Hallo, there has been a problem with Cisco WLSE LEAP authentication for WDS with an older version of freeRADIUS. Is this problem still there, or has it been fixed in the meantime? Thanks a lot Mark

3 2

FreeRADIUS 1.1.4 has been released
by Alan DeKok 09 Jan '07

09 Jan '07

Version 1.1.4 has been released, with a few notable improvements. The server has been updated to be compatible with Microsoft Vista clients for 802.1x. This feature should prove to be of significant interest in many deployments. The "rlm_pap" module has been updated, which should make many configurations much simpler. A new attribute has been added, called Cleartext-Password. This attribute should be used to hold the "known good" password, where configurations previously had used the "User-Password" attribute. Historically, User-Password has been used both as the users password in the Access-Request packet, and also for the "known good" password in the servers configuration ("users" file or SQL database). Having two meanings for one attribute is problematic, so we have modified the server to separate the meanings of the two attributes. Existing configurations will not be affected by this change. However, we recommend that everyone reads the "README" and "man rlm_pap" documentation once the server is installed. The ChangeLog is included below: Feature improvements * Major enhancements to rlm_pap, that make "encryption_scheme" a think of the past. See "man rlm_pap" for details. * Added SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS flag to use work-arounds that enable Windows Vista clients to work. * Added preliminary code to support Firebird. (closes: #378) Use at your own risk! * Send MS-CHAP2-Success, which makes EAP-TTLS/MSCHAP work on more platforms. (closes: #402) * Add a new "reply-name" directive in rlm_sqlcounter to define the name of the reply attribute. (closes: #403) * Added more dictionaries and attributes (closes: #408, among others) * Print ntlm_auth failure reason in Module-Failure-Message (closes: #398) * radsqlrelay is able to get the DB password from a file instead of command line. (closes: #395) Bug fixes * Fix a parse error in the digest module, where malformed digest requests would result in the user being accepted. Oops... * VALUEs can only be defined for 'integer', to catch mistakes with setting VALUEs for type 'string'. * Better parsing of VALUE names, so that values starting with a digit work correctly. * Check return from malloc (closes: #407) * Fix a double free() in rlm_eap_tls.c (closes: #404) * Check return code of malloc() during initialization. (closes: #407) * Fix a corner case where the proxy port isn't set either in radiusd.conf or in proxy.conf. NOT in this release * Threading issues with SSL and EAP on some systems. * MS-CHAP UTF-8 fixes. We expect both those fixes to be in a future release. Alan DeKok. FreeRADIUS Project Leader -- Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 11

Re: Can't access Internet?
by Tim Tyler 09 Jan '07

09 Jan '07

2 1

replicate database
by ann kok 09 Jan '07

09 Jan '07

Hi all Could you suggest a better way to replicate the database in 2 radius servers? rysnc / ssh / tar or any suggestion? Thank you very much __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

SQL Start Query Strings
by Cory Robson 09 Jan '07

09 Jan '07

My NAS sends a Ascend-Session-Svr-Key packet attr-151 and I wish to add an additional field into the tables to have this logged into. Now my question is what to call the variable in the sql statement (I.E. %{NAS-IP-Address}) I cannot find any documentation on the list of available strings and assume it is based on the dictionary files. Anyone have an answer on this for me.. Thanks

2 1

a bit off-topic policy question
by Matt Ashfield 09 Jan '07

09 Jan '07

Hi All We're in the process of setting up our wireless system to use radius authentication against our usernames/passwords which are stored in LDAP. We have come across an issue in testing the radius server. We are using Freeradius. The way we have this setup is quite standard (I hope). The user associates to the AccessPoint (AP) and is prompted for authentication credentials for access to the network. The AP sends the client's username/password credentials to the Radius server. This connection is secured. The Radius server then attempts to bind to the ldap server (again, a secured connection) using the clients credentials. The issue we have is when running the Radius server in debug mode with full log-level, we see the cilent's username and password in clear-text as it attempts to bind to the LDAP server. Certainly we could change the debug mode level to not see this, but the fact that the ability to see that is available is troubling. I'm sure many others on this list use FreeRadius and I'm wondering what sort of policies you have in place to address this security risk. Anyone with high-level access to the box could certainly login, make a change to the debug level and capture sensitive login information. Any advice/feedback is appreciated. Thanks Matt mda(a)unb.ca

5 5

Parse errors with Cisco-Avpair
by William Gemmill 09 Jan '07

09 Jan '07

I'm trying to use FreeRADIUS with a Cisco router to implement an authentication proxy. However when I try to define a test user in users, I'm getting a parse error on the spaces in the ACLs. Has anyone else implemented something similar? I found several guides for cisco logins, but they did not cover ACLs. Any help would be appreciated. Thanks! radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Jan 4 2007 at 13:58:04 radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/dictionary.cisco Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" */etc/raddb/users[3]: Parse error (check) for entry Cisco-Avpair="auth-proxy:proxyacl#1=permit: expecting '='* Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. *users file:* steve Auth-Type := Local, User-Password == "testing" Cisco-Avpair="auth-proxy:priv-lvl=15", Cisco-Avpair="auth-proxy:proxyacl#1=permit tcp any any eq 26", Cisco-Avpair="auth-proxy:proxyacl#2=permit icmp any host 60.0.0.2", Cisco-Avpair="auth-proxy:proxyacl#3=permit tcp any any eq ftp", Cisco-Avpair="auth-proxy:proxyacl#4=permit tcp any any eq ftp-data", Cisco-Avpair="auth-proxy:proxyacl#5=permit tcp any any eq smtp", Cisco-Avpair="auth-proxy:proxyacl#6=permit tcp any any eq telnet"

2 1

Ericsson Tigress access concentrator
by Cory Robson 09 Jan '07

09 Jan '07

Does anyone have a dictionary file for the old ericsson Tigress that will work with freeradius, I know there are still a few of these old units floating around.

1 0

PHP coding request - give me a price
by Cory Robson 08 Jan '07

08 Jan '07

I have an mysql backend from my accounting program that contains all my user details. I need a php script that I can run from cron that will Import all new users into freeradius that aren't already in its mysql db If the user is already in the freeradius db then see if any information is changed and update it. If the user is no longer in my mysql accounting system then also either remove it from freeradius or expire the user. I have the sql select statement for my mysql accounting system with the relevant information. Anyone able to do this at a reasonable price then drop me an email. thanks

4 4