May 2007 - Freeradius-Users - lists.freeradius.org

Force Inner=Outer identity
by Matt Ashfield 03 May '07

03 May '07

Hi All Using EAP-TTLS PAP with FR authenticated against LDAP. In looking at our monitoring software, it displays the user's outer identity. Problem is, a user can specify any userID as it's outer Identity and as long as it's a valid outer Identity, that's what shows up in our monitoring software. Makes user tracking quite difficult. Is there any way to force a users's outer identity to equal their inner identity? Thanks Matt Ashfield mda(a)unb.ca

2 2

multiple users with different service flows
by Cristian Novac 03 May '07

03 May '07

Hello all, I am Cristian NOVAC and I work to a Wimax project. I have to perform some tests where I need multiple users to authenticate, each of them having different service flows. I mention that I use Service-Flow-Descriptor and QoS-Descriptor VS ATTRIBUTES (defined in a WiMAX FreeRadius Dictionary) to configure the user's service flows. For now I have successfully run tests only if I've written these attributes into a DEFAULT reply of the "users" file. But this "technique" make all users having the same service flows. If I try to add the two attributes to a specific user's reply list of items(in users file) it doesn't work.(the attributes are not sent in Radius ACCESS-ACCEPT message). The same problem I encountered when I used the 3GPP2-Service-Option-Profile VSA (from freeradius dictionary.3gpp2) to set user's service flows. I am using EAP-TTLS authentication method. Could you please help, telling me what radius configurations to make, as you may have already encountered similar problems? Thanks!! BR, Cristian Novac.

2 3

additional SQL-query, after authorize_check_query fail
by cky 03 May '07

03 May '07

Hi, I use a SQL-database for authorization request from a cisco-ssg (a service gateway). This works fine But now I'm trying to perform an additional sql-query, when the calling-station-id isn't found in the sql-table. Also, my table looks like this: mysql> select * from ssg_check; +----+----------+-----------+--------+----+--------------------+ | id | UserName | Attribute | Value | op | Calling-Station-Id | +----+----------+-----------+--------+----+--------------------+ | 1 | Guest | Auth-Type | ACCEPT | := | 0009.2419.d428 | +----+----------+-----------+--------+----+--------------------+ If the SSG request the authorization for: Calling-Station-Id 0009.2419.a618, this record isn't found and the radius send a reject...this is ok. But, then the record isn't found, it would be great if the radius could do this insert-statement: INSERT INTO `ssg_check` (`UserName`,`Attribute`,`Value`,`op`,`Calling-Station-Id`) VALUES ('GUEST','Auth-Type','REJECT','op','%{Calling-Station-Id}'). Any ideas, how this can be realized? Thanks in advance! Best regards, Thomas PS: sorry for my bad english.... -- View this message in context: http://www.nabble.com/additional-SQL-query%2C-after-authorize_check_query-f… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: Freeradius-Users Digest, Vol 25, Issue 9
by khursheed Ahmed 03 May '07

03 May '07

1 0

FreeRadius+AD integration
by shrikant Bhat 02 May '07

02 May '07

Hi, I am trying to integrate freeradius with ADS 2003. I reffred to http://deployingradius.com/documents/configuration/active_directory.html . everything works perfectly fine till ( $ ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password=*password*) I get NT_STATUS_OK. I dont see NT_KEY output. I made changes to exec module in radius.conf as per the instructions, but radtest fails with Access-Reject .I have attached the debug window output for reference. ________________________________________________________________________________________ rad_recv: Access-Request packet from host 127.0.0.1:32928, id=44, length=57 User-Name = "raduser" User-Password = "radpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry sbhat at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 _____________________________________________________________________________________________________________________ Any help fixing this issue will be appreciated. thank you! SB

6 31

VLAN Queries
by Jacob Jarick 02 May '07

02 May '07

Salutations all, I will be attempting VLAN assignment tomorrow via FR + ADS + cisco wap. 1st Question: Is it possible to assign VLAN based solely on what ldap server authorized it. (The sites we are looking @ have 1 domain server for staff and 1 for students). 2: Ive been looking @ Mat Ashfields email query regarding vlans, it looks nice and straight forward to me, my only query: Is the ldap group automatically fetched or is some extra configuration needed under the ldap modules or ldap.attrbmap. Mats Example: DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=176, Tunnel-Type=VLAN, Fall-Through = no DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=177, Tunnel-Type=VLAN, Fall-Through = no Thanks for the info.

2 2

Problem with mysql authorization
by Ian Truelsen 02 May '07

02 May '07

I am trying to set up mysql authorization, but am having some problems. I have set up sql.conf which seems to be correct, based on the output: -- Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "xxxx" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" To me, that looks like it is correct. I have added info to the radcheck table: +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ Now, I try to test with radtest: brentwood-internet ~ # radtest ian tester localhost 1812 testing123 Sending Access-Request of id 88 to 127.0.0.1 port 1812 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=88, length=20 So, not so good. rad_recv: Access-Request packet from host 127.0.0.1:2048, id=88, length=55 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 That looks like the query is being processed as I would expect. The rest of the output: radius_xlat: 'ian' rlm_sql (sql): sql_set_user escaped user --> 'ian' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ian' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ian' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [ian]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [ian/tester] (from client localhost port 1812) So, I am not sure what is going on. When I run the command in mysql, I get the correct output, as I would expect: mysql> select id, -> UserName, Attribute, Value, op from radcheck where Username = 'ian' order by id; +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ 1 row in set (0.00 sec) Any thoughts on what I missed here? Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 2

Missing Huntgroups Man Pages
by Norman Zhang 02 May '07

02 May '07

Is huntgroups(5) removed from FreeRADIUS? I googled but all end up with dead links and downloaded 1.1.6 source, can't find it in there either. Please help. Norman

1 0

problem with Dell connection manager?
by Matt Ashfield 02 May '07

02 May '07

HI All We are running our wireless using FR to authenticate against LDAP. A user can login on a laptop, no problem, but when he then goes to a Dell laptop which uses a Dell Connection Manager program, it fails. The odd thing is is that in both cases there is an Access-Accept packet going out, except for the Dell, it does not assign a vlan (which is probably why it's failing). Since it's the same userID loggin in, I'm not sure why the vlan is not being passed. The only thing I can see is that the username field in the Access-Request is preceeded by "\\" in the case of the Dell, and not so in the case of the working laptop. Here's the Access-Request from the one that works: rad_recv: Access-Request packet from host 172.17.0.1:20001, id=166, length=144 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-15-E9-D9-94-85" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010008016d6461 User-Name = "mda" NAS-Port = 4596 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 And here is the Access-Request from the one that does not work (notice the username field): rad_recv: Access-Request packet from host 172.17.0.1:20001, id=161, length=146 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-13-02-77-97-CB" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010009015c6d6461 User-Name = "\\mda" NAS-Port = 4593 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 In both cases there is an access-accept, but vlan is only returned in the case of the first one. Any ideas on a workaround? Thanks for any advice. Cheers Matt Ashfield mda(a)unb.ca

2 2

Re : EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

I have appended the intermediate cert to the server cert but I got the same result. ----- Message d'origine ---- De : "Reimer Karlsen-Masur, DFN-CERT" <karlsen-masur(a)dfn-cert.de> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 2 Mai 2007, 9h40mn 59s Objet : Re: EAP-TTLS PEAP MCHAPv2 Hey. Append all intermediate CA certificates onto the end of the file specified with the "certificate_file" option in the eap.conf files eap->tls section. This file usually hold your RADIUS server certificate and can additionally hold the chain certificates as well. Eshun Benjamin wrote: > > I am using an enterprise certificate which has intermediate CA. The root > CA is well known (verisign) and already on the MAC keychain access(3.3) > by default. MAC recognises the certificate and its validity but > complains of "The server certificate is not trusted because there > are no explicit trust settings". If I click continue or always trust it > works fine but I want to get rid of this prompt without clicking > continue or always trust to give it smooth and uninteractive log on. -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0