June 2007 - Freeradius-Users - lists.freeradius.org

Re : Re : Off-topic: DHCP server with radius support
by Eshun Benjamin 22 Jun '07

22 Jun '07

RADIUS was *originally* intented to assign IP's. It's been doing that since at least 1993. Do you mean radius servers has being doing DHCP since 1993 or IP pool stuff. What is is the difference? >> No i meant exactly what i wrote. RADIUS can assign IP's (that's why we >> have the rlm_pool/rlm_sqlpool modules and the Framed-IP-Address >> attribute). I need to forward some information to home radius servers >> first and based on their response decide on the ip pool to give out >> IP's. OK. http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.… ISC DHCP supports scripts? News to me... A DHCP >> request can be transformed to an Acesss-Request (with some default >> password), forwarded to a RADIUS server and the IP assigned by the >> radius server returned back to the user. Do you want to do that or "That RFC actually describes the opposite of what we are talking about. (ie. How a RADIUS server can ask a DHCP server to assign an IP instead of how a DHCP server can ask a RADIUS server to assign an IP) " ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 21 Juin 2007, 10h44mn 24s Objet : Re: Re : Off-topic: DHCP server with radius support Eshun Benjamin wrote: ... > A radius server assigning IPs .......that is not radius (!) . RADIUS was *originally* intented to assign IP's. It's been doing that since at least 1993. > May be > you mean the radius server authenticating (MACs and/or IPs) before the > dhcp assigns it; this you have to configure and write your own scripts > on the dhcp server to authenticate against the radius. Radius is for AAA ISC DHCP supports scripts? News to me... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2

RADIUS Authentication
by nguyenvinht 22 Jun '07

22 Jun '07

Can RADIUS policy file in the authentication step reject a few servers to authenticate and allow all others to authenticate? My understanding is that RADIUS can only use IP-Framed Protocol to allow a number of systems to authenticate and reject the rest but can't do the opposite. Any ideas about how to accomplish this would be appreciated. Thanks. Vinh -- View this message in context: http://www.nabble.com/RADIUS-Authentication-tf3918468.html#a11110867 Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

radsqlrelay is rude
by Stefan Winter 22 Jun '07

22 Jun '07

Hi, attempting to kill a running radsql with ^C doesn't do anything, and kill'ing it with TERM doesn't impress it either on my system. I had to send KILL to get rid of it. Is this intentional? Then, on startup I see it instantiated but only the post-auth query is printed on startup with -X - leaving me with the question on whether the other queries are actually properly read or not (see below). That's not nice as well. I'm on 1.1.6. Module: Loaded sql_log sql_log: path = "/var/log/radius/radacct/sql-relay-main" sql_log: Post-Auth = "INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%S')" sql_log: sql_user_name = "" sql_log: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Module: Instantiated sql_log (sql_relay_main) (I'm very sure the config contains Start, Alive, Stop as well) Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 2

multilink
by Mahalakshmi Vijayakumar 22 Jun '07

22 Jun '07

hi, can u give me an instance where multilink is used thank you > > >

2 1

unsubscribe
by Emerson M. Borsatti 22 Jun '07

22 Jun '07

1 0

multilink attempt and double login
by Mahalakshmi Vijayakumar 22 Jun '07

22 Jun '07

hi, wats the difference between multilink attempt and double login..... thank you...

2 1

FreeRADIUS+VLANs
by Darren Maden 22 Jun '07

22 Jun '07

Hi, I found a few articles online about dynamically assigning VLAN IDs to users using RADIUS, this article was the most useful: http://searchsecurity.techtarget.com/general/0,295582,sid14_gci1169011,00.h… I tried setting up something like this from that page using my mysql tables in FreeRADIUS: Tunnel-Type=VLAN (13) Tunnel-Medium-Type=802 Tunnel-Private-Group-ID=VLANID But it doesn't seem to be working. Has anyone had any experience in doing this? It could just be that my NAS isn't compatible but I'd like to know if anyone has had any success doing this and any advice you could give. Thanks, Darren Maden

3 2

Re: Problem with OpenLDAP + FreeRADIUS
by gosha-necr 22 Jun '07

22 Jun '07

Thanks for answer, but this solution is first what i'm check. I'm set chmod -R 444 ./raddb chmod 555 ./raddb and nothing changes.

1 0

Problem with OpenLDAP + FreeRADIUS
by gosha-necr 22 Jun '07

22 Jun '07

Hi all! I'm setup Samba PDC (3.0.25a) + LDAP and i want that users connect to the internet throught VPN using their LDAP credentials. I think it will be MPD + FreeRADIUS. But when i'm try to configure radius work with ldap it get me error. I use this HOW-TO: http://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/radius.html This is my radiusd.conf: http://pastebin.ru/44057 And when i'm try /usr/local/sbin/radiusd -X -A it tells me: http://pastebin.ru/44058 There is my /usr/local/etc/raddb/ldap.attrmap: http://pastebin.ru/44059 My OS: FreeBSD 6.2 i386 FreeRadius 1.1.6 Please help me :)

2 1

MSCHAPv2 with 1.1.4
by Matt Cobb 22 Jun '07

22 Jun '07

Using 1.1.4, still can't get MSCHAPv2 working to a local file. Here is the full output and the conf files: Thread 2 handling request 1, (1 handled so far) NAS-Identifier = "localhost" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cobb@guests" MS-CHAP2-Response = 0x0101e79fb5f1bd1b2c95f335275ebc9e3d5a0000000000000000be30b1b54d7e9a9785 bd07c4cb7188553e231dbfa355970a MS-CHAP-Challenge = 0x1d9fbe47738e455b28dd9bc9bc81a6df Service-Type = 47 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 1 rlm_realm: Looking up realm "guests" for User-Name = "cobb@guests" rlm_realm: Found realm "guests" rlm_realm: Adding Stripped-User-Name = "cobb" rlm_realm: Proxying request from user cobb to realm guests rlm_realm: Adding Realm = "guests" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "ntdomain" returns noop for request 1 modcall: leaving group (returns noop) for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry cobb at line 1 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 1 rlm_mschap: Told to do MS-CHAPv2 for cobb@guests with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 1 modcall: leaving group MS-CHAP (returns reject) for request 1 auth: Failed to validate the user. Login incorrect: [cobb@guests] (from client localhost port 0 cli 127.0.0.1) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 1 users file: cobb User-Password=="secret" (also tried Cleartext-Password with same results) proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm guests { type = radius authhost = LOCAL:1812 accthost = LOCAL:1813 secret = whatever } realm testlab.com { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } realm DEFAULT { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } radius.conf: prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var/lib sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 1812 listen { ipaddr = * port = 1645 type = auth } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no } ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } } instantiate { exec expr # daily } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { preprocess chap mschap suffix ntdomain eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique suffix ntdomain # # Read the 'acct_users' file files } accounting { detail unix radutmp } session { radutmp } post-auth { } post-proxy { eap }

4 7