June 2007 - Freeradius-Users - lists.freeradius.org

Additionally set/provided variables... how to access them?
by Mark J Elkins 20 Jun '07

20 Jun '07

My telcom incumberant allows me to authenticate my clients on his network - providing me with both ADSL and Dialup facilities - which I then sell on to my clients. I need to be able to distinguish between these two different service types. My telco sends .... %{Telkom-Access-Type} and when I (for example) look in the environment - I see TELKOM_ACCESS_TYPE either set to "dsl" or "dial" - just what I need.... but I am trying to accesss these values inside some MySQL. In my "useracct" table - I have a table value called "aces_typ" (ie - Access-Type) which contains either the word "dial" or "dsl". In my "authorize_check_query" statement - I have.... AND ( aces_typ='%{Telkom-Access-Type}' OR '%{Telkom-Access-Type}'='' ) (I also do authenticate from NAS's which do not set that value (ie - My own AS5300) - hence the check for it not being set - Hmm - how do I set that in my Cisco?) This gives (in radiusd -X) the debug warning message of.... WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Telkom-Access-Type} So how do I correctly access and use this value???? -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

4 9

Re : Sending CA certificate during EAP-TLS
by Eshun Benjamin 20 Jun '07

20 Jun '07

Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? You may have to read the RFC :-). You need the certificates to do EAP-TLS ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Rafa Marin <rafa.marinlopez(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mercredi, 20 Juin 2007, 13h16mn 05s Objet : Sending CA certificate during EAP-TLS Hi all, Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? As Free Radius is sending it right now EAP-TLS packets get fragmented and I would like to avoid it. Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

4 4

Support for PEAP-Mschapv2 and PEAP-GTC simultaneously?
by Colleen C. Morrissey 20 Jun '07

20 Jun '07

Hi, I am running version 1.1.6 and have had a successful 802.1x/PEAP-GTC deployment for 3+ years. With Vista it looks like I have to move to 802.1x/PEAP-MSCHAPv2 - can not find peap-gtc supplicant. I was able to get 802.1x/PEAP-MSCHAPv2 working. My question is can I somehow support both simultaneously with the same freeradius daemon (I know I can simply run a second daemon on different port supporting the other but that will require me to do lots of work on infrastructure/ssids to point to different servers)? Does anybody happen to have this working and be willing to post config? Or any other ideas? Thank you for your time. Colleen Morrissey

4 8

Re: dialup_admin user password question
by Jay Banks 20 Jun '07

20 Jun '07

> On Wed 20 Jun 2007, Jay Banks wrote: >> I spent most of the day getting dialup_admin to work, and I did get it to >> work. Not being an mysql expert, I have to say what a blessing Webmin >> turned out to be on the project. It sure was nice to be able to easily >> use >> Webmin to look at data in the database table. > > Please do not hijack threads on the mailing list. Please start your own > thread! I've gone back through and read the latest posts. Unless I missed it, I have only seen two other discussions on Dialup Admin, and that was a bad link to download it, and a blank password for Mikrotik. I read the PAP - CHAP thread, if that is what I "hijacked" my apologies. I see that as related, maybe, but the real issue was with where Dialup Admin was telling it how to store a password. I worked all day on Dialup Admin and just overlooked it. And as I stated, was just looking for someone to point me in the right direction since I was going to be out of the office for a couple of days and wanted to hit the ground running when I returned to work. Feeling it had to be a Dialup Admin issue, I looked through the admin.conf again this morning. For people searching the archives, here was the line I missed: # # can be one of crypt,md5,clear # general_encryption_method: clear Change the above line from crypt to clear. This is located under this section: general_auth_request_file: The "general_auth_request_file" threw me off a little. I was thinking "password" at the time. Thanks, Jay Banks http://groups.yahoo.com/group/mikrotik-wisp

1 0

authenticating Linux and Windows servers with freeradius
by vasanth kumar 20 Jun '07

20 Jun '07

Hi everybody, This is sambu, I have configured FreeRadius-1.0.1-1 with Openldap-2.2.13-2 on Fedora 3. Both are running on (ip: 192.168.0.131) same machine and working very well. afterwards I configured ssh on the same machine where Freeradius running using PAM modules for authenticaton, it is correctly authenticating with Freeradius. Also I worked with routers and switches to authenticate with Freeradius, they are also correctly authenticating with Freeradius server for user name and password. My question is how to authenticate both Windows and Linux servers and ssh,telnet,ftp,apache running on different machines with Freeradius server. Is it possible to authenticate both Linux and Windows server and all other services with Freeradius? Please help me.Thanks vasanth

2 1

Multiple Databases
by Abdul Qadir 20 Jun '07

20 Jun '07

Hi, I am using freeradius with SER and oracle. Currently i have one domain for my SER. I want my SER to support another domain and separate database for second domain. Is it possible to configure Radius server to connect with two databases and perform queries based on URI or some other criteria eg. user(a)domainA.com should go to domainA database and user(a)domainB.com should go to domainB database. Thanking you all in advance. Best Regards, Abdul Qadir --------------------------------- Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

2 1

Frreradius PAP and CHAP
by lisa laam 20 Jun '07

20 Jun '07

Hi, I configured Freeradius to use PAP method with users file. The password is stored in clear text is stored in clear text in the user file and it works well. Now I want to use other mode of user storing with PAP method. (exemple MD5 with the user file locatedt in /freeradius-1.1.6/src/tests/digest-auth-MD5) 1- How to tell frreeradius that the user password is stored in clear text, or digest, or MD5 hashed, etc ?? I tried to copy the content of "digest-auth-MD5" in the "users" file and I got this errror : Errors reading /opt/freeradius/etc/raddb/users radiusd.conf[1067]: files: Module instantiation failed. radiusd.conf[1852] Unknown module "files". radiusd.conf[1788] Failed to parse authorize section. I want to test also CHAP method, how to tell radius to use this method in stead of PAP? thanks

6 9

Re: Server dies
by Hugh Messenger 19 Jun '07

19 Jun '07

Alan Dekok <aland(a)deployingradius.com> said > Yes. For simplicity: > > $ script valgrind.log > $ valgrind radiusd -xxx > ... > $ <ctrl-c> > $ exit Okie Dokie. I was going to use --log-file witrh valgrind, but 'script' works. Done. So far the only errors I'm seeing are these: ==29820== Thread 2: ==29820== Invalid write of size 1 ==29820== at 0x4819294: strNcpy (misc.c:187) ==29820== by 0x4CC43F3: sqlippool_postauth (rlm_sqlippool.c:527) ==29820== by 0xD469: modcall (modcall.c:236) ==29820== by 0xDA73: call_one (modcall.c:269) ==29820== by 0xD701: modcall (modcall.c:324) ==29820== by 0xC8F7: indexed_modcall (modules.c:469) ==29820== by 0x5865: rad_postauth (auth.c:430) ==29820== by 0x6101: rad_authenticate (auth.c:1029) ==29820== by 0xF6D4: rad_respond (radiusd.c:1669) ==29820== by 0x13240: request_handler_thread (threads.c:570) ==29820== by 0x3B4370: start_thread (in /lib/tls/libpthread-2.3.4.so) ==29820== by 0x208FFD: clone (in /lib/tls/libc-2.3.4.so) ==29820== Address 0x4A87AA2 is 0 bytes after a block of size 10 alloc'd ==29820== at 0x4804405: malloc (vg_replace_malloc.c:149) ==29820== by 0x1AA02F: strdup (in /lib/tls/libc-2.3.4.so) ==29820== by 0x4CC42AF: sqlippool_instantiate (rlm_sqlippool.c:486) ==29820== by 0xC5DE: find_module_instance (modules.c:358) ==29820== by 0xDD9C: do_compile_modsingle (modcall.c:1005) ==29820== by 0xCD6E: setup_modules (modules.c:580) ==29820== by 0x103E1: main (radiusd.c:965) There are typically three or four similar events for each authentication, a mix of invalid writes and reads. They are always out of sqlippool_postauth. > Alan DeKok. -- hugh

3 2

Re : Disabling EAP-TLS while keeping EAP-PEAP
by Eshun Benjamin 19 Jun '07

19 Jun '07

sounds interesting can you post your tls section config ================================================== ----- Message d'origine ---- De : "Reimer Karlsen-Masur, DFN-CERT" <karlsen-masur(a)dfn-cert.de> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 18 Juin 2007, 11h09mn 31s Objet : Re: Disabling EAP-TLS while keeping EAP-PEAP Hi! By commenting the CA_file parameter in the eap->tls section: # CA_file = ${raddbdir}/certs/trusted-ca-cert-list.pem *and* by setting CA_path parameter in the eap->tls section to an *empty* directory CA_path = ${raddbdir}/certs/trustedCAs should do the trick. No trusted CAs mean no trusted client certificates :-) Martin Gadbois wrote: > When enabling EAP-PEAP with FreeRADIUS, module EAP-TLS is required. > > How can I disable EAP-TLS while using EAP-PEAP? > > I agree that if the client does not have a client key, EAP-TLS will not > work. But how to restrict EAP-TLS in any case? -- Beste Gruesse / Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

UNSUBSCRIBE
by Florian Reinholz 19 Jun '07

19 Jun '07

UNSUBSCRIBE

2 1