July 2007 - Freeradius-Users - lists.freeradius.org

radius & mysql
by Michael Ziemann 09 Jul '07

09 Jul '07

Hi All! I have a problem with freeradius getting access to a mysql database. I installed freeradius 1.1.5 on OpenSuse. The radius server is working, because I get an Access-Accept Packet with radtest (I configured the clients.conf). But how do I configure FreeRadius to use an MySql-database? I already installed lampp, it contains an MySql-Server with the comfotable tool PHP-MyAdmin... Thanks Michael

4 3

R: Cisco VRF + Radius
by Francesco Cristofori 09 Jul '07

09 Jul '07

> Putting a User into a certain VRF is quite simple: > > vrfuser User-Password == "topsecret" > Cisco-AVPair += "lcp:interface-config#1=ip vrf forwarding \ > VRFNAME", Thank you Gerald, this is what I need to do. I tried using this method, but I end up with access-accept reply (from radiusd -X) like this: Sending Access-Accept of id 20 to x.y.159.252 port 1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Ascend-Client-Primary-DNS = x.y.z.1 Ascend-Client-Secondary-DNS = x.y.z.2 Session-Timeout = 20000 Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding Satcom" Framed-IP-Address = x.y.129.239 This seems correct to me, but the NAS ignores the Framed-IP-Address so the cpe never gets an Ip address. The IP address is taken from an ippool, the other attributes are stored in sql, everything works fine without that cisco-avpair attribute. Any hint? Thanks in advance, Francesco.

2 1

R: Cisco VRF + Radius
by Francesco Cristofori 09 Jul '07

09 Jul '07

Hi Kalik, thanks for your reply. I had a look at the cisco doc on vrf forwarding, but I think it's not what I need to do. I don't need to put all template items in fr, but only to select the vrf based on group which the user belongs to. Did I miss the point? Do I need to configure Templates inside radius? Thanks, Francesco.

1 0

FR + AD host/ machine/ workstation authentication
by Jacob Jarick 09 Jul '07

09 Jul '07

Im after some documentation on setting up host authentication on freeradius (or an example config). This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is. My files are configured according to this howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO and user authentication is working fine. I need host/ machine authentication for laptops that will connect wirelessly to a domain (<- need machine auth) before logon. Thanks in advance.

4 20

Re : using EAP instead of chilli
by Eshun Benjamin 09 Jul '07

09 Jul '07

i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. Do this, The settings below will help: SETUP Internet connection: IP on WAN Under Optional Settings Host Name: MyWireless (Name of your client-AP) Domain Name: yourdomain.com (Your own domain) MTU: Auto Under Network Setup Router Local IP: 192.168.1.1 Subnet: 255.255.255.0 Gateway: 0.0.0.0 DHCP DHCP Server: enabled WIRELESS Under Basic settings; Wireless mode: AP wireless Network Mode: Mixed Wireless Network Name: MyWireless (Name of your client-AP) Wireless Channel: 11-2.462GHz Wireless SSID Broadcast: enable Sensitivity Range: 2000 Under Radius MAC Radius Client: enable MAC format : aabbcc-ddeeff Radius Server Address: your radius server IP Radius Server port: 1812 MUU: Password format: shared key Radius shared secret: the secret of your cliet (AP) Wireless Security Security Mode: WPA Radius WPA Algorithms: TKIP+AES Radius Server Address: Your radius server IP Radius Server port: 1812 WPA shared key: the secret of your client (AP) key renewal interval: 3600 ADMINISTRATION management Routing: enable 802.1x : enable Make sure you have your client(AP) information in radius: client.conf ( AP IP , MyWireless, Shared Key) configure eap.conf and radius.conf as well. All the best. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Carl aniams <aniamss(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 7 Juillet 2007, 19h15mn 51s Objet : using EAP instead of chilli hi all i'm using freeradius with a mysql database to authenticate users through chillispot, and it's working fine. i would like to authenticate my user using EAP instead of using chilli that already grant them access through dhcp to the network i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. thanks a lot -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Login /logout script hooks
by Steven J Lamb 09 Jul '07

09 Jul '07

I have been looking for a good example of a way to execute scripts when there is a login or logout. I haven't yet found a good example and unfortunately all of my attempts have failed to do anything. Any help or suggestions as to where I can find a good example of running a shell script when someone logs in or logs out. I would much appreciate it. Thanks in advance. Steven Lamb

2 1

Freeradius 2.0 - vmps feature, inaccuracies on FreeNAC
by Sean.Boran＠swisscom.com 09 Jul '07

09 Jul '07

Hi, I just came across your blog post commenting on the release of the 2.0 version of freeradius. I was kind of surprised by the upcoming support of VMPS. While trying to know more, I also found a post commenting on OpenVMPS (http://lists.cistron.nl/pipermail/freeradius-users/2007-May/063152.html ) and I have to say that I've been really dissapointed by what you wrote. I really didn't expect that animosity or that amount of FUD coming from you. Quote, from Alan Dekok, Mon May 28 14:21:56 CEST 2007 " 2.0.0-pre2 has "Magic feature number one" :)" > Arran Cudbard-Bell wrote: > > Neat , unfortunately only Cisco switches seem to support it, and we run > > entirely on HP Procurves. > > Guess it means people will no longer have to use OpenVMPS to proxy :) > > Plus, OpenVMPS is not under active development, so there's no > maintainers. It claims it's part of another project (that I won't > name), but that project includes the *binary* of OpenVMPS, and not the > source. GPL concerns may apply... > > On top of that, the project is funded by a commercial company, as a > loss-leader for their commercial support, and the "community" that works > on it is limited to the employees of that company. Good luck getting > patches added if they conflict with the corporate agenda... > > Alan DeKok. The project in question that you did not want to name is "FreeNAC" and I'm the lead developer. You'll understand that I cannot let those things stay uncorrected, so I'll quickly make some issues clear : - This project has been, from the start, a GPL project, sources have always been published. Just because an OpenVMPS binary is there doesn't mean there's no source : look into the contrib directory. - The main sponsor is effectively Swisscom Innovations, but there's no need to put quotes around community. Even if it's small (70 registered users), I let you check our forums to verify that it is not limited to Swisscom. We received some contributions (patches, documentation) that we accepted and we don't have any hidden agenda. [FreeNAC is GPL, and we respect the GPL of OpenVMPS too]. - "Good luck getting patches added if they conflict with the corporate agenda" The community are free to change FreeNAC themselves, and submit patches, if we don't do it fast enough. That is what OpenSource is about. The core team is not closed to Swisscom Innovation people either. I'll welcome anyone with the motivation, skills and time. This is, I repeat, a GPL - OpenSource project. But, at the end, I'd really like to close this misunderstanding and move further. There's no point in arguing or flaming each other as we're both working on closely related opensource project. In fact, FreeRADIUS was always in our mind, we announced FreeNAC on the "freeradius-user" mailing list in 2006 and we also integrated it. This is natural because the core value of FreeNAC is in at the "policy level", and not in the support of underlying protocols like VMPS or 802.1x. We've also closely followed the development in the NAC area and contacted other opensource projects (SecureW2, NAC@FHH) for that purpose. We would enjoy a collaboration that would lead to create _the_ opensource NAC framework. Regards, Sean Boran, www.FreeNAC.net

3 3

Freeradius Auth via LDAP against Active Directory Server 2003
by Jacob Jarick 09 Jul '07

09 Jul '07

I have been at this for awhile now, so I thought I would share a summary of what I have figured out so far for anyone else that decides to try this. 1 - Documentation for this particular configuration is either out of date / incomplete / both. There are no howtos that will get from start to end (if you do know of one or wrote one yourself please share - I will myself when I figure it all out). 2 - Most the trouble is due to the fact we are making a linux service talk to a windows service (AD LDAP). Freeradius talking to the linux passwd file is a breeze by comprassion. 3 - Windows 2003 LDAP implementation will not provide a password when a user/ service preforms a ldap search, the proper way If I understand correctly is to supply plain text username / password then freeradius preforms a bind with the provided credentials against your ADS server, success means the password was correct. 4 - Installing "Services For Unix" on 2003 will make AD LDAP provide a password hash attribute among other unix LDAP attributes. The user has have posix enabled. 5 - Anonymous searchs can be preformed on 2003 AD LDAP if you set dSHeuristics to 0000002 using adsiedit.msc. 6 - Microsofts LDAP is different to Novells (big surprise) and so unfortunately their documentation isnt to helpfull as a reference for people trying to use ADS in the same fashion.

6 17

Plug-in Question
by George Beitis 08 Jul '07

08 Jul '07

Hi Everyone i have a question regarding freeradius. I am trying to write a plugin and i was wondering what the postauth section is for. I want to be able to alter the authentication decision of freeradius, once it is made but before the ok response is sent. I will use a policy engine to do that and i want to overwrite the final decision if the user is not authorized based on my policy. Is postauth the right place to do this? regards George

8 29

Block wiki spammer.
by Arran Cudbard-Bell 08 Jul '07

08 Jul '07

Hi Peter, Can you block Ce3Wre <http://wiki.freeradius.org/index.php?title=User:Ce3Wre&action=edit> Spamming Run-time-Variables page. And could I have edit rights to the start page, pretty please :) Thanks, Arran

3 5