July 2007 - Freeradius-Users - lists.freeradius.org

LDAP errror in dialup admin page
by Bishal 29 Jul '07

29 Jul '07

I am trying to use freeradius 1.1.7 in Freebsd 6.2 with openldap 2.3.37 for authentication and mysql for accounting. While creating new user I get following error in dialup admin page: Warning: file(/usr/local/etc/raddb/ldap.attrmap) [function.file]: failed to open stream: Permission denied in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 4 Warning: Invalid argument supplied for foreach() in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 5

2 2

Re: "WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I didn't mean the real WPA key (that's why I put them in brackets). I wanted a key (a pass of some predefined user) in radius server. And the user in raduis server is deleted X hours after it's first login. Is this possible, or am I missing the point completely? Ferd0 ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, July 29, 2007 5:46:00 PM Subject: Re: "WPA keys" that expires after use Hi, > The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. err, if the WPA key only becomes active AFTER they've reached the RADIUS server - then HOW are they to connect to the wireless in the first place - as the WPA key is required for the layer 2 link to come alive(!) AAA would be able to give you this 'very low level' type of authentication. what you COULD do with AAA is to use SSL certs....eg EAP-PEAP/EAP-TLS with WPA-enterprise. and then once the cert has been used, expire it. alternatively use WPA as you are currently doing but enforce another control method to get online - such as a SOCKS5 proxy. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better Heartthrob. Get better relationship answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545433

2 1

"WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I would like to setup a wirelless network in my shop for my customers. And instead of giving them WPA Shared Key, which is valid until I change it manually, I would like to give them a "WPA key, which is valid only for x hours". The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. This way, I could forgetet about changing WPA key manually every week, stop worring that my key was spred to much, etc. Is this possible with FreeRadius server? If yes, is there any "how-to" on this subject? Or do you recomend any other aproach? Ferd0 ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

2 1

OCSP support at FreeRadius
by Frank Büttner 29 Jul '07

29 Jul '07

Hello, does anyone know when FreeRadius will support OCSP at the eap-tls module? Because crl's are not very useful, you have the restart the radius daemon every time when you will revoke an certificate or when an new crl comes out in it normal turn. Frank

2 1

Auth-Type in post-auth SQL insert
by Brad Robel-Forrest 28 Jul '07

28 Jul '07

I'm pretty new to FreeRADIUS so I apologize if this is a really basic question. I've searched around quite a bit and have been unable to locate an answer. I've successfully configured FreeRADIUS to use a SQL driver for authentication checks as well as inserting records via the post-auth query. Is there a runtime variable that I can reference to save the Auth-Type used for authenticating the user during post-auth? I've tried what I thought to be the obvious (e.g. %{Auth-Type}) but that doesn't seem to be available (just inserts an empty string). Essentially, I'd like to catalog the type of authentication that was used for authorizing a user (assuming it was successful, of course). For example, user Joe authenticated via PAP. -brad

2 1

EXEC question w/ LDAP Attributes
by Reynold McGuire 27 Jul '07

27 Jul '07

Hello all, I have a question regarding returning attributes from LDAP with freeRadius. I need to do some logic comparing and the only way I have been able to get close is to use the post-auth section, enable 'exec' and push out some data to an external program were I can do some patter matching. Now I have this working just fine with LDAP, the DN and search filter is fine etc. What I want to do is return other attributes from LDAP to be included in the radius reply. I have added the following to "dictionary_mapping = ${raddbdir}/ldap.attrmap" checkItem employeeType employeeType When I run the server in debug mode, I see that it is in fact returning the value of the employeeType from LDAP. The question revolves around how to pass that out to my test program for validation? I have been able to pass out everything that is in the initial radius request, but nothing else. I have tried to modify the program line below to also send out %{employeeType} %{check:employeeType} %{request:employeeType} %{reply:employeeType} None of those work. I have even tried along the lines of %{modules.ldap.checkval} I can't seem to get it to work. Any help would be appreciated. Blow is a snip of the radius configuration file, and the little program I have seen in the user groups to echo out the responses that I am using to test. I have verified that if I return a '0' the request is accepted, and a '1' will reject the request... That part works fine. Also below is parts of the debug dump. I don't have the actual connection portion of the log as I am at a remote site currently, I can send that along also if people think it will be of benefit. Thanks for any assistance! - Reynold radius.conf ----------- exec { wait = yes input_pairs = request program = '${raddbdir}/test.sh %u %{Called-Station-Id}' } test.sh ------- #!/bin/bash echo "A: $1" echo "B: $2" echo "C: $3" exit 0 radiusd -X ---------- Module: Loaded exec exec: wait = yes exec: program = "/etc/raddb/test.sh %u %{Called-Station-Id}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Loaded LDAP ldap: server = "<ldapserver>" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "admin" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "pwd" ldap: basedn = "base-dn" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectClass=user)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userpassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP employeeType mapped to RADIUS employeeType conns: 0x8115218 Module: Instantiated ldap (ldap)

1 0

RE: Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

> > I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! > > > > When a juniper equipment try to authenticate it fails! (most other brand > > succed) They told me the field order are not send in the good order...> > First of all, I have no idea what you are doing from your explanation... > you are authenticating the PPPoE users, so I would think that you are > the ISP yourself.> As a mather of fact I'm working for an ISP ! > - What is the role of the Juniper device? (The device that is requesting > the connection? The device that is receiving the connection?)> - Exactly what kind of equipment is on the other end of the line?> - Which device is communicating with FreeRADIUS? Our equipment ISP is a Xedia router (Lucent AP) The authentication is done via Freeradius 0.9.3 running on mdk 10 The juniper equipment is on one of our client side, and it's the only equipment that won't authenticate at all In the radius users file we have the following: username(a)domain.com Auth-Type := Local, User-Password == "edc852" Service-Type = Login, Framed-Protocol = PPP, Framed-Address = 200.100.50.25, Xedia-DNS-Server = 175.200.225.250, XEDIA-PPP-ECHO-INTERVAL = 30 To answer the other question : No I didn't try with the latest version I'm having problems installing it (1.1.6) on this distribution (mdk 10) Thanks for your reply> > > : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1> > <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > RECV DECODE:(ethernet0/0)> > ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > Can I do something about this rapidely> > This does not look like a RADIUS problem. One of your PPP peers (the one > on the other end of the line) is mangling its responses and the device > from which you posted the logs is not accepting that (as it should, like > you already indicated yourself). This is a PPPoE problem.> > Gtnx> Marcel> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

2 1

SQL read_group patch - please apply!
by Roy Walker 27 Jul '07

27 Jul '07

FOR THE SAKE OF MY SANITY!!! Please apply the patch from http://readlist.com/lists/lists.freeradius.org/freeradius-users/2/10462. html, which was posted 3 and a half months ago! PLEASE, pretty please, with sugar on top! Thanks, Roy

2 1

Authorize after checking an LDAP attribute value
by Kenneth Marshall 27 Jul '07

27 Jul '07

Dear Freeradius users: I am trying to set up my authentication to allow only users with a particular value of a particular LDAP attribute to login. I am using freeradius 1.1.7 and I have the authentication going against Kerberos but I do not know how to have the radius server check the value of the attribute before allow access. If they are not in the group, it should send back the reject packet. Does anyone know how to perform a check item check against a particular LDAP attribute? Here is how I can set an attribute to the value and it works correctly: DEFAULT Auth-Type = Kerberos, NAS-IP-Address == 1.2.3.4, NAS-Port == 10 Connect-Info = "%{ldap:ldap:///dc=test,dc=com?testValue?sub?uid=%u}" Any suggestions would be appreciated. Regards, Ken Marshall

1 0

Openldap - Freeradius - auto vlan
by Fabio Silva 27 Jul '07

27 Jul '07

Hi all, i need to configure a system that works with openldap + freeradius and that assign the vlan automatic to the users... does anybody has any howto to do it? I read this one: http://www.freeradius.org/radiusd/doc/ldap_howto.txt but, the versions of the softwares is very old, and in some parts of the howto some options does not work. Regards, Fabio

2 2