February 2008 - Freeradius-Users - lists.freeradius.org

Mysql Crypt passwords
by Dustin Schuemann 22 Feb '08

22 Feb '08

I have my username and passwords stored in my database as encrypted. How can I get freeradius 1 to work with this passwords. Dustin Schuemann . Network Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . AMS/The Support Dept 400 Ann St NW Suite 102 Grand Rapids, MI 49504 p. 616.235.0725 ext. 7007 e. schuemann(a)supportdept.com

2 1

(no subject)
by Dustin Schuemann 22 Feb '08

22 Feb '08

I am trying to setup freeradius 1. I have chap authentication working with mysql but pap authentication will not work with mysql. This is what I receive from the nas when someone trys to connect. Sending Access-Request of id 1 to 127.0.0.1 port 1812 User-Name = "johndstuder" User-Password = "i\374\304U\017\026\264\027:\367PU\262\t\356" NAS-IP-Address = 205.208.132.2 NAS-Identifier = "SouthfieldMI.TNT.01.sisna.com" NAS-Port = 4810 NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP State = 0x Calling-Station-Id = "2312387271" Called-Station-Id = "2317820869" Acct-Session-Id = "485914041" Ascend-Data-Rate = 24000 Ascend-Xmit-Rate = 50667 Attr-102 = 0x6931 Vendor-6969-Attr-69 = 0x6931 Vendor-6969-Attr-71 = 0x34 Proxy-State = 0x32 rad_recv: Access-Request packet from host 127.0.0.1:1814, id=1, length=197 User-Name = "johndstuder" User-Password = "i\374\304U\017\026\264\027:\367PU\262\t\356" NAS-IP-Address = 205.208.132.2 NAS-Identifier = "SouthfieldMI.TNT.01.sisna.com" NAS-Port = 4810 NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "2312387271" Called-Station-Id = "2317820869" Acct-Session-Id = "485914041" Ascend-Data-Rate = 24000 Ascend-Xmit-Rate = 50667 Attr-102 = 0x6931 Vendor-6969-Attr-69 = 0x6931 Vendor-6969-Attr-71 = 0x34 Proxy-State = 0x32 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 Sending Access-Reject of id 1 to 205.208.202.130 port 33758 Sending Access-Reject of id 1 to 127.0.0.1 port 1814 Proxy-State = 0x32 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=1, length=23 Proxy-State = 0x32 Sending Access-Reject of id 2 to 205.208.202.130 port 33758 Attached is my radiusd .conf

4 8

rlm_ldap and large AD structure issue
by Capelle, Mark (PCMC-GB) 22 Feb '08

22 Feb '08

I have an issue since pointing FR to a point higher in my AD tree (which will return more objects). I get the following error in my FR logs when I try to authenticate a user: Fri Feb 22 10:37:14 2008 : Error: rlm_ldap: ldap_search() failed: Operations error If I point the LDAP module deeper down my AD structure everything works fine. At first I thought it was due to the number of results that AD returns when queried via LDAP, but I modified this and now it returns everything via an ldapsearch. If I run an ldapsearch against my AD tree using the "sAMAccountName = <username>" and the correct account info returned immediately, so it does not necessarily appear to be an ldapsearch issue but rather an issue with the way rlm_ldap uses it. PEAP via ntlm_auth does not have any issue with the tree size either. Has anyone else encountered this and found a solution? I am fighting like hell to not install the corporate standard Cisco ACS box at my site, but if I can't manage to get this working I may have to finally cave :-(. Regards, Mark Capelle

2 1

Freeradius 1.1.7 and LDAP
by Mike O'Connor 22 Feb '08

22 Feb '08

Hi Guys I have a small issue with freeradius and ldap, its authenticating as 'access accept' customers which have placed a space at the beginning of there user name. This then causes there accounting data not to match and so we do not account for there data. This this a bug or a setting I have incorrectly set ? Mike

2 1

WRT54 and freradius with client-station-id
by Rob 22 Feb '08

22 Feb '08

Hi Can anybody force freeradius to work with Linksys WRT54G with combinantion of /user/password/macaddress? Combination user/password works OK but there is no Client-station-id in packet Access-request. Can anybody help?

2 1

avoiding ldap group search
by Gopinath Reddy N 22 Feb '08

22 Feb '08

Hi, Presently my system is configured in such a way that freeradius checks whether user is present in ldap server and then it searches to find the user group in ldap. Is there a way I can avoid this? Basically I want to see if a user is present in Ldap server if he is present I will go ahead and authorize him instead of finding his group etc. My ldap configuration in radiusd.conf at present is: ldap ldap_primary { server = 157.235.205.31 port = 389 identity = "cn=Administrator,cn=Users,dc=xyt,dc=dyx,dc=com" password = temppass basedn = cn=Users,dc=xyt,dc=dyx,dc=com filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = UserPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember==%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 5 access_attr_used_for_allow = no } Iam using radius server 1.1.6 version. Thanks in advance -gnr

1 0

eap authentication and cpu utilization
by Norbert Wegener 21 Feb '08

21 Feb '08

Simple authentication with login/password can be handled in large numbers with a recent cpu and freeradius. . EAP authentication on the other hand requires a great amount of cpu processing. Therefore I have a simple(?) question: Did someone already calcute the theoretically maximum number of eap authentications per second, that a recent x86 cpu is able to handle? Or did someone some practical research on that issue? Norbert Wegener

3 8

migrating from files to ldap
by Stieven.Struyf＠komatsu.eu 21 Feb '08

21 Feb '08

I am looking to migrate from text files to an ldap directory. What is the best/easiest way to do this: -setup ldap, copy all data to the ldap from the start -setup ldap and gradually migrate (is it possible to have part of the clients in flat files and others in ldap?) "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."

1 0

howto freeradius with ldap
by Nikolay G. Petrov 20 Feb '08

20 Feb '08

I read a included document about freeradius to ldap, but I a forigner and difficult undersand content. Can we suggest a any content with example, how can I use group to ldap? Thanks!

2 1

Cisco AV-PAIRS
by David W Bell 20 Feb '08

20 Feb '08

Hi there. My Saga continues.... I have freeRADIUS working with openLDAP and can log into CISCO kit and pass the priv-level from the raddb/users file. Is there any way that this information can be passed from the openLDAP user details instead? I am looking to do a single-signon system and it seems a little awkward to have to change a password (as is required in the users file) in 2 locations. Thanks David

5 12