March 2008 - Freeradius-Users - lists.freeradius.org

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

freeradius for windows + mssql problem
by rodolfor 30 Oct '08

30 Oct '08

Hi all. I have installed freeradius for windows (www.freeradius.net) and it works well. Now I want to connect the service to an mssql database in the same machine. The error I receive (starting in debug mode) is (using mssql.conf): rlm_sql (sql): Could not link driver rlm_sql_unixodbc: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[10]: sql: Module instantiation failed. Could someone help me ? thanks -- View this message in context: http://www.nabble.com/freeradius-for-windows-%2B-mssql-problem-tf3731743.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

Thank you and Diameter question
by Raj Patel 30 May '08

30 May '08

Hi People First thank you, I been reading this mailing list for some time and I found it great source of help I want to share some info with you and than ask a question We are slowly moving here into Java and starting to have Diameter requirements I found OpenBloX Java Diameter a great source of help (i think its GPL)and it seems to meet our requirements (* http://sourceforge.net/projects/openblox/**) * as anyone else been using it, I will be happy for some feedback I guess this is the right place for a feedback with so many AAA gurus around J so sorry again for my post Thanks In advance RP

4 4

Re: SNMP error
by Alan DeKok 20 May '08

20 May '08

Edvin Seferovic wrote: > I am also curious about the answer on this question ! Are there any plans to > implement AgentX protocol into freeradius project? No plans. At this point, the only plans for 2.0 are minor feature improvements and bug fixes. I plan on spending time working on the book, unless otherwise motivated. Alan DeKok.

3 5

Reply-Items in Ldap-Group
by Giovanni Lovato 30 Apr '08

30 Apr '08

I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user belonging to that group authenticates. Is that possible? Thank you!

3 5

ENV variables in external scripts
by rsg 16 Apr '08

16 Apr '08

Hi, I need to check an environmental varible with an external script. For example to capture Calling-Station-Id and check it in an external database using a perl script # ../users : . DEFAULT Auth-Type = None Exec-Program-Wait = "/root/check.pl %i", Reply-Message := "Valid Caller-Id, access granted -> %{Calling-station-Id}", Fall-Through = Yes : . How could I call this ENV variable in my perl script ("/root/check.pl) ? I unsuccessfully attempted the options given by ../docs/variables.txt. Please help with the correct syntax. Thanks in advance. rsg

5 27

encrypted passwords in users file
by ashish verma 16 Apr '08

16 Apr '08

Hi all, Is it possible to keep encrypted passwords in users file? For e.g. test Cleartext-Password := "test" Service-type = NAS-Prompt-User instead of cleartext can we have encrypted passwords here. Thanks. On Thu, Mar 13, 2008 at 4:32 PM, < freeradius-users-owner(a)lists.freeradius.org> wrote: > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > freeradius-users-owner(a)lists.freeradius.org. > > > > ---------- Forwarded message ---------- > From: "ashish verma" <ashish.scit(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Date: Thu, 13 Mar 2008 16:32:21 +0530 > Subject: encrypted passwords in users file > Hi all, > > Is it possible to keep encrypted passwords in users file? > > For e.g. test Cleartext-Password := "test" > Service-type = NAS-Prompt-User > > instead of cleartext can we have encrypted passwords here. > > Thanks. > > > > On Tue, Oct 23, 2007 at 2:03 PM, < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Are SHA-256 certificates supported? (hannu.lammi(a)wipsl.com) > > 2. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Alan DeKok) > > 3. Re: TTLS with Mutual Authentication (Alan DeKok) > > 4. Re: Are SHA-256 certificates supported? (Alan DeKok) > > 5. FreeRADIUS and SNMP questions (Geoffroy Arnoud) > > 6. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (primoz) > > 7. Re: FreeRADIUS and SNMP questions (Alan DeKok) > > 8. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Alan DeKok) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 23 Oct 2007 10:10:05 +0300 (EEST) > > From: hannu.lammi(a)wipsl.com > > Subject: Are SHA-256 certificates supported? > > To: freeradius-users(a)lists.freeradius.org > > Message-ID: <14671.192.100.116.143.1193123405.squirrel(a)mail.wipsl.com> > > Content-Type: text/plain;charset=utf-8 > > > > Hi, > > > > I need to set up a RADIUS server that accepts certificates which use > > SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have set > > up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the > > box. > > > > After verifying that EAP-TLS authentication works with SHA-1 > > certificates > > I switched to SHA-256 certificate that was created with OpenSSL 0.9.8b, > > the same that FreeRADIUS was compiled against. > > > > Here's a snippet of the log I got from my SHA-256 test: > > > > ===== > > --> verify error:num=7:certificate signature failure > > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error > > TLS Alert write:fatal:decrypt error > > TLS_accept:error in SSLv3 read client certificate B > > rlm_eap: SSL error error:0D0C50A1:asn1 encoding > > routines:ASN1_item_verify:unknown message digest algorithm > > ===== > > > > It would seem there's a problem somewhere. It may very well be in the > > client I'm using. > > > > So, I'd like to know if FreeRADIUS supports SHA-256 certificates? > > If it doesn't, is the support for them planned? > > > > thanks in advance, > > - Hannu > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 23 Oct 2007 09:12:03 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: Freeradius doesn't detect EAP when authenticating against > > MySQL > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471D9EC3.4090609(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > preem wrote: > > > So, what is a common practice to do this then? > > > > It's not. > > > > People store MD5 or crypt'd passwords when the ONLY authentication > > they're doing is PAP. i.e. Unix logins, where the user supplies a > > clear-text password to the authentication system. > > > > For many EAP types, people do NOT store MD5 or crypt'd passwords, > > because they're useless. > > > > > I understand its not very > > > safe nor sane to store passwords in clear text, thats why I wanted to > > avoid > > > that, however it seems inevitable. > > > > It is safe, sane, and common practice to store passwords in clear text. > > > > > I am managing a wired network for some 300 users, its a student dorm > > and the > > > university owns the network and they require authentication for the > > ease of > > > management and control. 802.1x felt like the right way to go, because > > we are > > > planning some wireless access points as well. There are HP's Procurve > > 2650 > > > switches in use. I choose mysql db backend, because I also created set > > of > > > PHP scripts, where users can change their passwords and admin can > > > add/del/modify user info. > > > So what can one do to avoid storing passes in clear text or is it sane > > > enough? The server also serves some web pages and dhcp requests. > > > > Ensure that no one has physical access to the system storing the > > passwords. Ensure that no one has network access to the system storing > > the passwords. > > > > I would also suggest running the RADIUS server and/or the MySQL server > > with passwords on a separate machine from the web/dhcp server. That > > way, if someone breaks into the web server, they won't have access to > > the passwords. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 3 > > Date: Tue, 23 Oct 2007 09:23:50 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: TTLS with Mutual Authentication > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471DA186.5030601(a)deployingradius.com> > > Content-Type: text/plain; charset=UTF-8 > > > > Zolotov, Eyal wrote: > > > By ?mutual authentication? I refer to the following authentication > > process: > > > > > > 1. The client authenticate the server > > > > Give the client the CA cert used to sign the server cert. > > > > > 2. The server authenticate the client > > > > Create a client cert, signed by the server cert. > > > > > 3. Only than ? the clients sends username + password using > > MSCHAPv2 > > > > In unlang, set: > > > > update control { > > EAP-TLS-Require-Client-Cert = yes > > } > > > > This forces the server to validate the client cert, which is normally > > not required for TTLS. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 4 > > Date: Tue, 23 Oct 2007 09:25:33 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: Are SHA-256 certificates supported? > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <471DA1ED.9050806(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > hannu.lammi(a)wipsl.com wrote: > > > I need to set up a RADIUS server that accepts certificates which use > > > SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have > > set > > > up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the > > > box. > > > > If OpenSSL supports it, AND the client supplicant supports it, it > > should work. > > > > > Here's a snippet of the log I got from my SHA-256 test: > > > > > > ===== > > > --> verify error:num=7:certificate signature failure > > > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error > > > TLS Alert write:fatal:decrypt error > > > TLS_accept:error in SSLv3 read client certificate B > > > rlm_eap: SSL error error:0D0C50A1:asn1 encoding > > > routines:ASN1_item_verify:unknown message digest algorithm > > > > That would seem to be an SSL issue. > > > > > So, I'd like to know if FreeRADIUS supports SHA-256 certificates? > > > If it doesn't, is the support for them planned? > > > > FreeRADIUS doesn't support SSL. It uses OpenSSL, which *does* support > > SSL. So if there are SSL issues, find out why OpenSSL doesn't like the > > TLS session. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 5 > > Date: Tue, 23 Oct 2007 10:04:23 +0200 (CEST) > > From: Geoffroy Arnoud <garnoud(a)yahoo.co.uk> > > Subject: FreeRADIUS and SNMP questions > > To: FreeRADIUS users <freeradius-users(a)lists.freeradius.org> > > Message-ID: <626622.60897.qm(a)web27314.mail.ukl.yahoo.com> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Hi all, > > > > I have 2 questions regarding FreeRADIUS and SNMP: > > > > 1/ Is it possible to run 2 FreeRADIUS servers on the > > same box, with SNMP support activated? I understand > > it's possible, using distinct values for smux_password > > parameter. > > > > 2/ Connecting FreeRADIUS to Net-SNMP using SMUX is > > quite easy. Has anyone connected FreeRADIUS with BMC > > PAtrol agent using SMUX? > > > > Thanks for any answer > > > > Geoff. > > > > > > > > _____________________________________________________________________________ > > Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! > > Mail > > > > > > ------------------------------ > > > > Message: 6 > > Date: Tue, 23 Oct 2007 10:08:22 +0200 > > From: primoz <primski(a)gmail.com> > > Subject: Re: Freeradius doesn't detect EAP when authenticating against > > MySQL > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: > > <ead364dc0710230108u752b2593h4a7885ca04e61ce7(a)mail.gmail.com> > > Content-Type: text/plain; charset="iso-8859-1" > > > > On 10/23/07, Alan DeKok <aland(a)deployingradius.com> wrote: > > > > > > preem wrote: > > > > So, what is a common practice to do this then? > > > > > > It's not. > > > > > > People store MD5 or crypt'd passwords when the ONLY authentication > > > they're doing is PAP. i.e. Unix logins, where the user supplies a > > > clear-text password to the authentication system. > > > > > > > > And PAP is not very safe and smart way to go as i read it. > > > > For many EAP types, people do NOT store MD5 or crypt'd passwords, > > > because they're useless. > > > > > > > > So, crypted passwords are usefull only in web applications? I read a lot > > lately about, how one should never store passwords in clear text, i > > guess > > that applies only to web apps. > > > > > I understand its not very > > > > safe nor sane to store passwords in clear text, thats why I wanted > > to > > > avoid > > > > that, however it seems inevitable. > > > > > > It is safe, sane, and common practice to store passwords in clear > > text. > > > > > > > > I do not have many experience with this, in fact its my first project on > > the > > matter. > > > > > I am managing a wired network for some 300 users, its a student dorm > > and > > > the > > > > university owns the network and they require authentication for the > > ease > > > of > > > > management and control. 802.1x felt like the right way to go, > > because we > > > are > > > > planning some wireless access points as well. There are HP's > > Procurve > > > 2650 > > > > switches in use. I choose mysql db backend, because I also created > > set > > > of > > > > PHP scripts, where users can change their passwords and admin can > > > > add/del/modify user info. > > > > So what can one do to avoid storing passes in clear text or is it > > sane > > > > enough? The server also serves some web pages and dhcp requests. > > > > > > Ensure that no one has physical access to the system storing the > > > passwords. Ensure that no one has network access to the system > > storing > > > the passwords. > > > > > > > > That will be no problem, since I'm the only one with physical access. > > > > I would also suggest running the RADIUS server and/or the MySQL server > > > with passwords on a separate machine from the web/dhcp server. That > > > way, if someone breaks into the web server, they won't have access to > > > the passwords. > > > > > > I am using VMWare server, so that won't require much work. > > > > Alan DeKok. > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > > Thanks again, for clearing this up. > > > > primski > >

3 9

frammed ip adress
by David Hláčik 14 Apr '08

14 Apr '08

Hi, in my working solution, i have pptp (vpn) configured with radius using LDAP. Each user has a value Framed IP Adress which will assign him exact IP adress. Currently i am rebuilding ldap structure to groups. And i want the users which will be members of group foo , to have dynamically assignet ip adresses from pool 10.123.40.0/255.255.255.0 . How can i achieve ? Which radius attributes should i use? Thanks a lot!

2 14

Re: rlm_opendirectory (FR 2.0.0)
by Steven Simon 12 Apr '08

12 Apr '08

I build it by adding rlm_opendirectory to the ./src/modules/stable file. Then, run: make distclean ./configure <stuff> etc… Everything you need should be on the desktop OS. Let me know if that is not the case. If you are on desktop, you'll probably want to set up a service access list. The magic group name that gets set up by the admin tools is: com.apple.access_radius. - Steven On Jan 22, 2008, at 7:54 AM, freeradius-users-request(a)lists.freeradius.org wrote: > From: Info <info(a)sparkmediagroup.com> > Date: January 22, 2008 7:50:57 AM PST > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Subject: rlm_opendirectory (FR 2.0.0) > Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > Hello all, > > Quick Qs about the experimental rlm_opendirectory module: > > * Has anyone built in this module successfully? > > * Is it possible to add this in without the other experimental > modules and, if so, what is the proper flag? (Note, I've tried on > separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, > and --with-modules="rlm_opendirectory" seemingly to no avail.) > > * Does the module need to be built against a server version of the > Framework or should I be able to build this from the libraries on > any os x workstation? > > Cheers, > > Jim

14 31