April 2008 - Freeradius-Users - lists.freeradius.org

Re: Possible to limit user access to different types of authentication?
by Ryan 22 Apr '08

22 Apr '08

Hi Alan, Thanks for the update. I have read through "man unlang" as well. Overlooked on the part on the additional "Cisco-AVPair" attribute as it was only available after authentication is done. I have worked around it using the proxy-inner-tunnel method to terminal the EAP on the front radius and then proxy MS-CHAP to an internal radius that will do an LDAP bind with an additional attribute. As the front radius will also handle EAP requests that will not be handled by the internal radius, will it just proxy the EAP request based on the domain or it will terminate and forward to my internal radius instead? Thanks/Regards, Ryan On Fri, Apr 18, 2008 at 4:44 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > Date: Fri, 18 Apr 2008 07:55:42 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Possible to limit user access to different types of > authentication? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480837DE.5010400(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Ryan wrote: > > Did some further searching on the listing and noticed that it is > > possible to do a string compared in the authorize and authenticate > > sections. > > $ man unlang > > > However running radius in debug mode will return the following error. > > > > (Attribute Cisco-AVPair was not found) > > Because the attribute isn't in the request. Go look at the packet > that the server received. There is no such attribute in it. > > > I know that it is possible to match the Cisco-AVPair in the users > > file. Can we do the same in the authorize/authenticate sections as > > well? > > Yes. This is documented in the "unlang" man page. But if the > attribute isn't in the request, you can't compare it to anything. > > Alan DeKok.

2 1

Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 22 Apr '08

22 Apr '08

hi, I am using free Radius 2.0.3. I m configured my AAA through rlm_perl. I need to do the authorization by using the following attributes. Digest-Realm Digest-Method Digest-Uri Digest-Nonce Digest-Nonce Digest-Response Unfortunately i did not get any value from these attributes when i called using $RAD_REQUEST. Please tell me any idea to get these values. Here is the piece of authorization code that i've used. sub authorize { my $nasuser1; my $nasuser; my $naspass; my $dUserName; my $dRealm; my $dMethod; my $dUri; my $dNonce; my $nameindex; my $dResponse; $nasuser = $RAD_REQUEST{'User-Name'}; $naspass = $RAD_REQUEST{'User-Password'}; $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; my $dPassword; my $ha1; my $ha2; my $a1; my $a2; my $a; my $sqltest; my $sthtest; my $user = "user"; my $password = "password"; my $dbhtest=DBI->connect('dbi:ODBC:MSSQLDSN',$user,$password,{PrintError=>0,RaiseError=>0}); my $dbh = DBI-> connect('dbi:ODBC:MSSQLDSN', $user, $password, {PrintError =>0, RaiseError =>0}); my $sql = qq/select * from testing where UserName = '$nasuser'/; my $sth=$dbh->prepare($sql); if($dbh) { $sth->execute(); if(my $row = $sth->fetchrow_hashref) { #password from database against the username $dPassword=$row->{UserPassword}; $a1=$dUserName.':'.$dRealm.':'.$dPassword; #first part of the hash calculated. $ha1=md5($a1); $a2=$dMethod.':'.$dUri; #second part of the hash calculated. $ha2=md5($a2); #final string to be hashed. $a=$ha1.':'.$dNonce.':'.$ha2; #final response to be checked with the digest-response $a=md5($a); if($a eq $dResponse) { $RAD_REPLY{'Reply-Message'} = "Accepting Users"; return RLM_MODULE_OK; } else { $RAD_REPLY{'Reply-Message'} = "Incorrect Password"; return RLM_MODULE_REJECT; } }#End of row fetch else { $RAD_REPLY{'Reply-Message'} = "Incorrect Username"; #$RAD_REPLY{'Reply-Message'} = $nasuser; return RLM_MODULE_REJECT; }#End of else }#end of if database connection else { $RAD_REPLY{'Reply-Message'} = "Cannot connect to database"; } }#End of authorization subsection With Regards Elangbam Johnson

1 0

Freeradius/Netscreen help
by Mario Carassale 22 Apr '08

22 Apr '08

Hi All i am new to this list, so please understand my funny question :-) I have freeradius running fine and i want to authenticate a netscreen firewall against it. My question is, how can i get user privileges from the radius when a user logs into the firewall? If a set on the firewall to get get privilege from the RADIUS server, the login fails, i suppose this is due to not admin provileges. Thank you for all your help. Mario

5 4

imap + 802.1x password
by Enrico Fanti 22 Apr '08

22 Apr '08

Hi, I'm using freeradius 1.1.7, whith mysql to authenticate imap clients and wireless clients with peap method 8021x. For this to work, I created this user in radcheck table: mysql> select * from radcheck where username='fanti'; +------+----------+----------------+----+---------------+ | id | UserName | Attribute | op | Value | +------+----------+----------------+----+---------------+ | 7386 | fanti | Crypt-Password | := | 6yKjjYeLM2Y1E | | 6658 | fanti | Expiration | == | 1221515700 | | 7387 | fanti | User-Password | := | pippo | +------+----------+----------------+----+---------------+ I add the User-Password for the 8021x authentication (it needs clear text password). If I use the ":=" operator in tw0 password attributes It's OK , or I'm wrong ?? (If I use the "==", only the 8021x authentication it's ok) Thank you enrico

2 2

location of source files in windows freeradius
by sanjeev.kumarroy＠wipro.com 22 Apr '08

22 Apr '08

Hi, I tried installing freeradius 1.1.7 in windows XP machine. Here I am not able to locate the source files as was available in Linux. Can you please guide me by telling if the source file gets installed to some particular directory in windows when we install the freeradius exe. Or is there any website where I can get the source files. Any help is highly appreciated. Thanks The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 6

Q: on attr_filter.accounting_response
by rsg 22 Apr '08

22 Apr '08

Hi, I'm using FR 2.0.2. I require that the Accounting response includes "Reply-Message", Could one simply add Reply-Message =* ANY into ../raddb/attrs.accounting_response file to achieve? .. ------------------------------------------------------------------------------------------- Accounting Section: accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Return an address to the IP Pool when we see a stop record. # main_pool sqlippool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf #sql # # Instead of sending the query to the SQL server, # write it into a log file. # #sql_log # Cisco VoIP specific bulk accounting #pgsql-voip # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } ------------------------------------------------------ I see that Reply-Message is supressed only Proxy-State is carried by the accounting response excerpt of packet Capture: ------------- Radius Protocol Code: Accounting-Response (5) Packet identifier: 0xd (13) Length: 26 Authenticator: A6D7BFC84BEF5B6A8B1047F4435DAA16 Attribute Value Pairs AVP: l=6 t=Proxy-State(33): 30303064 Proxy-State: 30303064 ----------------- Commenting "attr_filter.accounting_response" from the accounting section has the same effect. What have I done missed in this? Thanks in advance for your help.

2 2

Dialup-Admin Alternatives?
by JaxxMaxx the Elder Druid 22 Apr '08

22 Apr '08

Greetings folks! I'm wondering if there is something else that other folks are using to allow GUI administrative access to FreeRadius w/MySQL-stored user databases. I'm noticing that the Dialup-Admin web interface is leaving a LOT to be desired, and doesn't appear to be keeping up with the rest of the FreeRadius updates. I had to modify some of the .sql schemas, and I'm still getting PHP errors on some of the interface pages. ** Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 ** Does anyone still use this interface with the current 2.0.3 ? What other methods do you use to allow non-SQL savvy administrative folks to add and remove valid usernames for authentication? Basically, this web interface is the last thing standing in my way of fully implementing the newer version of FreeRadius (needed to move to different hardware, supporting a captive portal device on a Wifi network)

2 1

Juniper ERX dictionary
by Giovanni Lovato 21 Apr '08

21 Apr '08

We need to use a dictionary for JunOS 8.2, but the syntax seems to be non-standard and FreeRADIUS can't recognize it: http://pastebin.com/m6916d351 How can I translate that dictionary or make FreeRADIUS recognize it? Thank you, G.L.

2 2

FreeRADIUS + 802.1X wireless rollout questions
by Walter Gould 21 Apr '08

21 Apr '08

List, Our institution (a 4 yr. state college) is planning on implementing a 802.1X wireless network in the coming months. We have a test network in place now and all seems to be working well. We have two FreeRADIUS servers. We followed the "FreeRADIUS Active Directory Integration HOWTO <http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO>" from the wiki to get freeradius talking with our centrally managed AD servers for authentication. We are using freeradius version 2.0.3. The primary server specs are: Intel 2GHz Xeon QC, 2GB installed RAM. The secondary is currently running on a vm. I hope to purchase a piece of hardware similar to the one above to run this on in the near future. Here's where my concerns lie - I am concerned about how many simultaneous authentication requests that a single Freeradius server can handle. I have read the "Testimonials" and the "Why we're #1" pages on the freeradius site - which says there are numerous sites using freeradius to support more than 10,000 or 20,000 users. Our school currently has around 21,000 students on our campus. Of that 21,000 - there is usually around 1000 users logged into our wireless network at any given time, however, that number continually increases. Questions: 1. Do any of you have feedback/thoughts/experience on how our freeradius server may handle the auth. request load given our situation? 2. Do you think that we may need to tweak any of the settings in the radiusd.conf file (max_requests, max_request_time, etc)? 3. Any other advice/suggestions you have or think of would be welcome and appreciated. Thanks, Walter -- Walter Gould Info. Tech. Specialist Office of Information Technology Auburn University, AL

3 3

EAP SIM - fresh RANDs
by sateesh busam 21 Apr '08

21 Apr '08

Hi, Is free radius compliant to RFC 4186? In particular, with respect to section 10.9 which says, The EAP server MUST obtain fresh RANDs for each EAP-SIM full authentication exchange. More specifically, the server MUST consider RANDs it included in AT_RAND to be consumed if the server receives an EAP-Response/SIM/Challenge packet with a valid AT_MAC, or an EAP-Response/SIM/Client-Error with the code "insufficient number of challenges" or "RANDs are not fresh". However, in other cases (if the server does not receive a response to its EAP-Request/SIM/Challenge packet, or if the server receives a response other than the cases listed above), the server does not need to consider the RANDs to be consumed, and the server MAY re-use the RANDs in the AT_RAND attribute of the next full authentication attempt. If compliant, how to configure it to generate fresh RANDs? Thanks, Sateesh Forgot the famous last words? Access your message archive online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0