April 2008 - Freeradius-Users - lists.freeradius.org

Re: Modifying User-Name and User-Password attributes in a module
by Stefan Winter 10 Apr '08

10 Apr '08

> > update request { > > User-Name := whatever > > User-Password := wh4t3v3r > > } > > > > in the pre-proxy section work? No need for a module then... And if I may > > ask, why would you need to modify name and password for proxying? If it's > > just about cutting out realms, there is an excellent realm module to do > > that for you. > > Yes, I can do that for static modifications, but in my case I have to > split the password and extract N bytes from it, which is a One-time > password for 2 factor authentication. I have to receive AUTH_ACK from > main radius server using the original password and then process the > second authentication stage with a 2 factor authentication manager using > that N bytes long OTP. (Connecting to 2FA server, sending OTP and > receiving result) This is why I need to do it in a module. unlang can do WAY more than just static replacements. Use a regular expression. if ( %{request:User-Password} =~ (.*)(......) ) update request { User-Password := %{2} } ... or something close to that. My syntax may be imperfect, maybe someone can provide a more bullet-proof/correct one. This here is supposed to mean: if the password is at least 6 characters long, change the password so that it only is those last six characters (%{1} would be: only the first part, without the trailing OTP). If it is less than six, this expression does nothing. I guess in your scenario you would want to discard those outright, because they don't contain a valid OTP. Add another rule for this case then. I'm ssuming your "N" to be = 6 because that's a common length for OTPs. Put more/less dots at the end of the regexp if you have a different setup. > Now, any ideas on which of the user-password vp's I have to change ? I'm trying to prepare you for the tough conclusion that you may not need any code changes here at all. That's why I changed the recipient to -users, not -devel. > I know this is ugly. So, If I define my own attributes, is it necessary > for main RADIUS server (which we proxy to) to have modified dictionary > files ? or it will simply ignore those unknown attributes ? It should. See RFC2865 section 5.26 and RFC5080 section 2.5 for details. But, to be honest, the pragmatically best approach is: TRY IT. Define a VSA, send it, and look what happens. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 09 Apr '08

09 Apr '08

Hi list, The problem was just the client (XP SP2). I change the client (Windows Vista) and it works (thanks Ivan). There is a hotfix for the problem in Micro$oft support website http://support.microsoft.com/kb/885453/en-us, but i installed it in XP and dont have success. Does anyone knows how to fix this problem with XP SP2? Thanks, Dácio ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 19:25:46 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > Try another client or JRadius Simulator. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 8/4/2008, "tiodacio" <tiodacio(a)bol.com.br> pise: > > >Clear-text > > > >---------- Início da mensagem original ----------- > > > > De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org > > Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org > > Cc: > > Data: Tue, 08 Apr 2008 18:51:42 +0100 > > Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > > > >> >I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. > >> > > >> > >> Is that password in the database encrypted or in clear text? > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> - > >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >> > > > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

EAP-TLS authentication with FreeRADIUS 2.0
by Erik Norgaard 09 Apr '08

09 Apr '08

Hi: I run FreeRADIUS 2.0 for EAP-TLS authentication on my wireless network, it works fine in my test setup but there are some pieces missing I can't figure out: 1. I'd like to add support for more than one root certificate 2. I'd like to log the certificate's distinguished name 3. I'd like to add a LDAP backend for further authentication The point is that I don't mind sharing my network as long as I know who people are, and it would release me of some certificate management if I can just add CA certificates. I'd like to log the distinguished name, as it is better when multiple CAs are used. It would be nice too, also to store a copy of any user certificate submitted, or log both email, distinguished name and possibly certificate serial number. I'd like the LDAP backend in order to add extra information for each user and possibly block a user without revoking the certificate, and other management tasks. Is this possible? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818 http://www.locolomo.org

2 1

Auth problem with password
by Mendel Mathieu 09 Apr '08

09 Apr '08

Hi, First sorry for my english... So we have a freeradius server and we have a problem of authentification. Sometimes we received in the log this kind of password if the user try to relog 2 or 3 times the log was successful but sometimes it don't work at all. For exemple : Auth: Login incorrect: [176384/3\226\336[\303\306\022\327\354\227\2215\241\3004y] (from client jm port 3 cli 00-40-CA-DE-17-78) Auth: Login OK: [176384/508830] (from client jm port 3 cli 00-40-CA-DE-17-78) Somebody have an idea why my password was received like that ?? Thanks a lot. -- Mendel Mathieu

1 0

Using tags (RFC2868)
by Imri Zvik 09 Apr '08

09 Apr '08

Hi, I'm trying to use tags, in order to group tunneling attributes. I've tried adding them like that: Tunnel-Preference:0 += "10" Tunnel-Preference:1 += "10" But when running the radius in debug mode (-X -x), I see that the following is being returned to the NAS: Sending Access-Accept of id 74 to 213.8.9.XXX port 21693 (....) Tunnel-Preference:0 += 10 Tunnel-Preference:0 += 10 Any ideas why?

2 3

SHA1 password, ldap authentication.
by antoine vallée 09 Apr '08

09 Apr '08

HI, Does anybody knows if ldap can make the authentication by itslef instead of radius? because my password a stored in sha in the ldap database, and i really nead to do md5. Certs can't bu used because it needs a PKI and it's not possible as well as eap-ttls because it requires securew2 (there's no eap-ttls module natively in windows) and we can't forced visitors to install a software in order to have access to some local ressources. So the only solution is eap-md5... I've heard something about ldap, that maybe it's possible to give the cleartext password to the ldap, then the ldap will find the shapassword and return to the radius server a message for the authentication. Is this possible? If so, how can I do that? Because last time, i've been told that the only solution to do login/pwd authentication was eap-ttls+securew2 (for xp) or to store my password in cleartext in the ldap database.. but they're both inapropriate. any ideas on the subject? Thanks, Antoine. _________________________________________________________________ Découvrez les profils Messenger de vos amis ! http://home.services.spaces.live.com/

2 1

Configuring multiple, chained EAP methods (i.e. EAP-TTLS-EAP-MD5-EAP-TNC)
by ingo.bente＠inform.fh-hannover.de 09 Apr '08

09 Apr '08

Hi, is it possible to configure multiple eap methods that must all be executed for a user? I.e., I am thinking of something like: - establish a TTLS tunnel - do EAP-MD5 for user authentication - do EAP-TNC for platform authentication Currently, I just managed to do either EAP-MD5 or EAP-TNC inside the TTLS tunnel, not both. I see no option in the config files where multiple eap methods can be added. Thanks, Ingo

2 1

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 08 Apr '08

08 Apr '08

Clear-text ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 18:51:42 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > >I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. > > > > Is that password in the database encrypted or in clear text? > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 08 Apr '08

08 Apr '08

Ivan, Thats the problem, i have sure the password its not wrong. The users test and test(a)some.domain.com have the same password. The first is authenticated, the second no. The problem is when my user has a domain and i need a domain because my radius will make proxy. I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. Dácio ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 15:41:01 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > >modcall: entering group MS-CHAP for request 6 > > rlm_mschap: Told to do MS-CHAPv2 for teste(a)unesp.br with NT-Password > > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > > > > Password is wrong. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

Freeradius 2.0.3 - radtest utility
by Jeff Green 08 Apr '08

08 Apr '08

Hi, Been using Freeradius for 5+ years now and I'd just like to say it's great software, many thanks to Alan et al for all their hard work ! I'm currently investigating moving from RHEL4 / Postgresql 8.1 / FR 1.1.6 to Centos5.1 / Postgresql 8.3 / FR 2.0.3 - fell down a couple of holes (config wise) but I think I've got everything working OK now. I've found that the radtest client in FR 2.0.3 isn't displaying the Accept / Reject message any more. However NTRadPing against the same server works OK. Is this me or a feature ? Many Thanks, -- Jeff Green Network Support Manager SAPIENS (UK) Ltd t: +44 (0)1895 464228 f: +44 (0)1895 463098 "the mirrors of my eyes are always focused in surprise, my mouth is covered by a smile" ------------------------------------------------------------------------ Confidentiality Note: The information contained in this email and document(s) attached are for the exclusive use of the addressee and may contain confidential, privileged and non-disclosable information. If the recipient of this email is not the addressee, such recipient is strictly prohibited from reading, photocopying, distribution or otherwise using this email or its contents in any way. Please notify the Sapiens (UK) Ltd. Systems Administrator via e-mail immediately at networksupport(a)sapiens.co.uk, if you have received this email in error. Disclaimer: The views, opinions and guidelines contained in this confidential e-mail are those of the originating author and may not be representative of Sapiens (UK) Ltd. ------------------------------------------------------------------------

2 1