May 2008 - Freeradius-Users - lists.freeradius.org

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

freeradius for windows + mssql problem
by rodolfor 30 Oct '08

30 Oct '08

Hi all. I have installed freeradius for windows (www.freeradius.net) and it works well. Now I want to connect the service to an mssql database in the same machine. The error I receive (starting in debug mode) is (using mssql.conf): rlm_sql (sql): Could not link driver rlm_sql_unixodbc: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[10]: sql: Module instantiation failed. Could someone help me ? thanks -- View this message in context: http://www.nabble.com/freeradius-for-windows-%2B-mssql-problem-tf3731743.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

PopToP VPN + FreeRadius
by Victor Asavei 04 Jul '08

04 Jul '08

Hello, I am running a PopTop server with FreeRadius for authentification. I have configured FreeRadius to use Oracle and I can successfully authenticate the users that connect to the VPN. My questions is how can I after a certain-period of time or after a certain condition is true (for example a value in the db in a table reaches 0) to disconnect a certain user ? Reading the documentation from the site I understood that the NAS server is responsable with this. How can i then do this using PopTop & FreeRadius ? Any help or hint is appreciated ! Thank You

4 6

FreeRADIUS 2 not listening on right port
by Casartello, Thomas 18 Jun '08

18 Jun '08

I just upgraded by FreeRADIUS server from the version 1 to version 2 family. I have the listen {} statements configured as follows: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 41045 Listening on accounting address * port 54893 Listening on proxy address * port 38374 Ready to process requests. However as you can see if always listens on random ports. What am I doing wrong? I am using version 2.0.2 which was distributed with Fedora 9. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

10 41

FR2.0.3 - UCD-SNMP 4.2.7 communication does not work on 64 bits Freebsd (but does on 32 bit Freebsd)
by Thomas Fagart 12 Jun '08

12 Jun '08

Hello, I've got several Freeradius servers running on Freebsd. I'd like to get them discuss with SNMP agent for statistics (using SMUX). I've notice that this is working on 32 bits Freebsd -------------------- portable-taf# snmpwalk -v 1 -m /usr/local/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.txt -c public localhost radiusAuth radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServIdent.0 = FreeRADIUS Version 2.0.3, for host i386-portbld-freebsd7.0, built on May 18 2008 at 17:05:17 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServUpTime.0 = Timeticks: (16500) 0:02:45.00 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServResetTime.0 = Timeticks: (16500) 0:02:45.00 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServConfigReset.0 = running(4) radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalAccessRequests.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalInvalidRequests.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalDupAccessRequests.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalAccessAccepts.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalAccessRejects.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalAccessChallenges.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalMalformedAccessRequests.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalBadAuthenticators.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalPacketsDropped.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServTotalUnknownTypes.0 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthClientAddress.1 = IpAddress: 127.0.0.1 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthClientAddress.2 = IpAddress: 127.0.0.1 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthClientID.1 = localhost radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthClientID.2 = localhost radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessRequests.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessRequests.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServDupAccessRequests.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServDupAccessRequests.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessAccepts.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessAccepts.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessRejects.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessRejects.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessChallenges.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServAccessChallenges.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServMalformedAccessRequests.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServMalformedAccessRequests.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServBadAuthenticators.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServBadAuthenticators.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServPacketsDropped.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServPacketsDropped.2 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServUnknownTypes.1 = Counter32: 0 radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthClientTable.radiusAuthClientEntry.radiusAuthServUnknownTypes.2 = Counter32: 0 ----------------------------------------------------------------- But on 64 bit Freebsd, I only get server uptime information : Below Extract of the walk request --------------------------------------------- snmpwalk -v 1 -m /usr/local/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.txt -c public localhost radiusAuth radiusMIB.radiusAuthentication.radiusAuthServMIB.radiusAuthServMIBObjects.radiusAuthServ.radiusAuthServIdent.0 = FreeRADIUS Version 2.0.3, for host amd64-portbld-freebsd7.0, built on May 18 2008 at 17:39:21 ----------------------------------------------- radius -X output Waking up in 0.9 seconds. Waking up in 0.9 seconds. Waking up in 0.9 seconds. Waking up in 0.9 seconds. SMUX message received type: 161 rest len: 28 SMUX Request OID: 1.3.6.1.2.1.67.1 SMUX getresp send: 130 Waking up in 0.2 seconds. SMUX message received type: 161 rest len: 33 SMUX Request OID: 1.3.6.1.2.1.67.1.1.1.1.1.0 SMUX getresp send: 10416 Waking up in 0.2 seconds. SMUX message received type: 161 rest len: 33 SMUX Request OID: 1.3.6.1.2.1.67.1.1.1.1.1.0 SMUX getresp send: 10416 Waking up in 0.2 seconds. SMUX message received type: 65 rest len: 1 SMUX_CLOSE with reason: 2 SMUX connect try 1 SMUX SMUX open oid: 1.3.6.1.4.1.11344.1.1.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 2 SMUX SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 2 Waking up in 0.2 seconds. SMUX message received type: 67 rest len: 4 Waking up in 0.1 seconds. SMUX message received type: 67 rest len: 4 Waking up in 0.9 seconds. Waking up in 0.9 seconds. snmpd.log // [smux_accept] accepted fd 8 from 127.0.0.1:59629 accepted smux peer: oid enterprises.11344.1.1.1, password verysecret, descr radiusd Do you know if this is a know bug ? Or I missed something. I've tested this behaviour on differents releases (6.3, 6.1 and 7.0) of Freebsd. Seems this is always the same issue (non complete value on 64 bits OS, and behaviour ok on 32 bits. Regards Thomas

3 14

Forcing lowercase User-Name with rlm_perl
by Chris 12 Jun '08

12 Jun '08

I basically want User-Name to be forced to lowercase for the duration of the request. I have done the following: modules { perl { module = my_perl_module.pm } } authorize { preprocess perl ... } Pertinent contents of my_perl_module.pm: sub authorize { $RAD_REQUEST{'User-Name'} =~ tr/A-Z/a-z/; return RLM_MODULE_OK; } This seems to do what I want. Is it the correct way to accomplish this task? Thanks.

4 7

FR and PEAP question
by Matt Ashfield 11 Jun '08

11 Jun '08

Hi, We're looking into using PEAP with MSChapV2, instead of PAP (don't want to use the SecureW2 client anymore) so are investigating ways to store the password in LDAP. According to http://deployingradius.com/documents/protocols/compatibility.html ,the options are storing the password in Clear-Text or in an NT Hash (ntlm_auth). In talking with our LDAP people, I was told the following: SunOne does not support nt-hash passwords. Supported formats are CLEAR, CRYPT, DES, NS-MTA-MD5 (Netscape MD5), SHA, and SSHA. Fedora Directory Server 1.1.0 supports CLEAR, CRYPT, DES, MD5, NS-MTA-MD5, SHA, SHA256, SHA384, SHA512, SSHA, SSHA256, SSHA384, and SSHA512. It sounds to me like if we want to do PEAP/MSChapV2 we'd have to store the password in cleartext? I would just like to verify this via this list. Any advice is appreciated. Thanks Matt mda(a)unb.ca

5 14

EAP TLS Authentication failing!!!! "Unknown CA"
by Avinash Patil 07 Jun '08

07 Jun '08

Hi All, I am trying to use authenticate one embedded WLAN device with using freeRadius server 2.0.4 I have radiusd.conf,client.conf files as per my configuration. I have created certificates using bootstrap script.Values in ca.cnf,client.cnf and server.cnf have been modified accordingly. I have copied ca.pem, client.pem to device filesystem.Private key has been extracted from client.pem. Since last week I am trying to authenticate freeradius server but I am getting error like "Unknown CA". Please see attached radius logs. When I verify client certificate using "openssl verify -CApath ca.pem client.pem" I see following error: Error 20 at depth 0 lookup : unable to get local issuer certificate. Device is already tested with Windows 2003 server's TLS(of course with different set of certificates :<) ) and it is working fine. What will be possible reason behind this and where am I going wrong? Appreciate your help. Thanks and Regards, Avinash.

2 1

Re: OT: EAP-TTLS - Problem with securew2 and Vista
by Sergio Belkin 01 Jun '08

01 Jun '08

2008/4/27 Tural Kaptan <tural.kaptan(a)alto.com.tr>: > > Dear Sergio, > > Sorry for the delay in the reply, I just wanted to drop you a note related > to the problem that you have mention in your e-mail to freeradius-users > lists on 18th of April .. > > We had experienced the same problem with some Vista machines - especially > 64bit versions .. For this we have used differently compiled version of > SecureW2 that you can download from here http://www.hofhom.nl/securew2/ .. > We are using this version now for some of Vista clients with no any problem > .. If you have already successfully solved the problem in different way, can > you please drop me a note on this .. If you already solved in the same way, > just ignore this e-mail .. > > Thanks and BR, > > Tural Kaptan > Technical Manager > ALTO/IT Solutions > Hi Tural, Sorry for reply to the list, but I think that maybe it's useful for someone. I'll try this version, since enter user and password in securew2 instead of waiting for dialog box appears didn't solve the problem. Thanks in advance. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1