May 2008 - Freeradius-Users - lists.freeradius.org

PAM for RADIUS
by Ravi setty 07 May '08

07 May '08

Hi, We are trying to authenticate Solaris box using RADIUS user accounts, and configured PAM to send ssh requests to RADIUS. Eventhough RADIUS accepts the user request by sending Access-Accept packet, ssh is not logging in to the system. Can anybody know what to configure to make Radius users to login to solaris box. Thanks, Ravi -- Thanks&Regards, Ravi Setti

2 1

Possible to update radius reply with additional attributes that are dynamic
by Ryan 07 May '08

07 May '08

Hi, I have a radius running on 1.1.3 with authentication via LDAP. Does anyone knows if it is possible to add attributes to the radius reply based on the radiusClass from LDAP as well as the NAS-IP? Thanks/Regards, Ryan

1 0

small problem with unlang (2.0.4)
by Pshem Kowalczyk 07 May '08

07 May '08

Hi, I have the following entry in the config (post-proxy section on our proxy server) if ("%{proxy-reply:Framed-IP-Address}" =~ /([0-9]+).([0-9]+).([0-9]+).([0-9]+)/){ if (\ ( "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" >= 3417153537 && \ "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" <= 3417153790 ) \ ) { update reply { Reply-Message := "IP in range" } } else { update reply { Reply-Message := "IP not in range" } attr_filter.strip-ip } During debugging I've noticed that the condition is always met, even though it shouldn't (ip in question 103.109.246.254) ++++? if ("%{proxy-reply:Framed-IP-Address}" =~ /([0-9]+).([0-9]+).([0-9]+).([0-9]+)/) expand: %{proxy-reply:Framed-IP-Address} -> 103.109.246.254 ? Evaluating ("%{proxy-reply:Framed-IP-Address}" =~ /([0-9]+).([0-9]+).([0-9]+).([0-9]+)/) -> TRUE ++++? if ("%{proxy-reply:Framed-IP-Address}" =~ /([0-9]+).([0-9]+).([0-9]+).([0-9]+)/) -> TRUE ++++- entering if ("%{proxy-reply:Framed-IP-Address}" =~ /([0-9]+).([0-9]+).([0-9]+).([0-9]+)/) +++++? if (( "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" >= 3417153537 && "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" <= 3417153790 ) ) expand: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4} -> 103 * 16777216 + 109 * 65536 + 246 * 256 + 254 expand: %{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}} -> 1828779774 ?? Evaluating ("%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" >= 3417153537 ) -> FALSE ? Skipping ("%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" <= 3417153790 ) +++++? if (( "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" >= 3417153537 && "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" <= 3417153790 ) ) -> TRUE +++++- entering if (( "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" >= 3417153537 && "%{expr: %{1} * 16777216 + %{2} * 65536 + %{3} * 256 + %{4}}" <= 3417153790 ) ) ++++++[reply] returns updated As you can see the first part of the check evaluates to FALSE and freeradius skips the second part, but surprisingly the whole expression evaluates to TRUE. Have I written the condition incorrectly or is it an actual bug? kind regards Pshem

2 2

Need advise on consolidating
by Nelson Serafica 06 May '08

06 May '08

Is it possible to append a domain depends on the CalledStationId? I have several dialup numbers and I have a proxy radius running by freeradius. I'll be consolidating 2 radius to 1. They have different dial up number. Since it will become 1, I want to implement restriction so that they cannot use the each others dialup number. I want to implement this in the proxy radius. Can someone help me? ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

1 0

How to delete a attribute
by Mikhail Novikov 06 May '08

06 May '08

Hello! How can I delete a attribute in request via unlang code? Michael

3 2

Certificate Properties.
by Andrew Olson 06 May '08

06 May '08

Are there attributes available to get at properties of a certificate. I want to look at properties like Subject DN, Serial number, etc. So, somewhere in the FR config, I could do something like '%{cert-serial-number} == blah'. Thanks, Andrew Olson

2 11

solaris login using radius
by Devaraj Hattibelegal Patil 06 May '08

06 May '08

Hi All, I want login to solaris box using radius account. So I have configured PAM module in solaris box to talk to radius daemon. Even after sending access accept from radius, I am not able to login to solaris box using radius accounts using ssh. I am getting access denied. L Am I need to send specific VSA's to login solaris? Any help in this regard would be of great help. Thanking you in advance. ------Start Radius log---- auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 230 to 127.0.0.1 port 10019 Unix-FTP-UID := 300 account-enabled := No account-expiration-date := "Dec 31 1969 19:00:00 EST" external-radius-used := No last-password-change-date := "Dec 31 1969 19:00:00 EST" password-change-required := No password-expiration-interval := 0 Unix-FTP-GID := 400 Unix-FTP-Group-Ids := "400" Unix-FTP-Group-Names := "emsgroup" Unix-FTP-Home := "/export/home/emsadmin" Unix-FTP-Shell := "/bin/bash" Finished request 0 Going to the next request ------End Radius log----

1 0

ignore the case insensitive in the users-file with using rlm_fastusers and EAP-TLS
by Khaiti, Issam (ext) 06 May '08

06 May '08

hallo, I´d like to know, how can I adjust the freeradius configurations to ignore the case insensitive for all Identifiers existing into the file "/raddb/users" using rlm_fastusers with EAP-TLS. User-Names in the Access-Requests should namely mached with the Identifiers, which are configured in lower case. Thanks for your help Issam

1 0

problem with postgres and 2.0.4
by A.L.M.Buxey＠lboro.ac.uk 06 May '08

06 May '08

hi, anyone else noted this - i'll file a bug if theres another noted problem. we are using the database to hold NAS entries. just upgraded to 2.0.4 and radiusd wont start. log shows this: Mon May 5 14:55:55 2008 : Info: rlm_sql (xbase): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Mon May 5 14:55:55 2008 : Info: rlm_sql (xbase): Attempting to connect to radius@localhost:/xbase Mon May 5 14:55:55 2008 : Error: sql_postgresql: calling unimplemented function further debugging with radiusd -X shows the following (we have 10 SQL threads open - default) rlm_sql (xbase): Attempting to connect rlm_sql_postgresql #9 rlm_sql (xbase): Connected new DB handle, #9 rlm_sql (xbase): Processing generate_sql_clients rlm_sql (xbase) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM xbaseschema.naslist rlm_sql (xbase): Reserving sql socket id: 9 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 39 , fields = 5 rlm_sql (xbase): Read entry nasname=127.0.0.1,shortname=localhost,secret=topsecretstuff sql_postgresql: calling unimplemented function this is postgres 8.1.11 - no change to schema between previous versions - all looks fine and a quick rollback to 2.0.3 and the daemon is fine. 2.0.4 postgres issue? alan

2 2

Machine authentication
by George KNIGHT 06 May '08

06 May '08

Hello All, I've been trying to setup an environment where WinCE OS client computers authenticate themselves using wireless connection to the freeradius v.2.0.3 server with PEAP. The authenticator will eventually be Cisco AP1242 AP but for now I am using Symbol AP300. The way that I want to set this up is that the computers with WinCE OS will be used by users who shouldn't be asked any user name or input. All I want is WinCE machines to authenticate themselves with freeradius through certificates. Basically, I want machine authentication as opposed to user authentication. Is there specific changes I have to do on conf files for this to work? Or any change at the client machines? Thank you. George Knight

1 1