May 2008 - Freeradius-Users - lists.freeradius.org

radius x509 authentication + LDAP ?
by Riccardo Veraldi 26 May '08

26 May '08

Hello, I am actually using freeradius with EAP-TLS and x509 user certificat authentication. After authentication I would like to chack the common name or email address propertires of te certificate againsta LDAP, to authorize the user connection. is it possible to do this ? I tyed but it seems not working in my configuration. any hints ? thank you very much Riccardo

3 12

Groups Problem
by radius＠e-comec.com 26 May '08

26 May '08

Hey, one question: I am working on FreeRadius 2.0.4 with mysql I have following situation: I have created 2 groups and I configured parameters for them in radgroupreply. Then I added one user, and added him to those 2 groups in radusergroup table. When I authenticate with that user, I get only parameters from the first group, but not from both. I tried to place a Fall-Through parameter in both groups, but it didn't help.. How can I make that the user by authentication gets parameters from 2 (or more groups) that he is in? Thx CoMeC

4 4

need info on EAP-SIM
by Kalyani Garigipati (kagarigi) 26 May '08

26 May '08

Hi Alan, Thanks for the reply .But I am still getting the same errors.I have put the lines as follows. I did not put any balnk lines in between . the editor in the mail is shoing like that. DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7 I am getting the following errors [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items Module: Checking session {...} for more modules to load Regards, Kalyani -----Original Message----- From: freeradius-users-bounces+kagarigi=cisco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+kagarigi=cisco.com@lists.freeradius.org ] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, May 26, 2008 3:30 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 37, Issue 125 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] (Riccardo Veraldi) 2. chap for ldap (Zahra Bahar) 3. Re: need info on EAP-SIM (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Mon, 26 May 2008 11:26:26 +0200 From: Riccardo Veraldi <Riccardo.Veraldi(a)cnaf.infn.it> Subject: Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <483A8242.3030708(a)cnaf.infn.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I wrote a rule in users file to reject login for users being in a certain grup, but still access is given DEFAULT Ldap-Group == "cn=rjgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have dialup access" user can authenticate succesfully with EAP-TLS. User is found in LDAP tree, user is part of ldap group rjgroup, but still is not being rejected. What am I missing ? thanks Riccardo Alan DeKok ha scritto: > Riccardo Veraldi wrote: > >> Not all the people having a certificate should authenticate on my WiFi >> infrastructure. >> These certificates are for general purpose, so also for EAP-TLS, >> > > Then your PKI system is wrong. You should NOT issue certificates for > multiple purposes. > > You should issue RADIUS (EAP-TLS) certificates ONLY to the people who > are allowed to use EAP-TLS. > > >> but some user in my case should not be authenticated. >> To select which are the users to be authenticated and which are not, >> I wanted to use LDAP properties. If a user is in the LDAP directory >> it should pass, if it is not, it should be refused, but at the end, I am >> unable to do it. >> > > Did you read my statement about using LDAP groups? Do you know what > an LDAP group is? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 2 Date: Mon, 26 May 2008 14:02:15 +0330 (IRST) From: Zahra Bahar <zahra_bahar(a)ec.iut.ac.ir> Subject: chap for ldap To: freeradius-users(a)lists.freeradius.org Message-ID: <30958651.75851211797935796.JavaMail.root(a)mta.iut.ac.ir> Content-Type: text/plain; charset=utf-8 Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server? ------------------------------ Message: 3 Date: Mon, 26 May 2008 10:44:09 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: need info on EAP-SIM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080526094409.GA8435(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, put the first check on the same line as DEFAULT and remove all those blank lines from between each check alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 37, Issue 125 *************************************************

4 3

rlm_exec
by Vittore Zen 26 May '08

26 May '08

I'm looking for some rlm_exec documentation? Which parameters pass, what's return.... thanks in advance v.

1 0

can not initiate sim, no RAND1 attribute
by Kalyani Garigipati (kagarigi) 26 May '08

26 May '08

Hi, Now I am able to start the Radiusd without any errors. But I am getting the following messages when I initiate EAP-SIM request to free Radius rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim can not initiate sim, no RAND1 attribute rlm_eap: Default EAP type sim failed in initiate rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [dummy(a)cisco.com/<via Auth-Type = EAP>] (from client cisco port 0 cli dummy(a)cisco.com) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> dummy(a)cisco.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. I have configures EAP -type as SIM in eap.conf Regards, Kalyani

1 0

chap for ldap
by Zahra Bahar 26 May '08

26 May '08

Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server?

3 2

Freeradius - OTP (one-time-password)
by Albert 26 May '08

26 May '08

Welcome I have Zywall SSL 10 to authenticate the possibility of using tokens. The service provides applications zywall tokens, which is installed on windows 2003 server. I would like to know if someone from your freeradius server set up to co-operate with one-time passwords (OTP). Regards, Albert

1 0

need info on EAP-SIM
by Kalyani Garigipati (kagarigi) 26 May '08

26 May '08

Hi , I am using Free Radius for EAP-SIM authentication. Could someone please let me know the minimum configuration changes that might be needed in users, radiusd and eap.conf file. I have added the following lines in users, but I am getting errors as follows # # # # Last default: shell on the local terminal server. # # DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef, EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7 When I run radiusd.conf [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:202 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items Module: Checking session {...} for mo Regards, Kalyani

2 1

how can i re-read the client.conf
by neoo 26 May '08

26 May '08

when i use the cmd "kill -HUP `/sbin/pidof radiusd`" , it does not re-read the client.conf,how can i do that ? when client.conf is changed.

2 1

openLDAP branches
by Vittore Zen 26 May '08

26 May '08

Hi, I have a openLDAP server with multiply branches: dc=domA ->a list of users dc=domB ->a list of users dc=domC ->a list of users now I want to AAA from freeradius using this syntax: userX@domA, userY@domB.... how to setup radius.conf? I sucessufully reach ldap server with single basedn = "dc=domA" ...but how to automatize it? Thanks in adavance. v.

2 2