June 2008 - Freeradius-Users - lists.freeradius.org

About client.conf
by Fabián Omar Franzotti 14 Jun '08

14 Jun '08

Hi guys I did install Freeradius 2.0.4 and i don't find the way to configure client 0.0.0.0/0 { secret = mysecret shortname = allworld } I have this configuration over older Freeradius, but with this version do not work can any one tell my how configure it in this version? Thanks

3 4

Re: pppoe problem
by Anooshiravan Merat 13 Jun '08

13 Jun '08

try to write query select * from radcheck Where USERNAME='joe' give this query in your mysql n will get result or not tell me ... Anooshiravan Merat

1 0

Fedora Core 6 Installation
by Heaton, Tobias 13 Jun '08

13 Jun '08

Hello, I'm new to the Radius PAM client, so I hope I'm writing to the correct place. I have an existing Radius server and I'm trying to install the PAM module on an FC6 box in order to authenticate SSH logins to the machine against the Radius server. The install instructions at http://www.freeradius.org/pam_radius_auth/ only include RedHat and after running the 'make', I'm not seeing the configuration files referred to in the instructions. If anyone has successfully installed the PAM module on FC6, I would very, very much appreciate some assistance! Thank you all! -Tobias

2 5

Simultaneous-Use and radwho
by Tuc at T-B-O-H.NET 13 Jun '08

13 Jun '08

Hi, I haven't been given authorization to do a radiusd -X yet, but I'm seeing something in my logs that I don't get . User is logging in from multiple times, so I put on Simultaneous-Use and it goes against the radutmp. So I test it by hand and I get in radius.log Wed Jun 11 17:30:45 2008 : Auth: Multiple logins (max 1) : [regtum14/TESTING] (from client localhost port 1812) Ok, good. So I reset the device and make sure it gets an: Wed Jun 11 18:17:04 2008 : Info: rlm_radutmp: NAS 192.168.75.39 restarted (Accounting-On packet seen) Wed Jun 11 18:17:04 2008 : Info: rlm_sql (sql): received Acct On/Off packet But it seems somehow they are able to "race" it : Wed Jun 11 18:19:53 2008 : Auth: Login OK: [regtum14/<CHAP-Password>] (from client SBC-2393 port 4 cli 00-13-02-20-F9-DC) Wed Jun 11 18:19:53 2008 : Auth: Login OK: [regtum14/<CHAP-Password>] (from client SBC-2393 port 2 cli 00-1B-9E-C4-9E-CD Would switching to SQL be better? (Or is this something that MUST have a radiusd -X to resolve?) Thanks, Tuc

2 3

Can FreeRADIUS proxy accounting requests to multiple systems?
by Sylvain Robitaille 13 Jun '08

13 Jun '08

Me again ... I have two FreeRADIUS-2.0.3 systems provinding AAA for our wireless networks and a couple of other (less widely used) services. The NAS devices are configured with both, and which one is likely receive access-request or accounting-request packets at any given time from any given NAS is essentially undefined (though they appear to be functioning in a mostly failover fashion, rather than any sort of load-balancing, given that there is a large majority of traffic going to one of the two FreeRADIUS servers). I'm looking to have both of these systems proxy incoming accounting data to each other, so that they both have complete, up-to-date data regarding which users are presently authenticated on which services, but I'd also like to have them proxy the accounting data to a third system (commercial "appliance" type of system, though I understand that it does use FreeRADIUS as its RADIUS server) which might act as our wireless network management system (we're presently evaluating it). It would use this accounting data to correlate end-user systems (by MAC addresses obtained from NAS devices) with user account names (from the RADIUS accounting data). I've been trying to understand the comments in raddb/sites-available/copy-acct-to-home-server, raddb/proxy.conf, and the relevant parts of raddb/radiusd.conf, but I'm not sure I have yet understood whether what I want can be done: proxy accounting-request packets from both "production" RADIUS servers to each other AND to the wireless network management system (though I expect that the NMS would get from each RADIUS server only accounting-request packets that weren't already proxied from the partner RADIUS server, to avoid it receiving duplicate data). I've started setting up proxy.conf as indicated below my signature, and I expect I'll need a sites-enabled/copy-acct-to-home-server, but I'm pretty sure that the proxy.conf as I now have it would not proxy the requests to both the partner RADIUS server and the wireless network management system at the same time (not "failover" nor "load-balance", but proxy to both simultaneously). I'm hoping that someone can offer guidance. Desired flow of accounting-request packets: +---------+ +---->| RADIUS2 | +-----+ +---------+ | +---------+ | NAS |---->| RADIUS1 |----+ +-----+ +---------+ | +---------+ +---->| WIFINMS | +---------+ OR +---------+ +---->| RADIUS1 | +-----+ +---------+ | +---------+ | NAS |---->| RADIUS2 |----+ +-----+ +---------+ | +---------+ +---->| WIFINMS | +---------+ -- ---------------------------------------------------------------------- Sylvain Robitaille syl(a)alcor.concordia.ca Systems and Network analyst Concordia University Instructional & Information Technology Montreal, Quebec, Canada ---------------------------------------------------------------------- --- old/proxy.conf.20080612 2008-03-27 12:47:55.000000000 -0500 +++ proxy.conf 2008-06-12 13:16:39.000000000 -0400 @@ -57,7 +57,7 @@ # # allowed values: {yes, no} # - default_fallback = no + default_fallback = yes } @@ -114,7 +114,7 @@ # acct - Handles Accounting-Request packets # auth+acct - Handles Access-Request packets at "port", # and Accounting-Request packets at "port + 1" - type = auth + type = acct # # Configure ONE OF the following two entries: @@ -146,7 +146,7 @@ # Usually 1812 for type "auth", and 1813 for type "acct". # Older servers may use 1645 and 1646. # - port = 1812 + port = 1813 # # The shared secret use to "encrypt" and "sign" packets between @@ -306,6 +306,30 @@ # Useful range of values: 3 to 10 num_answers_to_alive = 3 } +home_server radius2 { + type = acct + ipaddr = radius2 + port = 1813 + secret = testing123 + response_window = 20 + zombie_period = 40 + revive_interval = 120 + status_check = status-server + check_interval = 30 + num_answers_to_alive = 3 +} +home_server wifinms { + type = acct + ipaddr = wifinms + port = 1813 + secret = testing123 + response_window = 20 + zombie_period = 40 + revive_interval = 120 + status_check = status-server + check_interval = 30 + num_answers_to_alive = 3 +} ###################################################################### @@ -320,7 +344,7 @@ # 10 'realm" sections, and one "home_server_pool" section to tie the # two together. # -home_server_pool my_auth_failover { +home_server_pool cu_acct_failover { # # The type of this pool controls how home servers are chosen. # @@ -394,6 +418,8 @@ # be "acct", or the all have to be "auth+acct". # home_server = localhost + home_server = radius2 + home_server = wifinms # Additional home servers can be listed. # There is NO LIMIT to the number of home servers that can @@ -421,7 +447,7 @@ #DEFAULT Proxy-To-Realm := "realm_name" # # -realm example.com { +realm DEFAULT { # # Realms point to pools of home servers. # @@ -440,8 +466,9 @@ # configuration item, instead of specifying both "auth_pool" # and "acct_pool". - auth_pool = my_auth_failover + #auth_pool = my_auth_failover # acct_pool = acct + acct_pool = cu_acct_failover # # Normally, when an incoming User-Name is matched against the

3 5

Problem in connecting to switch on telnet
by Guk Viktor 13 Jun '08

13 Jun '08

3 2

Different LDAP base DN for different realms
by Giovanni Lovato 13 Jun '08

13 Jun '08

I have an LDAP directory organized as follows: dc=example,dc=org |-ou=first | \-ou=people | \-uid=john | |-ou=second | \-ou=people | \-uid=john | \-ou=third \-ou=people \-uid=john I would like to tell FR to do look in the appropriate OU based on the relam the user authenticates, for example: john@first will try to bind on uid=john,ou=people,ou=first,dc=example,dc=org john@second on uid=john,ou=people,ou=second,dc=example,dc=org ans so on... How can I achieve this with virtual servers or unlang? Thank you very much!

1 0

PEAP authenication issues - sort of
by Capelle, Mark (PCMC-GB) 13 Jun '08

13 Jun '08

I have FreeRADIUS setup do LDAP authentication against AD and also PEAP which ultimately uses ntlm_auth against AD. Both work fine for the most part except some users that I have started to add to the PEAP enabled wireless network. If I connect to this network, I authenticate fine. If one of these other accounts connects, the authentication fails for some reason. Here are the entries from the radius.log file: Thu Jun 12 13:21:25 2008 : Auth: Login OK: [DOMAIN\\user1] (from client WLANCTRLR1 port 0) Thu Jun 12 13:21:25 2008 : Auth: Login OK: [DOMAIN\\user1] (from client WLANCTRLR1 port 1 cli 00-0E-35-6F-A3-7D) Thu Jun 12 13:21:54 2008 : Auth: Login incorrect (rlm_ldap: User not found): [DOMAIN\\nonworkinguser/<via Auth-Type = EAP>] (from client WLANCTRLR1 port 0) Thu Jun 12 13:21:54 2008 : Auth: Login incorrect: [DOMAIN\\nonworkinguser/<via Auth-Type = EAP>] (from client WLANCTRLR1 port 1 cli 00-0C-F1-12-49-DD) Thu Jun 12 13:22:12 2008 : Auth: Login incorrect (rlm_ldap: User not found): [DOMAIN\\nonworkinguser/<via Auth-Type = EAP>] (from client WLANCTRLR1 port 0) Thu Jun 12 13:22:12 2008 : Auth: Login incorrect: [DOMAIN\\nonworkinguser/<via Auth-Type = EAP>] (from client WLANCTRLR1 port 1 cli 00-0C-F1-12-49-DD) Thu Jun 12 13:23:04 2008 : Auth: Login OK: [DOMAIN\\user1] (from client WLANCTRLR1 port 0) Thu Jun 12 13:23:04 2008 : Auth: Login OK: [DOMAIN\\user1] (from client WLANCTRLR1 port 2 cli 00-0E-35-6F-A3-7D) If I try the samba authentication from a command line on the FreeRADIUS server, it completes successfully: [root@RADIUS1 raddb]# /usr/local/samba/bin/wbinfo -a nonworkinguser%testpassword plaintext password authentication succeeded challenge/response password authentication succeeded If I test authentication of the user using radtest, it works fine and is able to find the user: [root@RADIUS2 ~]# radtest nonworkinguser testpassword 10.1.1.1 1 testing123 Sending Access-Request of id 221 to 10.1.1.1 port 1812 User-Name = "nonworkinguser" User-Password = "testpassword" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 10.1.1.1 port 1812, id=221, length=20 What I believe to be the relevant part of the radiusd -X output is: auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for nonworkinguser with NT-Password expand: --username=%{mschap:User-Name} -> --username=nonworkinguser mschap2: 85 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=3c2921ed60ab0f28 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=9b2c345dd9585a0b79b19cd2fe360474a737271903b6989c Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [DOMAIN\\nonworkinguser/<via Auth-Type = EAP>] (from client WLANCTRLR1 port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Anyone have any ideas as to what the problem might be?

2 1

combining local authentication and proxy ?
by dan 13 Jun '08

13 Jun '08

Hi, is it possible to combine a local authentication (against a MySQL Database) and the proxy function of freeradius ? I only want to forward requests of allowed users to a remote radius server where the actual authentication with password is done. I would like the radius server to check if a username is in the local database, and only if the user is in the database the radius should forward the request to a different radius server where the user and the password are checked. Do you know if and how I can do this ? Thanks Dan

1 0

Different attributes for different NAS
by Albert 13 Jun '08

13 Jun '08

Hello, I am new to RADIUS servers but have configured FreeRADIUS 1.1.3 with vendor specific attributes and made it work. Now I have a situation where I have a webpage where a user can see his usage with authentication from the RADIUS server. I also have a router with RADIUS authentication allowing access to the network. When the user logs in to the webpage certain attributes should be send and the user should be authenticated even if the usage limit for that month is exceeded. When the user logs in for network access the user should be restricted if the usage limit for the month is exceeded. I've got to the point where the user can no longer login on the router when the usage limit is exceeded but then the user can also no longer login to the website. Is there a way to send certain attributes to the RADIUS client depending on the NAS the user is authenticating from? If so it would be much appreciated if you could point me to a solution or some text which would assist in solving this. I'm using MySQL as user backend. Thanks in advance, Albert

2 1