August 2008 - Freeradius-Users - lists.freeradius.org

Locking accounts after failed attempts. pam_tally ?
by Mark Tunnell 19 Aug '08

19 Aug '08

Is there a way to disable radius access for a user after a specified number of incorrect passwords using the standard Unix passwd system? I have pam_tally running and it correctly increments on failed SSH login attempts. However, failed Radius attempts do not increment the counter. Is there a way to make pam_tally work with Radius or do I need to find another way to do this? Thanks, Mark

2 1

FreeRadius, MySQL, MAC Authentication w/ Dynamic VLAN
by James Taylor 18 Aug '08

18 Aug '08

Hello everyone! I am currently tasked with a new project where I have been asked to move our currently working 'users' file into a manageable MySQL DB (we have over 500 user entries so it's understandable). Below you will find a currently working entry from the 'users' file. Mac-addresss Auth-Type := local, User-Password == "password" Calling-Station-ID == "mac-address", Airespace-Wlan-Id = 5, Airespace-Interface-Name = Wireless WLAN Name, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE:802, Tunnel-Private-Group-ID = VLAN-ID As you can tell this is a wireless user and of course I have the dictionary attributes added (like I said it is currently a working users file) but my question is how to take this information and add it to the MySQL radius.radcheck database? From what I am seeing the ID is a primary key and must be unique and there is only one attribute field. I may be asking this incorrectly but, does the DB read the rows starting with the ID 1 being the first user and continue down until the next user entry and return all the rows into Radius for authentication? If you have any possible pointers it would be greatly appreciated! Thank you everyone! James Taylor FCIP Networks

3 6

Limiting a user to a specific realm
by Lisa Casey 18 Aug '08

18 Aug '08

Hi Folks, I know there's an easy way to do this, but I've googled a bit this morning and can't quite figure it out. We are running Freeradius with a users file (no database). I have several realms defined, each with a fallthrough like so: DEFAULT Realm == realm1.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm2.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm3.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 I also have these 3 realms defined in the realms file. The way things are setup now, username bob could log in as bob(a)realm1.com or bob(a)realm2.com or bob(a)realm3.com and as long as bob supplied the correct password he would be granted access and that's been fine up until now. What I'ld like to do is to fix it so that only certain usernames could log on as username(a)realm3.com (leave realm1.com and realm2.com as they are). So anyone with a correct username/password could log in using realm1.com or realm2.com but only bob, jane and alex could log in with realm3.com. I suppose I could add an entry in my users file as so: bob Realm=realm3.com, Auth-Type = Local, Password == xxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 Would that work? How would I define realm3.com earlier in my users file? Would this work or is there a better way? Thanks, Lisa Casey

2 1

LDAP backend and Password Encryption
by Phillip Heller 18 Aug '08

18 Aug '08

Hello, Relatively new to both freeradius and ldap here. I'm using the Centos Directory Server, which defaults to SSHA encryption on the userPassword attribute. I'm using freeradius to authenticate unix logins (via pam_radius_auth), VPN (cisco asa) logins, and router/switch vty logins. freeradius verifies existence of the user in various ldap groups, and based upon that logic, either proxies off to a cryptocard server for one-time-password authentication, or authenticates directly against the userPassword attribute value. It would seem that freeradius does not authenticate against SSHA. I did try a few other encryption policies (crypt, md5) and set the password_header value appropriately. This is with version 2.0.5. Any help would be greatly appreciated! Regards, Phil

2 6

LDAP group-checking - missing user-dn in filter
by Jason Long 18 Aug '08

18 Aug '08

This morning I'm attempting to upgrade my FreeRadius install from 1.1.7 to 2.0.5. I'm having an issue with LDAP group-checking. Here's my scenario: I authenticate users with LDAP (eDirectory). In addition, I do some LDAP group-checking to determine which RADIUS attributes I want to return to the network device. This happens in the "users" file, with lines like: DEFAULT Ldap-Group == students Aruba-User-Role = student DEFAULT Ldap-Group == employees Aruba-User-Role = employee This was working in 1.1.7. But now I'm on 2.0.5, and after converting the config files, this is how it is behaving: users: Matched entry DEFAULT at line 13 rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=person)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.messiah.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius2/etc/raddb/certs/messiah-ca.crt rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=ldap-radius,o=mc/*** to ldap.messiah.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in t=mc-tree, with filter (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=students)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group students not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=employees)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() ++[files] returns ok I can see the issue here... the filter is messed up. expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=). Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration... Jason

2 3

per client certificate
by Tomoki Taniguchi 18 Aug '08

18 Aug '08

Is there a way to setup freeradius with EAP so that each wifi-client has their own certificate to connect to the wifi network? i want to be able to just disable a specific certificate if one one the laptops is stolen or lost. but the howtos i have come across so seem to be a setup where all wifi-clients use the same certificate to authenticate against an access point. is what i am trying to accomplish even possible? Please help. TIA, Tomoki

3 4

Multiple accounting copies
by Alexandre Chapellon 17 Aug '08

17 Aug '08

Hello, I am planning to move from a Sun/SBR installation to Freeradius, and so have a lot of things to test before... For exemple, I need to proxy accounting request from my freeradius server (2.0.5) to several (at least) radius services to allow third party applications to be aware of services allowed for every user. I have read that directly proxying to multiple server is not allowed by freeradius and instead i have to log to a detail file and then create a virtual server that read this file and behave as a NAS. My question is: Is it possible to have multiple virtual servers, each proxying to a specific radius? If not can i achieve this with freeradius or do i have to look for something else.

2 1

Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap
by Venkata LK Mula 16 Aug '08

16 Aug '08

Hi, We are authenticating the clients via 'users' file. We are sending the required file "inner-tunnel", which we found in two locations 1. /usr/local/etc/raddb/sites-enabled 2. /usr/local/etc/raddb/sites-available we are sending the both the files, with SA as suffix for the file at location /usr/local/etc/raddb/sites-available. And also sending the 'users' file. regards, Venkat ----- Original Message ----- From: Maurizio Cimaschi <mauri(a)unixrulez.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap Date: Fri, 15 Aug 2008 09:41:03 +0200 > Venkata LK Mula wrote: > > modsingle[authenticate]: calling mschap (rlm_mschap) for > > request 6 > > rlm_mschap: No Cleartext-Password configured. Cannot > > create LM-Password. > > rlm_mschap: No Cleartext-Password configured. Cannot > > create NT-Password. > > rlm_mschap: Told to do MS-CHAPv2 for test100 with > > NT-Password > > rlm_mschap: FAILED: No NT/LM-Password. Cannot perform > > authentication. > > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > > modsingle[authenticate]: returned from mschap > > (rlm_mschap) for request 6 > > ++[mschap] returns reject > > modsingle[authenticate]: returned from eap (rlm_eap) for > > request 6 > > ++[eap] returns reject > > auth: Failed to validate the user. > > It seems that all is working OK, except that you had not > defining any valid source for the user password. > > How are you planning to authenticate users ? (file ? pam ? > ldap ? samba ? other ?) > > Could you post your "inner-tunnel" configuration file ? > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 6

Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap
by Venkata LK Mula 16 Aug '08

16 Aug '08

with the modified 'users' file also there is no luck. the problem remains the same. The 'Code: Access-challenge (11)' frame from server to the client is showing 'Checksum: 0x921e [incorrect, should be 0x206c]' error. please find the ethereal log as attached as 'eap-failure1'. regards, Venkat ----- Original Message ----- From: Maurizio Cimaschi <mauri(a)unixrulez.org> To: Venkata LK Mula <vlkmula(a)saitechnology.com> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap Date: Fri, 15 Aug 2008 23:38:19 +0200 > Venkata LK Mula wrote: > > We are authenticating the clients via 'users' file. > > In your "users" configuration file user "test100" (the one > that log files are referring to) is > > "test100" Auth-Type := EAP > Cleartext-Password == "venkat", > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-Id = 100, > Reply-Message = "Hello 100, %u", > Fall-Through = No > > I would modify it in this way > > test100 User-Password == "venkat", > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-Id = 100, > Reply-Message = "Hello 100, %u", > Fall-Through = No > > Bye. > > > > 1. /usr/local/etc/raddb/sites-enabled > > 2. /usr/local/etc/raddb/sites-available > > Usually, in sites-enabled there shoiuld be link to > sites-available. > >

3 2

Freeradius in an AD environment on opensuse server
by Murray, Elizabeth [DNR] 16 Aug '08

16 Aug '08

I've been struggling with this for months. I found a doc HOW TO on the opensuse website. It says I have to use Samba in order to have the users authenticate. For some reason every time I get that thing configured, it works for a few days then...it's gone. I cover a large geographic area and have not been able to focus on this until today and tomorrow. SO any help would be appreciated. We've moved from a Novell eDirectory solution to . . . . Active Directory. Can I set up freeradius to authenticate with ldaps and be secure? The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing? I would really be grateful for any help you could give me. I now have the radius server back to it's original configuration....clean. So I'm ready to do your bidding. Liz M

4 19