October 2009 - Freeradius-Users - lists.freeradius.org

implemnting ipv6 with freeradius and juniper ERX
by Ram Akuka 06 Oct '09

06 Oct '09

Hi, I am trying to implement ipv6 on my network using freeradius and juniper ERX as NAS. So I looked for some documentation and found that In order to assign ipv6 address to a user using radius I need 2 attribuets. Framed-IPv6-Prefix and ERX-IPv6-NdRa-Prefix I patched the juniper dictionary as found in Juniper webpage - and added the attributes to a user, now there's 2 problems. 1. Can someone help me with the format of the ERX-IPv6-NdRa-Prefix or where can I read about this? 2. When trying to debug this - I run the daemon radius -Xxx and for some reason I can't see the acess-request process only the accounting. I want to fully understand the process and know exactly what attributes the radius is sending the NAS. How can I do this? Thanks in advance, -- Ram

2 2

Selective Authentication
by Tawanda Kavayi 06 Oct '09

06 Oct '09

Hi, Is it possible to configure FR to forward authentication requests to a different radius server based on username attributes. For example, user(a)domain1.com should authenticate locally, whereas user(a)domain2.com should be forwarded to a different server for authentication. Regards, Tawanda

2 1

None
by David Jones 06 Oct '09

06 Oct '09

Hello, from first time poster. Is there anyone on the list who has an actual working example of two factor authentication coded in perl using rlm_perl they would be willing to share? There are a number of incomplete examples, and a some hints as to errors in them, and I've taken all this on board and as a result can pass the challenge response back to the NAS. What I'm having difficulty with is keeping state, so I can determine if an Authorize request is the first hit (real password) or the second (the second factor). Thanks. Davey Jones.

3 2

Re: RE: Davey Jones
by David Jones 05 Oct '09

05 Oct '09

A product of being called David Jones; I normally get the locker jokes first :)

2 1

Re: Overriding proxy response
by Eric 05 Oct '09

05 Oct '09

Hi All, Any pointers on how to start hacking the source? What I need to do is look for MS-CHAP-Error 648 (which means the password needs to be changed) and then add a different IP address and filter + DNS server information in order for the end-user to be redirected to a webserver. I can't do all of it in rlm_perl because I need to proxy to a windows IAS. Cheers John Morrissey wrote: > I would like to override failed (rejected, timed out) proxy responses with > local authentication data. IOW, if the proxy request fails, I want to > process the request locally. That can't really be done with the current server. You will need to hack the source code to get this done. > It looks like the proxy reply trumps local authorization/authentication, and > I can't find a way to override the proxy's response code. Yes. There is usually ONE source for authentication. Turning a reject into an accept is a *very* unusual practice. > If this was the opposite way (don't proxy for accounts that exist locally), > it seems I could remove Proxy-To-Realm to prevent proxying. > > Is there a way to do the opposite (perform proxying and override the proxy's > response with local auth)? No. Alan DeKok.

4 8

failed to authenticate when using md5 passwords with postgresql
by José Adiel Blandón Rivera 05 Oct '09

05 Oct '09

Hi everyone, I'm looking the manner to configure chillispot connecting to freeradius using postgressql database users. Everything goes good when I use clear passwords in the database but when I tried to use md5 password it don't authenticate :S Has someone configured freeradius in this situation? Sorry for my English I speak Spanish xD regards

2 4

Aruba-User-Vlan, how to configure RADIUS to send the that aruba VSA to the controller
by aangles 05 Oct '09

05 Oct '09

have freeradius 2.1, and the configuration of my users file is like the following: ... DEFAULT Auth-Type = LDAP Aruba-User-Vlan = 20, Fall-Through : = 1 .... once I do radiusd -X, I see only the first access-challenge with the Aruba-User-Vlan Attirbute, and no more access-challenges have this attribute. So, it is not working , May be i am close to the solution but I don't know what to do, and also I don't know what happen. Aruba does not put me in that Vlan ID.Of course RADIUS has its Aruba propietary dictionary included. I don't the steps to get it work successfully. I send to you a capture of wireshark: http://www.nabble.com/file/p25716490/radiusWireshark radiusWireshark Somebody can help me please? Any ideas please? http://www.nabble.com/file/p25716490/radiuswireshark1.jpg http://www.nabble.com/file/p25716490/radiuswireshark2.jpg http://www.nabble.com/file/p25716490/radiuswireshark3.jpg http://www.nabble.com/file/p25716490/radiuswireshark5.jpg Also, see this debug from Aruba controller. Aruba puts the guest in the VLAN 232!!. it is not the VLAN configured in the Radius users file. thanks a lot I hope somebody knows what happen and can help me http://www.nabble.com/file/p25716490/aruba_debug.jpg Thank you -- View this message in context: http://www.nabble.com/Aruba-User-Vlan%2C-how-to-configure-RADIUS-to-send-th… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 9

RE: Custom Logging
by Nasser Heidari 05 Oct '09

05 Oct '09

> -----Original Message----- > From: Nev [mailto:nev@watchuktv.co.uk] > Sent: 2009/10/05 02:22 > To: nasser(a)rasana.net > Subject: Custom Logging > > Hi Nasser, > > I was wondering if you could share how you configured checkval module to > allow certain users/groups to access specific NAS servers. > radiusd.conf: ... ... checkval NAS_IP { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = ipaddr nofound-reject = no } ... ... authorize { preprocess ... ... sql_auth NAS_IP ... ... } And after that you need A/V Pair for each user like this: test Auth-Type := Local, User-Password := 123321, NAS-IP-Address := 1.2.3.4 > This I'm about to start and it would save me a lot of time. > > Thx > Nev

1 0

only unix group teachers logging to freeradius should have switched-of ipcop-url-filter
by Eimo Enninga 05 Oct '09

05 Oct '09

Hello, I´m not a whole newbie in linux but really a newbie in freeradius and have to solve a little problem in the configuration of our school-net: We use the following freeradius users - file: ~~~~~~~~~~~~~~ DEFAULT Auth-Type = System, Login-Time := "Wk0600-2000" Idle-Timeout = 600, Fall-Through = 1 DEFAULT Group == "teachers" hartmagi goebelle DEFAULT Auth-Type := Reject Reply-Message = "Please get first a login-permission from your teacher." ~~~~~~~~~~~~~~ Alle teachers and some pupils with a login-permission p.e. "hartmagi" and "goebelle" are able to use the freeradius-login to ipcop-blue of our schoolserver. At ipcop an url-filter ist running for _all_ users in our ipcop-green- and ipcop-blue-wlan-net, but in the ipcop-configuration it is possible to switch of the url-filter for an internal ip-range p.e. for a part of the just used freeradius-dhcp-range 172.16.19.0 Now I search for a possibility to switching off the url-filter _only_ for the unix-group "teachers" in our ipcop-blue-net. -- Is it possible to realize that with ippool-tool of freeradius? For a configuration-tip I would be grateful. Regards Eimo Enninga, Bertha-von-Suttner-Gesamtschule, Highschool in Siegen, Germany

3 2

Client requesting group membership check
by Bob Franklin 05 Oct '09

05 Oct '09

Hello, We have a RADIUS server with a SQL backend running fine, authenticating 802.1X users to our Eduroam service. We'd like to re-use the user database for purposes other than Eduroam. We've got support for this in the SQL backend by it returning the status of different services as being group memberships for a particular user (e.g. a user who has Eduroam and dial-up access would be reported as being in those groups in the usergroup table). This all appears to work fine. However, because of the University's federated nature, individual colleges and departments may run their own RADIUS servers and proxy the requests up to ours (and possibly on to our proxies) for authentication and, possibly confirm authorisation to user a particular service. This relationship is not static and individual RADIUS clients may wish to check the same user for different services at different points, so we can't put a static configuration along the lines of 'this client is our dial-up server and so we're checking for the dial-up group'). Also, we don't wish to return the full list of enabled services with each request but allow them to merely check individual services. The way I can see to do this is allow clients to submit requests with a custom local attribute (e.g. 'UCam-Requested-Service'). If this attribute were present, we would fail the authentication if the user was not a member of the appropriate group (but otherwise authenticated OK). Before I embark on doing something along these lines, am I missing a better way to go about things, or is there some mechanism already available which would achieve this? Thanks for any help or advice, - Bob -- Bob Franklin <rcf34(a)cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service

2 1