October 2009 - Freeradius-Users - lists.freeradius.org

Re: Clear Text PAP passwords - how to enable
by Alex M 20 Oct '09

20 Oct '09

My SQL include and module authorization is enabled in instantiate section Im not 100% sure what "virtual server" do in new radius. I guess you are probably right about that fact that my radius is not accsesing SQL to see the users there,.. so since my Include is enabled i guess i need to figure out what those virtual servers are and how to use them tnx for helping! On Sun, Oct 18, 2009 at 5:04 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > Sql is not enabled in 2.x by default. Enable INCLUDE in radiusd.conf and > sql entries you need in default virtual server > (raddb/sites-enabled/default). > > Ivan Kalik > Kalik Informatika ISP > > > Password is in SQL table raddcheck > > Also will take a look at that FAQ > > > > I know i had the same problem w. FR 1.5 and there I just had to take out > > DEFAULT Auth-Type: system so that we don't look for system password but I > > didnt find anything like that on FR 2 > > > > > > > > > > On Sun, Oct 18, 2009 at 10:43 AM, Ivan Kalik <tnt(a)kalik.net> wrote: > > > >> > hey all > >> > we keep upgrading FR servers and i got stuck with problem where I need > >> PAP > >> > (I think) well i need clear text password and its not working for my > >> user. > >> > When i send request through NTRAdping w/ CHAP all works well but when > >> I'm > >> > using device as NAS nothing works :( > >> > > >> > I hope some one can point me out in right direction. Here is my > >> output: > >> > >> Where is password supposed to be? It wasn't found in users (files) or > >> system (unix) file. > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > >

3 5

how to call an external script one the users is expired?
by aangles 20 Oct '09

20 Oct '09

hello, please i need to know how to call an external script one the users is expired. I got radius call an external script once the user is authenticated with success by using the echo module, but now I need to call another script when the user tries to connect after expiration date. Any ideas? thanks a lot -- View this message in context: http://www.nabble.com/how-to-call-an-external-script-one-the-users-is-expir… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Windows client MS-chap auto-reauthentication
by Vieri 20 Oct '09

20 Oct '09

Hello, I'm connecting Windows clients to a LAN via Linksys access points and a Freeradius server. I'm using EAP/TLS with certificates installed on the clients and in modules/mschap I defined: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" So the Windows clients must have a certificate and login with the credentials of an Active Directory user member of the WIFI_DATA group. This setup works fine. However, I'm seeing a major difference between a Windows XP pro SP2 client and a Windows Vista: if the Vista client (laptop) reboots the OS then access to the LAN via WIFI requires the user to re-enter login username and password, as expected. If the XP client reboots the OS then user credentials seem to be automatically sent to the Radius server again, as if they were stored on the system (no user interaction). Can I change this behavior and require the user to re-send their login data each time the Windows session is closed or the OS reboots? I realize this is a "client-only" issue and that freeradius can't possibly detect the difference between the 2 cases (or can it?) but I am concerned that if, for example, the XP laptop is stolen (or unauthoritatively lent) then all the "unwanted" user needs to do to access our LAN is boot the OS, unless the legitimate user's password has expired. The laptop is for a hospital's Emergency department so it's easy to imagine that it cannot be under 24-hour surveillance (but usually, the legitimate users switch the device off when done working or the laptop automatically turns off after an inactivity timeout). Does anyone know: why XP re-authenticates automatically and how to disable it? why Vista doesn't behave the same way? if installing SP3 on XP removes this feature? if somethng can be done on freeradius to discriminate manual logins from auto-logins? I'm running freeradius 2.0.5 on Linux. Thank you, Vieri

6 9

Re: Re: IP address assignment for the authenticated users in Free
by David Mitton 20 Oct '09

20 Oct '09

1 0

Proxy based on Multiple Realms
by Bob Brandt 20 Oct '09

20 Oct '09

What I want to do is proxy requests based on being in multiple realms. For example: Realm1/username.Realm2 Where is Realm1 is "host" AND Realm2 is "some.fqdn" then proxy to xxx.xxx.xxx.xxx Specifically what I am doing is trying to use FreeRadius to proxy for AD Domains. I want to enable host based authentication (i.e. host/ workstation.domain.name ) but for multiple domains. I believe proxying is the only why to accomplish this. All I can find are references/warnings to making sure that I DON'T do this by mistake. Problem is I believe this is what I must do. Is this even possible with FreeRadius? Thanks Bob

3 10

EAP (RFC- 3579) under GPL with FreeRadius1.1.8?
by Divyank Rastogi 20 Oct '09

20 Oct '09

Hi, I was going through FreeRadius1.1.8 code when i saw that unlike the SRC code which is LGPL, EAP code is under GPL. As per my understanding LGPL (and not GPL) is applicable to be freely distributes as statically linked libraries and the files in ‘module’ folder are protected by GPL as against the ‘lib’ files which are protected by LGPL. I am planning to use the source code in the lib folder as well as that in the module folder (for supporting rfc-3579) in FreeRadius. Are there going to be issues in statically linking this code? If so, can anyone please help out with ideas on how to circumvent the issue (including other (licensed) vendor recommendations as well). Thanks, Divyank

2 1

Radius 2.1.7 disponible for freebsd?
by Alisson 20 Oct '09

20 Oct '09

Radius 2.1.7 disponible for freebsd? -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

1 0

RE:
by INACIO ALVES 20 Oct '09

20 Oct '09

Thanks Santiago and Ivan, The schema of the database is in the source of instalation and I have create my database in MySQL. I think that lack documentation to work with freeRADIUS. The new version 2.x is very different from early 1.x. So, how I said in the last post, the HOW_TO about SQL is out-of-date. The tables has name/schema changed. But I will have success. Finally. About the DHCP: How I said, my AP ignores the configurations that I set on users file, even if I disable the DHCP server in the AP. If I configure a DHCP server on my freeRADIUS server, I need atach MACxIP or if I set the configurations in the users file this informations will to the client? Again thanks to all, Inácio Alves http://www.polluxweb.com/inacioalves/site

2 1

Ldap search and AD operations error
by Leighton Man 20 Oct '09

20 Oct '09

Hi All, Following everyone's help our eduroam system is up and running by the target date - Many thanks, particularly to Alan and Ivan. I'm now trying to configure it *properly* I have, in the ldap module configuration: chase_referrals = yes rebind = yes I'm running version 2.1.6 on Solaris doing lookups against Active Directory. I get, in the debug: rlm_ldap: Bind was successful rlm_ldap: performing search in dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=mytestusername) rlm_ldap: ldap_search() failed: Operations error rlm_ldap::ldap_groupcmp: search failed Has anyone got latest information on what causes this or how to fix it. I have a workaround but it's not ideal. I assume trying to get more helpful information out of Microsoft AD is pretty futile but has anyone any clues as to what "operations error" realy means? The workaround is to specify a container in the search but as the number of possible containers for a search increases things rapidly begin to get out of hand ..... Regards, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 3

Re: IP address assignment for the authenticated users in Free
by Anoop C 20 Oct '09

20 Oct '09

Alan Thanks for the quick reply. I would like to have one more clarification. Can we use IP addrss as Attribute value pair so that the RADIUS server throws IPs dynamically to users after authentication. Regards Anoop Anoop C wrote: > Hi > We are running EAP-TLS authentication for office users using WiFi > network. This is a certificate based authentication and we are using Free > RADIUS. > I would like to know whether we can assign IP address dynamically to the > users through FREE RADIUS server ie RADIUS server works as DHCP server. For WiFi authentication, you need a DHCP server. Sending IP addresses to the NAS in a RADIUS packet won't work. > So > after successful authentication Server should through an IP address which is > configured against that particular MAC of the user in the server. No. You need a DHCP server. You can configure FreeRADIUS to be a DHCP server, but that involves creating a DHCP configuration, not a RADIUS configuration. Alan DeKok. Get your world in your inbox! Mail, widgets, documents, spreadsheets, organizer and much more with your Sifymail WIYI id! Log on to http://www.sify.com ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

2 1