November 2009 - Freeradius-Users - lists.freeradius.org

RE: Expanding run-time variables and checking access_attr for allow
by tnt＠kalik.net 19 Nov '09

19 Nov '09

>> > If I put, ONLY FOR CHECK, the base_filter = >> > "(uniquemember=cn=nicolas.velazquez(a)uam.es,cn=users,dc=uam,dc=es)" >> the >> > LDAP >> > replies with No Such Object. But the radius authorization sends ok. >> > The misconfiguration of LDAP is not the question here. >> > The question here is: documentation says if the parameter not exists >> the >> > authorization doesn't work. >> >> It exists so it does work: > > Is FR using the matchedDN parameter? > I used "cn" as access_atr. > It could be an explanation an then I must build a better access_atr. I don't know anything about ldap. Debug shows that freeradius found access attribute for that uid. I have no idea how, but it did. > And the initial question about the expand of runtime-variables? > The UNexpand of the base_filter is the normal way of operation? Yes, base_filter doesn't expand. I don't think that base_dn expands either. uid is the only one that's dynamic there. Ivan Kalik

1 0

how to configure realm in freeradius
by shivashankar 19 Nov '09

19 Nov '09

hi, sample configurations for realm in freeradius 2.1.6 regard;s shiv -- View this message in context: http://old.nabble.com/how-to-configure-realm-in-freeradius-tp26420475p26420… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

chap authentication problem
by shivashankar 19 Nov '09

19 Nov '09

hi, i am new to useing Freeradius 2.1.6 and soalris 10. users file entry "moto" Auth-Type := CHAP, Cleartext-Password := "shiva" Reply-Message = "Hello shiva , %u" and what about Auth-Type := MS-CHAP. trying chap authentication.but it is showing below as Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.232.163.145 port 2752, id=59, length=45 User-Name = "moto" CHAP-Password = 0xc6ac71b724160513a51c515c755775e1af +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "moto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry moto at line 93 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Segmentation Fault (core dumped) plz help me -- View this message in context: http://old.nabble.com/chap-authentication-problem-tp26420443p26420443.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: Freeradius-Users Digest, Vol 55, Issue 87
by Gilbert Lo 19 Nov '09

19 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Expanding run-time variables and checking access_attr for allow
by tnt＠kalik.net 19 Nov '09

19 Nov '09

> The second question. > > If I put, ONLY FOR CHECK, the base_filter = > "(uniquemember=cn=nicolas.velazquez(a)uam.es,cn=users,dc=uam,dc=es)" the > LDAP > replies with No Such Object. But the radius authorization sends ok. > The misconfiguration of LDAP is not the question here. > The question here is: documentation says if the parameter not exists the > authorization doesn't work. It exists so it does work: > [uam_vpn] user nicolas.velazquez(a)uam.es authorized to use remote access Ivan Kalik

2 1

adding eap-tls/peap/ttls support to freeradius problem
by Tomas Pelka 19 Nov '09

19 Nov '09

Hi guys, have some problems with compiling freeradius with eap-tls/peap/ttls support. configure running: ./configure --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --with-rlm_eap_tls \ --with-rlm_eap_ttls \ --with-rlm_eap_peap \ --without-rlm_eap_tnc \ --without-rlm_otp \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-openssl \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --without-rlm_counter \ --without-rlm_ldap Gcc output: /usr/bin/libtool --mode=link gcc -release 2.0.4 \ -module -export-dynamic -o rlm_sql_log.la \ -rpath /usr/lib/freeradius rlm_sql_log.lo rlm_sql_log.c /usr/src/freeradius-2.0.4+dfsg/src/lib/libfreeradius-radius.la /usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la -lnsl -lresolv -lpthread libtool: link: cannot find the library `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la' or unhandled argument `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la' make[7]: *** [rlm_sql_log.la] Error 1 make[7]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql_log' make[6]: *** [common] Error 2 make[6]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules' make[5]: *** [all] Error 2 make[5]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules' make[4]: *** [common] Error 2 make[4]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg' make: *** [build-arch-stamp] Error 2 Am I missing something? Thanks for advice. -- Tom

2 2

Is there a simple way to activate accounts on demand ?
by Mazzz86 19 Nov '09

19 Nov '09

Hye guys, I'm using Freeradius on a MySQL database with DialupAdmin web interface. I would like to activate/desactivate users account on demand but i didnt find any easy way to do it. After reading some forums, I saw some tricks like updating the 'radcheck' table by putting "Reject" instead of the password. It's kind of annoying. If you guys have any ideas, let me know. Thanks. By the way, does someone know how to encrypt those passwords in 'radcheck' table to increase security ? -- View this message in context: http://old.nabble.com/Is-there-a-simple-way-to-activate-accounts-on-demand-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 18 Nov '09

18 Nov '09

Hi all, I am wondering if someone will be able to point me in the correct direction with a setup I am trying to achieve. Basically we are rolling out a new offering to our customers where we want to have our LAC's query our radius servers which will then proxy requests on to our customer's radius servers based on the domain used in the username. I have got all of the proxy'ing working within radius - nice and easy following the wiki and instructions - thanks. My problem is that the response I send to our LAC has to contain extra information depending on the domain. Is it possible to query a local mysql database for this extra information (these are cisco av pairs needed to establish the tunnels between the LAC and LNS) and add it into the Access-Accept message that is returned to the LAC from the radius? An example would of what I have at the moment is: Sending Access-Accept of id 6 to xx.xx.xx.xx port 51274 Framed-IP-Address = 192.168.0.1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Tunnel-Server-Endpoint:0 = "yy.yy.yy.yy" And I need it contain 3 extra lines that would be stored locally (in italics): Sending Access-Accept of id 6 to xx.xx.xx.xx port 51274 Framed-IP-Address = 192.168.0.1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Tunnel-Server-Endpoint:0 = "yy.yy.yy.yy" Tunnel-Type:0 = L2TP Tunnel-ID=DEFGH L2TP-Tunnel-Password=ABCDE" This is currently running on FreeRADIUS Version 2.1.7. I have read the documentation and the mailing lists but cant seem to find anyone who has had to do a similar thing. Kind Regards Dan Fisher Technical Manager get your data flowing ... DDI: 020 7099 8985 Tel: 0845 868 7848 Fax: 0845 868 7858 danfisher(a)fluidata.co.uk <mailto:danfisher@fluidata.co.uk> www.fluidata.co.uk <http://www.fluidata.co.uk/> This message is intended solely for the use of the individual or organisation to whom it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Fluidata Ltd. Fluidata accepts no responsibility for loss or damage arising from its use, including damage from virus.

2 1

Other authentication method installation after
by Wagner Pereira 18 Nov '09

18 Nov '09

Alan, What I got from your website, Deploying Radius, was I can choose other authentication method after I install freeradius using PAP. Am I right? In that case, what would be the impact in a server running? -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

2 1

clients.conf
by Peter Carlstedt 18 Nov '09

18 Nov '09

Hello everyone again! Well as you may understand from the Subject I have a question about how clients.conf works. I´ve read the documentation in the file about how to add a client but when i tired to add another client it stoped working. I will try to explain how I have setup the network. I have one radius server connected to a Netgear wired switch, from that switch I have a AP(Mikrotik) connected. What I am trying to do is to add the Mikrotik into the clients.conf file but when I do i get an error at startup(dont remember the error message). Right now im instead using client 192.168.118.0/24{ } which accepts all NASes in the subnet. What i wrote in clients.conf before i changed to include a whole subnet is: client Netgear{ ipaddr = x.x.x.x netmask = 24 secret = xxxxxx require_message_authentication = no } client Mikrotik { ipaddr = x.x.x.x netmask = 24 secret = xxxxxxx require_message_authentication = no } What I am wondering about is if I have done a correct setup when trying to add several stand alone clients? Best regards/ Peter > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 55, Issue 52 > To: freeradius-users(a)lists.freeradius.org > Date: Thu, 12 Nov 2009 08:43:56 +0100 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (Ivan Kalik) > 2. Re: I need some help with freeradius 2.0.4 (Wagner Pereira) > 3. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (Wagner Pereira) > 4. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (tnt(a)kalik.net) > 5. SSL renegotiation ? (John) > 6. Re: FreeRadius with 3COM (Guk Victor) > 7. Microsoft: SmardCard or Certificate Auth (swatzy) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Nov 2009 19:30:35 +0000 > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB10DB.7040106(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Wagner Pereira wrote: > > Dear colleagues, > > > > I am introducing now a new information. Below is what is declared into my IOS - > > Cisco 6500. Is this correct? > > > Why don't you just read the cisco wiki page. > > > Ivan Kalik > Kalik Informatika ISP > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Nov 2009 17:42:15 -0200 > From: Wagner Pereira <wpereira(a)pop-sp.rnp.br> > Subject: Re: I need some help with freeradius 2.0.4 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB1397.9000002(a)pop-sp.rnp.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Ok, Ivan. I guess I removed that HTML craps now : ) > > Below is my new radgroupreply: > > mysql> select * from radgroupreply; > +----+-----------+---------------+----+-----------------------+------+ > | id | groupname | attribute | op | value | Prio | > +----+-----------+---------------+----+-----------------------+------+ > | 3 | pop-sp | Service-Type | := | NAS-Prompt-User | | > | 5 | reject | reply-message | := | Autentica??o recusada | NULL | > +----+-----------+---------------+----+-----------------------+------+ > 2 rows in set (0.00 sec) > > Hugs, > > -- > > Wagner Pereira > > PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo > CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo > http://www.pop-sp.rnp.br > (11) 3091-8902 > > > > tnt(a)kalik.net escreveu: > >> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> > >> > > > > Enough with that HTML!!!! It produces extraordinary ammount of crap as you > > can see: > > > > > >> I did what you recommended (I guess). See below:<br> > >> > > > > No, you didn't. But getting closer. > > > >> |  1 | pop-sp    | Framed-Compression | := | > >> Van-Jacobson-TCP-IP   > >> > > > > Remove *all* Framed attributes. > > > > > >> |  3 | pop-sp    | > >> Service-Type       | := | > >> NAS-Prompt            > >> |      | <br> > >> > > > > That should be NAS-Prompt-User. > > > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 3 > Date: Wed, 11 Nov 2009 17:57:18 -0200 > From: Wagner Pereira <wpereira(a)pop-sp.rnp.br> > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB171E.4010105(a)pop-sp.rnp.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Ivan, > > I already read the Cisco wiki page and I implemented what they > recommend, but it's not working yet. > > -- > > Wagner Pereira > > PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo > CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo > http://www.pop-sp.rnp.br > (11) 3091-8902 > > > > Ivan Kalik escreveu: > > Wagner Pereira wrote: > >> Dear colleagues, > >> > >> I am introducing now a new information. Below is what is declared > >> into my IOS - Cisco 6500. Is this correct? > >> > > Why don't you just read the cisco wiki page. > > > > > > Ivan Kalik > > Kalik Informatika ISP > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Wed, 11 Nov 2009 22:01:33 -0000 (UTC) > From: tnt(a)kalik.net > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <49743.87.194.16.13.1257976893.squirrel(a)www.kalik.net> > Content-Type: text/plain;charset=iso-8859-1 > > > I already read the Cisco wiki page and I implemented what they > > recommend, but it's not working yet. > > Does the debug now show Nas-Prompt-User in Access-Accept packet? If it > does - it's some problem on the router - debug ip ssh. > > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 5 > Date: Thu, 12 Nov 2009 11:01:44 +0800 (CST) > From: John <elmer_radius(a)yahoo.com.cn> > Subject: SSL renegotiation ? > To: freeradius-users(a)lists.freeradius.org > Message-ID: <145589.77590.qm(a)web15706.mail.cnb.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > I found??a new man-in-the-middle attack with SSL.? http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-d… > ? > I am afraid if freeRADIUS use SSL renegotiation?? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection.? > Does??freeRADIUS use SSL renegotiation ? > ? > Thanks. > John > > > ___________________________________________________________ > ????????????????? > http://card.mail.cn.yahoo.com/ >

6 16