November 2009 - Freeradius-Users - lists.freeradius.org

Nas update with DynDNS
by Fahd Kasri 17 Nov '09

17 Nov '09

To avoid restarting radiusd everytime the Nas table is updated, I want to use something similar to DynDNS. Does radiusd cache the domain's IP address at startup or does it resolve the domain name every time? -- Fahd

2 1

Authenticating in a Debian lenny through freeradius
by Wagner Pereira 17 Nov '09

17 Nov '09

Hi, What should I edit in a Debian lenny aiming to authenticate my user in another server running freeradius (via PAP method, according to Alan Dekok in http://deployingradius.com) Thanks. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

1 0

COA Examples
by Andrew Paternoster 17 Nov '09

17 Nov '09

HI Does anyone have any COA policy examples? I want to use them on a cisco router to change the traffic shaping policy at different times of the day. Thank you Andrew Paternoster Senior System Engineer [cid:logo35.jpg]<http://www.gpk.net.au/> [cid:spacer7cf.jpg] <http://www.gpk.net.au> 2/94 Abbott Road, Hallam, VIC 3083 Phone: 1300 854 223 Fax: 1300 854 228 www.gpk.net.au<http://www.gpk.net.au/> Did you know that you can now log faults by just sending an email to support(a)gpk.net.au<mailto:support@gpk.net.au> The information contained in or accompanying this e-mail is intended only for the use of the stated recipient and may contain information that is confidential and/or privileged. If the reader is not the intended recipient or the agent thereof, you are hereby notified that any dissemination, distribution or copying of this e-mail is strictly prohibited and may constitute a breach of confidence and/or privilege. If you have received this e-mail in error, please notify us immediately. Any views or opinions presented are those solely of the author and do not necessarily represent those of GPK Computers Pty Ltd.. Warning: Although the company has taken reasonable precautions to ensure no viruses are present in this e-mail, the company cannot accept responsibility for any loss or damage arising from the use of this e-mail or attachments

2 2

realm --help
by Yagnesh Dave 17 Nov '09

17 Nov '09

Hi, I have a realm as "vsnl.net" given to all the users (approx 2800 users), with different passwords. I have defined it in the "proxy.conf" as realm vsnl.net { type = radius authhost = local accthost = local } So, is this correct, as i am not defining any secret above because it is different to all the users, and the radius server itself will reply to the authentication request. Also is there a way by which I can migrate from Merit Radius to Freeradius seamlessly, as cuurently what I am doing is I have a perl script to convert the users file of Merit Radius to the syntax that Free Radius has and then use it. Thanks and Regards, Dave.

2 1

Book About Free-Radius Configurations
by INACIO ALVES 17 Nov '09

17 Nov '09

Hello, I have some days out, but I'm back. I would like know if exists any book with examples and explications about freeRadius configurations and the RADIUS protocol. What you thinks about the book http://www.amazon.com/AAA-Network-Security-Mobile-Access/dp/0470011947/ref=… Thanks, Inácio Alves http://www.polluxweb.com/inacioalves/site

2 1

acct-delay-time appears to be off
by Steven Staples 17 Nov '09

17 Nov '09

I have been looking at this, and scratching my head. It appears as if the (timestamp -(minus) acct-delay-time) does not always = the actual start time of the session. From my observation, and log reading script, I have found that there could be a +/- 1 second variance in either the timestamp, or the acct-delay-times. Could this be the router sending it's time, and the radius box intercepting it at a possible rounding up or down to the next second? Is there a way to use the microseconds to ensure that these values are accurate all the time? Basically, what I am trying to achieve, is that when I insert into my 'MySQL' database that it's updating the proper start record on 'Interim-Update' or 'Stop' records, and not creating a new start record for it when it's just off by 1 second or so. Is there possibly a better way to create a unique key, rather than what I am currently using as a unique group of fields: Framed-ip-address + nas-ip-address + user-name + acct-session-id + ((timestamp - acct-delay-time) - acct-session-time) Steven Staples

2 1

bug in rlm_ldap authorization password handling?
by John Dennis 17 Nov '09

17 Nov '09

I'm a little confused by how rlm_ldap is handing passwords. First let me state what I believe to be true, if I'm wrong on any of these assumptions please correct me. Authentication modules need access to either the cleartext password or hashed password, it is the role of the authorization modules to insert the password information into the *config* list of the request. The authentication modules will extract the password information from the config list during the authentication phase. The password attribute inserted into the config list during authorization is *never* PW_USER_PASSWORD, because this is the attribute supplied by the client in the request. Rather the authorization modules *may* insert into the *config* list one of (PW_CLEARTEXT_PASSWORD, PW_MD5_PASSWORD, PW_SMD5_PASSWORD, PW_CRYPT_PASSWORD, PW_SHA_PASSWORD, PW_NT_PASSWORD, etc.) These will then be used by the authentication modules. rlm_mschap needs the ntlm hash (PW_NT_PASSWORD), if that is not in the config list then it computes it from the cleartext password (PW_CLEARTEXT_PASSWORD) found in the config list. Is the above correct? If so then it seems to me rlm_ldap is doing something wrong in it's authorization routine. rlm_authorize() searches for the password attribute which may be multi-valued (typically the attribute name is userPassword from the posix objectclass) If found it adds PW_USER_PASSWORD to the config list, but PW_USER_PASSWORD does not belong in the config list, it's a request attribute, it should have been PW_CLEARTEXT_PASSWORD (with a caveat which follows). Here's the caveat, it's possible to indicate the password hash type by prepending {type} to the password string where type is typically one of (clear, crypt, md5, sha, nt, etc). This behavior is turned on by the auto_header configuration variable in raddb/modules/ldap, which for some reason is undocumented in raddb/modules/ldap, Why? FWIW, auto_header defaults to "no". However if auto_header is enabled then guess what? The attribute added to the config is one of the correct password attributes (e.g. PW_CLEARTEXT_PASSWORD, PW_NT_PASSWORD, etc.) But if and only if the password value returned is prepended with {type}, if it isn't prepended then it skips the password attribute rather than using the *default* of PW_CLEARTEXT_PASSWORD. (Our LDAP gurus believe the interpretation of userPassword without a prefix is clear text). So ... It seems as if you're storing a clear text password without a prefix in the userPassword attribute (or whatever attribute rlm_ldap is configured for) you'll never update the config list wtih PW_CLEARTEXT_PASSWORD in authorize and the subsequent authentication modules may fail as a consequence if they are depending on having access to the clear text password. Or am I just missing something? It seems to be there are three bugs: 1) inserting PW_USER_PASSWORD into config instead of PW_CLEARTEXT_PASSWORD 2) not documenting auto_header 3) if auto_header is enabled not defaulting to clear text if no prefix is supplied. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 2

Re: Freeradius-Users Digest, Vol 55, Issue 74
by Gilbert Lo 17 Nov '09

17 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

freeradius a openser installation
by toqeer ali 17 Nov '09

17 Nov '09

Hi all, I am new to freeradius i am facing a problem when starting the service freeradius after including the path of dictionary.radius in dictionary main file of freeradius. i am getinng this error. please help Error: Errors reading dictionary: dict_init: No ATTRIBUTE "Sip-Method" defined for VALUE "Other" -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

RE: Freeradius-Users Digest, Vol 55, Issue 73
by Peter Carlstedt 17 Nov '09

17 Nov '09

By the way I forgot to ask, is there anywhere I can read about this kind of things? I want to get a good understanding on how outer and inner tunnels work and what they do. Don´t think I´ve seen anything about it on the Freeradius wiki...or may I be blind? :) Best regards/ Peter > ????????????????? > http://card.mail.cn.yahoo.com/ >

1 0