February 2009 - Freeradius-Users - lists.freeradius.org

Regular expressions doesn't work in /etc/raddb/hints
by Victor Shkamerda 13 Feb '09

13 Feb '09

Hi, We are migrating from other RADIUS software to FreeRADIUS. In order to avoid changing existing users database objects, I'm trying to fix the User-Name attribute format in NAS request and it seems that preprocess module is the right place to do that. But after adding new default rule in the hints file I have discovered that it doesn't work. The rule is always matching my regular expression no matter what string I put into it. The regular expression is simply the string itself i.e. like "/string/". After looking through sources I found that in src/lib/valuepair.c in pairmove the operator T_OP_REG_EQ is commented out. Could it be the culprit or is there anything else that I should know? The FreeRADIUS version is 2.1.3 on SLES 10 compiled from sources. Best regards, Victor Shkamerda

2 5

FreeRadius client
by Apostolos Pantsiopoulos 13 Feb '09

13 Feb '09

Hi, Does the FreeRadius Client 1.1.6 compile under windows? Regards, -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 3

Free Radius server installation
by seyfullah 13 Feb '09

13 Feb '09

we are kocaeli university in Turkey. we want to install and configure radius server on solaris 10. where can we find full and detailed installatin and configration manuals( include dependencies). Thank you Seyfullah BAŞKÖYLÜ It Chairman of Kocaeli University Kocaeli University campus Kocaeli/Turkey

2 1

Proxy with two interfaces configuration
by D'AVELLA STEFANO 13 Feb '09

13 Feb '09

Hello all, I am using freeradius 2.1.0 on two ubuntu machines, one of which is configured as server and one as proxy. The network is configured in ipv6 but that's not the problem here (everything regarding ipv6 works well now) I am trying to create a testbed where there is three machines: -one server, which listens to an interface -one client (for testing I am just using radclient) that sends auth requests to a proxy -one proxy, in the middle of the two other machines, that proxies auth requests to the server. This proxy has two interfaces, one connected to the client and one to the server. All following ipv6 addresses are to be read with global scope (but as I said, if they were ipv4 it would be the same I think) Server address : 2001::400 Proxy (interface to the server) 2001::300 Proxy (interface to the client) 2000::300 Client 2000:200 Now when I try to run the test what it happens is that the client sends the auth request, the proxy correctly forwards it to the server, and the server correctly authenticate the client. The problem is that the proxy sends the proxied message with the address 2000::300, not 2001::300. When the server tries to reply to the proxy, it tries to send the packet to 2000::300 but since it is a different network there is no route for it. I have been searching for a while in the users / radiusd.conf / clients.conf / proxy.conf for a option to set the proxy ip address when proxying messages. It seemed to me that I saw something like that , but if I did I just can't find it again. If it exists it would be sufficient to tell me where to find it and I will hopefully solve this issue on my own. I attach some config files: Server: Clients.conf # IPv6 Client client 2000::300 { nastype = other secret = testing123 shortname = relay } (if I set 2001::300 it tells me that it receives a packet from the unknown host 2000::300 and discards it) Radiusd.conf listen { # ipaddr = * ipv6addr = 2001::400 port = 0 type = auth } Proxy Clients.conf # IPv6 Client client 2000::200 { secret = testing123 shortname = mobile } Proxy.conf home_server rad_server { type = auth ipv6addr = 2001::400 port = 1812 secret =testing123 } home_server_pool my_auth { type = fail-over home_server = rad_server } realm example.com { auth_pool = my_auth } (example.com is the realm I use in the test) P.S: another quick question. It is possible with some logging option (or in other ways) to save the attributes that the server adds to the auth accept message locally in a file in the proxy machine? I saw that there is some options to add/modify the attributes in the reply, but it is possible to save them in a file? Thanks in advance for the help and sorry if I am missing out something obvious. Best Regards, -- D'Avella Stefano Bell Labs Alcatel-Lucent Centre de Villarceaux Route de Villejust 91625 NOZAY

2 2

Simultaneous-Use for roaming wireless user
by ST Wong (ITSC) 13 Feb '09

13 Feb '09

Hi all, We enabled Simultaneous-Use checking with checking against accouting data stored in MySQL database. However, found that some of the Stop records are not received and this makes Simultaneous-Use checking fail. Seems roaming users will always encountered this problem. I wonder if I've to use checkrad instead but seems our AP (Aurba) is not permitted as nastype in clients.conf. Would anyone please advise any solution for this issue? Thank you very much. Best Regards, /ST Wong

2 1

Session-timeout problem
by Mitul Modi 12 Feb '09

12 Feb '09

hi, i am new to free radius. can any one help how i can cinfigure Session-Timeout? i am using EAP-TTLS with chap password. i have added credentials for user name and password in users file. thanks, mitul modi

2 2

Re: authenticating to ldaps/tls
by Peter Param 12 Feb '09

12 Feb '09

>> use start_tls=no fails also, >Maybe but keep it to no did that, still fails with the same message >> it seems to have a problem with the cert and/or cert directory: >> >> rlm_ldap: attempting LDAP reconnection >> rlm_ldap: (re)connect to ldap1.stvincents.com.au:636, authentication 0 >> rlm_ldap: setting TLS mode to 1 >> rlm_ldap: could not set LDAP_OPT_X_TLS option Success >> >?? this is confusing... could that mean that your ldap library wasn't >compiled with ssl support... I'm not sure >see >http://www.mail-archive.com/freeradius-users@lists.cistron.nl/msg09575.html >(but this is a rather old post) The version openssl I'm using is: OpenSSL 0.9.8i 15 Sep 2008 The CA certificate is valid for the ldap server because the client connects when I test with... "openssl s_client -CAfile SVMHS_CA_SSL_Server.pem -connect ldap1.stvincents.com.au:636" Freeradius was compiled as follows: /configure --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --localstatedir=/var --libdir=/usr/lib --includedir=/usr/include --with-radacctdir=/var/log/freeradius/radacct --with-raddbdir=/etc/freeradius --with-openssl-includes=/etc/include/openssl --with-openssl-libraries=/usr/lib cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

PEAP/MS-CHAPv2 for some, Kerberos (or PAM) for others...
by sth 12 Feb '09

12 Feb '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, First off, thanks to Alan and the "Configuring Authentication against Active Directory" HOWTO[1] for assistance in getting 802.1X authenticating against AD for WPA2 Enterprise. I currently have PEAP/MS-CHAPv2 authenticating against AD, TTLS/PAP against MIT Kerberos 5, and PEAP/MS-CHAPv2 against krb5 via KCRAP[2], thanks to a colleague who was already hacking on KCRAP for another project. (My supervisor wanted options...) Separately, they each work very smoothly, and PEAP/MS-CHAPv2/KCRAP will be going to production shortly. It would seem there are potentially multiple ways to execute my next task, and I wanted to ping the group for ideas on the most elegant way to do it. It seems like it could get complicated pretty quickly, and I'd like to avoid unnecessary config bloat. If I have to run two RADIUS servers to maintain sanity, that's fine. I'd like to integrate the function of an older RADIUS server (FR 1.0.1) into the new one (FR 2.1.3), which handles 802.1X. The old FR box handles authentication for a VPN concentrator. It has some static users defined, then defaults to PAM (which, in this context, means krb5). Krb5 works fine on the FR 2.1.3 config if I append: DEFAULT Auth-Type := Kerberos to the users file. Doing so breaks all tunneled EAP methods (which reading leads me to believe is predictable). Using PAM gives similar results, and I figured it better to use FR's native krb5 support anyway. I started down the path indicated in a seemingly-similar thread[3] from February of 2008, but my understanding of FR is still not good enough that I can parlay those (mostly FR1.x) instructions into a valid FR2.x config, in spite of Phil Mayers' general comments re: using 2.x's virtual server functionality. Are EAP and DEFAULTs mutually-exclusive? If not, what's the most effective way to approach this? Your thoughts on the matter are appreciated. I apologize in advance if there's already a wiki page or thread that deals with this, and accept links to such posts with great gusto. :-) Cheers, - -sth [1]http://deployingradius.com/documents/configuration/active_directory.html [2]http://www.spock.org/kcrap [3]http://www.nabble.com/PEAP-EAP-TTLS-acquires-DEFAULT-reply-attributes-via… sam hooker|http://www.noiseplant.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmQqIoACgkQX8KByLv3aQ1YxgCgsrheI8q4pzFfHfkMJrHEVd7l NFQAmwX1Us7zhDQi8MRop1qUapJ5d8I+ =ptp9 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Custom error messages
by Santiago Balaguer García 12 Feb '09

12 Feb '09

Hi, I use freeradius 1.1.7 for autenticate users to provide Internet connectivity. I have groups of usernames who has access from anywhere. However, I have others groups which only has access from one NAS (promotional codes). I know how to block these accounts from my Postgres Database: table radgroupcheck promotion NAS-IP-Address !~ 1.2.3.(4|5) I reject the request from the NAS wich IP 1.2.3.4 or 1.2.3.5. My question is: Can I send the error message: You are not allow from this site? If it is so, how? Thanks, Santiago _________________________________________________________________ Llévate Messenger en tu móvil allá donde vayas ¿A qué esperas? http://serviciosmoviles.es.msn.com/

1 0

Re: using IP address of vpn users in radius server
by Eric 12 Feb '09

12 Feb '09

yes.but how can I specify Calling-Station-Ids based on valid and invalid ips? I want that radius checks that if Calling-Station-Id is valid radius sends ippool 1 for vpn server and if Calling-Station-Id is invalid sends ippool2. Where this compare is set in radius server? Message: 2 Date: Sat, 07 Feb 2009 16:12:10 +0100 From: <tnt(a)kalik.net> Subject: Re: using IP address of vpn users in radius server To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <5yFqtWPV.1234019530.4835870.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 >I have a radius server that uses ldap server for authentication and >authorization. The client of radius server is a vpn server. >now they are working. I want to have two groups of vpn users in vpn server >base on their IP addresses. >Could radius server check IP address of users Yes. IP address should be in Calling-Station-Id attribute in the request. Ivan Kalik Kalik Informatika ISP

1 0