April 2009 - Freeradius-Users - lists.freeradius.org

strange for me
by Tseveendorj 16 Apr '09

16 Apr '09

Hello, I configured bandwidth shape in FreeRADIUS's MySQL with following in radgroupreply table Cisco-AVPair := ip:sub-policy-Out=256Kbps but today I defined Pool-Name attribute in radcheck table tseveen Pool-Name := pool the problem is when I defined Pool-Name attribute then bandwidth shape doesn't work. I can download something 1.2Mbps How do I define both bandwidth shape and Pool ? Really appreciate for any help. Sincerely, Tseveen

2 3

Re: Dynamically set password_attribute
by James Devine 16 Apr '09

16 Apr '09

Being able to verify the mac against the ldap database is the best scenario, the mysql database we are using for accounting only. I added: DEFAULT User-Name =~ "([0-9a-fA-F]{2}:){5}[0-9a-fA-F]" Auth-Type := Accept to the users file, but I am still see it setting auth type to ldap after authorization: Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: waiting for bind result ... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: Bind was successful Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: performing search in dc=gwis, with filter (&(macaddress=00:1f:3a:21:62:f8)(aaaenable=1)) Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for check items in directory... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: aaasimultaneoususe -> Simultaneous-Use == 1 Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for reply items in directory... Thu Apr 16 13:59:32 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Thu Apr 16 13:59:32 2009 : Info: [ldap] Setting Auth-Type = LDAP On Wed, Apr 15, 2009 at 5:06 PM, Kenneth Grady <klg(a)lanl.gov> wrote: > If you don't want LDAP to authenticate your mac addresses you need to > set the Auth-Type before it gets set to ldap. > You can do that a number of ways (I use #3) > > 1) try macs in the users file > 00:1f:3a:21:62:f8 ClearText-Password := "00:1f:3a:21:62:f8" > or > DEFAULT User-Name =~ > > "^00:1f:3a:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]$", > Auth-Type := Accept > > 2) or add mac addresses in your mysql database > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","ClearText-Password",":=","${MAC-Address}"); > or > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","Auth-Type",":=","Accept"); > > 3) a combination of put the DEFAULT and all MAC-Addresses in the mysql > database and don't have ldap set the Auth-Type > INSERT INTO radgroupcheck values (null,"DEFAULT","Auth-Type",":=","LDAP"); > INSERT INTO radusergroup VALUES ("DEFAULT","DEFAULT",1); > INSERT INTO radgroupcheck values (null,"MAC","Auth-Type",":=","Accept"); > #for each MAC you want to accept replace the 00: with your mac addresses > INSERT INTO radusergroup VALUES ("00:00:00:00:00:00","MAC",1); > DELETE FROM radusergroup where username ="00:00:00:00:00:00"; > and in modules/ldap > ldap { > ... > set_auth_type = no > } >

2 1

Freeradius+Java application api call and authenticate
by sollunga 16 Apr '09

16 Apr '09

i am using Cisco ACS for authenticating my vpn users, now i thought of using two factor auth in place against the direct authentication by ACS, on this process one of the googling guided me to try proxying the ACS to Freeradius and call some scripts to talk to the java application. now by making the ACS to do proxying at network configuration, i can see the request is flowing to freeradius from ACS, and the freeradius does "" [chap] rlm_chap: Attribute "User-Name" is required for authentication. ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 27 for 1 seconds "" after a while it says "" [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "Doe" with CHAP password [chap] Using clear text password "hello" for user Doe authentication. [chap] chap user Doe authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 63 to "" i am trying to figure out where could be the issue once after this process, i need to send the same to a java application and get a success status from there and authenticate this user. could it be possible? team i am a newbie here, i am just a sys admin, and now trying extend my knowledge, please help me. -- View this message in context: http://www.nabble.com/Freeradius%2BJava-application-api-call-and-authentica… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

other device to store configuration!
by new conf 16 Apr '09

16 Apr '09

hello to all; I have a question.. and i hope I'll have a reply or an idea!! If I have to store my files of configuration (eap, keys, randoms, dh..) in a usb device, have you an idea: how can I configure my freeradius? thanks you for your help!

4 10

Help with initial setup Sita<-->Ext. Radius<-->Int.Radius<-->AD
by Podlazov, Lev 16 Apr '09

16 Apr '09

Good morning , Our organization is trying to set Wireless Users authentication via AD with Radius in between. The reason for Ext. and Int. Radius based on our security group recommendations. I've installed freeradius-1.1.3 from RedHat . It's up on both Ext and Int boxes. I was able to run radtest and radclient locally on both machines but when I am trying to run them from Ext to Int I am getting these errors radclient: no response from server for ID 174 . I've set access for all users in /etc/raddb/users and defined clients in /etc/raddb/clients.conf according to documentation. I am totally new to Radius and this point I am lost what to try next. Any help greatly appreciated Thanks Lev Podlazov IMF 202-623-4054

3 3

Re: Freeradius-Users Digest, Vol 48, Issue 56
by Guk Victor 16 Apr '09

16 Apr '09

1 0

Re: NAS table
by Nizar Zulmi 15 Apr '09

15 Apr '09

i comment out this on clients.conf #client 127.0.0.1 { # secret = passwordradius # shortname = localhost # nastype = other # localhost isn't usually a NAS... #} and i add this to NAS table on radius database. insert into nas (nasname, shortname, secret) values ("client 127.0.0.1","localhost","passwordradius"); i restart the mysql server and then i perform test using radtest and got this message: radtest Nizar 123456 localhost 1812 passwordradius Sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 .... Re-sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 radclient: no response from server for ID 104 why its still dosn't work..?? clue plase... --- On Tue, 4/14/09, JDL <JDL(a)imaginenet.net> wrote: From: JDL <JDL(a)imaginenet.net> Subject: Re: NAS table To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tuesday, April 14, 2009, 11:42 AM Nizar Zulmi wrote: > i enable this on sql.conf > readclients = yes > > do i have to remove this : > client 127.0.0.1 { Do you have a "127.0.0.1" client in your the nas table? If so, then yes, you will need to remove it or else you will end up with a duplicate. If this client is not in your nas table, then you can just leave the 127.0.0.1 client in the clients.conf file. BTW, I think the 127.0.0.1 client is just there for testing purposes. I do not believe it will break anything if it is completely removed (unless, of course, you are running also running some sort of radius client on the same server as FreeRADIUS). Jim L. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

Detail file polling issues
by Alan DeKok 15 Apr '09

15 Apr '09

Some people have seen the detail file listener go "crazy", and use lots of CPU. I've managed to reproduce the problem, and have committed a fix to the "stable" tree. Please see http://git.freeradius.org/pre/ for tar files && debian files containing the fix. Or, see http://git.freeradius.org/ for instructions on grabbing the latest "stable" code from git. Alan DeKok.

3 6

Dynamically set password_attribute
by James Devine 15 Apr '09

15 Apr '09

Is it possible to dynamically set the password_attribute ldap module option? I tried setting it to %{Ldap-Pass-Attr}, but it doesn't seem to expand this.

3 6

RE: (EAP) AES Key-wrap of MK issued to the authenticator
by William Rettig 15 Apr '09

15 Apr '09

I'm trying to set up AES Key-wrap of MK issued to the authenticator. Is this possible? If it is, will someone please explain how to do it? Thank you, Bill

1 0