September 2009 - Freeradius-Users - lists.freeradius.org

Log file differentiation
by Nathan McDavit-Van Fleet 16 Sep '09

16 Sep '09

Is there anyway to have Freeradius log whether a connection is either PEAP or TTLS in the log file? Both of them indicated that it is through a TLS tunnel with no indication of the differences. FYI they are coming through the same NAS server. Nathan

3 2

Freeradius 2.x EAP-PEAP/MSCHAPv2 + LDAP
by Maverick 16 Sep '09

16 Sep '09

Hi, I'm kind of new to radius, and I would like to know if someone can tell me how to configure freeradius so I can authenticate wireless clients (Windows / Linux) but the users and passwords are stored in a openldap database. I've seen some tutorials on the net but they are all for freeradius 1.x

3 2

RE: Using Attributes to differentiate between different EAP types
by Nathan McDavit-Van Fleet 16 Sep '09

16 Sep '09

I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address"). if("%{outer.request:EAP-Type}" == 21) { ldap_wireless } And I get the error /etc/freeradius/sites-enabled/inner-tunnel[131]: Parse error in condition at: "%{outer.request:EAP-Type}" == 21) Does anyone know where this information is accessible from? I'm not able to find any data for what's available in the different inner/outer/request structs (or whatever they might be). Thanks, Nathan Van Fleet

4 8

dynamic-clients help
by Deepak 16 Sep '09

16 Sep '09

Hi, I am using freeradius 2.1.6 in CentOS 5.3 with mysql backend. As a follow up question to my previous posting, I have modified the following in dynamic-clients file. ====================================================== client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 86400 } server dynamic_client_server { authorize { preprocess chap mschap suffix unix sql expiration logintime pap noresetcounter dailycounter monthlycounter accessperiod update control { #FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" #FreeRADIUS-Client-Require-MA = no #FreeRADIUS-Client-Secret = "testing123" #FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}" #FreeRADIUS-Client-NAS-Type = "other" #FreeRADIUS-Client-Virtual-Server = "something" } if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } } ok } } ====================================================== I am not sure if I have to put all the modules as in the default file. I skipped the ========== eap { ok = return } ========== but rest is same as default in authorize section In my "nas" table, I have following: ==================== nasname: 0.0.0.0 shortname: <shortname> type: other ports: 0 secret: <sharedsecret> ==================== My AP have same secret set but still the request is ignored. What are the other things I need to consider? I am trying to authenticate users from NAS somewhere in the internet. Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

5 14

Parenthesis "()" question?
by Deepak 16 Sep '09

16 Sep '09

Hi, Just out of curiosity, I noticed that radius silently ignores the attributes in the group name with parenthesis. For example: =========== If groupname is "My Plan (Gold)", radius ignores the check attributes in this group when authenticating. If groupname is "My Plan Gold", it works fine. =============== Since I am not familiar with inner working of radius, just curious if parenthesis have special meaning. Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

1 0

input to radclient
by Rakotomandimby Mihamina 15 Sep '09

15 Sep '09

Hi all, I made preliminary tests for AUTH with radclient. now, I would like to make some ACCT tests (start, stop) and see if it updates the database. As far as I know, it's about echo "something" | radclient. Beside me is a working old installation I have detailed logs, like [1]: are those looking like what I should feed radcalient with? (I just have to provide the right password) [1]: cat of radacct/hostname/details-`date` [...] Tue Sep 1 15:54:21 2009 Vendor-14559-Attr-8 = 0x312e302e3134 Vendor-14559-Attr-10 = 0x00000000 Acct-Status-Type = Start User-Name = "Supv_logging" Calling-Station-Id = "00-24-2B-60-02-19" NAS-Port-Type = Wireless-802.11 NAS-Port = 7 NAS-Port-Id = "00000007" Framed-IP-Address = 10.150.0.134 Acct-Session-Id = "4a9d194e00000007" NAS-IP-Address = 10.150.0.1 Called-Station-Id = "00-90-0B-10-D0-8D" NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Acct-Unique-Session-Id = "0e888a6b0f97e6e0" Timestamp = 1251809661 Request-Authenticator = Verified Tue Sep 1 15:59:23 2009 Vendor-14559-Attr-8 = 0x312e302e3134 Vendor-14559-Attr-10 = 0x00000000 Acct-Status-Type = Interim-Update User-Name = "Supv_logging" Calling-Station-Id = "00-24-2B-60-02-19" NAS-Port-Type = Wireless-802.11 NAS-Port = 7 NAS-Port-Id = "00000007" Framed-IP-Address = 10.150.0.134 Acct-Session-Id = "4a9d194e00000007" NAS-IP-Address = 10.150.0.1 Called-Station-Id = "00-90-0B-10-D0-8D" NAS-Identifier = "nas01" Acct-Input-Octets = 189943 Acct-Output-Octets = 159669 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 617 Acct-Output-Packets = 856 Acct-Session-Time = 302 WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Acct-Unique-Session-Id = "0e888a6b0f97e6e0" Timestamp = 1251809963 Request-Authenticator = Verified [...] -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

1 1

request for experience with LDAP
by Rakotomandimby Mihamina 15 Sep '09

15 Sep '09

Hi all I am going to make the try to use LDAP with FreeRadius 2 - Just CHAP - No encryption - Clear text password - dialup (with credit --) accounting All on Debian Lenny, packaged only. Has anyone written down his notes for that usage? Would like to share? :-P -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Using Attributes to differentiate between different EAP types
by nmcdavit＠alcor.concordia.ca 15 Sep '09

15 Sep '09

I have configured a Freeradius server to work with PEAP using NTLM_AUTH. Everything worked fine and tested out perfectly. Since then I added a configuration for EAP_TTLS, which really just means I added a configured LDAP module ldap_myconfig into the inner-tunnel. Unfortunately the PEAP connection no longer works, but the TTLS does. PEAP is my default EAP type. So Im pretty sure the simplest fix is to just have a if operator and for something like If(rlm_eap_type == EAP/TTLS) { ldap_myconfig} The only problem is that I have not seen any such attribute for freeradius. I figure there should very well be something akin to that as a run time variable correct? Regards, Nathan Van Fleet

6 8

LDAP/AD and multiple OU's
by Justin Steward 15 Sep '09

15 Sep '09

Hi guys, A couple of quick questions just to make sure I don't end up chasing my own tail. Need to authenticate by doing a basic bind against an AD server. All users are contained in seperate OU's below a primary OU. The relevant LDAP lines from radiusd -X are (with identifiable information removed): rlm_ldap: bind as Cn=lookupuser,OU=Primary, ou=....../password123 to .....:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Primary,ou=....., with filter (uid=username) rlm_ldap: object not found or got ambiguous search result Now, I know the user is actually contained in ou=2015,ou=Primary,ou=..... and there are others contained in 2016,2017,2018, etc. 1) Does freeRadius automatically search each of these sub containers, or do I have to tell it to some how? 2) Does AD even store usernames in UID? (loln00b question. But i have no experienec with AD, so far I haven't had an AD box to play with, and this one is more or less out of my control, I can only talk to it over LDAP.) Many Thanks, Justin

4 4

client certs signed by server certs
by Piotr Honik 15 Sep '09

15 Sep '09

Hi, I found a problem with a client cert in Windows certificate store, after all three certs have been installed. The server cert is considered invalid, because it lacks the privilege to sign further certs. I hacked the Makefile a little bit, to generate client certs signed by CA cert, not by the server certs. This way, CA signs both certs and only the CA and client certs are required for Windows systems, and after successful installation both are considered valid. I do understand that eliminating server cert has a security impact, but where should it be installed? __________ Informacja programu ESET Smart Security, wersja bazy sygnatur wirusow 4425 (20090914) __________ Wiadomosc zostala sprawdzona przez program ESET Smart Security. http://www.eset.pl lub http://www.eset.com

1 0