January 2010 - Freeradius-Users - lists.freeradius.org

LDAP identity is plaintext?
by John 20 Jan '10

20 Jan '10

Hi all, We are using freeRADIUS-1.1.6 talk to LDAP server. We need configure "identity" and its "password". My question is can "password" be encrypted, for example use "chap" or "sha1" ... enctryption? Best. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

WinXP 802.1x
by Devinder Singh 19 Jan '10

19 Jan '10

2010/1/20 Devinder Singh <devinbhullar(a)gmail.com> > Hi Ivan > > I had had followed the steps to create certitifactes for Win XP and > configured the AP. > > Also copied the client.p12 and ca.der to XP machine > > When i double click on the SSID palstaff it shows the windows was unable to > log you on to the palette network. > > Regards > > > Devinder > -- Devinder

1 0

Re: Decoupled accounting
by Devinder Singh 19 Jan '10

19 Jan '10

Hi Ivan Ok i managed to install ca.der and client.p12 on my XP When i run radiusd -X i get rad_recv: Access-Request packet from host 203.121.4.59 port 6001, id=30, length=216 User-Name = "devinder(a)palettemm.com" NAS-IP-Address = 203.121.4.59 Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" Calling-Station-Id = "00-04-23-7b-56-b9" NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" State = 0xf30ae66df60debd09c91249e7b82f0a9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207002c0d000116030100205a6f866d20eb642ddc9f404f90d8650422eb751e7bb0199a016bb14e384df6fa Message-Authenticator = 0x06206416bbe520db012eb924f72ba75e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "palettemm.com" for User-Name = "devinder(a)palettemm.com" [suffix] No such realm "palettemm.com" ++[suffix] returns noop [eap] EAP packet type response id 7 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry devinder(a)palettemm.com at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 30 to 203.121.4.59 port 6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 24 with timestamp +83 Cleaning up request 1 ID 25 with timestamp +83 Cleaning up request 2 ID 26 with timestamp +83 Cleaning up request 3 ID 27 with timestamp +83 Cleaning up request 4 ID 28 with timestamp +83 Cleaning up request 5 ID 29 with timestamp +83 Waking up in 1.0 seconds. Cleaning up request 6 ID 30 with timestamp +83 Ready to process requests. Users File "devinder(a)palettemm.com" Auth-Type := EAP DEFAULT Auth-Type := Reject Reply-Message = "Authentication Failed" 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >> Do i copy this file to the XP and install ca.der >> >> ca.der and client.p12 > > Yes. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 5

vlan id
by cd 19 Jan '10

19 Jan '10

hello I have a little problem. I try to authentificate users with freeradius+LDAP (it works) and put them in vlan by ldap-group all looks good example: ldap_parse_result rlm_ldap::ldap_groupcmp: User found in group Eleves ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 206 but freeradius tries to get VLAN informations from ldap server radiusTunnelType: VLAN radiusFilterId: Enterasys:version=1:policy=Enterprise User radiusTunnelMediumType: IEEE-802 and not from users files DEFAULT ldap_sw-Ldap-Group=="Eleves" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="ok", Fall-Through=No any help ? thanks my config files http://cdeze.pastebin.com/m2a7473b2 freeradius -X output http://cdeze.pastebin.com/m419134bf

1 0

Re: Reply-Message
by zhongwei feng 19 Jan '10

19 Jan '10

hi, configure postauth_query in dialup.conf, postauth_query="UPDATE POSTREPLY SET REPLYMESSAGE='%{reply:Reply-Message}' WHERE USERNAME='%{SQL-User-Name}' " than , you can query the message from DB SERVER. BTW: if reject user, then ... # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Post-Auth-Type REJECT { %{sql:UPDATE POSTREPLY SET REPLYMESSAGE='%{reply:Reply-Message}' WHERE USERNAME='%{SQL-User-Name}' } } >Message: 1 >Date: Sat, 16 Jan 2010 20:55:45 -0000 >From: "Neville" <nev(a)itsnev.co.uk> >Subject: Reply-Message >To: <freeradius-users(a)lists.freeradius.org> >Message-ID: <1C54F0ABDAFE4EF7B9F3F9D4EC3EFBAC@NevPC> >Content-Type: text/plain; charset="iso-8859-1" > >Hi, > >Is there any way to get the reply message loaded into a SQL TABLE, which a user can then query on to see the last reply based on there username? > >Thx >Nev >

3 3

TR: Using the same FreeRadius for account into MySQL for clients whithdifferent attributes
by David Florella 19 Jan '10

19 Jan '10

Hi, I am using a FreeRadius server Version 1.0.1 only for accounting with Cisco gateways. Now, I want to use the same server with Dialogic gateways. Dialogic and Cisco have their own RADIUS dictionary. When I write in a MySQL database the log of accounting, how can I write for both attributes (Cisco and Dialogic)? No on have an idea to solve this problem? Regards, David. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

customize Post-Auth-Type REJECT
by pawel_221 19 Jan '10

19 Jan '10

I'm trying to change user speed to lower when he reach transfer limit. Currently after reaching transfer limit NAS is disconnecting user and when he's trying to connect he is rejected. In debug log I can see: rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user user01, check_item=50000000, counter=50062959 ++[noresetbytescounter] returns reject Could you help me with Post-Auth-Type REJECT? How can I read the control:counters in Post-Auth? I couldn't find an answer on forum... What should I write instead "if (%{control:counter} > %{control:check_item} ) {" in my config? Post-Auth-Type REJECT { if (%{control:counter} > %{control:check_item} ) { update reply { Reply-Message := "You have reached your transfer limit. Limited bandwitch" } update control { Auth-Type := "Accept" WISPr-Bandwidth-Max-Down = 1048576 WISPr-Bandwidth-Max-Up = 262144 } } My sqlcounter.conf: sqlcounter noresetbytescounter { counter-name = Max-Total-Octets check-name = Max-Total-Octets reply-name = HotSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctInputOctets)+SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" } Greetings Pawel -- View this message in context: http://old.nabble.com/customize-Post-Auth-Type-REJECT-tp27173361p27173361.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

Major noob question about freeradius
by Bryan Boone 18 Jan '10

18 Jan '10

Hi everyone maybe you can help me. I have a small network of about 10 windows XP machines. I need to set these machines up so that my users can log into any of these machines. For me the simplest solution to solve this would be a windows 2003 server domain controller. Unfortunately due to some corporate restrictions I cannot install a windows server. I was told that a Radius server could accomplish the same thing for me. Is this true? Basically I just need a way for my users to sit down at any of the windows XP workstations and log into it. I don't need anything special like "roaming profiles" and such. All I need is for a way for a windows user to sit down at any computer and type in a user name and password in order to gain access to use the computer. I saw the tutorials online but I don't think this is what I need. Something about setting up a VPN and adding certs and such. I need freeRadius to control access to user the computer not to gain access to a network resource. I have installed freeRadius and got it up and running on openSUSE but I am not really sure how to configure it according to what I need (if it can be done at all). Am I making sense or am I way off base? Does someone have a document I can follow that will tell me how to configure freeradius so that my windows users can authenticate against it? thanks _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. http://clk.atdmt.com/GBL/go/196390707/direct/01/

4 3

Re: Major noob question about freeradius
by freeradius＠corwyn.net 18 Jan '10

18 Jan '10

At 02:01 PM 1/18/2010, Eric Swanson wrote: >On Mon, Jan 18, 2010 at 10:51 AM, Bryan Boone ><<mailto:bryan-boone@msn.com>bryan-boone(a)msn.com> wrote: >For me the simplest solution to solve this would be a windows 2003 >server domain controller. Unfortunately due to some corporate >restrictions I cannot install a windows server. > > >If you can't set up a Windows server to do this job, the best way to >meet this need is to run Samba on a Linux machine. If you run it in >domain control mode, it'll act very much like a Windows server for >the purposes you're talking about. If there's a corporate restriction on installing a windows server, setting up a linux server to behave just like a windows server might also be a problem. and indeed if it's one the same network, you'll really need to get things right so that it doesn't screw anything up (such as becoming the master browser). Just be sure first :-) rick

3 2

Re: Freeradius-Users Digest, Vol 57, Issue 58
by TAKANASHI, Hitoshi 18 Jan '10

18 Jan '10

freeradius-users-request(a)lists.freeradius.org wrote: >Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > >To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users >or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > >You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Freeradius-Users digest..." > > >Today's Topics: > > 1. Re: Escaped . does match any character (Matthias Cramer) > 2. EAP-FAST (Stefan Winter) > 3. Re: Can't start radiusd -X ? (Fernando) > 4. Help with Freeradius + MySQL Problem.... (Ale Luna) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 18 Jan 2010 13:50:39 +0100 >From: Matthias Cramer <matthias.cramer(a)iway.ch> >Subject: Re: Escaped . does match any character >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <4B54591F.2040800(a)iway.ch> >Content-Type: text/plain; charset=UTF-8 > >Hi Alan > >Alan DeKok wrote: >> Matthias Cramer wrote: >>> I have the following in my users file: >>> >>> >>> DEFAULT User-Name =~ ".+\.xy(a)example.com", Auth-Type := Accept, >>> Proxy-To-Realm := "DONOTREALM" >>> >>> This Regexp macthes not only user.xy(a)example.com but also >>> useraxy(a)example.com. >>> >>> Is this a bug, or do I have to escape the . in a different way ? >> >> You may need two \\ > >Thanks, this solved the problem. > >Regards > > Matthias > >-- >Matthias Cramer / mc322-ripe Senior Network & Security Engineer >iway AG Phone +41 43 500 1111 >Josefstrasse 225 Fax +41 44 271 3535 >CH-8005 Z?rich http://www.iway.ch/ >GnuPG 1024D/2D208250 = DBC6 65B6 7083 1029 781E 3959 B62F DF1C 2D20 8250 > > > > >------------------------------ > >Message: 2 >Date: Mon, 18 Jan 2010 14:05:04 +0100 >From: Stefan Winter <stefan.winter(a)restena.lu> >Subject: EAP-FAST >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <4B545C80.5010703(a)restena.lu> >Content-Type: text/plain; charset="iso-8859-15" > >Hello, > >every now and then there's a mild interest on this list about enabling >EAP-FAST. In our eduroam R&D group, we are currently looking into >EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile >posting our results here, for others "play with it" as well? Or has >everybody already run away from the somwhat complicated installation of >EAP-FAST support in FreeRADIUS [we certainly had our difficulties...] > >Greetings, > >Stefan Winter > >-- >Stefan WINTER >Ingenieur de Recherche >Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et de la Recherche >6, rue Richard Coudenhove-Kalergi >L-1359 Luxembourg > >Tel: +352 424409 1 >Fax: +352 422473 > > >

1 0