December 2010 - Freeradius-Users - lists.freeradius.org

Assign VLAN
by Rangel, Luciano 10 Dec '10

10 Dec '10

Hello Dears, I´m using Freeradius for EAPOL authentication with AD (ntlm). My users file is: more /etc/raddb/users DEFAULT Auth-Type = ntlm_auth Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "200" I Success authentication but the switch not assign vlan 200 to client port as log below: Why the switch taking the VLAN 0? 23:27:44: dot1x-ev:dot1x_vlan_assign_authc_success: Successfully assigned VLAN 0 to interface FastEthernet0/22 23:27:44: dot1x-sm:Posting AUTHC_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authc_result, got event 23(authcSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authc_result -> auth_authz_success 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authz_success_enter called 23:27:44: dot1x-ev:dot1x_switch_supplicant_add: Adding 001e.6847.9261 on FastEthernet0/22 in vlan 1, domain is DATA 23:27:44: dot1x-ev:dot1x_switch_addr_add: Added MAC 001e.6847.9261 to vlan 1 on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:ignored vlan 1 vp is added on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:dot1x_switch_port_authorized: set dot1x ask handler on interface FastEthernet0/22 23:27:44: dot1x-ev:Received successful Authz complete for 001e.6847.9261 23:27:44: dot1x-sm:Posting AUTHZ_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authz_success, got event 26(authzSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authz_success -> auth_authenticated 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authenticated_enter called 23:27:44: dot1x-ev:FastEthernet0/22:Sending EAPOL packet to group PAE address 23:27:44: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/22. 23:27:44: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/22 23:27:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up 23:28:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up PS. I tested sending attribute with Cisco ACS and ran Luciano Rangel Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

6 19

pppoe+freeradius+mysql reject user
by S Adrian 09 Dec '10

09 Dec '10

Hey, SO far I got it working alright. The only thing is that I might want to reject a username ( even if the password is ok ) ( for example that username hasn't paid ). I tried inserting into radreply Auth-Type := Reject but it still gets access-accept :/ Any ideas ? Thanks in advance, Adrian

2 2

Oracle OID and FreeRadius
by Robert Masters 07 Dec '10

07 Dec '10

Okay, so we've got the whole ancient version thing sorted out, and we now have things working - sort of. To recap: We've been working on using Freeradius on RHEL5.4 to link a Motorola RFS6000 with Oracle OID. We now have the following situation - and fair warning this is something of an edge-case as far as FreeRadius goes, as the problem appears to be more OID. We can: Use the oracleadmin user to bind to OID and have everything work. This is sub-optimal for more reasons than I care to count, and probably more than I can imagine. We can: Set up an ACL/ACI in OID to allow the purpose-created bind-user to access the userpassword of a specific user. Radius authentication then works for that user. Needless to say, it is impractical to do this for every single user. We cannot: Set up an OID ACL/ACI to allow the purpose created bind-user to access the userpassword of every user. This is where we want to get to. An alternate path would be to convince FreeRadius to obtain the user-supplied password via EAP-GTC *before* connecting to OID to authenticate the user, if that is possible. (None of the doco I have read to date suggests that it is.) Does anyone have any suggestions? Oracle are being questioned on this as well, but are not being particularly helpful yet. -Rob. Unix Systems Administrator Bunnings Group Limited 126 Pilbara Street, Welshpool WA 6106 Locked Bag 20, Welshpool WA 6986 Phone : (08) 9365-1507 Fax : (08) 9358-6054 E-mail : rmasters(a)bunnings.com.au Website : www.bunnings.com.au ************************************************************************ Bunnings Legal Disclaimer: 1) This email is confidential and may contain legally privileged information. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this email in error, please notify us immediately by return email and delete the document. 2) All emails sent to and sent from Bunnings Group Limited. are scanned for content. Any material deemed to contain inappropriate subject matter will be reported to the email administrator of all parties concerned. ************************************************************************

2 2

Re: Attribute not passing to NAS?
by Rob Yamry 07 Dec '10

07 Dec '10

Hey Mikkal- Im not sure if my last few emails went through the list... I got a msg stating they were pending approval since they were too long. I kept digging into this and I came across the eapol_test utility: http://deployingradius.com/scripts/eapol_test/ I tried running that to take the client and NAS out of the process. As far as I can tell, it all looks like fine. Even with a default install of 2.1.10 (and another test using new certs with the required OIDs for XP clients: http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on…) I still get those 9 requests. Are you using EAP? Is anybody else following this that can/test verify that they get the same responses as I do. Thanks- Rob

2 6

EAP-Type = SIM
by Wagner <D4rkGl0be> Andre 07 Dec '10

07 Dec '10

Hi everybody, I'm trying to configure EAP-SIM test on my FreeRADIUS server, and I would like to know if is possible to validate the parameters by database as setting in the radcheck? I tested validating with the users file and all sounds good, but I'm not having the same results with just database configuration. It not recognises SIM EAP-Type, instead it returns MD5 value. Someone could help me to validate this parameters just using databases attributes? Thanks

1 0

Need help Configuring Radius and Ldap
by James Winter 07 Dec '10

07 Dec '10

My apologies before hand if this is an easy fix, but I have been working on configuring a radius server on and off now for a few weeks. As a note, I have Radius 2.1.10 installed and I am trying to authenticate using Ldap as the user database. I have little to no experience in both Radius and Ldap, but I have been reading up and looking for documents that explain the process well. The majority of documents that I did find were on an older version of radius, or were not pertinent to my situation. The following is a copy of my screen when I try authenticating a remote device to the radius server, please let me know if this helps(or if you would like more information on my config) Thanks in advance, - James # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [files] users: Matched entry DEFAULT at line 58 ++[files] returns ok [ldap] performing user authorization for jwn6657 [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=jwn6657) [ldap] expand: cn=Users,dc=ds,dc=saintjoe,dc=edu -> cn=Users,dc=ds,dc=saintjoe,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=Users,dc=ds,dc=saintjoe,dc=edu, with filter (samaccountname=jwn6657) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user jwn6657 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/raddb/sites-enabled/default +- entering group ntlm_auth {...} [2010/12/03 10:14:58.799575, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "idmap domains" [2010/12/03 10:14:58.799645, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "idmap domains" [2010/12/03 10:14:58.799870, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "master browser" [2010/12/03 10:14:58.799883, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "master browser" Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 186 to 131.93.254.2 port 4844 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 186 with timestamp +452 Ready to process requests.

3 9

send accounting data
by Sokvantha YOUK 07 Dec '10

07 Dec '10

Dear All, I would like to configure freeradius server to send accounting data to other server. Could any one advice me or show me how can I achieve this method? -- YOUK Sokvantha Tell: (855) 89896589 email: sokvantha(a)gmail.com

1 0

Re: [RESOVLED] Re: customize Post-Auth-Type REJECT
by jaydorado 07 Dec '10

07 Dec '10

Newbie here.. I badly need help!! This is exactly what I want to achieve. But it isn't clear to me as to where to place those configurations. Should it be in the authorize section?? or in the sqlcounter module? Could someone post their configurations please.. Thanks so much in advance.. Regards, Jay -- View this message in context: http://freeradius.1045715.n5.nabble.com/RESOLVED-customize-Post-Auth-Type-R… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Crosspost [hostap, freeradius] Can I send "temporary failure" or "wpa tls has failed, so shove them on a vlan" ?
by Christ Schlacta 06 Dec '10

06 Dec '10

I want an option to do some sort of "your authentication is pending administrative approval. a message has been sent to the administrators, please try again in a few minutes". AND an option to sya "your authentication has failed completely, I'm sending you to a separate vlan" namely, the situation is as follows: I've got an interface available on a separate AP to allow users to register for and acquire a certificate. The certificate is bound to a single hostname and mac address. THere are two failure conditions: 1) the user has bad or no credentials in this case the user should be sent to a captive vlan where all they can do is connect to the registration webpage to acquire a certificate and bind it to their wifi MAC address. 2) the user has good credentials but fails "MAC" authentication. The mac address will go through some level of processing, which will result in either "adding" the mac address to their account and succeeding, or triggering a "We have to send a request for review to the administrators" and sending the user to a separate vlan with a "explain why you have so many MAC addresses" website. Not sure how to configure hostapd and freeradius together to do this.

2 3

syntax to add mac addresses of users file
by Viirydiianah Robles 06 Dec '10

06 Dec '10

hello! i have ubuntu 10.4 and freeradius-server-2.1.10 Recently i made some changes to the users file, to be able to register users via their MAC addresses in which use the following syntax : jesssi cleartext-password :="chispas" service-type= framed-user, framed-protocol =ppp, # framed-ip-address = 172.163.1.12 # framed-ip.netmask = 255.255.255.0 # framed-routing = broadcast-listen, # framed-filter-id="std.ppp", # framed-mtu =1500, Called-Station-Id = "00-0F-CF-BC-2A-9A:3Com", (this is the line that adds) Calling-Station-Id = "00-17-37-FA-B2-EB", (this is the line that adds) framed-compression = van-jacobsen-tcp-ip someone could help me or give me a different syntax to add the mac addresses in the users file? thank you -Viridiana Ambriz Robles

3 3