December 2010 - Freeradius-Users - lists.freeradius.org

FW: altas de direcciones mac
by Leonardo Fajardo López 01 Dec '10

01 Dec '10

From: cosita_bodoque(a)hotmail.com To: freeradius-users(a)lists.freeradius.org Subject: altas de direcciones mac Date: Tue, 30 Nov 2010 20:19:42 +0000 Hello I am Leonardo Fajardo Lopez, I am working with an operating system Ubuntu 9.10 and with freeradius-server-02.01.1910 and say high to a customer in the file clients.conf Client localhost { ipaddr = 127.0.0.1 secret = testing123 } and a user in the users file steve Cleartext-Passwords="testing" sirvice=Type=Framed-User, Framed-Protocot=PPP Framed Compression=van-Jscobsen=TCP-IP I want to know is where you should enlist the mac direcion?

1 1

Re: TLS authentication works, but does not check usernames against 'users'file.
by Nolan King 01 Dec '10

01 Dec '10

It is easier for me to put explicit denies in the users file when authenticating with TLS. By default anyone with a valid cert gets in. See also certificate revocation list >>> Andrew Bovill <abovill(a)gmail.com> 11/30/10 7:56 AM >>> Hi, I'm trying to get WPA Enterprise EAP/TLS working with my wireless router. It appears that the TLS portion of the authentication works (valid certificates give me a working connection) but it does NOT appear to actually be checking the username/password combination that is also sent along the line. I have followed the WPA_HOWTO as best I could (my clients are OS X and Android and Gentoo, not Windows XP) but I can't figure out how to 'fail' an auth attempt with an invalid user/pass combination. Here is the debug output: Thanks for any advice. I didn't want to start reconfiguring with a shotgun :) <snip>

1 0

Re: dynamically selecting, which attribute to evaluate
by Alan DeKok 01 Dec '10

01 Dec '10

Stefan A. wrote: > and then to evaluate TicetType specific Attributes... > > if ("reply:%{control:TicketType}-trigger-reactivation" != ""){ You can't really do two levels of expansion like that, sorry. > Why does it not expand the %{control:TicketType} to Ticket245 in this > situation? You can't really do two levels of expansion like that, sorry. > How may I dynamically select Attributes to check for? Perl. Alan DeKok.

2 1

Freeradius and Voip
by miha- 01 Dec '10

01 Dec '10

Hello, I am first time setting freeradius. I am setting it for voip accounting. I need a little help form you guys :) I read that I need to enable sql in radiusd.conf. I have also run a script for creating a tables. I changed sql.conf to voip-postpaid.conf ( I changed login, pass, and server in conf file). Is this the right scipt for crating tables : http://wiki.freeradius.org/MySQL_DDL_script http://wiki.freeradius.org/MySQL_DDL_script I am getting this error beacuse I do not know where must I put users and etc. sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "(null)" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Acct-Multi-Session-Id = "1291187632294" Cisco-Attr-130 = 0x683332332d63616c6c696e672d656e74657270726973652d69643d656e74504258 Calling-Station-Id = "81609000" NAS-Identifier = "intraswitch" NAS-IP-Address = 212.13.228.58 3GPP2-Prepaid-acct-Capability = 0x010600000002 3GPP2-Session-Termination-Capability = 1 h323-conf-id = "h323-conf-id=1291187632294" Vendor-Specific = 0x00000009 Event-Timestamp = "Dec 1 2010 08:13:52 CET" User-Name = "081609000" User-Password = "1234" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "081609000", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 081609000 at line 92 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '081609000' rlm_sql (sql): sql_set_user escaped user --> '081609000' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '081609000' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql: Failed to create the pair: Unknown attribute "1234" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 2 with timestamp 4cf5f5ac Nothing to do. Sleeping until we see a request. Thank you for your help!!! I will remember this :) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-and-Voip-tp3287359p32873… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Certificate-based client side authentication towards a website with freeradius
by Martin Schneider 01 Dec '10

01 Dec '10

Hello all, we're trying to setup a freeradius / apache installation that allows us to authenticate and authorize users with *certificates* towards a website. Is there a good tutorial out there somewhere? We did only finde partial information that seems to be quite old unfortunately. Or could somebody who is deep into this matter please give some advice or ideas how we can solve our task? Best regards M

5 10

Grant access for all users before login
by snowman5840 01 Dec '10

01 Dec '10

Hi I'm using freeradius with ldap users and mschap + peap. But i have one problem. When a user gets his login prompt, no access to the network is allowed because they first get access when they login and freeradius can perform an ldap check with the username. But when a new user wants to login or the user uses an different computer, the user dosen't exist on this machine -> so they can't login -> no network connection ->can't load profile -> no local user. So i have tested a little bit with guest vlan ... but this didn't solve my problem. What can i do to solve this issue? I think it will be possible if alle users get access to an restricted vlan before they login with their user credentials. Then the profile can be loaded from server and then the user can validate. But how can i do this, that every user get access before login? I'll hope you understand my problem und you can give me some futher hints what i can do to solve this. best regards -- View this message in context: http://freeradius.1045715.n5.nabble.com/Grant-access-for-all-users-before-l… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Re: Problem with authenticate method (Auth-Type)
by snowman5840 01 Dec '10

01 Dec '10

sltd wrote: > > No authenticate method (Auth-Type) configuration found for the request: > Rejecting the user > Failed to authenticate the user. > What authentication do you want to use!? the user file? you should enable your prefered authentification!!!!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-with-authenticate-method-Au… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

mac address validation
by Jorge L. Herrera 01 Dec '10

01 Dec '10

Hello ... my name is Jorge I raised a question I am making the draft validation of users by MAC address and my question is not that high given file directions Mac, I installed before 1.2.1910 Freeradius a virtual machine VirtualBox-3.2.8 Win-64453-OS "Ubuntu 9.10" in the / raddb belonging to freeradius files are "users" and "clients.conf" which amended. your help will be very important ........

1 1