February 2010 - Freeradius-Users - lists.freeradius.org

freeradius with PEAP configuration
by dev nath 09 Feb '10

09 Feb '10

Hi, I am trying to authenticate Xsupplicant (open1x) through freeradius using EAP-PEAP-MSCHAPv2 configs. TLS initial connection was successful but MSCHAP-v2 authentication was not initiating (Xsupplicant returned TLS application packet not decrypted). PLEASE HELP with correct freeradius configurations required. I was not able to google the appropriate configurations for the same. Please provide me with config files with some working PEAP configurations(radiusd.conf, eap.conf, user, clients.conf) Regards, Dev

2 1

Simultaneous Use
by Josh Willmarth 09 Feb '10

09 Feb '10

Hello, Quick question: how do I restrict simultaneous use on a user by user basis in the users file? Thank you.

2 1

Is it possible to make groups of called-station-id 's?
by Matt Ashfield 09 Feb '10

09 Feb '10

Hi All We are using FR 2.1.5 for authenticating wireless users against our LDAP database. Recently, our student wireless vlan is getting too large, and we wish to subdivide it. Currently we place users in the appropriate vlan based on the user type returned via the groupmembership_attribute as defined in modules/ldap. So if that attribute =student, we put them in student vlan. Our users file entry looks like: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Called-Station-Id =~ ".*Wireless ", Huntgroup-Name == WSS1, unbldap-Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=student, Tunnel-Type=VLAN, Fall-Through = no To reduce the number of broadcast domains going out a wireless access point, we are thinking of placing all students in Building X into a student_vlanX. To do this, we need to identify all the APs in the building. For each AP in that building we'd have something like this in our users file (where 00-01-02-AA-BB-CC is the mac-address of an access point in building X): DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Called-Station-Id =~ "00-01-02-AA-BB-CC.*Wireless", Huntgroup-Name == WSS1, unbldap-Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=student_vlanX, Tunnel-Type=VLAN, Fall-Through = no I'm quite certain this would work, however I was hoping there'd be some way similar to the huntgroups file (which I realize is for NAS's which our AP's are not acting as) that could group all our Access Point devices into a group s we wouldn't have to have a statement in the users file like the one above for every single wireless access point in our network. Any advice is appreciated. Thanks Matt

2 1

Proxy based on request attribute content, not username realm
by Oliver Gorwits 09 Feb '10

09 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'd welcome some guidance on configuring FreeRADIUS (any version) to select a onward proxy server(s) based on a RADIUS request attribute, and not the username's realm. The specific situation is that it would be useful to proxy based on the wireless SSID to which a user is authenticating. In our Cisco system, this information comes in via the Called-Station-Id attribute of the request packet. We're open to any kind of solution, including setting dummy realms, or using the rlm_perl module, but would appreciate any pointers you have, and details on the processing order within FreeRADIUS to make sure we set things up properly. (Yes, it's also possible just to configure different RADIUS servers directly on the Cisco system per SSID, but we'd much prefer to have one RADIUS configuration there, and proxy onwards from FreeRADIUS.) Many thanks in advance, regards, oliver. - -- Oliver Gorwits, Network and Telecommunications Group, Oxford University Computing Services -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktxH4gACgkQ2NPq7pwWBt49JgCg0YKNoh/uq0YYee7oZ+FCk+Bz m+UAnRywfx8WQjXDsi8wiHX37a/kFnFM =inE2 -----END PGP SIGNATURE-----

2 1

Proxy on Fail.. Or intelligent proxy...Or Utilize multiple acocunt directories
by Larry Ross 09 Feb '10

09 Feb '10

Good afternoon all; I am looking at configuring FR to Auth accounts across multiple account directories. Basically I would like FR to take in PAP queries, attempt Auth against krb, then if that comes back as a fail, try a secondary Radius server (Eduroam...) or module (Shibboleth). We are looking at this as we foresee collisions occurring between accounts residing within other universities and our local guest accounts (which use email address as the principal). Any ideas where and with what I should start testing with (as in create virtual servers an d pass a single success and fail on multi fail..) Thank you Larry

3 2

Help getting rid "Info: WARNING: Child is hung for request" message
by José Manuel 09 Feb '10

09 Feb '10

Hi, I have upgraded recently one of my servers to 2.1.8 (RHEL 5), and am seeing thousands of messages like this in a day. It looks the message was introduced with patch no. 139c45b4c51c945414b53ece36bbeb42edb1b2a7 from November 29. I'm wondering what parameters should I tune to get these messages disappear (and the possible underlying problem fixed, of course). The auth backend is an openldap directory, but I have disregarded any timeout issues by running the server in debug mode. Here are some of the values I guess could be related with the cause of these messages: ------- - radiusd.conf: max_request_time = 30 cleanup_delay = 5 max_requests = 1024 thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } - proxy.conf proxy server{ retry_delay = 5 } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 11812 secret = XXXXX response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } ------- I'd appreciate some light on this issue. Except for the message, the server is behaving correctly. thanks in advance, jose manuel.

2 2

inner vs outer User-Name
by Kenneth Grady 09 Feb '10

09 Feb '10

Is there any way to authorize a user using the inner-tunnel User-Name and not the outer? I get an outer User-Name of anonymous and a reject when searching for authorized users in an ldap group. If they convolute the configuration for the device with an outer User-Name of a person in the ldap group, it authorizes them, and they can authenticate using Kerberos. Mon Feb 8 12:53:21 2010 Packet-Type = Access-Request User-Name = "anonymous" ... Mon Feb 8 12:53:21 2010 Packet-Type = Access-Accept Reply-Message = "case WAREHOUSE" Reply-Message = "not authorized for mygroup" Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "duser" ... Mon Feb 8 14:08:11 2010 Packet-Type = Access-Request User-Name = "duser" ... Mon Feb 8 14:08:11 2010 Packet-Type = Access-Accept Reply-Message = "case WAREHOUSE" Reply-Message = "Warehouse mygroup" Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "duser" /etc/raddb/sites-available/default ... case "WAREHOUSE" { update reply { reply-message += "case WAREHOUSE" } #EMPLOYEE { # need to use the inner-tunnel User-Name #} if ( EMPLOYEE-Ldap-Group == "mygroup" ) { update reply { reply-message += "Warehouse mygroup" } } else { update reply { reply-message += "not authorized for mygroup" } # update config { # Auth-Type := Reject # } } }

2 1

modify realm in authenticate section
by cd 08 Feb '10

08 Feb '10

hi is it possible to modify realm like this ? and then use the realm in users file ..see below Auth-Type ldap { group { ldap_admin { reject = 1 ok = return } if (ok) { update reply { Realm:="admin" } } ldap_peda { reject = 1 ok = return } if (ok) { update reply { Realm:="pedago" } } } } users file DEFAULT Realm=="pedago" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="ok_hostpeda" DEFAULT Realm=="admin" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="ok_hostadmin"

2 1

rlm_caching with freeradius (2.1.7 or 2.1.8)
by Max Mazur 08 Feb '10

08 Feb '10

Hi! I have some strange problems with freeradius (2.1.7 or 2.1.8) and rlm_caching. After module was compliled, it can not be loaded. Error: /etc/raddb/modules/caching[44]: Failed to link to module 'rlm_caching': file not found Error: /etc/raddb/sites-enabled/default[11]: Failed to find module "caching". But as far as I can see using strace, file realy exists, and "not found error" is "fake" error. # strace radiusd -XXX 2>&1 | grep rlm_cach open("/usr/lib/freeradius/rlm_caching.la", O_RDONLY) = 3 read(3, "# rlm_caching.la - a libtool lib"..., 4096) = 1006 open("/usr/lib/freeradius/rlm_caching-2.1.7.so", O_RDONLY) = 3 open("/usr/lib/freeradius/rlm_caching-2.1.7.so", O_RDONLY) = 3 access("/usr/lib/freeradius/rlm_caching.so", R_OK) = 0 open("/usr/lib/freeradius/rlm_caching.so", O_RDONLY) = 3 write(1, "Mon Feb 8 09:46:27 2010 : Error"..., 122Mon Feb 8 09:46:27 2010 : Error: /etc/raddb/modules/caching[44]: Failed to link to module 'rlm_caching': file not found (it possible bug in error message as I can ubderstand) All other modules loaden normally. Any ideas what I have to check? Best regards, Max Mazur

2 1

Radius Proxy Accounting
by Jeremy Brown 08 Feb '10

08 Feb '10

Hi Everyone, I'm trying to setup a FreeRadius server to act as a proxy for another DNS server, and this seems straightforward enough from the documentation, however I also want the FreeRadius proxy to send accounting information to another Radius server. I haven't seen any documentation on how to do this and I'm sure there is a simple way to configure this. Any help or pointers to some documentation would be much appreciated. Best Regards, Jeremy

2 1