June 2010 - Freeradius-Users - lists.freeradius.org

Conditions for executing module
by Mindaugas Riauba 13 Jun '10

13 Jun '10

Hello, FR 2.1.9 and novice in FR module programming. :) How to define some conditions in users/acct_users file when to use our module? It is quite heavy and we'd like to avoid its execution in as many cases as possible. I tried such configuration in users. Idea comes from http://freeradius.org/radiusd/doc/Autz-Type DEFAULT Auth-Type := Ourclient, Calling-Station-Id == "333" DEFAULT Auth-Type := Accept And adding this to sites-enabled/default: Auth-Type Ourclient { ourclient } But rlm_files complains about unknown value for Auth-Type. Should I just define this new Auth-Type in dictionary (then which range of values is for local use?) or there is more elegant solution? Regards, Mindaugas

2 2

Re: Freeradius-Users Digest, Vol 62, Issue 56
by lenard.smith＠gmail.com 12 Jun '10

12 Jun '10

Help Sent from my BlackBerry® by Boost Mobile -----Original Message----- From: freeradius-users-request(a)lists.freeradius.org Date: Sat, 12 Jun 2010 12:00:12 To: <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 62, Issue 56 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c ( ??? ) ---------------------------------------------------------------------- Message: 1 Date: Sat, 12 Jun 2010 16:43:51 +0800 From: " ??? " <09120560(a)bjtu.edu.cn> Subject: The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c To: freeradius-users(a)lists.freeradius.org Message-ID: <MAVUSEBQQPRYQOASLDHPTQUMPLHW.09120560(a)bjtu.edu.cn> Content-Type: text/plain; charset="gb2312" Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 12 Jun '10

12 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

attribute name manipulation
by Alexandre Chapellon 12 Jun '10

12 Jun '10

Hello, I want to remove some attribute from my access-accept messages regardless the value of this attribute. I tough I could use the "!*" but the wiki says it's not usable as a reply item. Further more "!*" is not present in unlang(5) if I try to use it freeradius says config file have a syntax error. How can i remove an attribute from the reply message (regardless of its value)? Additionnally I'd like to rename some attribute returned by the radreply query.... is there anything specific for this job or is it adding new attribute with the value of the previous one and then deleting the previous one? Regards. -- Alexandre Chapellon <alexandre.chapellon(a)mana.pf> Mana SAS

2 1

AD Auth - problem with some chars in user's DN
by Nelson Vale 12 Jun '10

12 Jun '10

Hi all, I've recently found a problem authenticating some users in AD (2003) when the user's Distinguish Names have one or more of the following characters: " ' ` (double quotes, apostrophe or grave accent), using freeradius 2.0.2 and 2.1.9 versions: "... [ldap] login attempt by "johndoe" with password "test123;" [ldap] user DN: CN=John "The Man" Doe,OU=students,DC=domain,DC=localal [ldap] (re)connect to 192.168.0.73:389:389, authentication 1 [ldap] bind as CN=John "The Man" Doe,OU=students,DC=domain,DC=localal/test123; to 192.168.0.73:389:389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ..." ( the correct DN for this user is "CN=John "The Man" Doe,OU=students,DC=domain,DC=local" ) The rlm_ldap module is performing the user authentication using a DN that as two more characters as it should be (the "al" in the end), and the number of these extra characters is the same as the number of the occurrences of the characters described above. The characters that cause this problem are the ones from the src/lib/valuepair.c pairparsevalue() function (PW_TYPE_STRING type), and if they are removed from there the authentication will be processed successfully ( I know, if they are there there must be some reason ). I've managed to fix this in rlm_ldap by quoting the characters in the vp_user_dn->vp_strvalue, but I'm not sure if this will fix all the problems that can arise from this. Have anyone ever had such a problem? I know that it's a little unusual to have these characters in user's names but AD allows it ... Thx, Nelson Vale

2 4

howto use the attribute of "Access-Period"
by Spacelee 12 Jun '10

12 Jun '10

I set the value to 3600, but it says [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "3600" for attribute name "Access-Period" -- Spacelee

2 1

Re: LDAP groups
by Alan DeKok 12 Jun '10

12 Jun '10

Génaël VALET wrote: > I use LDAP groups for EAP-PEAP Authentication in wifi WPA context. For now, > I used a DEFAULT line in "users" file like this : > > DEFAULT ldap_1x-Ldap-Group != "radius" , Auth-Type := Reject > Reply-Message = "ACCES REFUSE" > > I have a LDAP Group named "radius" but I don't know howto permit another one > LDAP Group See "unlang". The LDAP group comparison has some oddities, unfortunately. authorize { ... if ((LDAP-Group == X) || (LDAP-Group == Y)) { # OK } else { update reply { Reply-Messages := "Access refuse" } reject } } Alan DeKok.

1 0

checking DN of user certificate
by Riccardo Veraldi 11 Jun '10

11 Jun '10

Hello, when using EAP-TLS I would like to check the DN of hte user certificate and in particulare I need to check the Locality (L) string to matcha particular string. Is it possible in some way ? thanks Rick

2 1

EAP-MSCHAPv2 and MPPE key
by Stefan Winter 11 Jun '10

11 Jun '10

Hello, we're trying to get IKEv2 under Windows 7 going. It can use among others "EAP-MSCHAPv2"; notably with EAP wrapper but without TLS. While auth succeeds, FreeRADIUS doesn't send MPPE keys back, and Win 7 then rejects the session. I noticed that rlm_mschap can be configured to calculate and send MPPE keys, while rlm_eap/types/mschapv2 does not; the two modules seem to be mostly independent. Is that something that can easily be added? BTW, a check back with a developer "Martin" from strongswan.org yielded: "Then I'd assume you are using FreeRADIUS :-). It does not include the MSK in MSCHAPv2 if used over EAP. IKEv2 however requires the MSK to calculate the AUTH payload. In its current form, you can't use FreeRADIUS for your setup, my apologies. One could extend FreeRADIUS to copy over the MPPE keys, but writing such a patch is not something I can do in a few minutes." Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

Removing local auth (freeradius server 2.1.9)
by Martin Richard 11 Jun '10

11 Jun '10

Hello, I've tried the doc, the wiki, and the ML archives but I can't find an answer to what must be a simple configuration thing.. I've compiled freeradius server 2.1.9 and only added two simples lines to $confdir/user: mrichard Cleartext-Password := "qwerty" mrichard2 Cleartext-Password := "qwerty" When starting radiusd -X (yes, I've looked at the output) and testing these 2 most simple accounts with radtest, the first one fails while the second one works. The difference being that there's a "mrichard" account on the box in /etc/passwd while "mrichard2" only exists in radiusd's config. Hence the output differences when calling "radtest thelogin qwerty localhost 666 testing123" (cut) : for mrichard: +- entering group PAP {...} [pap] login attempt with password "qwerty" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject for mrichard2: +- entering group PAP {...} [pap] login attempt with password "qwerty" [pap] Using clear text password "qwerty" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 79 to 127.0.0.1 port 60023 Of course, the first account works if I use the OS level password associated with it. After a bit of searching I found a reference in the ML archives to $confdir/sites-enabled/default and saw "unix" in there with the description saying it caches the hashes from /etc/passwd and its accompanying shadow. I've commented those lines and restarted the daemon. Now I get this in the PAP output for both users: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject I must be missing something rather obvious.. But how can I totally disable the lookup of OS accounts ? Thanks Martin

4 4