June 2010 - Freeradius-Users - lists.freeradius.org

little sql help required
by Strong, Mark 06 Jun '10

06 Jun '10

All, I've read the SQL_HOWTO, and have it working, however I'm trying to understand this bit in the example. group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } I've got two servers, each with its own mysql db (replicated to each other), and I'd like freeradius to fail over to the other boxes mysql server if its local one dies. So I'd like to understand what that group mysql example does, before I paste it into my configs. Looked at the docs, but can't find it (or something like it) described anywhere. I've got version 2.1.6, on Centos 4.7 Regards Mark Strong

2 2

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 06 Jun '10

06 Jun '10

Thank you for reply. I found the problem. I missed a field during nas table analysis. The field was "server, varchar(64). I added it. I had also to - clear clients.conf from NAS manually added to avoid duplicates; - set one NAS address, formerly added, as Host address instead of subnet. Now it works fine! Now backup of configuration and going to work on chiphering passwords and manage WiFi. Superataru. reply to . . "Your message doesn't have enough information to troubleshoot your problem. Run FreeRADIUS in debug mode (radiusd -X) and read the error messages. If you still can't solve your problem, send the debug output to the mailing list. Tim"

1 0

backup of external proxy
by Fred MAISON 06 Jun '10

06 Jun '10

Hello, When proxing some eap-type by real to an external radius, is it possible to configure a normal and a backup proxy server ? I saw (in proxy.conf comments) it was possible when proxying to a local virtual server, but I don't understand what to do for normal/backup externals radius we have to proxy to for a particular real. Best regards, Fred MAISON

2 1

username and attributes
by rosect190＠yahoo.com 06 Jun '10

06 Jun '10

I have two users (u1 and u2) and want to use PEAP to auth them. For each user, I will return an attribute. For example, attr1 for u1 and attr2 for u2. An interesting thing is that, when my out-tunnel user name is "anonymous", I do not see any attribute be returned although the auth is successful. Further testing shows, if I use user2's name (u2) as user1's out-tunnel name and use user1's name (u1) as user2's out-tunnel name, user1 will receive attri2 and user2 will receive attr1. It seems that the server picks attributes based on the out-tunnel name, not the real user name. In file /etc/raddb/users, I configure users as follows: u1 Cleartext-Password := "p1" Service-Type = 6 u2 Cleartext-Password := "p2" Service-Type = 4 I do not understand why. Is there anything I did not configure in the server? Thank you very much for any suggestion!

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowlegde. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David Hoepelman 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowledge. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User- Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

1 0

EAP-TLS vs X.509 certificate chains
by Paolo Barbato 04 Jun '10

04 Jun '10

Looking at the mailing list it's seems not possibile configure freeradius to use a CA chains certificate, instead of a single CA root. Since also Comodo distribute server certificate in that way I wonder if this could be managed in future release of freeradius. Comodo has been choosen by Terena TCS service that is used by almost all educational organization in Europe .. and many of them, like mine, use also FreeRadius. Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 1

expiration module and reply items
by Ana Gallardo 04 Jun '10

04 Jun '10

Hello, I'm working with freeradius 2.1.8 and I want to return an attribute when eexpiration module return 'userlock'. I try to add the item in expiration module: /etc/freeradius# cat modules-enabled/expiration # -*- text -*- # # $Id$ expiration { Reply-Message = "LA CUENTA HA EXPIRADO PARA %{%{Stripped-User-Name}:-%{User-Name}}" Codigo-Reject := Cuenta-Expirada } But it doesn't work. I also try using unlang in authorize section: authorize { . . . expiration if (userlock){ update reply { Codigo-Reject := Cuenta-Expirada } } pap } My debug info: rad_recv: Access-Request packet from host XXXX port 59252, id=177, length=71 User-Name = "prueba(a)temp.XXX.es" User-Password = "prueba" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 server XXX { . . . [expiration] Checking Expiration time: '1 Jun 2010' [expiration] Account has expired [expiration] expand: Password Has Expired -> Password Has Expired ++[expiration] returns userlock } Using Post-Auth-Type Reject +- entering group REJECT {...} . . . Sending Access-Reject of id 177 to 158.49.247.199 port 59252 Reply-Message = "Password Has Expired\r\n" Somebody can help me. Thak you and sorry for my english. ____________________ Ana Gallardo Gómez ____________________

2 2

i was puzzled now
by Spacelee 04 Jun '10

04 Jun '10

Q1.what's the difference between radgroupcheck and radgroupreply? Q2. if i want to add a group which users in that group can have the limitation: it will expirate in 2 days? how to set the attribute... sorry for asking so silly questions....and thanks for you reply... -- Spacelee

2 2

HOW TO USE OPT + MYSQL?
by miaowang 03 Jun '10

03 Jun '10

OTP can do mysql were used for user authentication, for example, some users use the OTP authentication, some users in the user authentication using MYSQL? OTP also use the time to authorize it? Is how to attribute it to his return? I used the login authentication CISCO, thank you 2010-06-04 miaowang

1 0