November 2011 - Freeradius-Users - lists.freeradius.org

Help: FreeRadius Users with multiple passwords
by Duong Manh Truong 15 Nov '11

15 Nov '11

Hi all, I have encounter with an issue and can not find the solution after several days of thinking :( I set up FreeRadius & Mysql successfully, testing with some account ok, but my real case: Lot of my users *have more than 1 passwords*, Example: User: "truongdm" comes with the password "abc123" or the password "123abc" is both ok Please help me: How can i set it up? - I try to insert serveral records with the same "username" and difference "value" - password- in the "radcheck" table but at one time, the server accept 1 pair of "username/value" only :( - I try to edit the file "users" manually but no help ..... Anyone has had this matter, please help me find the direction! Thanks & Best Regards!

2 1

EAP-TLS CRL checking when multiple CAs used
by Martin Čmelík 15 Nov '11

15 Nov '11

Hi, I downloaded current stable freeradius version 2.1.12 and import configuration from old server (rewrite etc/raddb). Everything seems to be OK, but I must now add another two trusted CAs into ca.pem and also enable checking against CRL files as for other. Lets say that eap.conf is setup by default: tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random check_crl = yes CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" ecdh_curve = "prime256v1" cache { enable = no max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } One of our script downloading CRL files every 20 minutes, move them to certs directory and c_rehash them. It works for old certificates (4x CAs) but doesn't work for two which I add now. When somebody with certificate issued by new CA try to login I see this error in log: Thu Nov 10 12:56:51 2011 : Error: --> verify error:num=3:unable to get certificate CRL Thu Nov 10 12:56:51 2011 : Auth: Login incorrect (unable to get certificate CRL): [John Smith] (from client some-device port 29 cli AA-BB-CC-DD-EE-FF) Hash are generated well: lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 21e0d39d.r0 -> crl3.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 3cc8c9a0.r0 -> crl6.pem lrwxrwxrwx 1 radius radius 20 Nov 10 16:19 5a64316f.0 -> radius.crt lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 5be750ed.r0 -> crl2.pem lrwxrwxrwx 1 radius radius 20 Nov 10 16:19 68db0f86.0 -> radius.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 92b2a332.r0 -> crl5.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 b0f3e76e.r0 -> crl4.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 f31b716b.r0 -> crl1.pem lrwxrwxrwx 1 radius radius 6 Nov 10 16:19 f6efabfa.0 -> ca.pem ... My question is: How freeradius find correct CRL list and check if user certificate is still valid? This radius server has been setup by colleague many years ago and he cant remember how he do this :] Thank you very much because there is lack of any information about it on Internet — Martin Čmelík

3 7

Freeradius process crash receiving answers from Microsoft NPS Server
by IT Support 14 Nov '11

14 Nov '11

Good afternoon I'm a newbie with freeradius and I'm trying to configure a radius proxy server that makes to a server microsoft radius nps. I have a Enterasys C3 switch that sends auth requests to my Freeradius. If the request is for auth a MAC the FR auth locally, but if the request is for auth a windows user (EAP) the FR resend the request to the Microsoft NPS radius server. I use Debian 6.0 and the debian package of FR (version is 2.1.10). The problem is that when the Microsoft RADIUS server returns an accept packet, the freeradius server process dies. But if the answer is reject, the process works properly. When the process dies, only appears in the syslog the following line: "November 11 16:20:35 debian-radius kernel: [2380.591594] freeradius [1749]: segfault at 3934c708 b76fd497 ip sp error 4 in libfreeradius b5ae4970-radius-2.1.10.so [+1 b76ec000 E000]" Can anyone help me? Sorry for my poor English. Best greetings Toni

6 10

Removing domain prefix from login
by Alejandro Gandara 14 Nov '11

14 Nov '11

I'm authenticating users in RADIUS against LDAP, if I login from computer with 802.1x configured and users and password taken from domain automatic. Im getting wrong authenticated because the login has the following chain. DOMAIN\\Users How can i avoid that radius read the prefix? I've tried to introduce the option prefix in /etc/sites-enable/default , but its getting me back errors because of wrong way to introduce that line. Can any help me? Thanks very much

4 19

radius sql quastione
by Miha Zoubek 14 Nov '11

14 Nov '11

Hi, our freeradius is working with our softswitch perfect. All my columns in radacct are populating. Now I have set freeswitch and I also got it work with freeradius. This are two different softswitchs and I would like that bouth will populate same base. Problem appears as freeswitch is sending different attributes, so I make differences in dialup.conf (than the other softswitch will not populate right radacct table). Can I populate same base? But how to configure dialup.conf than? How can I set up in on radius to different base with to different dialup.conf (I must edit this file due to different attribute representation). Below you will find freeswitch attributes: rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 33534, id=134, length=402 Acct-Status-Type = Stop Acct-Session-Id = "1d83c61f-3167-4c15-9da3-871cd76f3d7c" Freeswitch-Hangupcause = Normal-Clearing User-Name = "018108500" Freeswitch-Src = "018108500" Freeswitch-CLID = "018108500" Freeswitch-Dst = "051357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = xxx.xxx.xxx.xxx Freeswitch-Context = "default" Freeswitch-Ani = "018108500" Freeswitch-Source = "mod_sofia" Freeswitch-Lastapp = "bridge" Freeswitch-Billusec = 2427061 Freeswitch-Callstartdate = "2011-11-09T14:30:45.095287+0100" Freeswitch-Callanswerdate = "2011-11-09T14:30:52.965479+0100" Freeswitch-Callenddate = "2011-11-09T14:30:55.392540+0100" Acct-Session-Time = 2 Freeswitch-Signalbond = "inbound" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default P.s.: I am getting all inputs in radacct table duplicate. Can you help me out how can I deal with this issue? I have put radius log on http://pastebin.freeswitch.org/17730 BR, Miha

2 2

Patch: Support for {BASE64_MD5} LDAP passwords in rlm_ldap and rlm_pap
by Peter Lambrechtsen 13 Nov '11

13 Nov '11

Attached is a minor patch to include support for BASE64_MD5 encoded passwords in a LDAP directory (or anywhere else it may be, as the pap module does the authenticate). In ldap the record would look like: userPassword: {BASE64_MD5}/F4DjTilcDIIVEHn/nAQsA== If the password was helloworld Thankfully the pap module is clever enough to normalize the password from Base64 encoding automatically so the BASE64_MD5 tag just needed to be added under header_names array, and then do the MD5. So no code change was really required. The debug trace shows: [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{BASE64_MD5}/F4DjTilcDIIVEHn/nAQsA==" [ldap] looking for reply items in directory... [ldap] user peterltest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "helloworld" [pap] Using MD5 encryption. [pap] Normalizing MD5-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Cheers Peter

1 0

.
by Zoet Omar Zepeda 12 Nov '11

12 Nov '11

You probably think that this is unimportant, but youre wrong! http://caribbeanrentavilla.com/index143ttww--.php?hyxogmailID=6 Sat, 12 Nov 2011 19:56:00 _____________________ "About eighty feet, Professor Gray figured it roughly." (c) Camdon vivisezione

1 0

Re: "Cannot assign requested address" Error starting FreeRadius
by Paul Heil 12 Nov '11

12 Nov '11

I have a GuruPlug Server 003-GP0001 running Debian Linux 6.0.3 with FreeRadius 2.1.10 installed. I have followed the Basic Configuration HOWTO<http://wiki.freeradius.org/Basic-configuration-HOWTO>, but when I get to the point of starting the server for the first time, I get this error: Fri Nov 11 18:31:49 2011 : Info: Loaded virtual server inner-tunnel Fri Nov 11 18:31:49 2011 : Info: Loaded virtual server <default> Fri Nov 11 18:31:49 2011 : Error: Failed binding to authentication address 127.0.0.1 port 18120 as server inner-tunnel: Cannot assign requested address Fri Nov 11 18:31:49 2011 : Error: /etc/freeradius/sites-enabled/ inner-tunnel[32]: Error binding to port for 127.0.0.1 port 18120 Can anybody suggest how to fix this issue? The complete output from the freeradius -X command is available: http://pastebin.com/cX3ti0wk Thanks, PaulH

5 7

Fixed Duration Weekly, Monthly and Daily Accounts
by JennyBlunt 12 Nov '11

12 Nov '11

Looking for some advise regarding accounts with a preset amount of time. I have freeradius setup and working with the sqlcounter module. Am just a little lost. How do I create a group which provides access for a preset amount of time, for instance one day, week or month. I've tried by using expiration but don't think thats right. Will the noreset parameter do this? In our current system (not freeradius), we'd set this up as a continuous account which starts the counter the first time the users logs on. It's only the daily, weekly, monthly plans that work like this. I feel if we set a monthly rule to allow 43200 minutes, the user will get a lot of time online! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Fixed-Duration-Weekly-Monthly-and-D… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 18

Re: Authorising Clients by Calling Station ID Not IP
by JennyBlunt 12 Nov '11

12 Nov '11

Hi Can anyone out there help me with this??? I really need to authorize our dynamic clients against a db which includes the called-station-id I can see called-station-id is only sent after authorization but need to see if this can be changed. My requirements are: 1. Allow all dynamic clients through 2. Lookup their called-station-id in the db 3. Use the 'hotspot' shared secret which is done per location and stored in the same table as above 4. Allow or disallow access to user Thanks Jenny -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorising-Clients-by-Calling-Stat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 22