November 2011 - Freeradius-Users - lists.freeradius.org

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 02 Nov '11

02 Nov '11

something else i just found radtest only seems to work from localhost.. [root@ops2 raddb]# radtest marguin2 r0adkill localhost 0 i6Lw7uNsG7pZDUGgxirg Sending Access-Request of id 235 to 127.0.0.1 port 1812 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=235, length=30 Filter-Id = "wireless" [root@ops2 raddb]# radtest marguin2 r0adkill 192.168.10.31 0 i6Lw7uNsG7pZDUGgxirg Sending Access-Request of id 96 to 192.168.10.31 port 1812 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 96 to 192.168.10.31 port 1812 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 96 to 192.168.10.31 port 1812 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 96 socket 3 On 11/2/2011 10:53 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Huntgroup Checking (simonm123) > 2. Re: Need help with Freeradius and 802.1X (johnboy68) > 3. Re: Huntgroup Checking (Ben West) > 4. Re: cisco WAP/FreeRadius/OpenLDAP (Matthew Arguin) > 5. Re: Need help with Freeradius and 802.1X (Alan Buxey) > 6. Re: Need help with Freeradius and 802.1X (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 2 Nov 2011 07:07:34 -0700 (PDT) > From: simonm123<simon.morley(a)me.com> > Subject: Re: Huntgroup Checking > To: freeradius-users(a)lists.freeradius.org > Message-ID:<1320242854156-4958155.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > Can anyone tell me if hungroup checking can be made to work on the group > level, not just the user level? > > Thanks > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495815… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 2 > Date: Wed, 2 Nov 2011 07:08:58 -0700 (PDT) > From: johnboy68<tripleadad68(a)yahoo.com> > Subject: Re: Need help with Freeradius and 802.1X > To: freeradius-users(a)lists.freeradius.org > Message-ID:<1320242938352-4958157.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > I have ntlm_auth working. I can auth my AD users with this command: > > radtest -t mschap aduser aspassword localhost 0 testing123 > > And it works. > > My problem is when I configure one of my Cisco switches to do 802.1x and > authenticate with Freeradius my Windows (Windows 7 and Vista) machines fail > to get authorized with the Windows supplicant. I am running Freeradius in > debug mode and have tried to trace down where it is failing on my own but > since I have no experience in this area I am just chasing my tail. Is it a > problem with PEAP, EAP, TLS? Do I need a certificate? I just don't know > and if I did I wouldn't know how to configure it. I have not been able to > find any conclusive documentation in this area. > > I could put the output here of what Freeradius outputs during a connection > attempt but I since I am testing this in our production environment, I don't > want to put that kind of information out in a public forum. > > Any thoughts? > > > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-with-Freeradius-and-802-1… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 3 > Date: Wed, 2 Nov 2011 09:22:25 -0500 > From: Ben West<westbywest(a)gmail.com> > Subject: Re: Huntgroup Checking > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CADSh-SNFZJ1dOx3S1D_sVKPHxxP7GfDq-4+=2rSRLtUwbS+nTw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > You may need to inspect whether the groupcheck query in > mysql/dailup.conf (if you are using MySQL) looks in the huntgroup > table. > > For example, this is the default query in my copy of freeRADIUS > provided by Debian: > > authorize_group_check_query = "SELECT id, groupname, attribute, \ > Value, op \ > FROM ${groupcheck_table} \ > WHERE groupname = '%{Sql-Group}' \ > ORDER BY id" > > Try modifying it as such: > > authorize_group_check_query = "SELECT id, groupname, attribute, \ > value, op \ > FROM ${groupcheck_table} \ > WHERE ( groupname = '%{Sql-Group}' \ > OR groupname = '%{Huntgroup-Name}' ) \ > ORDER BY id" > > > On Wed, Nov 2, 2011 at 9:07 AM, simonm123<simon.morley(a)me.com> wrote: >> Can anyone tell me if hungroup checking can be made to work on the group >> level, not just the user level? >> >> Thanks >> >> -- >> View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495815… >> Sent from the FreeRadius - User mailing list archive at Nabble.com. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> > > -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

2 1

ssh authentication only via Radius
by gthbvf＠aol.com 02 Nov '11

02 Nov '11

Greetings everyone, We have few of linux servers which we are trying to get authenticated only via radius. I found out I'm able to authenticate using radius password or using local (system) password. I am trying to configure it in such a way that as long as radius server is up and responding user should only able to logon via ssh with his radius password (no login with local password or even other local user and password ) And in case of radius is unavailable/not responding, user should able to logon locally with local pass My question to all experts is 1) can it be done 2) what changes and where needs to be done (/etc/pam.d/sshd or system-auth-ac) Thanks Shri

1 0

Need help with Freeradius and 802.1X
by johnboy68 02 Nov '11

02 Nov '11

I have searched the forum but can't find what I'm looking for. Here is my scenario: Users with Vista machines and the 802.1X supplicant configured Windows Server 2008 with Active Directory Other network connected devices and 'unknown' computers 100% Cisco LAN/WAN Here is what I want to do: Dynamic VLAN assignment based on 802.1X with Freeradius able to use Active Directory for the computers with the supplicant configured and also be able to use MySQL to do MAC authentication bypass for known devices like printers that can't use a supplicant. I don't have much experience with Freeradius but I feel this is something that would be a "normal" 802.1X configuration. Any help on how to configure this environment would be greatly appreciated. Thanks, John -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-with-Freeradius-and-802-1… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 02 Nov '11

02 Nov '11

Alan, i have no mention of ldap in my pap module file, but the auto_header *WAS* set to no, fixed that same result: [root@ops2 raddb]# cat modules/pap # -*- text -*- # # $Id$ # PAP module to authenticate users based on their stored password # # Supports multiple encryption/hash schemes. See "man rlm_pap" # for details. # # The "auto_header" configuration item can be set to "yes". # In this case, the module will look inside of the User-Password # attribute for the headers {crypt}, {clear}, etc., and will # automatically create the attribute on the right-hand side, # with the correct value. It will also automatically handle # Base-64 encoded data, hex strings, and binary data. pap { auto_header = yes } -m On 11/1/2011 2:09 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: IPv6 ready? (Alan Buxey) > 2. Re: cisco WAP/FreeRadius/OpenLDAP (Alan Buxey) > 3. Re: add field in radcheck table (gary) > 4. Re: add field in radcheck table (Fajar A. Nugraha) > 5. Client hostname in clients.conf instead of IP address (tohaikmeng) > 6. Re: Client hostname in clients.conf instead of IP address > (Fajar A. Nugraha) > 7. Re: add field in radcheck table (gary) > 8. Re: add field in radcheck table (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 31 Oct 2011 19:23:09 +0000 > From: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: IPv6 ready? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<20111031192309.GC19191(a)lboro.ac.uk> > Content-Type: text/plain; charset=iso-8859-1 > > Hi, >> Thank you all for your help. I added two more listen blocks in >> radiusd.conf and I updated detail { ... with the following: >> %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but >> ..... (there's always a but). if we use an IPv6 address, then >> Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and >> the path becomes : >> >> ?????????????? ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log >> >> but FR crashes since it cannot create a folder with that name. Is there >> any way of overcoming this issue? replace : with . or so??? > well, you asked how it could be done..you didnt say you were > trying this on Windows! whats the next surprise? > > I would do something like use PERL to make %{Packet-Src-IPv6-Address} become > sanitized..... eg assign %{Tmp-String-0} and use SED to swap : with - > > this means no single source code line change and easily adaptable to whatever > else you might come across.... > > then use simly use %{Tmp-String-0} in your detail module config.... > > > alan > > > ------------------------------ > > Message: 2 > Date: Mon, 31 Oct 2011 19:25:49 +0000 > From: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: cisco WAP/FreeRadius/OpenLDAP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<20111031192549.GD19191(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> so now the password is not clear text in the log as it was before but >> still seeing that no good password error....but then there is that line >> towards the bottom that sasys user authorized to use remote access... do >> i need to configure Filter-Id or something in the sites-enabled/default >> or innertunnel or something like that? > getting confused with authorization and authentication? check your requirements > in LDAP - do they match (eg CN/DN?) > > have you got PAP listed after the ldap and is the auto_header enabled in the pap > module? > > alan > > > ------------------------------ > > Message: 3 > Date: Tue, 1 Nov 2011 10:07:00 +0800 > From: "gary"<gary.yang(a)browan.com> > Subject: Re: add field in radcheck table > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID:<003901cc983a$f335b490$cd15a8c0@ggyy40fbc8fbae> > Content-Type: text/plain; format=flowed; charset="iso-8859-1"; > reply-type=original > > ----- Original Message ----- > From: "Fajar A. Nugraha"<list(a)fajar.net> > To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius.org> > Sent: Monday, October 31, 2011 8:34 PM > Subject: Re: add field in radcheck table > > >> On Mon, Oct 31, 2011 at 5:23 PM, gary<gary.yang(a)browan.com> wrote: >>> Hi Fajar >>> I think the secondname field may be realm instead of. >> First rule before asking anything: make SURE you know what you want. >> When you're not even sure, how can others help you? >> >>> I am thinking this in case without proxy, using local database it can >>> determine by two field "username+realm" instead one check field username >>> such as "gary@companyA" . User can see his/her name like "gary" only >>> without >>> "@companyA" character. >> What do you mean "User can SEE"? >> >> The question is simple. What does the user put as username? How do you >> want to process that username? >> >> If the user only inputs "gary", and you don't know how you you can get >> the realm, then how can FR do what you want? By being psychic? >> > Sorry for my poor english. > > From the login page,user can type his name and select pull-down option for > the realm and then send to FR server for authentication. > for example, gary@domain1 and gary@domain2 come from different company and > both in same database. > I can directly input gary@domain1 and gary@domain2 as user name for > authentication. > but I would like to separate two field for checking. > user can see(probably read) user infomation(eg:logout page) only user name > instead of gary@domain1 . > Furthermore, in case lot of data in radcheck, it can be search,sort...etc > according to the realm field to improve server performance. > >> -- >> Fajar >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Tue, 1 Nov 2011 10:02:22 +0700 > From: "Fajar A. Nugraha"<list(a)fajar.net> > Subject: Re: add field in radcheck table > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAG1y0scMgFLgQivxcF+i12pUyFcMWWzZuXYgn8VdfMmz4QRBqw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On Tue, Nov 1, 2011 at 9:07 AM, gary<gary.yang(a)browan.com> wrote: >>> From the login page,user can type his name and select pull-down option for >> the realm and then send to FR server for authentication. >> for example, gary@domain1 and gary@domain2 come from different company and >> both in same database. >> I can directly input gary@domain1 and gary@domain2 as user name for >> authentication. >> but I would like to separate two field for checking. >> user can see(probably read) user infomation(eg:logout page) only user name >> instead of gary@domain1 . > This is a captive portal setup, right? FR doesn't really care what > user puts in "drop down box", it only cares what the NAS (e.g. > chillispot) sends. And the NAS doesn't really care what the user > inputs, it only cares what the captive portal sends it (which may or > may not be the same as what the user inputs). > > For example, in my setup the captive portal adds a realm automatically > (user can't put it manually) and pre-process the password that user > entered (e.g. using a custom hash). > > In that setup there's really no need to separate user and realm. Just > use the default setup. > >> Furthermore, in case lot of data in radcheck, it can be search,sort...etc >> according to the realm field to improve server performance. > I actually think the easiest way is to just add a "realm" field in > radcheck as ENUM type, indexed, used only for search/sorting purposes, > updated automatically by mysql trigger. That way you don't have to > modify anything on FR side. > -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

1 0

Service-Type Error
by Darren Shaw 01 Nov '11

01 Nov '11

Hello, The FreeRadius server is a VM machine and the ESX host failed, everything came back and is now working apart from the following The Radius Service, when the service starts this is the error we receive /usr/local/etc/raddb/sites-enabled/default[219]: ERROR: Unknown value Administrative-User, for attribute Service-Type /usr/local/etc/raddb/sites-enabled/default[214]: Failed to parse "update" subsection. /usr/local/etc/raddb/sites-enabled/default[210]: Failed to parse "if" subsection. /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. This error prevents the Network team from logging into their devices, their username is authenticated but they receive the following on the SSH session to the switch/router. ACCEPT: Authorizing enable access and then nothing. I have checked the following Dictionary.rfc2865 and this states that the administrative-user has a value of 6, which according to Cisco is correct. We use the Radius Server for all our Wireless Authentication and this is working without any known issues, please find the section of the Radius configuration file from '/usr/local/etc/raddb/sites-available/default'. By commenting out the 'Service-Type' line Raduis will start, otherwise we get a syntax error. if(!control:Auth-Type && (request:NAS-Port-Type == Virtual || request:NAS-Port-Type == Async) && (NAS-Identifier == hudds_switches || NAS-Identifier == bar_switches || NAS-Identifier == old_switches || "%{client:clientgroup}" == "networks")){ update control { Proxy-To-Realm := LOCAL } if(ldap_staff-Ldap-Group == CMSX_NETW){ update control { Auth-Type = "ntlm_auth" } update reply { Reply-Message = "ACCEPT: Authorizing enable access", Cisco-AVPair = "shell:roles*\"network-admin\"", Cisco-AVPair += "shell:priv-lvl+15", #******* Service-Type = Administrative-User, *****# Fall-Through = No } } } Help is greatly appreciated. Rgds Darren Shaw The Network Team Computing Services University of Huddersfield Queensgate Huddersfield HD1 3DH TEL: 01484 471317 MOBILE: 07792 773807 ________________________________ --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Proxy decision based on LDAP lookups and Radius_client match.
by Frank Skovboel 01 Nov '11

01 Nov '11

Hi, I have been asked to build a radius proxy using freeradius, and I'm completely new to freeradius, and with the flexibility in freeradius I'm having a hard time figuring out how to accomplish my goal, or if it's even possible to do. Objective: I need to verify that the user that tries to login from Company A really is an employee of Company A, and not an employee of Company B. For this purpose I have access each company's AD and of cause I know what radius clients belong to each company. Once I have validated that the user exists in the Company's AD, I then have to proxy it to another radius server where the users OTP will be validated, and from that give an access-accept or access-reject. If the user does not exist in the Company's AD, freeradius should send an access-reject and not proxy it to the OTP radius. I imagine the flow is some thing like: 1) User from Company A tries to login 2) Company A's VPN sends a radius request to Freeradius 3) Freeradius looks at the Radius_client IP and finds the right AD. 4) Freeradius does an LDAP bind to Company A's AD, and checks if the user exists. 5) If user exists request is proxied to the OTP radius, if the user does not exists access-reject is sent from Freeradius. I have freeradius setup to proxy the request to the OTP radius server today, without any checks. As I said I'm completely new to Freeradius, and not sure what files I need to configure or what to put in them, so any help is highly appreciated. -- Thank you, Frank Skovboel

2 5

add field in radcheck table
by gary 01 Nov '11

01 Nov '11

2 8

Client hostname in clients.conf instead of IP address
by tohaikmeng 01 Nov '11

01 Nov '11

Hello, Can anyone help me with this question? I have added the following configuration to raddb/modules/attr_rewrite, which allows me to get Client IP address. attr_rewrite addclientip { attribute = Client-IP-Address searchin = packet searchfor = "^$" replacewith = "%{Client-IP-Address}" maxmatches = 1 new_attribute = yes } Is there anyway for me to retrieve the Client hostname as configured in raddb/clients.conf shown in the example below. client www.abc.com { secret = password } Any help will be greatly appreciated. Thanks :) Alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/Client-hostname-in-clients-conf-ins… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1