February 2011 - Freeradius-Users - lists.freeradius.org

Hash username or mac address to assign user to different vlan
by schilling 03 Mar '11

03 Mar '11

Hi All, I get dynamic VLAN assignment working in post-auth section with help/hints from a lot of list members. Now I want to do one more steps. I would like to hash the username or mac-address to distribute users to different VLANs. The idea is to use freeradius to spread the load on different smaller subnets to reduce the broadcast in bigger VLANs. For example I want to do the following if ( "%{User-Name}" !~ /@/ ) { if ( %{User-Name}%2 == 0 ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff0" } elsif ( %{User-Name}%2 == 1 ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff1" } } } Will I be able to do this in the post-auth with unlang? Thanks, Schilling ---------- Forwarded message ---------- From: schilling <schilling2006(a)gmail.com> Date: Tue, Jan 25, 2011 at 10:19 AM Subject: Re: dynamic VLAN assignment w/ mschapv2 against AD and LDAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> I believe I resolved this. I used eapol_test to get all wanted result, and will try on real NAS later on. The following is what I did. Basically I followed Alexander's example, Modified peap section in eap.conf to use another virtual server "auth" instead of inner-tunnel virtual server. I almost blindly copied Alexander's example in auth server except I removed the reject for the realm checks. The ldap cache pm is not needed in my case since I do not query windows AD via LDAP to get their attributes. If I want to do ldap after ntlm against AD, then Alexander's pm might be needed. Then I want to map certain attribute like employeeStatus from our iPlanet ldap server to some radius attribute, so I can manipulate it in the post-auth section. I put the following line in etc/raddb/dictionary ATTRIBUTE My-Local-employeeStatus 3000 string and the following line in etc/raddb/ldap.attrmap #FOO specific attributes replyItem My-Local-employeeStatus employeeStatus Without these two line addition, radius will complain unknown attribute. Then in the post-auth section #default will have no Tunnel attribute/value, instead, they will be configured on #the NAS to go to student VLANs. # this will cover my ldap ntPassword authentication/authorization #facstaff have employeeStatus set while student does not if ( "%{User-Name}" =~ /@/ && "%{reply:My-Local-employeeStatus}" ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff" } } #this will cover my AD ntlm auth, People in AD are all facstaff if ( "%{User-Name}" !~ /@/ ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff" } } In this way, people can map arbitrary attribute from ldap to radius, if not in dictionary/ldap.attrmap, then just defined your own. Then you have flexibility of using these attribute/value in your logic at post-auth section. Thanks all for the hints and help! Schilling

8 22

New User and AD Question
by McNutt, Justin M. 02 Mar '11

02 Mar '11

New member to the list, here. I have a question about AD computer-based authentication. Basically, how is it accomplished? I have Googled and Googled, but only found references to the fact that it *can* be done (mostly from archives of this list), but little reference on HOW to do it, other than that it has something to do with editing the "realms" file. I also went to #freeradius on FreeNode, but it seemed there was rarely anyone in the channel. So here I am. I'm running FreeRADIUS 2.1.7 from the RHEL 5 RPM (freeradius2-2.1.7-7.el5). It's running on an RHEL 5 virtual machine that is a member of an AD domain via Samba 3.5.4 (which was required to talk to the 2008R2 domain controllers). We have a multi-domain, single forest environment. I'm running two virtual servers, based on the defaults. I have the "campus-main" virtual server that is pretty much the exact same as the default, except that I have LDAP authentication enabled. This works perfectly and is able to authenticate users for all domains. I also have the "campus-eap" and "campus-inner-tunnel" virtual servers for EAP authentication that are the same as the "default" and "inner-tunnel" servers except for the names. (I copied them so I could make changes to the "campus-XXX" virtual servers and still have the originals for reference.) The EAP functions for clients using EAP-TTLS and EAP-PEAP work just fine for all users in all domains (authenticated via ntlm_auth) EXCEPT for the "host\\computer.domain.name" users (the computer accounts). I'd like to make this work, partly because a large number of the failed login attempts in my logs are from hosts that are valid domain members. Sooo... help? What's the basic idea behind making this work? Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

8 57

global hash variable perl
by Vinh Nguyen 02 Mar '11

02 Mar '11

hi all, I was able to setup my freeradius to use perl and mysql. Things are working ok. I wanted to use a global hash variable to store information. This way all other requests can also access this hash variable. Is this doable? I know you can use mysql for this purpose, but i wanted to reduce the # of mysql hits. Thanks. -- Computer Science B.S. at Texas A&M C# .Net Developer Server Analyst.

4 9

Radsec support on FR?
by Panagiotis Georgopoulos 01 Mar '11

01 Mar '11

Hello there, Judging from the website and the archives in the mailing list, native support for Radsec is planned on FR. Is there anyone actively working on this? Is there any timescale for this to be streamed on the main codebase? Thanks a lot in advance, Panos

4 7

Open Directory Howto
by Raymond Norton 28 Feb '11

28 Feb '11

Is there a good howto on setting up freeradius to work with Open Directory? (Freeradius will be on stand alone box)

2 2

Radius - Ldap
by Kyle Jake Plimack 28 Feb '11

28 Feb '11

I've configured radius to use ldap for authorization and authentication. Authorization works fine, but will allow access to authorized users without a correct password. Why? ldap stores passwords using SSHA encryption. Is there any way to: a. provide radius with the key/salt so it can compare the passwords properly b. have radius bind as the user to check that the password is correct? c. option I haven't thought of yet? Kyle Plimack KYLE J PLIMACK / SYSTEMS ADMINISTRATOR 415.531-9827 www.saymedia.com www.facebook.com/saymedia www.twitter.com/saymediainc

2 1

Fwd: FreeRadius 2.1.10 does NOT send VSA's or other attributes back in the Access-Accept (for EAP-TTLS)
by Amit Nath 28 Feb '11

28 Feb '11

hello, I am attempting to authenticate end-users via EAP-TTLS (with EAP-MD5) as the inner method. I have noticed that the Access-Accept Message does NOT contain the right VSA attributes, nor the dynamic VLAN assignments. Infact it would appear that the Microsoft MS-MPPE-Rec/Send Key attributes are sent back ? Sending Access-Accept of id 6 to 172.23.35.62 port 62548 MS-MPPE-Recv-Key = 0x57718ff5e99e08f770ee3832bd9edf5cf3f010be6f9d200e86bb9afa55ca3c45 MS-MPPE-Send-Key = 0x946a940cd99bb88a10de103fec50b1634f14869cc8f4da3788e099d5896cf272 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "data1" Now what makes this really interesting if I change my client's authentication type to EAP-MD5 only the Radius Server Sends back an Access-Accept message with Vendor VSA's and the dynamic-VLAN assignments (As per the screen capture below) Sending Access-Accept of id 2 to 172.23.35.62 port 55033 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "data1" Please advise if I have configured something incorrectly ? As everything works correctly for EAP-MD5, but not for EAP-TTLS (with EAP-MD5 inner authentication) Attached are the full server debug trace for both scenarios. thanks Amit NOTES: - FreeRadius 2.1.10 (installed via the "yum install freeradius") command - Platform Fedora Linux (v14) 2.6.35.6-45.fc14.i686 - below is an excerpt of my users file for the user "data1" data1 Cleartext-Password := "data1" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 4,

2 2

store and proxy accounting packets
by Waqas Toor 28 Feb '11

28 Feb '11

Hello Community, I want to store accounting packets to local database and proxy same accounting packet to some other accounting listener server. I couldn't make sense out of copy-acct-to-home-server that where I can define the other accounting listening server. also if I use robust-proxy-accounting I am unable to understand the pass-through accounting, is it going to save to local accounting as well ? Thank you Waqas Toor

2 11

Logging to Microsoft SQL
by Mark Holmes 28 Feb '11

28 Feb '11

I'm looking at having freeradius log accounting information to an MS-SQL database on our centralised logging box. Googling returns a lot of pages on this. I had a look in at them but many relate to freeradius 1. Before I go making a lot of work for myself needlessly - could anyone outline what I need to be doing, or point me in the direction of up to date instructions? Many thanks, Mark

2 1

Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY)
by adx grave 27 Feb '11

27 Feb '11

Hi list, I got this after server HUP and it just die. The same error appeared after i manually restart the server but it continue to work just fine. A bug? Or maybe something wrong with my config? Any hint to where should i look? Freeradius 2.1.10. Thanks.

2 2