March 2011 - Freeradius-Users - lists.freeradius.org

Network authentication and password policy
by Jeffrey Belles 23 Mar '11

23 Mar '11

Hello, I am new to this list and planning to deploy a radius-server. Sole purpose will be to authenticate against network equipment. Mainly Juniper and cisco and Sonicwall. I am looking for best practice solutions for password policy. Is there any way to force network engineers to change their passwords after either first login or expiry date? Having everybody manually submit passwords on the server and/or having them change it every x weeks seems a bad plan. Anyone any ideas? Thx Rgds, Jeffrey

2 3

Re: Debian packaging
by Adrien Demarez 23 Mar '11

23 Mar '11

Dear all, I have an issue with the new (development/git) version of the TLV parsing (nested TLVs for WiMAX) : is there a clean way to end a container TLV ? Here is my issue : I have to insert several WiMAX-Packet-Flow-Descriptor TLVs (each containing a WiMAX-Packet-Flow-Id and a WiMAX-Service-Profile-Id). However, I cannot simply write the following (e.g. in update reply) : WiMAX-Packet-Flow-Id = 0 WiMAX-Service-Profile-Id = 1 WiMAX-Packet-Flow-Id = 1 WiMAX-Service-Profile-Id = 2 WiMAX-Packet-Flow-Id = 2 WiMAX-Service-Profile-Id = 3 WiMAX-Packet-Flow-Id = 3 WiMAX-Service-Profile-Id = 4 If I do this, all I get is a single WiMAX-Packet-Flow-Id containing 8 sub-TLVs, while I want 4 WiMAX-Packet-Flow-Id (each containing 2 TLVs). The "quick hack" I found is to write WiMAX-Packet-Flow-Id = 0 WiMAX-Service-Profile-Id = 1 WiMAX-IP-Technology = 0x06 WiMAX-Packet-Flow-Id = 1 WiMAX-Service-Profile-Id = 2 WiMAX-IP-Technology = 0x06 WiMAX-Packet-Flow-Id = 2 WiMAX-Service-Profile-Id = 3 WiMAX-IP-Technology = 0x06 WiMAX-Packet-Flow-Id = 3 WiMAX-Service-Profile-Id = 4 WiMAX-IP-Technology = 0x06 Here, the "WiMAX-IP-Technology = 0x06" (but it could be anything else) acts as a separator, forcing FreeRadius to write a new WiMAX-Packet-Flow-Id container. But this is not clean IMO. Is there a better way to do this ? Best regards, -- Adrien Demarez Le 3 mars 2011 à 08:23, Alan DeKok a écrit : > Adrien Demarez wrote: >> The debian/ folder is still based on the 2.1.8 version, and dpkg-buildpackage does not compile/run for a number of reasons : >> - some patches do not apply anymore. e.g. I had to regenerate radiusd-to-freeradius.diff. I also had to deactivate (no time to fix it now) the dialupadmin-help.diff. >> - eap.conf, sql.conf and sqlippool.conf have moved to raddb/modules/, thus I have to delete the original references to those files in intall and postinst conf files >> - this has another side effect : in the previous configuration, sql.conf was commented by default. Now, it is executed by default since it is in the modules/ folder, which means that default freeradius installation is broken/not working if I don't install freeradius-mysql in the same time (because there is a $INCLUDE directive in modules/sql referencing sql/${database}, which is only installed if I install freeradius-mysql). Same for sqlippool, which has a default reference to sql/postgresql (by the way, it would be desirable to have something homogeneous between default sql and sqlippool files : either both on them with postgresql, or both of them with mysql, but not the current "mixed" scheme !). For the moment, I just propose to comment the $INCLUDE directives in modules/sql*, but maybe there is a cleaner way to do it ? Is there a way to specify something like "$INCLUDE everything except sql*" in radiusd.conf ? >> - since raddb/eap.conf does not exist anymore, the freeradius.postinst must be changed regarding the generation of the certs/ folder. If the certs/ folder remains empty, freeradius installation is broken since modules/eap references nonexisting files ! >> - the code behind --with-edir does not compile, thus I had do disable the --with-edit flag in rules >> >> I send you the diff file on the debian/ folder I use. I am compiling on a fresh Debian Squeeze (i386). > > Applied, thanks. > > I left the "--with-edir" option in, as the edir code got fixed recently. > > Alan DeKok.

2 1

Oracle stored procedure
by Rabidinov M.A. 23 Mar '11

23 Mar '11

Hello, Freeradius-users. Does freeradius 2.1.10 support Oracle stored procedures? I need to call stored procedure in accounting_update_query. How can I do it? ----------------------------------- Marat Rabidinov SaimaTelecom Bishkek, Kyrgyzstan tel. +996 312 900159 e-mail: m.rabidinov(a)saimatelecom.kg -----------------------------------

1 0

rlm_sqlcounter returning wrong value...
by Paweł Soja 23 Mar '11

23 Mar '11

Hello, I'm using 2.1.9+dfsg-1ubuntu1. I've got a problem with sqlcounter. I try to use it as data limit counter. I've read that this counter has got 2GB limit, but I've got problem even with smaller amount of data. Info: [noresetbytescounter] sql_xlat finished Debug: rlm_sqlcounter: Check item is greater than query result Debug: rlm_sqlcounter: Authorized user 00:27:22:02:56:8E, check_item=62914560, counter=31610584 Debug: rlm_sqlcounter: Sent Reply-Item for user 00:27:22:02:56:8E, Type=Mikrotik-Total-Limit, value=31303976 And it's ok. But when I use monthlybytescounter I have: Info: [monthlybytescounter] sql_xlat finished Debug: rlm_sqlcounter: Check item is greater than query result Debug: rlm_sqlcounter: Authorized user 00:27:22:02:56:8E, check_item=52428800, counter=31610584 Debug: rlm_sqlcounter: Sent Reply-Item for user 00:27:22:02:56:8E, Type=Mikrotik-Total-Limit, value=31303976 Info: ++[monthlybytescounter] returns ok It doesn't return 20818216. Dailybytescounter do the same. Info: [dailybytescounter] sql_xlat finished Wed Mar 23 13:36:08 2011 : Debug: rlm_sqlcounter: Check item is greater than query result Wed Mar 23 13:36:08 2011 : Debug: rlm_sqlcounter: Authorized user 00:27:22:02:56:8E, check_item=41943040, counter=6902480 Wed Mar 23 13:36:08 2011 : Debug: rlm_sqlcounter: Sent Reply-Item for user 00:27:22:02:56:8E, Type=Mikrotik-Total-Limit, value=31303976 Wed Mar 23 13:36:08 2011 : Info: ++[dailybytescounter] returns ok I've read that sqlcounter works on time and it's counter is seconds, but how can I do "daily/monthly data limit counter" using freeradius? I found this thread: http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-October/msg… but it's from 2008 and maybe there is another solution? Thx for reply Pawel

1 0

Fw: Radius Problem EAP/TTLS Openssl support issue
by Amrita Mandpe 23 Mar '11

23 Mar '11

Hi Alan, Im new to freeRADIUS, trying to implement it for my test machine running currently on Ubuntu 9.04 Server.Im trying to establish a communication between Windows XP,SP3 client and RADIUS SERVER ( on Ubuntu Server) through EAP/TLS and cerrtificates. The problem i m facing is, when i run the server in debug mode it gives me this warning - -------------------------------------------------------------------------------------------------------------- Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } I tried to install the patch available for OpenSSL, but the error still persists. Also, i tried to run the rlm_eap_ttls.c file but the error i get is -- root@ubuntu:/etc/freeradius-2.1.9+dfsg/src/modules/rlm_eap/types/rlm_eap_ttls# ./configure checking for OpenSSL support... no configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged It would be great if you can help me get through this issue. Regards, Amrita

2 1

Group checking in ldap authorization
by Robert Roll 23 Mar '11

23 Mar '11

I have an ldap module that I want to force to do group checking. Reading the documentation, it seems that there should be an attribute (I'm assuming control?) that should force that check ? i.e. instance-name-Ldap-Group .. I notice that the ldap module seems to have group checking disabled by default. I thought that uncommenting the group config below should enable it ? # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName Below is what I have in my authorization section. I update control { ldapADut-Ldap-Group := "cn=chemVLAN,OU=Groups,OU=UofURadius,dc=ad,dc=utah,dc=edu" } ldapADut { notfound = reject } Looking at the debug, it seems that there is no attempt to actually do any group checking ? What am I doing wrong ? Thanks, Robert

3 6

Is it possible to get packet id in pre-proxy section?
by 魏景鹏 23 Mar '11

23 Mar '11

Helo guys, One side auth with pap method, but the other side needs chap auth method, so I have to do some translating work. chap-string = Packet-Id + Cleartext-Password + authenticator chap-password = packet-id + md5(chap-string) Is it possible to get packet id in pre-proxy section? how can i pack packet-id & authenticator into chap-string? Any ideas welcomed. many thx

2 1

execute DML in unlang
by 魏景鹏 23 Mar '11

23 Mar '11

Dear all, How to execute insert, update, delete statments in unlang? if I set %{sql:delete....} freeradius can't interpret the configure file correctly. if I set Tmp-String-0 := %{sql:delete...} the output of 'radiusd -X' shows there's some problem since the statement don't return any value. Any Ideas? thx

2 1

Freeradius Ldap
by Usuário do Sistema 22 Mar '11

22 Mar '11

Hello everyone, I'm dificult with freeradius and LDAP. the user autheticate only it's work when I put in the user file User-Password clear text as follow. "maicon.pereira" Cleartext-Password := "meleca" Reply-Message = "Hello, %{User-Name}" however, my integration between Freeradius and Ldap it isn't working. My question is: there is possible to make the intragation?? because I've read that freeradius needs supply to ldap User-Password clear text. it's true ?? I wish to use the ldap as database authetication. thank!

3 3

$75.00 USD Bounty
by Craig Smith 22 Mar '11

22 Mar '11

Good Morning! I will pay $75.00 USD (via PayPal) to the first person who can send me the documentation and working configuration files for external authentication using a PHP script. Thanks, Craig

5 9