August 2011 - Freeradius-Users - lists.freeradius.org

Home servers in SQL for CoA Proxy
by Francois Gaudreault 12 Aug '11

12 Aug '11

Hi, Is there a way to list the home servers (so the access switches) into a sql table (like nas table) intead of proxy.conf? My goal here is to proxy the CoA to the NAS without having to manually list all the devices in proxy.conf, and use Proxy-To-Realm = %{NAS-IP-Address}. Thanks -- Francois Gaudreault, ing. jr Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

Config for TLS, TTLS and PEAP and subject validation
by Daniel Bertolo 12 Aug '11

12 Aug '11

Hi I currently run FreeRADIUS 2.1.6 and have a working configuration for EAP-TTLS and PEAP that is used for a WPA2 network. In addition to that, I would like to allow our users to use their user certificate from a public issuer to connect using EAP-TLS. This means that I have to check if the subject contains our organisation. I read in previous threads about checking the subject in the authenticate section: authenticate { Auth-Type eap { eap if (!"%{TLS-Client-Cert-Subject}" =~ /\/O=MyCompany\// ) { reject } } } I have two questions about that: - This would belong in the "outer" request as there is no inner request with EAP-TLS, right? - What happens to requests that don't provide a client certificate (the users who still use EAP-TTLS or PEAP)? In conclusion, is there a way to distinguish between EAP-TLS requests and EAP-TTLS or PEAP requests? And if so, can I use a different server section for EAP-TLS? Thanks for help. Best regards, Daniel

2 2

how to conf VLAN assign,mac-auth-bypass, and redirect url?
by freeradius 12 Aug '11

12 Aug '11

hi all, can anyone show me how to conf VLAN assign,mac-auth-bypass, and redirect url?thank you very much

3 2

dynamic CRL
by Travis Dimmig 11 Aug '11

11 Aug '11

Apologies ahead of time if this information is easily available somewhere else, but everything I found seemed to be a few years out of date. Does freeRadius now have the ability to re-read a certificate revocation list, or does it still require a restart after additions to the CRL? Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

3 3

SSH to use CHAP
by chesschi 11 Aug '11

11 Aug '11

Hello! I try to authenticate ssh users via PAM using FreeRadius. Is it possible to use CHAP for the authentication between radius server and radius client? SSH client -> SSH server <- PAM -> Radius Client <- CHAP-> Radius Server For example, if I specify in radius server to use CHAP auth-type for a particular user, e.g. in users file: sshuser Auth-type := Chap, Cleartext-Password := "xxx" When I use an SSH client to login, the following error is shown in radius server. [chap] rlm_chap: Attribute "CHAP-Password" is required for authentication. So is there a way to actually specify the CHAP-Password in radius client so that it can be authenticated via CHAP? If yes, which file I should modify? Thanks a lot!!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/SSH-to-use-CHAP-tp4685793p4685793.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Freeradius and group membership check
by Vlad Glagolev 11 Aug '11

11 Aug '11

Hello there, I'm here to say that I've found kind of misconfiguration/bug in Freeradius. The version is 2.1.10, and the platform is i386 (i686) OpenBSD. when I try to use group membership check, I see strange behaviour: instead of commas there are symbols (those are in ASCII?) like that: [files] expand: (|(&(objectClass=PosixGroup)(memberUnixUserName=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=PosixGroup)(memberUnixUserName=uid\3dtest\2cou\3dIT\2cou\3dDepartments\2cou\3ddom.tld\2cou\3dDomains\2cou\3dUsers\2cdc\3ddomain\2cdc\3dtld))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtest\2cou\3dIT\2cou\3dDepartments\2cou\3ddom.tld\2cou\3dDomains\2cou\3dUsers\2cdc\3ddomain\2cdc\3dtld))) of course if I use %{User-Name} instead of %{control:Ldap-UserDn} it works well (with simplified search filter, but it's the same with that above): [files] expand: (&(objectClass=posixGroup)(memberUnixUserName=%{User-Name})) -> (&(objectClass=posixGroup)(memberUnixUserName=test)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=tld, with filter (&(cn=disabled)(&(objectClass=posixGroup)(memberUnixUserName=test))) rlm_ldap::ldap_groupcmp: User found in group disabled is this a known behaviour? thanks in advance -- Dont wait to die to find paradise... -- Cheerz, Vlad "Stealth" Glagolev

2 1

SNMP
by David Peterson 11 Aug '11

11 Aug '11

Is SNMP available yet in the latest code? David

2 1

Need your help me get daloradius fully integrated with freeradius
by Mobin Yazarlou 10 Aug '11

10 Aug '11

Hi, This is my first email on freeradius mailing list so I would like to say thanks to freeradius development team and all those who participate in this mailing list. I am using freeradius 2.1.11 on Debian 6.0 to have enough control over pptpd users. Everything is hosted on a single machine and freeradius works fine but I can't use some of the features I see in daloradius 0.9-9 control panel. One of this features is "Max-All-Session" and some other attributes that allow me to limit download/upload bandwidth. I used to following checklist to install and integrate daloradius with freeradius database: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- apt-get install apache2 apt-get install php5 apt-get install php5-mysql apt-get install php-pear apt-get install php5-gd apt-get install php-db wget http://www.xxxxxxxx.com/pptp/daloradius-0.9-9.tar.gz tar -zxvf daloradius-0.9-9.tar.gz mv daloradius-0.9-9 dalo cp -R dalo /var/www chown www-data:www-data /var/www/dalo -R chmod 644 /var/www/dalo/library/daloradius.conf.php mysql -u radius -pPASSWORD radius < /var/www/dalo/contrib/db/mysql-daloradius.sql # Set CONFIG_DB_USER and CONFIG_DB_PASS in daloradius.conf.php nano /var/www/dalo/library/daloradius.conf.php -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- I think this checklist is just a minimum to only get daloradius to work. I would be thankful if you provide a better checklist or letting me know about other things that need to be done. Yesterday I spent about two hours to find out why freeradius fails to authenticate the user when I use "Max-All-Session" attribute. I just googled the error message I could see in "freeradius -X" and found that I have to add "noresetcounter" in the authorize { } section of /sites-enabled/default and uncomment "$INCLUDE sql/mysql/counter.conf" in radiusd.conf. This eliminated the error message and the users that have a "Max-All-Session" attribute can connect but freeradius still let the user to connect even when its time credit is finished. The only attributes that seem to work properly are "Simultaneous-Use" and "Expiration". I don't have any problem with them and they work fine. Actually, I am not sure if it is about daloradius. Please correct me if I am wrong cause I am a web developer and do know just a little about networking, radius server, access server, etc. Thanks in advance. Moby

1 0

Re: How to log "TLS name" instead of username
by Alan Buxey 10 Aug '11

10 Aug '11

Do not set auth-type for EAP in your users file, the server is not stupid alan

2 1

Re: Hello all
by Alan Buxey 10 Aug '11

10 Aug '11

Follow the advice of the WARNING lines and check your shared secret in clients.conf as that password looks quirky alan ----- Reply message ----- From: "Jon Cash" <chafik122(a)gmail.com> Date: Wed, Aug 10, 2011 11:51 Subject: Hello all To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Hello all i use freeradius with the network access control Packetfence I have a problem with captive portal registration I use radius authentication and i have this problem when i put login pass in the authentication page rad_recv: Access-Request packet from host 127.0.0.1 port 47764, id=171, length=50 User-Name = "user" User-Password = "\026JoL\267\277O\235:~\327\374\367" NAS-IP-Address = 127.0.0.1 server packetfence { +- entering group authorize {...} [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry user at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair User-Name = user rlm_perl: Added pair User-Password = \026JoL\267\277O\235:~\327\374\367 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Cleartext-Password = pass ++[perl] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. } # server packetfence Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 171 to 127.0.0.1 port 47764 Waking up in 4.9 seconds. Cleaning up request 33 ID 171 with timestamp +1302 Ready to process requests. the password match in user file any idea please cheers

1 0