July 2012 - Freeradius-Users - lists.freeradius.org

Prompt for new password on mac 10.7 after change with 2.1.12 ?
by Jonathan Paul 30 Jul '12

30 Jul '12

Hi, We are running a freeradius 2.1.12 server for access to our wifi. The server is configured to authenticate users through ldap back to our Novell Edirectory. We are required to change our passwords every 6 months. The password change occurs, but users are not prompted for this new password on their mac when they try to get on the wifi the next time. We were previously running 2.1.10 and built a new server this summer as I was under the impression this was supposed to be fixed in this version. Is there a config change necessary to prompt for a new password when authentication fails ? Thanks Jonathan Paul Network Support Services

3 3

Invalid Authenticator... i.e. "munged" nt-key from Winbindd ...
by Robert Roll 30 Jul '12

30 Jul '12

Yes, I know this is really a Samba problem. I'm asking on this list because I really feel that a number of the users of ntlm_auth, winbindd are Radius admins. This is in regards to the "munged" nt-key bug in Winbindd. Most of the suggestions have been to simply upgrade Samba. From my reading, this all seems to go back to Samba 3.2.X'ish ? Well we are(were) running Samba 3.5.6. I figured that was relatively safe? Actually, I had noticed that the bug did still seem to exist, but would only occur after running Winbindd for a "while". I found other admins on the net reporting the same thing. We all seemed to adopt the same solution. Simply re-start Winbindd when the problem arose. This scheme worked very well for over a year. Then around 16:40 last Friday afternoon, something in our environment changed and this "bug" seemed to get tweaked all of the time. The radius servers just seemed to start to melt down. Actually, after a few hours 4 of 10 of our backend servers seemed to find a somewhat "stable" situation. In any case, I tried installing an older version of Samba 3.0.31 as there was some reference that nobody had seemed to see this problem with that version. However, that version did not do authentication at all against our win2008R2 directories. I found a bug report about that, and it basically said, "yes we know, we don't intend to fix it in 3.0.31 as that is an old version, upgrade". So, in any case, I did upgrade to the latest Samba 3.5.16 and things "seem" to be working now. After all said above, my real question is, has anybody seen anything somewhat definitive on this bug that would indicate the source of the problem has really been found and fixed ? Or, does it just seem that other changes to Winbindd have just "seemed" to make this bug go away (or hide better) ? The reason I ask, is that we use Freeradius here and we are a large R1 University with associated medical center. Our radius architecture is beginning to support not only the Campus, but the medical center as well. The plan is to really bring ALL of the medical center Wireless that requires authentication into our Freeradius architecture. Believe it or not, there are becoming more and more medical devices that are starting to have some wireless capabilities now. >From what I can tell, most of the use is to simply gather data about the device and ship it off to some master data gathering tool for analysis at a later time. However, I'm not sure, but some EKG devices in the future might start using this to actually ship the EKG results in real time to a doctor that is actually remotely located. This and other potential real time uses start to scare me a bit ??? I know that these devices should have some other backup capabilities for transmitting the data, but...... Thanks, Robert Robert Roll Computer Professional University of Utah (801) 581-7655

3 3

Abwesenheit (was: Freeradius Installation Challenges)
by tietjen 29 Jul '12

29 Jul '12

Vom 21. Juli bis einschl. 12. August bin ich nicht erreichbar (Urlaub). Bitte beachten Sie, daß von mir keine eingehenden E-Mails bearbeitet werden können. Vertretung: Hr. Brinkmann, Tel. 040-7410-56129, brinkmann(a)uke.de Hr. Werner, Tel. 040-7410-59630, k.werner(a)uke.de Vielen Dank für Ihr Verständnis. Diese Mail wird nicht weitergeleitet. Jan Tietjen

7 20

Session-Timeout
by Klaus Klein 28 Jul '12

28 Jul '12

Hi Folks, I'm in the process to setup a WPA(2)-Enterprise (IEEE 802.1X) protected WLAN. I choose FreeRADIUS (2.1.10) with a EAP-TLS to authenticate and control the access to the network. While everything works so far, I just can't get the Session-Timeout to work. If I start 'freeradius -X' I can see that FreeRADIUS sends the Session-Timeout information with the Access-Accept message. Also if I limit the Login-Time (e.g. Login-Time := "Wk0000-1500") and the remaining time is less then the Session-Timeout, the remaining time is send as a Session-Timeout. Nevertheless, after the session times out, no reauthentication takes place and the client stays connected to the network. As this behavior happens with all (two) APs I've got, I'm not sure where to locate the problem.(FreeRADIUS, AP or Client (Debian Squeeze with wpa_supplicant)) Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side? Thanks, Klaus

3 5

[Freeradius-Dialupadmin] "NAS Ports Number"
by Osvaldo T Crispim Filho 28 Jul '12

28 Jul '12

Greetings to all! I wonder if this is the correct list to talk about the Freeradius-Dialupadmin. If so, I wonder to what refers to the port number in registration of NAS (Radius Client). Is this for snmp communication? "NAS Ports Number" If not here the correct place ... Excuse me! Thank you.

2 1

Avoid locked Active Directory Account when using PAP/krb5 against active directory
by Thomas Glanzmann 28 Jul '12

28 Jul '12

Hello, I have Citrix Netscaler which authenticates user against active directory with PAP. First against Active Directory using krb5 and second against smsotp using a PAP Access challenge. If someone knows a username he can type in multiple times the right username with the wrong password and can so lock the account in active directory. Now I'm looking for solutions to avoid that. Is there a FreeRadius Module which accounts the login failures of another FreeRadius Module (krb5) within a given time range and stops prompting the underlying FreeRadius Module (krb5) if a user has authenticated itself for example 3 times within one hour, if not whatever practical solutions do you have in mind? Cheers, Thomas

2 2

Uninstall FreeRadius
by George Innocent 27 Jul '12

27 Jul '12

How can one uninstall the Freeradius 2.1.1 from Ubuntu 12 LTS

6 5

Re: Abwesenheit (was: Freeradius Installation Challenges)
by Alan Buxey 27 Jul '12

27 Jul '12

So, whats the problem? What are you trying to do, what have you already done to your configuration files and what is your output when running the server in full debug mode? Ps 'authentification' doesn't exist. It's authentication. alan

2 1

Huntgroup Implementation with MySQL and Radgroupcheck
by Jenny Blunt 27 Jul '12

27 Jul '12

I'm looking for some help with the implementation of huntgroups. Am using mysql and have followed the following topic through: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-td4950385.html In sites-available/default I have this, (just after preprocess: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } And the debug log show's this query's working: expand: %{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'} -> Location One In my radgroupcheck table, I've added Huntgroup-Name == Location One I've also modified my authorize_group_check_query in dialup.conf as per a recommendation authorize_group_check_query = "SELECT id, groupname, attribute_name, \ Value, op \ FROM ${groupcheck_table} \ WHERE ( groupname = '%{Sql-Group}' OR groupname = '%{Huntgroup-Name}' ) \ ORDER BY id" (Which doesn't make logical sense to me) What I'm failing to get my head around is how to reject or allow access based on the location their dialing in from? For example, a user from IP 1.x.x.x should be allowed access at location 1 only.

3 10

Re: Freeradius Installation Challenges
by Alan Buxey 27 Jul '12

27 Jul '12

Don't care what the client output says... server output is important. In this case its telling you exactly what is wrong....you are already running the server. Kill that process and then run it. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2