October 2013 - Freeradius-Users - lists.freeradius.org

Digest Authentication with a Cisco device
by Philip Walenta 02 Oct '13

02 Oct '13

I'm trying to do what might be an odd configuration. I'm attempting to digest auth users without caring about their "User-name" attribute. So in other words I want to auth on the "Digest-User-Name = "testuser"" that comes in as part of the Digest-Attributes and a password. So in the users file I have "DEFAULT Cleartext-password := "password"" I created a partial digest file but it appears to be ignored on every test: Digest-User-Name = "testuser" Digest-Algorithm = "MD5" Digest-QOP = "auth" In the debug I see: [digest] A1 = testuser:sp.eng:passwod I can change to username to anything I want and as long as the password is correct the user will auth. Am I attempting something impossible or doing it incorrectly?

2 1

Password gets changed while proxying
by JB 02 Oct '13

02 Oct '13

Hi! We're proxying auth requests to another RADIUS service and encounter the following problem: The password seems to get changed somewhere along the way. In our case, a 9 character password arrives as 16 character garbage at the home server, which then -of course- rejects the access request. Unfortunately, we don't have direct access to the home server, but the provider is convinced that the password gets mangled on our side. I can see the correct password in our FreeRADIUS debug logs. Other than preprocess, there's no module, which theoretically could change the password, before the proxy realm . My guess is that this is some sort of double encoding problem… Or maybe that the password doesn't get decoded properly on their side? Has anyone encountered a similar situation? Thanks! JB

4 5

HTTP; JMS Access
by George Innocent 02 Oct '13

02 Oct '13

I seek your support and advice to resolve this incidence relating to the Radius server used for authentification. There is a user created on the Radius that is used by Netcool for the synch with the SAM server. The user authenticates successfully but there is failure of connection on the JMS and http with the error message below when RADIUS is used. · george (admin account) : Found message of type FATALERROR: Probe failed to subscribe for notifications. Caused by: javax.jms.JMSSecurityException: SAM-O Access Violation - knoll (SAM-O account) : Exception in NSHeadResyncIntervalThread - Failed to establish HTTP connection for resync The user created on Radius as below: knoll Cleartext-Password :="airtel!23" Service-Type = Framed-User, Framed-Protocol = PPP, Sam-security-group-name = "SAM-O" Is there any parameters that have to be enabled or assigned for this user to be able to have the functions assigned to it. -- Regards: George Innocent.

2 1

Active Directory Group Membership filtering query
by Simon Grierson 01 Oct '13

01 Oct '13

Hi there, I'm new to freeradius, and am setting it up purely in a test environment before deploying live. We're using Freeradius 2.2.0 and Ubuntu server 12.04 .3 lts with Active Directory and Fortinet Fortigate based APs We're trying to achieve the following: Authentication via Active Directory, but with access granted depending on AD Group membership. EG: User A Is allowed Wifi access, as they are in Wifi-Users group User B is not as they do not have membership of this group. So we have the Freeradius server up and running, and it can authenticate against AD fine, but I cant figure out the group filtering portion of the setup. The documentation points to configuring the modules/ldap file to point to our LDAP server (I.E. our AD server0, and to configure the /users file with the following line DEFAULT Ldap-Group == "CN=sec-eduroam-users,OU=Access,OU=SecurityGroups,OU=Groups,DC=testres,DC=org" DEFAULT Auth-Type = Reject When I run freeradius in debug mode, we get all the usual output but no ldap modules mentioned It dues include modules/ldap but little else. FYI I have built this 3 times, 1. With 13.04 Ubuntu Server and Freeradius 2.2.0 from source 2. With 12.04 lts with FR 2.2.1 from source 3. With 12.04 lts with FR from the Launchpad based package ppa:freeradius/stable which is from 2.2.0 I can authenticate against LDAP and pull down group information using command line queries, so I know that LDAP is installed correctly and working in the linux build. What I cant get is LDAP to work through free radius. Am I doing something wrong, is there a better way to do this? Any help appreciated! NOTICE AND DISCLAIMER This e-mail (including any attachments) is intended for the above-named person(s). If you are not the intended recipient, notify the sender immediately, delete this email from your system and do not disclose or use for any purpose. We may monitor all incoming and outgoing emails in line with current legislation. We have taken steps to ensure that this email and attachments are free from any virus, but it remains your responsibility to ensure that viruses do not adversely affect you. Cancer Research UK Registered charity in England and Wales (1089464), Scotland (SC041666) and the Isle of Man (1103) A company limited by guarantee. Registered company in England and Wales (4325234) and the Isle of Man (5713F). Registered Office Address: Angel Building, 407 St John Street, London EC1V 4AD.

3 2