February 2013 - Freeradius-Users - lists.freeradius.org

returning error code of script to module
by Chitrang Srivastava 26 Feb '13

26 Feb '13

Hi, Is their a way to return status code of an external script to the module. Let me explain the problem: PEAP-MSCHAPv2 with ldap and fallback is also there i.e. if ldap server is not reachable do local auth. Now mschapv2 authentication with ldap is to be done using ntlm_auth , So basically I want to know what ntlm_auth has returned ? it actually returns "*Reading winbind reply failed! (0xc0000001) *" when ldap is not reachable (net join has failed winbindd hasn't started) ldap is reachable but userid/password incorrect *Logon failure (0xc000006d) * * * For both cases Exec is return reject=1 as module return code, radius should only do local authentication ldap is not-reachable and not when ldap reject , but because exec output is always reject I cant distinguish the real cause of failure. Only way I can know what actually *ntlm_auth returns* ? if I know that I can take decision in radiusd.conf.

2 4

Re: HuntGroup check in radgroupcheck
by Lorenzo Milesi 26 Feb '13

26 Feb '13

> Post the debug output, as suggested in the FAQ, "man" page, web > pages, and daily on this list. I posted the freeradius -X output into the linked file... Aren't you referring to that? > > > Given the following properties: > > radcheck: > > F000001 MD5-Password := somemd5hash > > radusergroup > > F000001 HuntGroup01 > > radgroupcheck > > F000001 Huntgroup-Name =~ nas04|nas05 > > > > the user is always authenticated, even if the connection comes from > > a nas which is not nas04 or nas05. > > I think you're confused about huntgroups. NASes are placed into > huntgroups via the "huntgroups" file. Not SQL. When you check group > membership, you check for the huntgroup name, not the NAS name. According to [1] huntgroups can be checked via SQL as well... >From the debug output i posted here [2] you can see the huntgroup is correctly identified from SQL... [1] http://wiki.freeradius.org/guide/SQL_Huntgroup_HOWTO [2] https://dl.dropbox.com/u/706934/check01.gz > You're using Huntgroup-Name to check the *nas* name. It won't > work. I omitted to say that in my radhuntgroup table I defined HG with the same names as nases in the nas table. Can this be a problem? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 3

eap-fast on freeradius 2
by John 26 Feb '13

26 Feb '13

Hi, I found freeRADIUS support eap-fast. Can I use eap-fast in eap2, meanwhile use other eap types in eap? Does EAP fragmentation issue fixed in eap2? Best, -John

2 1

Re: Problem with quoting (Version 2.2.0)
by Alan Buxey 25 Feb '13

25 Feb '13

....or use a local symlink that doesn't have spaces in it ;) alan

3 2

277 realms to maintain
by Bertalan Voros 25 Feb '13

25 Feb '13

Hello All, In order to be able to use the home server pools and fail-over I had to create a list of 277 realms. There are now 277 entires similar to this: realm domain.com { auth_pool = my_auth_failover nostrip } Could I use an $INCLUDE statement here to maintain the list of realms in a separate file? That way it would be easier to automate the creation of the realms list. Is there a better way of doing this? Thank you, Bertalan

3 2

Problem with quoting (Version 2.2.0)
by Sven Anders 25 Feb '13

25 Feb '13

Hello! We have the following configuration (running FreeRadius version 2.2.0): eap { verify { tmpdir = /tmp/radiusd client = "/usr/sbin/radius-cert-verifier '${..CA_path}' %{TLS-Client-Cert-Filename}" } } Our problem is, that the script /usr/sbin/radius-cert-verifier gets (correctly) two parameters but the first parameter WITH the single quotes. We need the quotes here, because ${..CA_path} can contain spaces! If we remove the single quotes (and we tested double quotes too) and we have a path with spaces in it, the call fails, because now we get 3 parameters. What should we do? Is this a bug in FreeRadius itself? Regards Sven Anders -- Sven Anders <anders(a)anduras.de> () UTF-8 Ribbon Campaign /\ Support plain text e-mail ANDURAS intranet security AG Messestrasse 3 - 94036 Passau - Germany Web: www.anduras.de - Tel: +49 (0)851-4 90 50-0 - Fax: +49 (0)851-4 90 50-55 Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

2 1

Re: Problem with quoting (Version 2.2.0)
by Alan Buxey 25 Feb '13

25 Feb '13

Escape quotes around the CA path? \" alan

2 1

RADIUS-Proxy before MAC Auth
by Oliver Warda 25 Feb '13

25 Feb '13

>Use the example I gave you... it works - many thanks for your support Oliver

1 0

Simple Proxy setup
by Randy 25 Feb '13

25 Feb '13

Hi, I am upgrading from an older server which uses version 1 quite happily. The setup is simple, upstream proxies talk to my FreeRadius which then talks to my Home server which is a really old DOS based product. I read other threads saying just to use realms, but I still get lost in the conf files. Getting over a major operation has left me feeling a bit foggy and I would really appreciate some assistance. Treat me like the village idiot, I don't mind, but I need this to be as simple as possible. Exactly what do I need in the clients, proxy and radiusd.conf files? Any help appreciated.

2 2

MAC-Auth + Freeradius + MySQL Database
by Russell Mike 24 Feb '13

24 Feb '13

Greetings Dear Alan D. & List Members, First of all, thank you very much for developing such application. I need help, i have functional Freeradius server with MySQL backend. i have been asked to add MAC address authentication support for the servers. i googled the topic and got many many mail archive results, i tried to read those for about a day before posting to the maling list. Most of them, administrators are discussing troubleshoot topics, but i was searching how to.. start implementation and the REQUIREMENTS. i also came across where guys are discussing EAP and MAC authentication. i could not conclude, if it is a better way of doing MAC authentication using EAP. Finally, i came across wiki documentation. almost everything is there and it is well explained as well, thanks. i have now understand how it works. But SQL part is not still a question. http://wiki.freeradius.org/guide/Mac-Auth#Mac-Auth-authorisation-by-SSID-SQL How to store MACs in MySQL database. Perhaps, i need to create additional table to store MAC, Honestly, i am not sure how to go about it. Is there any documentation that i may do NOT know of. and i can follow to finish the setup. Grate thanks for attending to this request and thanks for your support ever since ! additional Information: FR_v2.2 With Coova 1.3.0 Regards -- RM

3 8