July 2013 - Freeradius-Users - lists.freeradius.org

Authenticate against one module, if fail attempt authentication against another
by Ben Parker 29 Jul '13

29 Jul '13

I currently have two auth types (NTLM_AUTH and PAM) in my default site configuration (using FreeRadius version 2.1.12) - although I would like to achieve the following: If the user authenticates against to radius server and fails NTLM_AUTH, the request will then be authenticated against PAM and if it still fails it will be rejected. Now I presume this could be done via the "users" file? I have read the documentation for the users file on the wiki without much luck.

2 1

Re: FreeRadius + MySql + Crypt-Password unable to authenticate
by Alan DeKok 29 Jul '13

29 Jul '13

Marcel Kraan wrote: > I'am marcel kraan from Holland and i have a problem with Crypt-passwords > in the mysql table. > FreeRadius is working really great with "Cleartext-Password" but it does > not authenticate with "Crypt-password" You can't use Crypt-Password and MS-CHAP. http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.

5 8

Error undefined symbol: get_vtable with FR 3.0
by Avesh Agarwal 27 Jul '13

27 Jul '13

Hello, While running FR3.0 and loading modules via eap_tnc, I get the following errors: 9 [0x7f355327d840] WARN TNCS.Coordinator null - Error while initializing libtool. ???J5: undefined symbol: get_vtable And it sometimes gives segfaults. I did not have this issue with FR2.2.0 with the same set of packages. This error I am getting on both fedora 19 and rhel. I am not sure what I am missing. I used the FR3.0 packages from http://koji.fedoraproject.org/koji/buildinfo?buildID=438289 . Thanks Avesh

4 9

What is the strongest encryption of password Jradius can support?
by Rama Krishna 26 Jul '13

26 Jul '13

Sample client that I wrote on Solaris using JRadius APIs is able to get authenticated from a FreeRadius server running on Linux. However, the password was passed as clear text? What is the strongest encryption supported in JRadius for password encrypting / hashing? Is there a document that I can refer to for settings required in FreeRadius server and APIs that can be used in JRadius? Thanks, Rama

1 0

Need examples for MSCHAPV2Authenticator
by Rama Krishna 26 Jul '13

26 Jul '13

Already sent this email to David Bird, author of MSCHAPV2Authenticator of JRadius client and waiting for the reply. Just sharing the same with mailing group so that I can receive response from at least one of folks if not David. Here are my 3 questions. 1. I am in the process of updating my existing JRadius client to use MSCHAPV2Authenticator. Is there a document or example that explains on how to send the hashed passwords between Radius client and server using this authenticator? 2. As per Wiki, it seems to be mandatory to mention CA issued certificates. Is there an example that uses certificates for mutual authentication? 3. Based on different authenticators available in JRadius, MSCHAPV2 seems to be the strongest authentication possible. Is that understanding fair? Thanks, Rama

2 1

TLS-Client-Cert-Expiration date format
by Franks Andy (RLZ) IT Systems Engineer 25 Jul '13

25 Jul '13

Hi All, Just wondering if anyone knew what the expiration date format was back from eap-tls transactions? I have a cert here that expires 23/07/2015 and FR gives back "150723132302Z". That's a Z on the end..? It's certainly not seconds since epoch or Jan 01 - 1601 which is seen in certain other operating systems. As part of fault finding I wanted to report back if the certificate has expired as I can't work out how to get the eap-tls failure message to a linelog. If I do an explicit check in post-auth-reject at least I can determine whether it's failed because the certificate that's expired. It would also be nice to have a list of people authenticating and report how many days left until the certificate they have expires, so we can take steps in the auto enrolment doesn't work. Thanks Andy

4 3

Realm attribute population
by stefan.paetow＠diamond.ac.uk 25 Jul '13

25 Jul '13

Hi, After FreeRADIUS 2.10, we had to replace the DEFAULT {} stanza with the below in proxy.conf to ensure that the Realm attribute was correctly populated: realm "~.+$" { authhost = "host to deal with other realms" : : } Is that still necessary for FR 3.0? I'm just updating some of our internal documentation here and wanted to make sure that I don't add extraneous stuff when it's not necessary. :-) Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 3

Login-Service Type
by Gab Quidilla 25 Jul '13

25 Jul '13

Good day, I just wanted to ask if Login-Service doesn't support SSH? I am only able to configure it for telnet. My setup involves switches authentication to the RADIUS server, and ssh is pretty important I guess.

2 1

msRADIUSFramedIPAddress AD attribute
by Júlíus Þór Bess Ríkharðsson 25 Jul '13

25 Jul '13

2 3

RE: TLS-Client-Cert-Expiration date format
by Franks Andy (RLZ) IT Systems Engineer 25 Jul '13

25 Jul '13

Thanks guys, that's great Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Michael Schwartzkopff Sent: 25 July 2013 09:38 To: FreeRadius users mailing list Subject: Re: TLS-Client-Cert-Expiration date format > Just wondering if anyone knew what the expiration date format was back > from eap-tls transactions? I have a cert here that expires 23/07/2015 > and FR gives back "150723132302Z". > That's a Z on the end..? <http://en.wikipedia.org/wiki/ISO_8601>. -- George D M Ross MSc PhD CEng MBCS CITP, University of Edinburgh, School of Informatics, 10 Crichton Street, Edinburgh, Scotland, EH8 9AB Mail: gdmr(a)inf.ed.ac.uk Voice: 0131 650 5147 Fax: 0131 650 6899 PGP: 1024D/AD758CC5 B91E D430 1E0D 5883 EF6A 426C B676 5C2B AD75 8CC5 The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Am Donnerstag, 25. Juli 2013, 09:32:46 schrieb Franks Andy IT Systems Engineer: > Hi All, > Just wondering if anyone knew what the expiration date format was back > from eap-tls transactions? I have a cert here that expires 23/07/2015 > and FR gives back "150723132302Z". > That's a Z on the end..? Zulu time. Equals GMT. > It's certainly not seconds since epoch or Jan 01 - 1601 which is seen in > certain other operating systems. YYMMDDhhmmss"Z" -- Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 0