- Freeradius-Users - lists.freeradius.org

Authentication with multiple AD
by Pavel Klochan 25 Jan '12

25 Jan '12

Hi. I need advise/help with my problem. I'm trying to authenticate with 2 LDAP-servers from freeradius, but without success. I have two AD with different domains (e.g. domain1 and domain2, and they are not linked). I'm trying to authenticate by UPN (username@domainX). I thought it would be possible to regexp User-Name in Authenticate section and substitute values of LDAP config, but it doesn't work. In sites-enables/default Authenticate section: if (User-Name =~ /domain1/i) { Server1 } elsif (User-Name =~ /domain2/i) { Server2 } in modules/ldap I have: ldap Server1 { server = "x.x.x.x" identity = "user" password = pass basedn = "DC=example1,DC=com" filter = "(userPrincipalName=%{User-Name})" ldap_connections_number = 5 timeout = 10 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes } ldap Server2 { server = "x.x.x.x" identity = "user" password = pass basedn = "DC=example2,DC=com" } filter = "(userPrincipalName=%{User-Name})" ldap_connections_number = 5 timeout = 10 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes # ldap_debug = 0xFFFF } If user@domain1 (on any other) belongs to group "mobile" in AD - I send Access-Accept. When I start FreeRadius in debug mode - I don't see any regexp information. With current config-file freeradius will use only ldap server2 to authenticate users. Is any way to te authenticate with multiple AD Thanks

2 1

DHCP testing, v2.1.x
by Fajar A. Nugraha 25 Jan '12

25 Jan '12

(changed subject to better match content) On Tue, Jan 24, 2012 at 10:00 PM, Fajar A. Nugraha <list(a)fajar.net> wrote: > 2012/1/24 Marinko Tarlać <mangia81(a)gmail.com>: >> I'm using CentOS so I'll try with the latest 2.1.x from git >> The problem which bothers me is that I need more than classic ip-mac >> pairing. Beside the IP address I need to return a few other parameters to >> cable modems/MTA. >> >> For example ISC DHCP config for regular modems is: >> >> host blaBlaBla { >> filename "confingFile.cm"; >> fixed-address 192.168.12.167; >> hardware ethernet 00:cc:ab:11:cc:22; >> } >> >> As you can see, I'm returning the IP address and the name for config file. >> >> Is this possible with FreeRadius DHCP ? > > Should be. The IP address assignment (whether static or dynamic) is > easy enough with a special instance of sqlipool like in the example. > If you only want static IP then you can even use only files without > db. > > As for the filename, dictionary.dhcp has DHCP-Boot-Filename attribute, Just tested pxe boot (with the help of virtualbox and linux containers), and it works as expected. Some notes though: (1) the option "filename" in ISC's dhcp should refer to pxe boot image, something like host clientname { filename "/tftpboot/tftpboot.img"; ... } If your system is x86, and the OS/kernel loaded is linux or can be booted with multiboot (e.g. solaris), then usually you can just use pxelinux in "filename" option. pxelinux can then load the correct config file for each host using a host-specific configuration file (based on the hosts' MAC or IP address), or it can load the default config file: http://www.syslinux.org/wiki/index.php/PXELINUX Are you sure you're actually using per-host filename option instead of a common one? (2) I tested by adding this block in FR's DHCP-Discover and DHCP-Request section: update reply { DHCP-Boot-File-Name = "/boot/pxelinux.0" } it works as expected. The attribute is sent to all hosts requesting DHCP address, but only hosts doing network boot will acttually use it. A cleaner approach would probably be checking if the client sends DHCP-Parameter-Request-List = DHCP-Boot-File-Name ... and only send the reply then. -- Fajar

1 0

Authenticating Laptop without a Certificate Installed
by McSparin, Joe 25 Jan '12

25 Jan '12

When I connect a mobile phone or a tablet to my wireless network it works fine even though they don't have a certificate installed. I am checking the MAC address and putting them into a public vlan if it is not found. However when I connect a windows laptop that does not have a certificate installed it doesn't allow it. It won't connect and radius says it has an unknown CA I am using PEAP which it is my understanding would allow you to connect with a user name and password and no certificate if you told it not to validate the certificate. It is important that people be able to connect even if they don't have a certificate and I just control it based on the mac address. Thanks, Joe -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

5 5

Re: Only "Out-of-tunnel"
by Sergio Belkin 25 Jan '12

25 Jan '12

2012/1/17 Sergio Belkin <sebelk(a)gmail.com> > > > > 2012/1/16 Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> >> >> Where's the log for when this happens? As MAC auth wouldn't go through EAP tunnel it would suggest that some entry in eg users file is coming into play... >> >> alan >> > > Alan, I have three logs, > > I have the following parameter on radiusd.conf: > > requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log > > > For example for today, I have > > /var/log/radius/radiusd-inner-tunnel-20120117.log (using ttls) > var/log/radius/radiusd-inner-tunnel-peap-20120117.log (using peap) > /var/log/radius/radiusd-DEFAULT-20120117.log > > The weird thing is that I've found one user that has entries *only* in /var/log/radius/radiusd-DEFAULT-20120117.log AFAIK is out-of-tunnel > > For example: > > Mon Jan 16 11:22:57 2012 : Auth: Login OK: [wterra] (from client AP-PVIII-VI port 2 cli 00-11-00-E4-67-EE) > > But neither wterra nor 00-11-00-E4-67-EE have entries in /var/log/radius/radiusd-inner-tunnel-* log files > > Please could you explain me? > > I don't use mac based authentication... > > Thanks in advance! Note: I've copied the entry from yesterday log because of that you see "Mon Jan 16" but the question it's the same: Why is there an entry on DEFAULT logs but not in "inner-tunnel" logs Thanks again -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

1 0

Re: Only "Out-of-tunnel"
by Sergio Belkin 25 Jan '12

25 Jan '12

2012/1/16 Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > > Where's the log for when this happens? As MAC auth wouldn't go through EAP tunnel it would suggest that some entry in eg users file is coming into play... > > alan > Alan, I have three logs, I have the following parameter on radiusd.conf: requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log For example for today, I have /var/log/radius/radiusd-inner-tunnel-20120117.log (using ttls) var/log/radius/radiusd-inner-tunnel-peap-20120117.log (using peap) /var/log/radius/radiusd-DEFAULT-20120117.log The weird thing is that I've found one user that has entries *only* in /var/log/radius/radiusd-DEFAULT-20120117.log AFAIK is out-of-tunnel For example: Mon Jan 16 11:22:57 2012 : Auth: Login OK: [wterra] (from client AP-PVIII-VI port 2 cli 00-11-00-E4-67-EE) But neither wterra nor 00-11-00-E4-67-EE have entries in /var/log/radius/radiusd-inner-tunnel-* log files Please could you explain me? I don't use mac based authentication... Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

1 0

Juniper MX auth issue
by Paul Stewart 24 Jan '12

24 Jan '12

Hi there.. We have an existing FreeRadius setup that works perfectly for our Cisco BRAS devices etc. I am trying to get some Juniper MX working properly. If I add a user to our system it works fine (dynamic IP assignment etc). The minute we add a static IP address, things go weird with the MX platform. The user authenticates and obtains the correct IP address but no traffic will pass. JTAC says this is an attributes related issue and we are back and forth. I was hoping someone on the list here could correct by users entry below based on their experiences? I'm running a fairly bare set of attributes hoping to figure out why this keeps breaking on the Juniper side: pstewart Auth-Type = System Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = xxx.xxx.111.73 Our typical users entry that works fine in the Cisco world looks like this: pso Auth-Type = System Service-Type = Framed-User, Framed-IP-Address = xx.xxx.58.115, Framed-MTU = 1500, Idle-Timeout = 11116000 So far I have messed around with many variables and not getting it to work properly.. At the same time JTAC has been quite helpful but we're still not operational yet. Thanks, Paul

2 2

No authenticate method (Auth-Type) found for the request
by Harish Mandowara 24 Jan '12

24 Jan '12

I am using network manager with radius server. I put this config in this files eap.conf default_eap_type = peap create new certificate as per http://deployingradius.com and network manager side i put ca.der but its giving Ready to process requests. rad_recv: Access-Request packet from host 192.168.21.32 port 32773, id=1, length=127 User-Name = "testing" NAS-IP-Address = 192.168.21.32 Called-Station-Id = "00ffff000001" Calling-Station-Id = "1caff76ce38c" NAS-Identifier = "00ffff000001" NAS-Port = 3 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000c0174657374696e67 Message-Authenticator = 0xbc498e29bfb9f44c5276dcb7d57b082e WARNING: Empty authorize section. Using default return values. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 1 to 192.168.21.32 port 32773 Waking up in 4.9 seconds. Cleaning up request 5 ID 1 with timestamp +95 Ready to process requests. thanks in advance -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 7

Next release of the server?
by Alan DeKok 24 Jan '12

24 Jan '12

It's been 4 months since the last release of the server. Any objections to a new release? Are people using the v2.1.x branch in "git"? My idea would be to release this version as 2.2.0. It's stable, and doing 2.2.0 would probably be better than 2.1.13. :) I'd also like to release 3.0 in the next few months. I know I've been saying that for a while. The delays have been due to some intended design changes which haven't yet been implemented. As background, the RADIUS protocol encoder/decoder has changed to its final form in 3.0. It does more with less code, and is easier to understand. I don't think it will change again. Similarly, the state machine for handling packets has been updated in 3.0. It's a lot better than 1.x or 2.x, but it's not quite done yet. The hope is that I can do some small changes for 3.0 which will finalize the internal state machine. That will make it easier to separate the RADIUS, DHCP, and VMPS functionality in the server. It will also mean that certain new features will be easier to add. :) Alan DeKok.

9 26

Freeradius + Mysql + PEAP Authentication
by RAZAFIMBELO Faliharinohatra Rindra 24 Jan '12

24 Jan '12

Hi all, I have configured a freeradius + mysql server and i would like to use the PEAP authentication. I have tried the EAP-TTLS and it worked fine, but when i have tested the PEAP authentication all my requests were rejected by freeradius. I saw that both of PEAP and EAP-TTLS used TLS and i thought that there was no need to make big configuration to migrate from EAP-TTLS to PEAP. Can someone help me, please? I use freeradius 2.1.10 and here is my eap.conf configuration: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = madaoil452 private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} cipher_list = "DEFAULT" cache { enable = no max_entries = 255 } verify { } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } thx --

2 3

Using sql and userfile together
by Krzysztof Grobelak 24 Jan '12

24 Jan '12

Hello all, I just wanted to ask how could I make FR to use either users file or sql to send attributes based on the NAS ip address. I suspect that I would need to use ulang for that. Something like: if(NAS-IP-Address == NAS A IP) { use sql } else { use users file } I'm just wondering what is the proper syntax of making FR use sql or user file. Kind regards, Krzysztof

2 2