- Freeradius-Users - lists.freeradius.org

Empty user attributes in proxied request
by Attou eric 06 Jan '12

06 Jan '12

Hi Every body! I'm setting up an Eduroam infrastructure authenticating through a LDAP directory. I conveniently configure realms for local request and remote request as well. But, i'm dealing with empty user attribute issue while attempting to authenticate with the eduroam user. It seems that although the request is proxied, my server tries to locally check the authorized attributes of the user against my local ldap server. And since no such user exists ldap returns : object not found Thu Jan 5 20:19:26 2012 : Debug: rlm_ldap: object not found Thu Jan 5 20:19:26 2012 : Debug: search failed Thu Jan 5 20:19:26 2012 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Jan 5 20:19:26 2012 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Thu Jan 5 20:19:26 2012 : Debug: ++[ldap] returns notfound Next, my server proxies an other request with empty attributes certainly resulting from the previous object found result : Sending Access-Request of id 144 to 193.190.198.59 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Thu Jan 5 20:19:47 2012 : Debug: No response to status check 3 from home server 193.190.198.59 port 1812 What may have been misconfigured ? Note : The home server is alive since i test it through radtest command Please see here in attachment the log of user authentication attempt Thanks for your help. Eric ATTOU

3 2

What is the problem??
by Erick Rojas Bastidas 06 Jan '12

06 Jan '12

I'm doing tests using authentication eap-tls and freeradius response with Acces-Accept, but internet connectivity is practically nil.. Which can be the problem? Previously had a warning "compatibility certificate".. And I'm doing the tests from the same machine you configure freeradius.. Help please!! Thanks.. Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

Re: Empty user attributes in proxied request
by Rui Ribeiro 05 Jan '12

05 Jan '12

> > Hi, > >> to authenticate with the eduroam user. It seems that although the >> request is proxied, my server tries to locally check the authorized >> attributes of the user against my local ldap server. And since no >> such user exists ldap returns : object not found > > use unlang to put a protection wrapper around your ldap eg > > if (%{realm} == /yourrealm.com/){ > ldap > } I solved it in the users file: DEFAULT Realm == "yourrealm.com", Ldap-Group == "your_ldap_group" Service-Type = "Framed-User", Reply-Message = "Eduroam instuition", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "xxxx"

1 0

SQL Statement in users file
by McSparin, Joe 05 Jan '12

05 Jan '12

Does this seem like a doable scenario in the users file it doesn't return anything but I'm not sure if it is query issue or if those values are not available in the users file. DEFAULT Auth-Type = "ntlm_auth" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-id = "%{sql:SELECT 'vlans.assigned_vlan' FROM 'vlans' WHERE 'vlans.device_mac' = '%{Calling-Station-Id}'}" Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 5

freeradius+openvpn disconnect user from radius
by Azfar Hashmi 05 Jan '12

05 Jan '12

Anyone confirm me that openvpn support session-timout/acct-session-timeout, i want radius to tell my NAS to disconnect users if they reached their expiration. Currently its not working.

3 11

Re: Freeradius with EAP-SIM
by Alan Buxey 05 Jan '12

05 Jan '12

Ready to process requests. ...and that's it. Where's the incoming query to be dealt with? alan -- Message may be brief as it has been sent from my mobile

3 3

Using FreeRadius to override VLAN Assignment
by McSparin, Joe 04 Jan '12

04 Jan '12

I have put the following into my users files DEFAULT Auth-Type = "ntlm_auth" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-id = "1001" I have told my access point to Allow RADIUS Override on the VLAN Assignment however the VLAN is not getting overridden. Does the Above entry into my users file not actually send back a vlan assignment and if not is there somewhere else this is supposed to be done? Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 7

Accounting not working
by John Corps 04 Jan '12

04 Jan '12

Hello All, I have 4 servers setup exactly the same at 4 different locations. Each server is using the exact same configs and is working perfectly well doing what I want it to do. The only issue I have is at the 1 location, I am not getting any accounting requests and therefor nothing is being updated in the radacct table. Starting radiusd in debug mode -X shows that its listening for accounting requests the exact same as the 3 other locations, just no accounting requests are coming through. Is there any way to do a test to see if its even listening and working at all? I have been racking my brain over this the last few days, checking switch and router configs etc but that is all the same as the other 3 locations as well, everything is the same at all 4 locations, just this one location isn't doing the accounting. Any help would be great :) Thanks.

3 5

RE: Radperf message error
by Serge Toussaint 04 Jan '12

04 Jan '12

Hi, For a big test for 9 000 requests with radperf, I have got the message : Radperf: received response to request we did not send. (id=125 socket 19) ( 500 lines) ???? Serge -----Message d'origine----- De : freeradius-users-bounces+stoussaint=netprest.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+stoussaint=netprest.com@lists.freeradius.or g] De la part de Daniel Finger Envoyé : mercredi 4 janvier 2012 16:11 À : FreeRadius users mailing list Objet : Re: Not sending all trusted CA Certificates in EAP-TLS Server Hello Hi! As far as I can see the Server does not send the full certificates, but only announces the certificates the server knows. I did not read the RFC yet, but I assume that this only informs the client which certificates can be requested to verify the server certificate chain. Am 04.01.2012 15:09, schrieb Alan DeKok: >> Is it possible to change the behaviour that only the certs in the >> certificate_file are used? > > Use CA_path instead of CA_file. That might help. It does indeed help. Thanks! -- Regards Daniel Finger

1 0

Not sending all trusted CA Certificates in EAP-TLS Server Hello
by Daniel Finger 04 Jan '12

04 Jan '12

Hi! We are using 802.1X EAP TTLS to Authenticate Phones in our network. It is working, but after seeing a tcpdump, the Radius Server is sending all known CA Certificates to the Client during EAP TLS Negotiation. Our Config looks like this: private_key_file = ${certdir}/radius_server.key Containing the private Key of the Radius Server certificate_file = ${certdir}/radius_server.crt This contains the radius certificate and the corresponding self-signed CA certificate. CA_file = ${cadir}/trusted_ca.pem Contains different sub-CA certifikates and the self-signed root certificate of the sub-CA used to issue client certs (!= server cert) During EAP-TLS negotiation the Radius Server sends all known certificates (the ones in the certificate_file and the one in the CA_file) to the client. Is it possible to change the behaviour that only the certs in the certificate_file are used? This should be enough for the clients to verify the server certificate. -- Regards Daniel Finger

2 2