- Freeradius-Users - lists.freeradius.org

Ignoring failed module in post-auth
by Michal Bruncko 10 Jan '12

10 Jan '12

Hello list I am using freeradius server as the authenicator for our WPA2 wifi network. We are using loggining of result for every authentication request from clients to sql database through sql module in post auth section. but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section. and my question is: how is possible to make change in radiusd configuration, that in case of mysql server unreachability the user reqested access will be authenicated even of failing sql module. sql logging is the only used module in post-auth section. thanks for help -- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic

4 6

rlm_eap_tls: authenticate instead of authorize?
by Graham Leggett 10 Jan '12

10 Jan '12

Hi all, I notice that when rlm_eap_tls checks the user's certificate, it does so in the authenticate section instead of the authorize section, and in the process none of the fields in the certificate are available to other modules until post_auth. Would there be any ill effects if the rlm_eap_tls certificate parsing was moved from the authenticate section to the authorize section? Regards, Graham --

2 2

Connecting Windows XP wirelessly with EAP TKIP
by McSparin, Joe 09 Jan '12

09 Jan '12

Is there anything special that needs to be done on windows XP to connect wirelessly to an access point using FreeRadius. I was connecting fine with Windows 7 but now tryng to connect windows XP there is nothing even triggering the Radius server I am running in radiusd -X and when I connect the xp box nothing even happens. Anyone ever seen this before? Thanks, Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 4

WPA Enterprise Certificate renewal for FreeRadius
by Mike Diggins 09 Jan '12

09 Jan '12

I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients already have the Thawte Root certificate installed. I renewed the new certificate just recently and discovered that Thawte is no longer issuing certificates under the old root so my clients will likely be asked to trust the new certificate when I install it. All my documentation changes as well but that's another story. My question is, what is the value of adding the roots/intermediates to the certificate file i.e certificate_file = ${certdir}/certificate.crt? Does it really allow a client without the Root already installed to verify this certificate? -Mike

4 6

Samba + Radius
by Szilard Gyorgy 09 Jan '12

09 Jan '12

Hi I have one group of samba servers what I try to configure to auth. the windows 7 workstations using one central radius server. I found documentation about how to make other way around - like radius to use samba or krb database, but I don't want that – (In the next stage this radius server will be used by other network equipment too - so I don’t want my Cisco router to use samba database for auth :) ) Is any way how can I configure my samba servers to use one radius auth server ? Thank You, Szilard Gyorgy

2 1

Modify request before proxying
by Lorenzo 09 Jan '12

09 Jan '12

Dear Freeradius experts, Is there any way to apply ttls to non-tunneled requests before proxying them? Thanks. Lorenzo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Modify-request-before-proxying-tp51… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

no calling-station-id received
by S Adrian 09 Jan '12

09 Jan '12

Hey everybody .... I don't seem to get a calling-station-id packet when a username is trying to connect. I'm running gentoo and have the following package versions: net-dialup/ppp-2.4.5-r1 USE="activefilter atm dhcp eap-tls pam radius -gtk -ipv6" 0 kB net-dialup/rp-pppoe-3.10-r1 USE="-X" 0 kB net-dialup/freeradius-2.1.7 USE="mysql pam ssl threads udpfromto -bindist -debug -edirectory (-firebird) -frascend -frxp -kerberos -ldap -postgres -snmp" 0 kB Another problem I seem to have is people using the same pool_key in my radippool table :/ Where should I start digging ? Thanks in advance.

4 8

Support for check_cert_subjectAltName?
by Graham Leggett 09 Jan '12

09 Jan '12

Hi all, When using client certificates in EAP-TLS, the check_cert_cn option exists that allows you to check that the username matches the CN. Is there a corresponding option somewhere that will allow you to verify the User-Name against the subjectAltName instead? Regards, Graham --

3 5

Proxying to a virtual server through unlang?
by Arnaud Loonstra 09 Jan '12

09 Jan '12

Hi All, I'm trying to get into the unlang world since it seems really powerful but I can't get my hands around a simple virtual server switching scenario. I basically want to switch to a virtual server based on some attributes, Service-Type for instance. This is because on some network hardware I can't add a radius server for every type of authentication. So everything (802.1x, mac-auth, prompt auth goes to the same server) I found a thread suggesting to do the following: (http://freeradius.1045715.n5.nabble.com/virtual-servers-tt2769141.html) authorize { switch "Service-Type" { #MAC authentication case 'Call-Check' { update control { server[mac-auth] } } #NAS console authentication case 'NAS-Prompt-User' { update control { server[mac-auth] } } } } This works as the debug logs shows: # Executing section authorize from file /etc/freeradius/sites-enabled/nas-auth However it only executes the authorize section of the nas-auth virtual server. I could create realms for the virtual servers and proxy to them by using Proxy-To-Realm := "mac-auth" instead of the server[] directive. But I kind of liked the minimal unlang approach. Is there any good way of accomplishing this purely with unlang or is it still best to use the proxying approach using realms? Here's a log of the process. As you can see it only issues the authorize section of the nas-auth virtual server as apposed to going through the full server when using Proxy-To-Realm. rad_recv: Access-Request packet from host 10.6.254.62 port 1025, id=152, length=95 User-Name = "testusr" User-Password = "testpwd" NAS-IP-Address = 10.6.254.62 NAS-Identifier = "ST-AN07258-412" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Message-Authenticator = 0x63ee5e1b0f7b81e883780f9e57c2941c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering switch Service-Type {...} +++- entering case NAS-Prompt-User {...} server nas-auth { # nested call # Executing section authorize from file /etc/freeradius/sites-enabled/nas-auth +- entering group authorize {...} ++? if (Service-Type == 'NAS-Prompt-User') ? Evaluating (Service-Type == 'NAS-Prompt-User') -> TRUE ++? if (Service-Type == 'NAS-Prompt-User') -> TRUE ++- entering if (Service-Type == 'NAS-Prompt-User') {...} [edir-ldap] performing user authorization for testusr [edir-ldap] expand: %{Stripped-User-Name} -> [edir-ldap] ... expanding second conditional [edir-ldap] expand: %{User-Name} -> testusr [edir-ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=testusr) [edir-ldap] expand: ou=users,o=radius -> ou=users,o=radius [edir-ldap] ldap_get_conn: Checking Id: 0 [edir-ldap] ldap_get_conn: Got Id: 0 [edir-ldap] performing search in ou=users,o=radius, with filter (cn=testusr) [edir-ldap] checking if remote access for testusr is allowed by cn [edir-ldap] Added the eDirectory password testpwd in check items as Cleartext-Password [edir-ldap] No default NMAS login sequence [edir-ldap] looking for check items in directory... [edir-ldap] looking for reply items in directory... [edir-ldap] user testusr authorized to use remote access [edir-ldap] ldap_release_conn: Release Id: 0 +++[edir-ldap] returns ok ++- if (Service-Type == 'NAS-Prompt-User') returns ok ++ ... skipping else for request 4: Preceding "if" was taken } # server nas-auth with nested call ++++[server[nas-auth]] returns ok +++- case NAS-Prompt-User returns ok ++- switch Service-Type returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. Login OK: [testusr] (from client primary-network port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) expand: %{request:Calling-Station-Id} -> ? Evaluating ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i) -> FALSE ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) -> FALSE ++[callingstationid2vlanid] returns notfound ++? if (ok) ? Evaluating (ok) -> FALSE ++? if (ok) -> FALSE ++[reply] returns notfound Sending Access-Accept of id 152 to 10.6.254.62 port 1025 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "132" Rg, Arnaud-- Stichting z25.org Concordiastraat 67A 3551 EM Utrecht The Netherlands +31-(0)6-41861063

2 2

Dear Expert(Need assistance with Freeradius + openvpn consulting)
by sekchel lee 09 Jan '12

09 Jan '12

The expenses will be paid by US dollar. Current states and My Requirements Computer 1 (Freeradius server action) mysql db CentOS-6.0-x86_64 ssh port ready nas1 (openvpn server action ) ssh port ready CentOS-6.0-x86_64 openvpn user (mysql/ userid/password ==> Authentication ,Authorization,Accounting) action But UserDrop(disconnect) Function is no action My Requirements radius user drop Function (For openvpn user) F1) Max-All-Session(Time Limit (secs)) F2) Expiration (User Expiration Date ) I want radius user drop function (for openvpn user) F1) only F2) only F1) + F2) both ==> F1(O) F2(X) --> drop F1(X) F2(O) --> drop

3 2