- Freeradius-Users - lists.freeradius.org

Question at certificates
by Andreas Rudat 24 Nov '11

24 Nov '11

Hi, I'm a little bit confused, I configure radius with self signed cert, peap+mschap, so if I tried to connect with an android or apple device I get the question if I want to accept the server cert, thats ok, but with windows or linux I get the error that there is no cert, but it still works, why these clients don't download the cert? I can manually add them sure but why is that so different? Thanks

2 1

radzap: Nothing to send
by Angel L. Mateo 24 Nov '11

24 Nov '11

Hello, I have a script using radzap to zap clients. This script with freeradius 1.1.7 worked, but since I updated to 2.1.10 it didn't work. The command I run is: root@vulpes21:~/scripts/radius# radzap -P 9937 -u <user> -N 10.57.112.8 localhost <secret> radclient: Nothing to send. The output for this user in radwho -R is: User-Name = "<user>" Acct-Session-Id = "00002CC6" NAS-IP-Address = 10.57.112.8 NAS-Port = 9938 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 92 Calling-Station-Id = "9084.0d64.2d83" Any idea? One difference between my 1.1.7 config and the new one is that now I'm using virtual servers? Could it be the reason? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 6

OpenVPN + pam_auth_radius + Windows 2008 Radius Server
by Nate 23 Nov '11

23 Nov '11

I'm running the following, Centos 5.7 openVPN 2.2.1 pam_radius 1.3.17 I've installed the /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so into this directory /usr/share/openvpn/plugin/lib. Here are the contents of my pam_radius_auth file auth sufficient /lib/security/pam_radius_auth.so debug account sufficient /lib/security/pam_radius_auth.so I installed the pam_radius_auth.so module into /lib/security. Next I used the same configuration file for openvpn server, but added these lines to the bottom and changed it from "dev tun" to "dev tap" plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn client-cert-not-required username-as-common-name for the openvpn client, I added the line "auth-user-pass" Next, I set up the radius server to accept the ip address of the openvpn server. Finally, I tried connecting with the client and I keep getting this error message. Here's the output of the openvpn logs that I get: AUTH-PAM: BACKGROUND: user 'myuser' failed to authenticate: Permission denied Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1 Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 TLS Auth Error: Auth Username/Password verification failed for peer Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 [] Peer Connection Initiated with {MYRADIUS_IP}:61645 Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 PUSH: Received control message: 'PUSH_REQUEST' Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 Delayed exit in 5 seconds Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1) Tue Nov 22 14:26:24 2011 read UDPv4 [ECONNREFUSED]: Connection refused (code=111) Tue Nov 22 14:26:27 2011 {MYRADIUS_IP}:61645 SIGTERM[soft,delayed-exit] received, client-instance exiting On the windows radius client, I only get this in the tracing logs: [5624] 11-22 14:26:21:280: IAS extension host returned responseType=2, reasonCode=21 [5624] 11-22 14:26:21:280: No AUTHORIZATION extensions, continuing Any ideas on what I'm missing? (and yes, I have googled it!)

2 4

Fwd: freeradius logging
by sandmann＠uni-greifswald.de 23 Nov '11

23 Nov '11

Hi all, I am hoping that someone can help me. I need more informations in the logs because sometimes the radius service will be stopped. But i don't know why. Where i must configure this Loglevel to get more informations in this logs? best regards David Sandmann

2 1

Limit guest/anonymous users for 15 minutes
by CyAndrew 23 Nov '11

23 Nov '11

Hello, could someone give me a hints about how to reach a configuration when users with anonymous/guest account are able to access for limited time only and then blocked for some period of time? Example: 1. First user log in as guest/guest. 2. Access is granted for FIRST user and his device for let say 15 minutes only. 3. Second use log in as guest/guest. 4. Access is granted for SECOND user and his device for 15 minutes only. 5. Access for FIRST user expires. 6. Access for SECOND user expires. Is it possible to configurate such a behaviour with SQL user storage? Thank you very much for any hint or configuration example. CyAndrew -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-guest-anonymous-users-for-15-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

FR 2.1.12 stop alone
by BELLIERE Eric 22 Nov '11

22 Nov '11

Hello, I have installed the new version 2.1.12-1 (Fedora fc14 taken from http://koji.fedoraproject.org/koji/packageinfo?packageID=298 I can see that the process is stopped after a while without any information in log file. Are you aware of any bug like this? Ma config include LDAP auth and Perl script to add attribute to user. We have 2 other FR running perfectly in release 2.1.9 (these one only Proxying request and duplicate accouting) Thanks Eric Bellière <https://mysite.mobilebelgium.be/Person.aspx?guid=C9F0A81A-FE99-40F9-A83C-5B…> Operation & Integration Expert ITNO/ISO/ISIO/LSS Avenue Jean Mermoz 32 6041 Gosselies Tel: +32 (0)2 745 79 97 GSM: +32(0)495 55 13 43 please consider the environment - do you really need to print this email? *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

1 0

password encrypt
by Dale Grice 22 Nov '11

22 Nov '11

Hi all, I am hoping that someone can verify my understanding of one part of the Xauth process. I am using a Juniper SSG as a firewall and need to allow access from a vendor on the untrust zone to a server on a demil zone for admin purposes. My understanding is that freeradius uses the secret password in the clients.conf file to encrypt the user password sent to the Juniper in this case, which then sends to the untrust user for verification. Is this correct. I am trying to determine if the password is in the clear on the Internet or if I have to go through the trouble of setting up a VPN between the vendor and the server. Thanks, Dale -- Dale Grice Staff Engineer, Lab Architect; Motorola

2 1

LDAP Attributes
by Houston-III, Lester L 22 Nov '11

22 Nov '11

Is there a way to truncate the UID used by the LDAP module? My system is using an UID structured like an email I would like to use everything in front of the '@' as the UID. Is this possible? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

2 1

LDAP Filter
by Houston-III, Lester L 22 Nov '11

22 Nov '11

I have a LDAP server performing authentication on FR clients where EAP-TLS is being used as the mechanism, but the LDAP module is not using TLS. Is there a way to use the client certificate common-name as the UID in the LDAP authentication. I'm thinking that I just need to modify the filter statement, but I'm unsure how the statement should be structured? I hope I'm making sense? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

2 1

RE:please help me :Failed binding to authentication address 192.168.1.102 port 1812
by Harshavardhan Ch 22 Nov '11

22 Nov '11

Hello sir, while activating the free radius server with eap authentication via vmware virtual machine i got error like "Failed binding to authentication address 192.168.1.102 port 1812" and i attched the output file.

3 2