- Freeradius-Users - lists.freeradius.org

RE: Help: FreeRadius Users with multiple passwords
by Duong Manh Truong 21 Nov '11

21 Nov '11

What i did is that: With each user (Uid) , i created multiple "userpassword attribute" values, then, while authenticating, OpenLDAP will compare the input password with all the created password values --one by one If the input matched any one of the created pass => Access - Accept I also know that my scenario is somehow strange and not good, but it is really what i need! My policy is : with 1 user, just sends one pass in the "password pool" for his authentication becoming successfully (Access - Accept) Regards! Vào 22:31 Ngày 18 tháng 11 năm 2011, John Dennis <jdennis(a)redhat.com> đã viết: On 11/18/2011 06:20 AM, Duong Manh Truong wrote: > >> Hi, >> Thanks for your reply :) >> >> I have a better news that: By using OpenLDAP for FR Authen & Authorization >> => I can configure multiple passwords for each user (Uid) >> and use 1 of those passwords for successfully Authentication! >> >> Although it is done manually now, but somehow it solves the matter ! >> >> If anyone have experienced this, please give some advices ! >> Example: How to do it automatically or >> How to create a pool of passwords then use the pool for multiple users :) >> > > Not exactly sure what you did, ldap does have the concept of multi-valued > attributes but that won't be of any use to you even if you set multiple > values for one attribute type (e.g. name). Why? The radius server can only > use one password for a user, not exactly sure what it will do if it get > more than one back from ldap, I assume it just picks the first one (where > first is probably non-deterministic). > > The bottom line is there must be a one-to-one mapping between users and > passwords. User's should have just one password, this is good practice. If > you want to write custom code you can bypass the limitation but really > really don't want to do that. > > Accept it as a given, 1 user, 1 password > > Also please be courteous and trim your emails of non-relevant text. > > -- > John Dennis <jdennis(a)redhat.com> > > Looking to carve out IT costs? > www.redhat.com/carveoutcosts/ >

2 1

Hiding "secret" used in for PAM authentication
by Gregory Machin 20 Nov '11

20 Nov '11

Hi. We are using using PAM to authenticate users against Freeradius, an that is working well. The problem is that the users are 3rd party developers and some need root access. The issue we have is that the radius secret is stored in clear text file. How can this be hidden so that is can be misused ? Is there a document on hardening Freeradius ? Thanks G

3 3

eap-ttls with ldap
by Angelica Delgado 20 Nov '11

20 Nov '11

We want to configure eap-ttls with freeradius. Currently, we have freeradius with ldap authentication. The ldap that we are using is Active Directory. We want to know if there is good site that we can follow to implement eap ttls with ldap authentication. Thanks. Angela

4 14

2.1.10 crashes on debian/arm
by Wegener, Norbert 20 Nov '11

20 Nov '11

radius crashes sometimes on arm architecture. Version is: radiusd: FreeRADIUS Version 2.1.10, for host armv5tel-unknown-linux-gnu, built on Nov 20 2011 at 17:41:56 >From gdb output: Maybe this is the reason?(around line 550) #1 0x00034428 in radius_do_cmp (request=0x14b9b98, modreturn=<value optimized out>, depth=<value optimized out>, ptr=<value optimized out>, evaluate_it=Cannot access memory at address 0x630 ) at evaluate.c:528 The complete gdb output is a bit longer and can be found at: http://www.wegener-net.de/freeradius/radius-crash-gdb.txt With best regards, ________________________________ Norbert Wegener Atos IT Solutions and Services AIS MS NC PSU SDC Bruchstraße 5 45883 Gelsenkirchen, Germany Tel.: +49 (209) 94565716 Fax: +49 (201) 8165581284 mailto:norbert.wegener@atos.net Atos IT Solutions and Services GmbH; Geschäftsführung: Winfried Holz, Christian Oecking, Rainer-Christian Koppitz; Vorsitzender des Aufsichtsrats: Charles Dehelly; Sitz der Gesellschaft: München, Deutschland; Registergericht: München, HRB 184933.

4 5

Radius Billing System
by Dom 20 Nov '11

20 Nov '11

I was wondering if there was a open source billing system available to manage our DSL customers and automatically populate radius users file that anyone could suggest to me. Thanks, Domenic

4 3

getting sometimes TLS error
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, I get the error from time to time, I use one self signed cert for alle clients and some times I get this error from one ubuntu client, do you have any idea? so self+signed cert + mschapv2 TLS Alert read:fatal:bad certificate Sat Nov 19 18:52:30 2011 : Error: TLS_accept:failed in SSLv3 read client certificate A Sat Nov 19 18:52:30 2011 : Error: rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Sat Nov 19 18:52:30 2011 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Sat Nov 19 18:52:30 2011 : Debug: TLS receive handshake failed during operation its not the password problem, how I said, the same cert works fine on two different machines, windows + linux the other got archlinux and xp running Thanks

1 2

temporary url-redirect
by Student University 19 Nov '11

19 Nov '11

Hi , anyone have configure freeradius attribute for temporary url-redirect every 1 hour , regards Lily ,,,

2 1

Radius + SambaPDC + "offline" login
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, perhaps it is the wrong mailing list but I try it :) my samba pdc is running in a different subnet than my radius clients. So, samba ist running x.x.15.x and my Wlan+Radius users using x.x.16.x I use wins instead of dns. I joined with my client the domain successfully, but if I try to login I get the msg "domain not reachable", sure, because I'm not online at that moment, but is there anyway to be that? Thanks.

2 1

Hiding "secret" used in for PAM authentication
by Gregory Machin 19 Nov '11

19 Nov '11

Hi. We are using using PAM to authenticate users against Freeradius, an that is working well. The problem is that the users are 3rd party developers and some need root access. The issue we have is that the radius secret is stored in clear text file. How can this be hidden so that is can be misused ? Is there a document on hardening Freeradius ? Thanks G

2 1

Deleting user accounts in windows xp
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, hope anyone knows that, if I connect successfully with an xp client, I have never again to put in my login data, so windows has to save my login stuff anywhere but where? I would like to delete my login data. Thanks Andreas

2 2