- Freeradius-Users - lists.freeradius.org

OpenVPN + pam_auth_radius + Windows 2008 Radius Server
by Nate 23 Nov '11

23 Nov '11

I'm running the following, Centos 5.7 openVPN 2.2.1 pam_radius 1.3.17 I've installed the /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so into this directory /usr/share/openvpn/plugin/lib. Here are the contents of my pam_radius_auth file auth sufficient /lib/security/pam_radius_auth.so debug account sufficient /lib/security/pam_radius_auth.so I installed the pam_radius_auth.so module into /lib/security. Next I used the same configuration file for openvpn server, but added these lines to the bottom and changed it from "dev tun" to "dev tap" plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn client-cert-not-required username-as-common-name for the openvpn client, I added the line "auth-user-pass" Next, I set up the radius server to accept the ip address of the openvpn server. Finally, I tried connecting with the client and I keep getting this error message. Here's the output of the openvpn logs that I get: AUTH-PAM: BACKGROUND: user 'myuser' failed to authenticate: Permission denied Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1 Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 TLS Auth Error: Auth Username/Password verification failed for peer Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA Tue Nov 22 14:26:21 2011 {MYRADIUS_IP}:61645 [] Peer Connection Initiated with {MYRADIUS_IP}:61645 Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 PUSH: Received control message: 'PUSH_REQUEST' Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 Delayed exit in 5 seconds Tue Nov 22 14:26:22 2011 {MYRADIUS_IP}:61645 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1) Tue Nov 22 14:26:24 2011 read UDPv4 [ECONNREFUSED]: Connection refused (code=111) Tue Nov 22 14:26:27 2011 {MYRADIUS_IP}:61645 SIGTERM[soft,delayed-exit] received, client-instance exiting On the windows radius client, I only get this in the tracing logs: [5624] 11-22 14:26:21:280: IAS extension host returned responseType=2, reasonCode=21 [5624] 11-22 14:26:21:280: No AUTHORIZATION extensions, continuing Any ideas on what I'm missing? (and yes, I have googled it!)

2 4

Fwd: freeradius logging
by sandmann＠uni-greifswald.de 23 Nov '11

23 Nov '11

Hi all, I am hoping that someone can help me. I need more informations in the logs because sometimes the radius service will be stopped. But i don't know why. Where i must configure this Loglevel to get more informations in this logs? best regards David Sandmann

2 1

Limit guest/anonymous users for 15 minutes
by CyAndrew 23 Nov '11

23 Nov '11

Hello, could someone give me a hints about how to reach a configuration when users with anonymous/guest account are able to access for limited time only and then blocked for some period of time? Example: 1. First user log in as guest/guest. 2. Access is granted for FIRST user and his device for let say 15 minutes only. 3. Second use log in as guest/guest. 4. Access is granted for SECOND user and his device for 15 minutes only. 5. Access for FIRST user expires. 6. Access for SECOND user expires. Is it possible to configurate such a behaviour with SQL user storage? Thank you very much for any hint or configuration example. CyAndrew -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-guest-anonymous-users-for-15-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

FR 2.1.12 stop alone
by BELLIERE Eric 22 Nov '11

22 Nov '11

Hello, I have installed the new version 2.1.12-1 (Fedora fc14 taken from http://koji.fedoraproject.org/koji/packageinfo?packageID=298 I can see that the process is stopped after a while without any information in log file. Are you aware of any bug like this? Ma config include LDAP auth and Perl script to add attribute to user. We have 2 other FR running perfectly in release 2.1.9 (these one only Proxying request and duplicate accouting) Thanks Eric Bellière <https://mysite.mobilebelgium.be/Person.aspx?guid=C9F0A81A-FE99-40F9-A83C-5B…> Operation & Integration Expert ITNO/ISO/ISIO/LSS Avenue Jean Mermoz 32 6041 Gosselies Tel: +32 (0)2 745 79 97 GSM: +32(0)495 55 13 43 please consider the environment - do you really need to print this email? *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

1 0

password encrypt
by Dale Grice 22 Nov '11

22 Nov '11

Hi all, I am hoping that someone can verify my understanding of one part of the Xauth process. I am using a Juniper SSG as a firewall and need to allow access from a vendor on the untrust zone to a server on a demil zone for admin purposes. My understanding is that freeradius uses the secret password in the clients.conf file to encrypt the user password sent to the Juniper in this case, which then sends to the untrust user for verification. Is this correct. I am trying to determine if the password is in the clear on the Internet or if I have to go through the trouble of setting up a VPN between the vendor and the server. Thanks, Dale -- Dale Grice Staff Engineer, Lab Architect; Motorola

2 1

LDAP Attributes
by Houston-III, Lester L 22 Nov '11

22 Nov '11

Is there a way to truncate the UID used by the LDAP module? My system is using an UID structured like an email I would like to use everything in front of the '@' as the UID. Is this possible? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

2 1

LDAP Filter
by Houston-III, Lester L 22 Nov '11

22 Nov '11

I have a LDAP server performing authentication on FR clients where EAP-TLS is being used as the mechanism, but the LDAP module is not using TLS. Is there a way to use the client certificate common-name as the UID in the LDAP authentication. I'm thinking that I just need to modify the filter statement, but I'm unsure how the statement should be structured? I hope I'm making sense? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

2 1

RE:please help me :Failed binding to authentication address 192.168.1.102 port 1812
by Harshavardhan Ch 22 Nov '11

22 Nov '11

Hello sir, while activating the free radius server with eap authentication via vmware virtual machine i got error like "Failed binding to authentication address 192.168.1.102 port 1812" and i attched the output file.

3 2

RE:please help me :Failed binding to authentication address 192.168.1.102 port 1812
by Duong Manh Truong 22 Nov '11

22 Nov '11

Be sure that u run just 1 process of FR at one time . Just type "ps -A | grep radius" to see how many process of FR u are running Hope that helps Vào 12:06 Ngày 22 tháng 11 năm 2011, < freeradius-users-request(a)lists.freeradius.org> đã viết: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE:please help me :Failed binding to authentication address > 192.168.1.102 port 1812 (Harshavardhan Ch) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 21 Nov 2011 21:05:51 -0800 > From: Harshavardhan Ch <harshavardhan.ch(a)intelligraphics.com> > Subject: RE:please help me :Failed binding to authentication address > 192.168.1.102 port 1812 > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <CAGFXDh0FRxe=hgLuX1gtE76rQJMpJ6_n_dwLH2MLz9XWD33MEw(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > Hello sir, > while activating the free radius server with eap > authentication via vmware virtual machine i got error like "Failed > binding to authentication address 192.168.1.102 port 1812" > and i attched the output file. >

1 0

users file
by Jim Pazarena 21 Nov '11

21 Nov '11

I'm a newby to freeradius2 (from cistron), and I have it starting up, and logging. However, it isn't attempting to load the "users" file. I do not see any line in the radiusd.conf file which references "users". I can remove the users file, and freeradius2 doesn't complain about it. Please, what am I missing? -- Jim Pazarena work:250 559-7777 Box 550 - 405 2nd Avenue fax: 866 279-3608 Queen Charlotte BC V0T 1S0 mailto:jim@paz.bz

3 3