- Freeradius-Users - lists.freeradius.org

racct and radpostauth
by andreapepa 11 Sep '11

11 Sep '11

Hi all, I'm testing freeradius 2 on a debian 6 with postgresql db. My question is about the correlation beetwen the tables in subject, how can i correlate records without using timestamp but maybe a unique session id? I think this would be helpful when listing online users, for example when there is no acctstoptime value in radacct and maybe that user in not online anymore, or just to sort out a list of the access request/accept/reject report not only by timestamp. In Dialupadmin the online user page list users only by null acctstoptime, but doesn't check( and how would it be possible ) if records belong to a rejected request in radpostauth. I'm testing the server not in the real but with the jradius simulator, with "Generate Unique Acct-Session-id" option on -- View this message in context: http://freeradius.1045715.n5.nabble.com/racct-and-radpostauth-tp4782906p478… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 27

Windows Pre-Login Auth
by Scott Hughes 10 Sep '11

10 Sep '11

Hello all, I have been using FreeRadius for several years now and am stuck trying to make our Windows based wireless system authenticate PRIOR to user login. I have searched the FreeRadius and Deploying FreeRadius sites as well as Google, but no luck. Here is a brief over-view of my FreeRadius setup: 1) Clients: Windows XP & Windows 7 (Professional in both cases - NO VISTA!) 2) Currently running FreeRadius version 2.0.5 3) Currently authenticating users via TLS/PEAP with computer name/username I'm not sure what else (if anything) you might need. I am also looking at changing the FreeRadius setup to authenticate against our Windows 2008r2 Active Directory servers. We have one main location and two remote sites. Currently we have only one FreeRadius server at the main site. If the VPN connection between the main site and either / both of the remote sites goes down, the remote sites can't authenticate. My thought was to have three FreeRadius servers that would authenticate to the local copy of the AD. Having said all of this, I do not want to get to many things going at one time. I much prefer to tackle on issue at a time. Thanks in advance for any insight you may have on either/both of these issues. Scott

8 20

Error in dialupadmin
by Alberto Mijares 09 Sep '11

09 Sep '11

Hi, This is my first time using FreeRADIUS. It's running on Debian 6 and yesterday I installed freeradius-dialupadmin package. Read HOWTO.gz and README.Debian, and still not working. Home page looks fine but when I go to Accounting or New User button it shows an error DEBUG(SQL,MYSQL DRIVER): Connect: User=XXX,Password=XXX (I'm protecting credentials, of course) error.log in apache2 doesn't say something relevant but some warnings (PHP notice). Anybody with same issue? Thanks in advance. Alberto Mijares

2 2

accepting user with username and password depending from mac-address
by Markus Müller 09 Sep '11

09 Sep '11

Hi, I need your help and I am a freeradius beginner, so please be patient with me. In our school we have wireless internet-access for laptops via the copspot-plugin with freeradius behind it (I guess its at least free radius v. 2.0, but I am not sure). Right now Internet-access is limited to teachers, who have to authenticate themselfes with their individual username and individual password. Therefore I modified the "users" file as follows: DEFAULT Session-Timeout = 7200, Idle-Timeout =600, Fall-Through = 1 DEFAULT Group == "teachers", Login-Time:="Wk0700-1730" DEFAULT Auth-Type :=Reject Reply-Message="Fuer SchuelerInnen ist dieser Zugang derzeit gesperrt. No access for students so far." We also have laptops for our students and we want to give them wireless internet access limited to these laptops during lessons. So therefore I want to configure freeradius so that teachers will have wlan access with ANY mobile device after authentication with individual username and individual password as before, students will have wlan access after authentification with individual username and individual password ONLY when they use one of our school laptops and will be rejected if they try it from another mobile device (e.g. private laptop or smartphone). I know that the mac-address will be submitted as "calling-station-id" during the authentification-process. So I guess I have to create a file with all allowed mac-addresses and have to modify the users file, so that it checks a) if username and password of this non-teacher is correct and then b) if the request comes from one of our computers. But I don't know if this is a possibility, I don't know if this is a good possibility and I don't know how to do this. So any help would be really appreciated and will help to give our students internet access with our laptops. If you need further information please ask. Thank you very much in advance. best wishes Markus

1 0

htpasswod authentication.
by Agent Smith 09 Sep '11

09 Sep '11

Can FR do htpasswd file based auth? Ideally I'd like to define users in users file with their crypto password right from htpasswd. Is this possible? how would a user file look like. I searched the docs and all I found was 'cleartext password' but I won't know that since its htpasswd.

2 2

Trying to remove a suffix
by Brett Littrell 09 Sep '11

09 Sep '11

Hi All, I hate to post this here, I am sure there is a fairly simple thing to do this but I have been looking and can't seem to find how to do it. So we have users that typically login with a relative context. So there is a base context set to say ou=HS1.o=students, then they type in their name with a relative context, so it may be jsmith.y2012, with our network it sends to the server jsmith.y2012.hs1.students and logs in just fine. The problem we are having is that freeradius is getting the jsmith.y2012 as the username and trying to send that to ldap that first does not understand "." and second the ldap side is a flattened tree to speed up lookups so there is no sub-context. So the solution would seem to be to strip everything after the '.' so "jsmith.y2012" becomes just "jsmith". So I have been approaching it from this side and have tried using hints and attr_rewrite to do it. I am sure I missed something in each of them because it seems either should work, especially after reading a lot of the archived threads. So this is what I have done so far: created a "relative_username" module and placed it in /etc/raddb/modules directory. Contents are : attr_rewrite relative_username{ attribute = User-Name searchin = packet searchfor = ".y2012" replacewith = "" ignore_case = yes max_matches = 1 append = no } This is just for testing, I originally tried a regex expression of "searchfor =~ "^\w*" and "searchfor = "^\w*" but the unlang equal for regex poped with an error and the regual = I do not think recognized regex so I assumed that meant the regex was not supported in this module. Anyway, I have been testing the rewrite with a literal for a specific user to just see if it will work and does not seem to work. From here I call the relative_username in the /etc/raddb/sites_enabled/Radsite file in the Authorize section authorize { relative_username With this everything loads find and running radiusd -X I see that it is still trying to send the info to the LDAP server as jsmith.y2012 and of course it is failing. So on the hints side I was a little unsure of how it worked so I tried : DEFAULT User-Name =~ "^\w+" User-Name := "%{1}" That also did not seem to have an affect. So I am sure I am either barking up the wrong tree with both of these approaches or I am missing something in here. I should also mention, if I do not use the relative context the users authenticates just fine all is good in the world, it is just that darn trailing .y2012 that is the issue. Sorry ahead of time if this is really a stupid question, I am still learning freeradius (which I think is awesome)... So the debug log is below but it basically shows a object not found. rad_recv: Access-Request packet from host 10.2.2.100 port 36360, id=239, length=65 User-Name = "jsmith.y2012" User-Password = "123454" NAS-IP-Address = 10.2.2.100 NAS-Port = 1813 +- entering group authorize {...} [preprocess] expand: %{User-Name} -> jsmith.y2012 ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "jsmith.y2012", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jsmith.y2012 [ldap] expand: (cn=%{mschap:User-Name:-%{User-Name}}) -> (cn=jsmith.y2012) [ldap] expand: o=musd -> o=musd rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.###.###.###:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder2.b64 rlm_ldap: bind as cn=#######,ou=Radius,o=servers/######### to 10.###.###.###:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=musd, with filter (cn=jsmith.y2012) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jsmith.y2012 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 239 to 10.2.2.100 port 36360 Waking up in 4.9 seconds. Cleaning up request 0 ID 239 with timestamp +10 Ready to process requests. Brett Littrell Network Manager Milpitas Unified School District blittrell(a)musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 CISSP, MCNE, CCVP, CCSP, Project+,MCITP/EA

1 2

Odd issue with auth-type:ldap
by Michael Holstein 09 Sep '11

09 Sep '11

Using .. FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 ^^ .. that is what Debian 5.0.6 (Lenny) had in packages. I have LDAP enabled as an auth-type (for ipsec-tools using libradius, since it sends cleartext password and I have AD as backend). I also process mschapv2 (for l2tp/ipsec connections). This works correctly *only* if I enable LDAP debugging. {radiusd.conf} ldap_debug = 0xFFFF Whereby I get : (for ISPEC) rlm_ldap: user XXXX authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok or (for L2TP/PPP) Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok *HOWEVER* .. if I disable the debug directive, I get : rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Debugging what goes on in the background, the underlying complaint is "must bind to perform.." in case #2. The first case (from a pcap trace) does to the search as defined user (in radiusd.conf) and then bind as the "found" DN, so it's not as if debugging forces a valid return on all queries. Any ideas? Related question .. is there an easier way to pass plaintext (to Radius) credentials into AD (and determine group membership) like auth_ntlm does? .. I know how to call ntlm_auth with plaintext credentials and return a success but can't seem to get freeradius to use that as an auth-type. TIA, Michael Holstein Cleveland State University

3 3

Error in Activation Attribute
by Det Det 09 Sep '11

09 Sep '11

Hi, I have Activation attribute in radcheck table (which has a date VALUE) in old RADIUS server. I don't find this attribute in FreeRADIUS. I get this error. any idea? Failed to create the pair: Invalid octet string "Mar 09 2010 " for attribute name "Activation" thanks det

3 2

PAP-ascii (is it safe to use)?
by Matthew Benjamin 08 Sep '11

08 Sep '11

Can someone tell me if PAP-ASCII is safe to use as an password encryption protocol? -- mB.

3 2

Freeradius and LDAP keepalive
by Angel L. Mateo 08 Sep '11

08 Sep '11

Hello, I have a freeradius 2.1.10 running in a ubuntu (10.04) server. My users are in a ldap directory. The problem I have is that openldap server has an idle timeout (if there is more than this time with an idle connection, openldap closes the connection). So I want to know if there is some way to configure a keepalive on the ldap connection of freeradius. I have found in http://freeradius.1045715.n5.nabble.com/rlm-ldap-amp-TCP-KeepAlive-td279507… that it seems to be code to do this. I have checked this code with code from version 2.1.10 and it is there, but I think I have to configure something because connections are closed and I have logs like: Sep 7 12:12:51 vulpes22 freeradius[21497]: RADIUS Requested access: <myuser@mydomain> (0) Sep 7 12:12:51 vulpes22 freeradius[21497]: [ldap-email] ldap_search() failed: LDAP connection lost. Sep 7 12:12:51 vulpes22 freeradius[21497]: [ldap-email] Attempting reconnect Sep 7 12:12:51 vulpes22 freeradius[21497]: Login OK: [<myuser@mydomain>] (from client XXXXXXX port 10000) freeradius is working (it reconnects with the ldap without any problem), but I want to avoid this error. Is there any way to configure this keepalive? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 5