- Freeradius-Users - lists.freeradius.org

Cisco Accounting Attributes
by Arran Cudbard-Bell 29 Jun '11

29 Jun '11

Dear List Users, Would anyone happen to know if the Cisco Aironet 1130AG is capable and willing to provide client IP addresses in Accounting Starts/Stops/Updates? Theoretically it must know the IP address of connected clients, because it does that fancy ARP caching stuff, but it seems like it needs some special hidden command to prod it into sending this information to the RADIUS server. Yes.. I know, not FreeRADIUS related, flame me later... Many Thanks, Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter

1 0

Consigue acceso a mis imágenes y más
by Horacio Andrade 29 Jun '11

29 Jun '11

Hola: He creado una cuenta en Netlog con mis imágenes, vídeos, blogs y eventos. Quiero agregarte a mi lista de amistades para que puedas verlo, ¡pero antes tienes que registrarte en Netlog! Cuando te conectes podrás crear tu propio perfil. Échale un vistazo: http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MSZnbT0xMiZ1PSUyRmdvJT… Saludos, Horacio ---------------------------------------------------------------- ¿No quieres recibir más invitaciones de tus amigos? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MiZnbT0xMiZ1PSUyRmdvJT… Don't want to receive invitations from your friends anymore? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MyZnbT0xMiZ1PWh0dHAlM0…

1 0

802.1x auth EAP-TLS problem
by Marco Londero 29 Jun '11

29 Jun '11

Hi folks, I have a problem in my freeradius setup and I'm looking for some hints about that. Scenario: 1) GNU/Linux client w/ WPA supplicant configured to request access through EAP-TLS using a certificate (in order to achieve 802.1x ethernet authentication) 2) 802.1x enabled switch where client is connected 3) user/pass 802.1x authentication works fine (MSCHAPv2 based) 4) freeradius authenticates users on LDAP Freeradius debug log of the issue is here: ------- http://pastie.org/2132916 ------- All certificates should be ok (both on server and client): ------- FP42A certs # openssl verify ca.pem ca.pem: OK FP42A certs # openssl verify server.pem server.pem: OK FP42A certs # openssl verify 02.pem 02.pem: OK ------- Any tips? Thank you! -- mandi, Marco

4 6

LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 28 Jun '11

28 Jun '11

Hi, We use radius (freeradius2-2.1.7-7.el5) for user authentication/authorization on network devices. Therefore we use a mapping from huntgroups to ldap groups. We have three ldap server running, and wanted to use "redundant" or "redundant-load-balance". I have tested two cases till now, because i already found messages that point to known problems with ldap redundancy and extends (ldap-groups) within the users file. Case 1 ================ Defining 3 separate ldap server whithin modules/ldap ldap ldap-1 { server = "<IP ldap-1>" .} ldap ldap-2 { server = "<IP ldap-2>" .} ldap ldap-2 { server = "<IP ldap-3>" And using "redundant" for ldap whithin authorize and authenticate: authorize { preprocess files redundant { ldap-1 ldap-2 ldap-3 handled } pap } authenticate { Auth-Type PAP { pap } Auth-Type ldap-1 { ldap-1 } Auth-Type ldap-2 { ldap-2 } Auth-Type ldap-3 { ldap-3 } Auth-Type LDAP { redundant { ldap-1 ldap-2 ldap-3 handled } } } Problem: radius is using always the same ldap server for group extends. If this (one!) server fails, radius authentication is not possible. Very bad, because we have "redundancy" configured, and expected to have zero outage. Case 2 ================ Defining all three server whithin one section in modules/ldap ldap { server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" .} And setting just "ldap" within authorize and authenticate: authorize { preprocess files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) I found mails regarding similar problems within the archive, but no suitable solution. (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) Is there a solution for reducing the outage and having loadbalancing for our case? I hope that i explained my problem in an understandingly (native language is german), and didn´t paste too much configs. Jan Just a gap of our users file, we have 18 default lines and additional 4 for a local/PAP user: DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-b>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-c>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet, Vendor-Specific = 9, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" DEFAULT Auth-Type := LDAP, Huntgroup-Name == "brocade", LDAP-Group == "<LDAP-GROUP-Team-a>" Vendor-Specific = 1991, Foundry-Privilege-Level = 0, foundry-command-string="*", foundry-command-exception-flag=0 DEFAULT Auth-Type := LDAP, LDAP-Group == "<LDAP-GROUP-Team-a>" Service-Type = Administrative-User, Login-Service = Telnet, Vendor-Specific = 9, cisco-avpair = "shell:priv-lvl=15"

3 3

Changing the User-Name value from a request
by Tiberiu Breana 28 Jun '11

28 Jun '11

Hello. I'm using freeRADIUS to authenticate SIP requests and I'm having problems processing the users. In a request I receive a User-Name that isn't useful, and a Sip-URI-User value which contains the real User-Name that I need. I've tried if(Sip-URI-User) { update request { User-Name = Sip-URI-User } } in default's authorize section, but it says "request returns notfound". I've tried User-Name = Sip-URI-User in the preprocess section of radiusd.conf but it doesn't seem to do anything. So, how can I switch the two before proceeding to authenticate the user? Where and what conditions should be placed? I'm kind of in a time crisis and I don't know what to try anymore. Advice is welcome. Thank you.

3 2

change EAP Accept-reject to Accept-Accept
by adzhuma 28 Jun '11

28 Jun '11

Hello, how it's possible change EAP-PEAP Accept-reject to Accept-Accept? I tried with unlang in ms-chap authenticate in inner-tunnel config, but read the documentation for the unlang that the Auth-Type := "Accept" can't be used with EAP. I tried with such config: MSCHAP authentication. Auth-Type MS-CHAP { mschap { reject = 1 } if (reject) { update reply { Framed-IP-Address = "10.0.0.0+" } update control { Auth-Type := "Accept" } ok } Please, help me to solve this issue and how can I change reject to accept. -- View this message in context: http://freeradius.1045715.n5.nabble.com/change-EAP-Accept-reject-to-Accept-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Freeradius + Ldap + SSL/TLS
by RATSIMIVEH Remi 28 Jun '11

28 Jun '11

Hi, I install freeradius on Debian machine. I have my user in ldap and I use that directory to authentication.But when I want to use SSL or TLS in connections between radius and ldap, I have that error in radius log. (Freeradius -X) --------------------------------- [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.corporate.com:1793, authentication 0 [ldap] setting TLS CACert File to /etc/freradius/certs/RootCA.pem [ldap] setting TLS CACert Directory to /etc/freeradius/certs/ [ldap] setting TLS Cert File to /etc/freeradius/certs/RootCA.crt [ldap] setting TLS Key File to /etc/freeradius/certs/SSLSubCA.pem [ldap] setting TLS Key File to /etc/freeradius/certs/ [ldap] bind as uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793 [ldap] waiting for bind result ... [ldap] ldap_result() [ldap] uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793failed: timeout [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail --------------------------------- i have in ldap.conf : ldap { server = "ldap.corporate.com" port = 1793 ... tls { # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/certs/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" cacertfile = /etc/freradius/certs/RootCA.pem cacertdir = /etc/freeradius/certs/ certfile = /etc/freeradius/certs/RootCA.crt keyfile = /etc/freeradius/certs/SSLSubCA.pem randfile = /etc/freeradius/certs/ require_cert = "allow" it's an another team who manage this ldap corporate. This team request me to import the Corporate.Root.CA and Corporate.SSL.CA to be able to SSL connections. About them, my radius server don't used SSL connections. I don't know where put them... Sorry for my English, the french replies will be accepted.....

1 0

Bind username to certificate
by Marco Londero 28 Jun '11

28 Jun '11

Hi folks, is it possible to bind a SSL certificate (used for EAP-TLS auth) to a specific LDAP user instead of using user's LDAP-stored password? Thank you! -- mandi, Marco

2 2

Copy user entries from a server to another?
by Tiberiu Breana 28 Jun '11

28 Jun '11

Hello. Is it possible to copy user entries from a server to another? I have a user that connects to a "foreign" Radius server (AAAF). The AAAF detects his realm and forwards the request to the realm's appropriate Radius server (AAAH). The AAAH authenticates the user and returns the result. What I'd like to do: copy the user entry to the AAAF (username, password, check items, reply items) so that the AAAF can later authenticate the user without having to forward the request. Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables? Any advice is welcome.

4 5

(no subject)
by Waqar Qayyum 28 Jun '11

28 Jun '11

1 0