- Freeradius-Users - lists.freeradius.org

Authenticating against Win2k8r2 without ntlm_auth
by Thomas Smith 25 Apr '11

25 Apr '11

Hi, I'm using FreeRADIUS 2.1.7 on RHEL 5.6. My AD admins recently upgraded from Win2k3 to Win2k8r2. As a result, this broke compatibility with Samba 3.0.x--so I was forced to upgrade to Samba 3.5.x to resolve those issues. To further complicate things, I use Likewise Enterprise to provide AD integration--for compatibility with Samba 3.5.x, I had to upgrade from Likewise 5.x to 6.0. While Samba 3.5 and Likewise 6 fixed the problems authenticating against Win2k8r2, Likewise removed support for Samba/Winbind in their 6.x series product (they included full support for Samba/Winbind in their 5.x series product)--they now use their own libraries to provide "winbind" functionality. The result of this is that the Samba-included ntlm_auth no longer works (and Likewise doesn't provide a comparable replacement)--since my FreeRADIUS install was using ntlm_auth for AD authentication and authorization, it is no longer working. So I'm looking at alternate ways of authenticating against Win2k8r2. I was hoping to get some input from the list regarding this. The FreeRADIUS server is fully configured (via Likewise Enterprise) to authenticate against AD using Kerberos. Authorization is also provided by Likewise Enterprise through other libraries. Both authentication and authorization function properly at the OS level and it integrates well with PAM and anything that can use Kerberos for authentication--so you can do things like log into the server via SSH using AD credentials. I currently only use FreeRADIUS to provide access to VPN clients--the VPN server is a Cisco ASA. I am also working on a Cisco Aironet deployment that will use FreeRADIUS, though this hasn't been configured yet (I'm in the early stages of that deployment). I don't really care if authorization is local or via AD, but I would definitely like authentication to occur via AD. So barring ntlm_auth, is there a good/better/best way of connecting FreeRADIUS to AD? PAM? Kerberos? LDAP? ~ Tom

4 8

question re inner tunnel / virtual server
by Michael Arndt 25 Apr '11

25 Apr '11

Hi *, i try to get a better grip in understanding the virtual server for inner eap tunnel. Please forgive if any of the following statements represents misunderstanding of concepts from my side. Which of the following statements describe the inner tunnel virtual server for EAP wrong / correct ? EAP: -The eap module can map tunneled requests to a virtual server ( inner tunnel ) - It "knows" where to communicate by freeradius reading the virtual servers configs in sites-enabled -So the Port configured for the inner tunnel virtual server (statement valid only for this inner tunnel VS) is only relevant wrt external for testing purposes in order to test correct freeradius config wrt EAP -freeradius handles the communication to the inner tunnel with the above mentioned mapping of the eap module. So in productive use there is no need to reference the Port for the inner tunnel ( except when proxying or using the test for EAP to check for a valid config ) -the main goal of the inner tunnel virtual server is to allow completely independent policies for outer / inner tunneled sessions. hope i did not fall for to many misunderstandings TIA Micha

2 1

how to fix proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

2 2

How to fix the proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

1 1

how to fix proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

1 0

Help with simultaneous use and radutmp
by Rodrigo Yoshioka 24 Apr '11

24 Apr '11

Hi folks..... I have a FreeRadius server working with Mikrotik as NAS, and I'm often receiveing message of multiple connection at log, and the user is not able to connect. I found some solutions at google but it's to whom uses freeradius with sql as session manager. I'm using radutmp file and I couldn't find any solution to kill the session locked at the radutmp file. anyone can help me..?? The message I'm receiving is: Sat Apr 23 18:02:03 2011 : Auth: Multiple logins (max 1) : [#######@########/<no User-Password attribute>] (from client ###.##.0.0/24 port 35226 cli ##:##:##:##:##:##) My Freeradius version is 2.1. Thanks Rodrigo Yoshioka

2 3

Re: New to RASIUS
by Jahm 24 Apr '11

24 Apr '11

But when I enable the RADIUS server in Mac, it can only recognize AirPort devices and can't add my NetGear. Sent from my iPhone On Apr 24, 2011, at 8:31 AM, Arran Cudbard-Bell <a.cudbardb(a)gmail.com> wrote: Is FreeRADIUS is somehow the same as the RADIUS server offered in Snow Leopard Server? Snow leopard has an older version of FreeRADIUS but yes its essentially the same thing. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

New to RASIUS
by Jahm 24 Apr '11

24 Apr '11

Hi, good day! I have 25% knowledge about servers (Win2k3 and Mac) and completely noob when it comes to RADIUS. I'll just ask a few things for me to get started. What are the things needed for me to set-up a RADIUS server? Is FreeRADIUS is somehow the same as the RADIUS server offered in Snow Leopard Server? Sent from my iPhone

2 1

Example of how to use caching (Cached-Session-Policy)?
by John Douglass 23 Apr '11

23 Apr '11

I am apparently using the Caching improperly in regards to configuration in eap.conf. The first authentication works great (EAP-PEAP-MSChapv2) and DB lookups. The second time (with caching enabled) it appears to only be adding the User-Name attribute to the reply. I see the comments in the file "eap.conf" but they don't go very far into explaining how to get certain attributes saved INTO the cache or pulled out of it. Does anyone have an example of how to use this "Cached-Session-Policy" which is applied to the cached session? eap.conf cache section reads: The "Cached-Session-Policy" is the name of a policy which should be applied to the cached session. This policy can be used to assign VLANs, IP addresses, etc. It serves as a useful way to re-apply the policy from the original Access-Accept to the subsequent Access-Accept for the cached session. What exactly am I supposed to store into the attribute "Cached-Session-Policy"? Is this referring to a policy within the file "policy.conf" that will run and extract attributes according to the function there or is it something else? The notes also say: # You probably also want "use_tunneled_reply = yes" when using fast session resumption. And I have turned that on everywhere I could find, but it doesn't appear to be even saving the 1st values of Tunnel-Private-Group-Id. Debug output: First time that responds correctly given a VLAN. [snipped] [peap] Using saved attributes from the original Access-Accept Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 157 to 128.61.2.253 port 1645 Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" MS-MPPE-Recv-Key = 0xbdc694a560b3fc4e37385fe08bb9876e11d215add69317c704fa374f462bcb0a MS-MPPE-Send-Key = 0xa039b0c10a7ef3511a68cdd837f13747c7a4adcb86dc5d73a8506f0105a9ced4 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request After attempting a second auth which appears to bypass the logic to assign a VLAN but doesn't appear to be adding it to the response from the cache at all. [snipped] [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Adding cached attributes to the reply: User-Name = "jd187" [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 161 to 128.61.2.253 port 1645 User-Name = "jd187" MS-MPPE-Recv-Key = 0x0d398b0ed22899753eac37c8b308afb8a600a4be2b35d4260470148c6f4774cc MS-MPPE-Send-Key = 0x570045c77b56ef4d327189610f20f358038cea5bda215ded4ca32eefd2a72cf2 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11.

3 4

Limit Period time
by googerdi 23 Apr '11

23 Apr '11

Hi How can i limit a group or user to be logined in a specific time. for example i have night group that i want to be logined from 1 am to 7 am. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-Period-time-tp4333210p4333210… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2