- Freeradius-Users - lists.freeradius.org

Re: Authentication based on users and NAS
by Thor Spruyt 12 Apr '11

12 Apr '11

Hi, If you're going to use LDAP, then just add the Called-Station-Id to your search filter and add one or multiple attributes to match against in your LDAP entries. Regards, Thor. ----- Original Message ----- From: "Sergio Belkin" <sebelk(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, April 12, 2011 5:46:58 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna Subject: Authentication based on users and NAS Hi, It was easier than I thought, I simply had to add to /etc/raddb/users something like: steve Called-Station-Id == "00259c14066e",Cleartext-Password := "password" Still I had to solve 2 issues: The first one is that if I want steve to login through more than NAS I have to add one line like above per NAS. Is a nicer way to do it? The second one is that I don't know how to do it for Ldap users. Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

ldap and file authentication
by Marco Kalmbach 12 Apr '11

12 Apr '11

hi @all, is it possible to provide ldap authentication and users file authentication at the same time on a radius server? On my radius server the ldap authentication works fine, additional I want to provide users file authentication, so I commented out the following lines: -->radiusd.conf file { userfile = ${confdir}/users } ... authorize{ ... files ... } My users file: testuser Cleartext-Password := "XXX" When I want to login the user "testuser" the Debugscreen shows: Login incorrect: (rlm_ldap: User not found): [testuser] Are there any other options I have to set or isn´t it possible to authenticate users via ldap and users file at the same time? Thanks for your answers, greetings Klaus -- NEU: FreePhone - kostenlos mobil telefonieren und surfen! Jetzt informieren: http://www.gmx.net/de/go/freephone

2 1

Different sql servers for separated auth&acc
by c.schwarz＠funknetz.at 12 Apr '11

12 Apr '11

Hello, in a special setup we are using freeradius Version 1.1.3 (sql.conf v 1.41.2.2.2.2), on a debian x86 machine, which can't be upgraded to Version >2.0. I would like to check authorization against mysqldb1 and insert/update accounting in mysqldb2. Is it possible to use two independent mysql databases in Version 1.1.3? Thanks in advance, chris

2 1

Authentication based on users and NAS
by Sergio Belkin 12 Apr '11

12 Apr '11

Hi, It was easier than I thought, I simply had to add to /etc/raddb/users something like: steve Called-Station-Id == "00259c14066e",Cleartext-Password := "password" Still I had to solve 2 issues: The first one is that if I want steve to login through more than NAS I have to add one line like above per NAS. Is a nicer way to do it? The second one is that I don't know how to do it for Ldap users. Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

1 0

How to add RADIUS users under OU=People
by pradyumna dash 12 Apr '11

12 Apr '11

Hello, I need a help, What i want is instead of creating a OU called radius, i would like to add all radius users under OU=People, how to achieve this? I am not able to add a user with "objectclass:radiusprofile", I tried changing radius schema to AUX but no luck. Please have a look at my LDIF file. I am using SuSE 11 dn: uid=kris,ou=People,dc=example,dc=com uid: kris cn: kris objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: uidObject objectClass: radiusprofile userPassword: {crypt}$2a$10$DXf3RUs5cQv/WYOgaeyv1uwvUJ.3ZfW3sr7sCr75/6/dw062c5YOe shadowLastChange: 15076 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 1003 gidNumber: 100 homeDirectory: /home/krisradiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None radiusGroupName: dial radiusGroupName: isdn radiusAuthType: LDAP Suggestions will be appreciated. /Neo

1 0

freeradius, how to cooperate with a wireless AP( system is linux, openwrt)
by xuyu 12 Apr '11

12 Apr '11

Hi,I want to build a wireless network with radius server . server computer is ubuntu , wireless router is a linux system-openwrt.So i need to install something in the router,So what is it? Can somebody know something about it? please do me a favor.

2 1

Help me with Access-Challenge configuration
by GreenUA 12 Apr '11

12 Apr '11

I reviewed RFC and FAQ, but i can't fined sane info about configuration of freeRADIUS server (on Windows) to send access-challenge message on access-request. My configuration is (users.conf): test Auth-Type := Local, User-Password == "test" Service-Type = Login-User, Login-IP-Host = 192.99.98.119, Login-Service = Telnet, CS_Priv_Level = 2, Reply-Message = "Hello, %u. Wellcome from RADIUS. You are Administrator" For such configuration RADIUS server (receive access-request)checks Login + Pass and if they are correct sends "Reply-Message" with right "CS_Priv_Level" for Client (access-accept). But i need to validate one more parameter from client and sent for him access-challenge, and i don't know how to configure my RADIUS server to send "Access-challenge". Guys pls help me with the answer or if it's possible give me some link or manual in which i can fined the answer. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-me-with-Access-Challenge-confi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 11

new to radius osx client 3com switch
by jeffrey j donovan 12 Apr '11

12 Apr '11

hello I have been learning about freeradius and could use some guidance. I have a freeradius server a 3com 5500 switch and mac osx client I setup a test machine and added a client record and shared secret. Joe User is getting his credentials from ldap, and the machine he sent the request on is 10.5.1.8, freeradius running on 10.5.1.101. Now I need to configure a 3Com switch, and mac OSX client to send/accept EAP or EAPTLS. neither apple or 3com have good setup docs, so Im looking to the list , maybe someone has crossed this river before I build a new bridge ? here was my auth test from remote user; echo "User-Name = joeuser\n User-Password = hispassword" | radclient -sx 10.5.1.101 auth Secret Sending Access-Request of id 137 to 10.5.1.101 port 1812 User-Name = "joeuser" User-Password = "hispassword" rad_recv: Access-Accept packet from host 10.5.1.101:1812, id=137, length=20 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Mon Apr 11 20:17:42 2011 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 10.5.1.8 port 57337, id=254, length=51 User-Name = "joeuser" User-Password = "hispassword" Mon Apr 11 20:27:04 2011 : Info: +- entering group authorize {...} Mon Apr 11 20:27:04 2011 : Info: ++[preprocess] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[chap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[mschap] returns noop Mon Apr 11 20:27:04 2011 : Info: [suffix] No '@' in User-Name = "joeuser", looking up realm NULL Mon Apr 11 20:27:04 2011 : Info: [suffix] No such realm "NULL" Mon Apr 11 20:27:04 2011 : Info: ++[suffix] returns noop Mon Apr 11 20:27:04 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Apr 11 20:27:04 2011 : Info: ++[eap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[unix] returns updated Mon Apr 11 20:27:04 2011 : Info: ++[files] returns noop Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The host 10.5.1.8 does not have an access group. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: no access control groups, all users allowed. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: Setting Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[expiration] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[logintime] returns noop Mon Apr 11 20:27:04 2011 : Info: [pap] Found existing Auth-Type, not changing it. Mon Apr 11 20:27:04 2011 : Info: ++[pap] returns noop Mon Apr 11 20:27:04 2011 : Info: Found Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: +- entering group opendirectory {...} Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Auth: Login OK: [joeuser/hispassword] (from client noc port 0) Mon Apr 11 20:27:04 2011 : Info: +- entering group post-auth {...} Mon Apr 11 20:27:04 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 254 to 10.5.1.8 port 57337 Mon Apr 11 20:27:04 2011 : Info: Finished request 2. Mon Apr 11 20:27:04 2011 : Debug: Going to the next request Mon Apr 11 20:27:04 2011 : Debug: Waking up in 4.9 seconds. okay so thats good. now I assume that I can configure the switch , after following 3coms instructions i end up with 5500G-EI]display dot1x int g1/0/5 Equipment 802.1X protocol is enabled CHAP authentication is enabled DHCP-launch is disabled Proxy trap checker is disabled Proxy logoff checker is disabled Configuration: Transmit Period 30 s, Handshake Period 15 s Quiet Period 60 s, Quiet Period Timer is disabled Supp Timeout 30 s, Server Timeout 100 s The maximal retransmitting times 2 Total maximum 802.1x user resource number is 1024 Total current used 802.1x resource number is 1 GigabitEthernet1/0/5 is link-up 802.1X protocol is enabled Proxy trap checker is disabled Proxy logoff checker is disabled The port is a(n) an authenticator Authenticate Mode is Auto Port Control Type is Mac-based Max on-line user number is 256 Authentication Success: 0, Failed: 2 EAPOL Packets: Tx 13, Rx 12 Sent EAP Request/Identity Packet : 5 EAP Request/Challenge Packets: 5 Received EAPOL Start Packets : 3 EAPOL LogOff Packets: 0 EAP Response/Identity Packets : 5 EAP Response/Challenge Packets: 0 Error Packets: 0 1. Unauthenticated user : MAC address: 0025-xxxx-xxxx Controlled User(s) amount to 1 [5500G-EI] disp domain 0 Domain = nocdomain State = Active RADIUS Scheme = nocsys Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable 1 Domain = system State = Active Scheme = LOCAL Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable at this point I thought I had it, but the OSX client just fails and it's like the eap never leaves the 3com switch nothing hits the logs, it's quiet. so, I need to know what each side is looking for. can someone smack me around a bit thanks for any insight -j

1 0

MLPPP Acct-Session-Id
by Jay Kuhne (jkuhne) 11 Apr '11

11 Apr '11

Hi, Is there another attribute syntax on radclient that could be used aside from Acct-Session-Id to perform COA to a session We are using MultilinkPPP (single session per bundle still) and it is not working as it normally would with PPP. Thanks, Jay RADIUS: COA received from id 48 x.x.x.99:1052, CoA Request, len 149 COA: x.x.x.20 request queued RADIUS: authenticator 70 8D C4 4D 97 82 50 02 - 73 6B 53 27 81 52 29 BD RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Acct-Session-Id [44] 10 "000110A4" RADIUS: Vendor, Cisco [26] 46 RADIUS: Cisco AVpair [1] 40 "ip:sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 48 RADIUS: Cisco AVpair [1] 42 "ip:sub-qos-policy-out=policy_session_out_coa" COA: Message Authenticator missing or failed decode ++++++ CoA Attribute List ++++++ 7FD2EA5DA700 0 00000009 username(447) 23 user1(a)asr_5_6_mlp.com1 7FD2EA5DB090 0 00000001 session-id(409) 4 69796(110A4) 7FD2EA5DB0A8 0 00000009 sub-qos-policy-in(421) 17 policy_session_in_coa 7FD2EA5DB0C0 0 00000009 sub-qos-policy-out(423) 18 policy_session_out_coa RADIUS/ENCODE(00000000):Orig. component type = Invalid RADIUS(00000000): sending RADIUS(00000000): Send CoA Nack Response to x.x.x.99:1052 id 48, len 157 RADIUS: authenticator 76 2F 9A 52 29 2C 26 57 - 27 F6 E0 CC A6 E6 F1 13 RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Vendor, Cisco [26] 43 RADIUS: Cisco AVpair [1] 37 "sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 45 RADIUS: Cisco AVpair [1] 39 "sub-qos-policy-out=policy_session_out_coa" RADIUS: Reply-Message [18] 18 RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405]

3 11

LDAP-group filter search is failing
by joezamosc 11 Apr '11

11 Apr '11

2.1.10 Here's a snippet of freeradius -X... +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop Sending Access-Accept of id 100 to 192.168.100.2 port 1645 User-Name = "DEVELOPMENT\\RobertTest1" MS-MPPE-Recv-Key = 0xa873077b6643bb983d8dbf04da66667699d7832fe38f78c5458b0318eaa27db6 MS-MPPE-Send-Key = 0x866779d60ae2e9da0a928ebfb1f20e2f5e26dc05d050075dc8e65210e2946936 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. This is in my postauth_users file... DEFAULT Huntgroup-Name == Switches, Ldap-Group == "WANN" Service-Type = "Framed-User", Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "dragons_cave" The 10th line from the bottom of the snippet returns with the following... rlm_ldap::ldap_groupcmp: ldap_get_values() failed I'm waiting for a subsequent "[ldap] performing search in" my DN and to match with filter (cn=WANN) But it's not happening. Any insight? Thx. Joe -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6