- Freeradius-Users - lists.freeradius.org

Separate rlm_perl in each virtual server
by Alexander Shikoff 05 Feb '11

05 Feb '11

Hello, I have two virtual servers and I need to process events in these servers with different perl scripts. Is there a way to configure separate rlm_perl instances for each virtual server? Thanks. -- MINO-RIPE

3 7

Unable to authenticate in case of multilingual characters
by karnik jain 04 Feb '11

04 Feb '11

Hi, While I am doing testing of my RADIUS client with multilingual characters consits in the username to check my multilingual support module. At that time I am using* FREE RAIDUS server*, I have attached all configuration files related to my setup with this mail. *username :* ∞ *password :* gameover I have sent the username after encoding username = ∞ that is 0xe2889e into UTF-8 that is 0xf8 0xb8 0xa2 0x9e to RADIUS server. But I am not able to authenticate user with the *FREE RAIDUS server*, who wants to login with the above credentials everthough there is not problem in UTF-8 encoded characters. So, Can you please help me out to resolve this issue or pointing me out if i am going in some wrong way by looking into the config file attached. I have also attached the error log of the RADIUS server and wireshark output with this mail. Regards, Karnik jain

3 3

Radius Client UDP port selection
by vijay s sheelavantar 04 Feb '11

04 Feb '11

Hello Friends, Now the radius client UDP port is selected randomly, Is there a way by which i can mention the server to use perticular UDP port  as client port. 1. Is there a way where i can configure port numbers for client and server?2. Or if i need to change the code then in which function i have to change? I want client udp port number should be greater than 32767. Kindly help me. Thanks and Regards,VIJAY S.

4 3

Question regarding nested WiMAX TLV formatting
by Adrien Demarez 04 Feb '11

04 Feb '11

Dear all, I wish to deploy FreeRadius on a WiMAX setup, and I need a modern version of FreeRadius in order to use WiMAX-Packet-Flow-Descriptor-v2 and nested TLVs (according to http://freeradius.1045715.n5.nabble.com/Sub-TLV-s-td3336559.html, I should use the git/2.2 version of FreeRadius - which I did compile and run successfully). My question is about how to configure/describe/format the nested TLVs in the reply (not in the dictionary), either in the "users" file or in the MySQL tables (e.g. in "radgroupreply"). Indeed, in the following example : how can I express the fact that the WiMAX-PFDv2-Packet-Data-Flow-Id attribute is *inside* the WiMAX-Packet-Flow-Descriptor-v2 ? what should I put in the "value" field for "WiMAX-Packet-Flow-Descriptor-v2", since the real "value" is constituted by the following TLVs ? How can I say "end-tlv" at some point so that the "Some-other-attribute" is no longer inside WiMAX-Packet-Flow-Descriptor-v2 but is at the root level ? INSERT INTO `radgroupreply` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (1, 'Gold', 'WiMAX-Packet-Flow-Descriptor-v2', ':=', '??') (2, 'Gold', 'WiMAX-PFDv2-Packet-Data-Flow-Id', ':=', '1') # inside the first one ... (100, 'Gold', 'Some-other-attribute', ':=', 'foobar') Best regards, -- Adrien Demarez

2 1

Radius + LDAP + SecurID
by Marc Phillips 03 Feb '11

03 Feb '11

So I've been beating my head against a wall on this for a few days, so I figured I'd share what "worked" now that the swelling has gone down. Configuration is fairly straight forward. I have authorization via LDAP (AD), and Authentication via SecurID (via PAM..yeah, I know you aren't s'posed to use PAM 'cause of mem leaks, and the SecurID one certainly had 'em, but the latest module has been stable in Radius 1.1.7 for me for over 2 years on multiple platforms). I previously had a simple radius to securid bridge I'm just now adding in LDAP. Using FreeRadius 2.1.10 (I patched it for an exec callout which can be found in the devel group). Used the "default" site and enabled ldap: authorize { preprocess auth_log # This is important and (it's ommision) was # the cause of the lump on my skull files ldap } authenticate { pam } modules/ldap ldap { server = "mydc" port = 636 identity = "exec:my_callout" password = "exec:my_callout" basedn = "dc=some,dc=corp,dc=com" filter = "(CN=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls_mode= yes tls { start_tls = no cacertfile = /path/to/cafile require_cert = "demand" } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" chase_referrals = no rebind = no set_auth_type = no } users file: DEFAULT Ldap-Group == "admins", Auth-Type = pam Reply-Message = "Hello (admin), %{User-Name}", ....(other attributes) Fall-Through = No DEFAULT Ldap-Group == "Operators", Auth-Type = pam Reply-Message = "Hello (operator), %{User-Name}", ....(other attributes) Fall-Through = No DEFAULT Auth-Type := Reject Reply-Message = "you are not authorized" So what happens is the user sends his request, the user ID is looked up in AD and then the groups are looked up for that user, in the order listed in the users file, until a match is found. If a match is found, it passes to the Auth-Type for authentication otherwise sends back a reject. Note, this is a basic POC config. As another note, I found a python module (pyrad, not py-radius) very helpful in debugging this. radtest is nice, but I don't like entering my pin in he clear on a shared unix box. Here's a script I used for that (merged the good of the py-radius example with the pyrad example): -------------cut -------------------------- #!/usr/bin/python import socket, sys import pyrad.packet from getpass import getpass from pyrad.client import Client from pyrad.dictionary import Dictionary secret = '' uname,passwd = None,None while not secret: secret = getpass('RADIUS Secret? ') while not uname: uname = raw_input("Username? ") while not passwd: passwd = getpass("Password? ") srv=Client(server="localhost", secret=secret, dict=Dictionary("/path/to/dictionary")) print "read dictionary" req=srv.CreateAuthPacket(code=pyrad.packet.AccessRequest, User_Name=uname) req["User-Password"]=req.PwCrypt(passwd) req["Service-Type"] = "Login-User" try: print "Sending authentication request" reply=srv.SendPacket(req) except pyrad.client.Timeout: print "RADIUS server does not reply" sys.exit(1) except socket.error, error: print "Network error: " + error[1] sys.exit(1) if reply.code==pyrad.packet.AccessAccept: print "Access accepted" else: print "Access denied" print "Attributes returned by server:" for i in reply.keys(): print "%s: %s" % (i, reply[i]) -----------cut --------------------------- R. Marc

1 0

MAC Authentication - Bad Idea?
by Jim Rice 02 Feb '11

02 Feb '11

Greetings, Still a newbie, but getting there... (Alan, do you ever sleep?) I have been asked to implement MAC authentication for a local service provider with a Canopy radio network and MikroTik routers. No, really. I was able to test this and received Accept-Accept after placing the MAC address in the UserName (Password is ""), but had to set Auth-Type := Accept. I haven't found much in the way of documentation regarding MAC authentication in some of the "dated" books I have on Radius and 802.1x, nor in the FreeRadius docs. The goal is to provide for different classes of service, bandwidth management, accounting, etc. I imagine some of this can be done through vendor specific attributes to dynamically configure the routers (VLANs, data rates, priority queues and such), based on which group a user belongs. Dumb question #1: Just because you can do a thing, it doesn't mean you should. Can someone give me the "you idiot" speech and talk me out of this? Deploying client certificates to every device in their network seems an administrative nightmare. Using usernames/passwords doesn't make sense since most devices will always be connected. In the days of dial-up, users understood having to "login" to connect. Today, not so much. So, are there better alternatives? Or am I still just a clueless newbie? Thanks for your patience, Jim

7 11

Active Directory and authorize section
by Harry Hoffman 02 Feb '11

02 Feb '11

Hi All, I'm trying to find out what to use (if anything) in the authorize section when authenticating clients via MSCHAP-v2 and AD credentials. The how-to at deployingradius.com only speaks to the authentication section. If I only want to ensure that the username/password credentials are valid do I need to run through authorize or just go straight to authenticate? Cheers, Harry

6 9

Re: EAP-TTLS & Kerberos
by Alan Buxey 02 Feb '11

02 Feb '11

not a single bit of EAP being triggered according to these logs. Look at the default server and how it used EAP and pushes request to inner-tunnel. You won't have any password details outside of the EAP tunnel and that ain't been created in your setup. Alan

1 0

How to store clients.conf in LDAP?
by c0re 02 Feb '11

02 Feb '11

Hello freeradius users! I've configured authentication and authorization via freeradius that looking in openldap for users and passwords. In radius.conf in ldap section I used filter filter = "(&(cn=%{Stripped-User-Name:-%{User-Name}})(description=%{NAS-IP-Address}))" So I only need to make description field with IP address of device to give user access to some device. But when I add new device I always have to edit clients.conf, add new IP address and secret. I do not want to use 0.0.0.0 and same secret for all devices. Is it possible to store device secrets in openldap? If yes, please, point me to right direction. And may be it's possible change way how can I give access to devices for users? I mean something like group cn=someSwitch,ou=devices,dc=domain,dc=com, and this group has field with IP address of device and something like "member: user1" or "memberUid: cn=user1,ou=users,dc=domain,dc=com". I'm a bit confused about how to implement it... Thanks in advance for advices!

3 4

Question on Radius logs
by Brett Littrell 02 Feb '11

02 Feb '11

Hi All, Real quick and I am sure easy question here. I read through the unlang man page, really helped in getting a clue. One thing I was wondering though, is there a way to output text to the log based on a condition? What I mean is something like if x!=y then printf(" x did not equal y"). This would be for debugging and log review. Currently we use Cisco ACS, which with all it's limitations the one thing that is great about it is it's pass/fail logs. Our techs use them all the time to diagnose problems. If I could inject text strings into the logs when certain issues occur it would make it a lot easier to figure out scripts as well as make common issues easier for techs to troubleshoot. From what I can tell in the unlang man page it did not mention this, perhaps I missed it though. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

5 6