- Freeradius-Users - lists.freeradius.org

need help - force EAP-TTLS to validate the server certificate
by Klaus Laus 21 Sep '10

21 Sep '10

Hello, I have one question, is it possible to configure my freeradius server so that only clients with a ca certificate can login themselves with their username and password? I want to configure my freeradius server so that the users can only login after the successfully server certificate validation. At the moment I use EAP-TTLS for authentication, but the options in the clients "servercertificate validation" is optional. I want to use EAP-TTLS and force the ca certificate on the clients. Thanks for help! misterklaus -- GMX DSL SOMMER-SPECIAL: Surf & Phone Flat 16.000 für nur 19,99 Euro/mtl.!* http://portal.gmx.net/de/go/dsl

5 18

JRadius need FreeRadius?
by Noura Kossentini 21 Sep '10

21 Sep '10

Hi To install JRadius server, I must install freeRadius server? thanks

1 0

Newbie
by Schwartz, Curtis H. (GSFC-443.0)[SGT, INC] 21 Sep '10

21 Sep '10

New download of Freeradius 2.1.9. Compiled and accepted all defaults. This is right out the box and the first self test is failing. Can anyone provide some helpful hints? Followed directions: Edit the users file, and add the following line of text at the top, before anything else: testing Cleartext-Password := "password" Start the server in debugging mode (radiusd -X), and run radtest from another terminal window: $ radtest testing password 127.0.0.1 0 testing123 Server rejects with the following debug: rad_recv: Access-Request packet from host 127.0.0.1 port 60552, id=144, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = x.x.x.x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 144 to 127.0.0.1 port 60552 Waking up in 4.9 seconds.

3 3

which samba version / patch for Active Directory 2008
by Neil Prockter 21 Sep '10

21 Sep '10

Hello If someone who has a working freeradius samba ntlm_auth AD 2008 setup could let me know which version of samba they are using and which patches it might help me a great deal. I have a working configuration freeradius + samba 3.0.37 + Active Directory 2003. Our Active Directory servers are in the process of moving to 2008 and the 3.0.37 does not return the correct/same keys when looking at a upgraded AD server. I have it pointed to our last AD 2003 server and it work there. I've setup samba 3.4.8 with the patch https://bugzilla.samba.org/attachment.cgi?id=5894 (which needed a little changing to match line number changes). The session keys (if thats what they are) returned by running ntlm_auth on the 2 setups are different (I've put a wrapper script around it so that I can catch them being returned). If I run ntlm_auth repeatedly with the same challenge and nt-response the ones returned by the broken setup seem to change every few minutes whereas the working one stays the same. Thanks in advance, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

5 8

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 20 Sep '10

20 Sep '10

Estaré ausente de la oficina desde el 20/09/2010 y no volveré hasta el 26/09/2010. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2) o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

convert mac adresses to lower case
by PENZ Robert 20 Sep '10

20 Sep '10

Hi! I'm running # rpm -qa | grep radius freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-utils-2.1.7-7.el5 and I've different switch types. Some send the MAC address lower case the others upper case. For switches which send it lower it case it works (as the macs are stored lower case in the db). How can I convert them all in the clear text password attribute to lower case? The attr_rewrite module looks good, but the only way I see is to have 6 rewrite rules each replacing one letter, but that seems inefficient. The matching in the SQL Database works case insensitive and returns a row but the pap check logs following: rlm_sql (sql): Released sql socket id: 1 +++[sql] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "0025B3A013AA" [pap] Using clear text password "0025b3a013aa" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. I tried to remove pap but then I get following +++[sql] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Hope someone can help me. Thx! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

6 7

still not working (newbie for radius)
by gahn 20 Sep '10

20 Sep '10

Hi all: I apologize for the emails for such simple issue...:) it is still not working. I have done all of your guys advised and tried to read through the documents, but...:( here is my "client.conf" file: client 192.168.255.138 { secret = testing123 nastype = juniper } for my "users" file: bob Auth-Type := Local User-Password = "bob", Juniper-Local-User-Name = "labrat" I started radius with "radiusd -X" and also started tcpdump process. here is what i got from freerediaus debugging: rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 User-Name = "bob" User-Password = "bob" NAS-Identifier = "lab-r8" NAS-IP-Address = 150.150.0.1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 Sending duplicate reply to client r8 port 54462 - ID: 202 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 2.9 seconds. Cleaning up request 0 ID 202 with timestamp +11 rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 User-Name = "bob" User-Password = "bob" NAS-Identifier = "lab-r8" NAS-IP-Address = 150.150.0.1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 4.9 seconds. Cleaning up request 1 ID 202 with timestamp +18 Ready to process requests. for tcpdump: 17:07:11.998936 IP 192.168.255.138.54462 > 192.168.255.128.radius: RADIUS, Access Request (1), id: 0xca length: 57 17:07:14.999487 IP 192.168.255.138.54462 > 192.168.255.128.radius: RADIUS, Access Request (1), id: 0xca length: 57 Interestingly, I only saw 'Access Request" came in, but I didn't see Access Reject messages. any help would be greatly appreciated. gahn

4 9

Use both SQL and SQL-LOG
by Marius Pesé 20 Sep '10

20 Sep '10

Hi everyone, I'm using mySQL to log accounting data, and also want to save the queries (not the packets) to a text file to use with a different program. Since that is both in sites-enabled/default, they seem to be mutually exclusive. Or maybe I'm just a bit blind - it's Friday after all. Any hint would be appreciated. Regards Marius

2 3

dictionary vendor options
by PENZ Robert 20 Sep '10

20 Sep '10

Hi! I'm running # rpm -qa | grep radius freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-utils-2.1.7-7.el5 and I copied following into the /etc/raddb/dictionary VENDOR Extreme 1916 ATTRIBUTE Extreme-CLI-Authorization 201 integer Extreme ATTRIBUTE Extreme-Shell-Command 202 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan 203 string Extreme ATTRIBUTE Extreme-Netlogin-Url 204 string Extreme ATTRIBUTE Extreme-Netlogin-Url-Desc 205 string Extreme ATTRIBUTE Extreme-Netlogin-Only 206 integer Extreme ATTRIBUTE Extreme-User-Location 208 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan-Tag 209 integer Extreme ATTRIBUTE Extreme-Netlogin-Extended-Vlan 211 string Extreme ATTRIBUTE Extreme-Security-Profile 212 string Extreme VALUE Extreme-CLI-Authorization Disabled 0 VALUE Extreme-CLI-Authorization Enabled 1 VALUE Extreme-Netlogin-Only Disabled 0 VALUE Extreme-Netlogin-Only Enabled 1 which seems ok for me but the freeradius thinks otherwise as I get including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[37]: unknown option "Extreme" Does anyone know the problem with my config? thx! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

2 2

2 Called-Station-Id authorize unlang filtering question
by tmihalicek 20 Sep '10

20 Sep '10

Hi everyone ... I need to put up a certain scenario for radius. I have 2 Called-Station-Id numbers 111111 an 122222, first number should always be accepted for auth users, the second one should be accessed after the user hits 10 hours quota on first number. I was wonder if this configuration is the right way. server dialup { authorize { preprocess expiration logintime if (Called-Station-Id == "111111") { sql_dialup pap } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) < 36000}") { sql_dialup pap update control { Auth-Type := Reject } update replay { Reply-Message := "10 hour quota still not reached" } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) >= 36000}") { sql_dialup pap update control { Auth-Type := Accept } update replay { Reply-Message := "10 hour quota reached, access accepted" } else { reject } } ... post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject update reply { Reply-Message := "Access denied" } } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/2-Called-Station-Id-authorize-unlan… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0