- Freeradius-Users - lists.freeradius.org

Re: LDAP groups
by Alan DeKok 12 Jun '10

12 Jun '10

Génaël VALET wrote: > I use LDAP groups for EAP-PEAP Authentication in wifi WPA context. For now, > I used a DEFAULT line in "users" file like this : > > DEFAULT ldap_1x-Ldap-Group != "radius" , Auth-Type := Reject > Reply-Message = "ACCES REFUSE" > > I have a LDAP Group named "radius" but I don't know howto permit another one > LDAP Group See "unlang". The LDAP group comparison has some oddities, unfortunately. authorize { ... if ((LDAP-Group == X) || (LDAP-Group == Y)) { # OK } else { update reply { Reply-Messages := "Access refuse" } reject } } Alan DeKok.

1 0

checking DN of user certificate
by Riccardo Veraldi 11 Jun '10

11 Jun '10

Hello, when using EAP-TLS I would like to check the DN of hte user certificate and in particulare I need to check the Locality (L) string to matcha particular string. Is it possible in some way ? thanks Rick

2 1

EAP-MSCHAPv2 and MPPE key
by Stefan Winter 11 Jun '10

11 Jun '10

Hello, we're trying to get IKEv2 under Windows 7 going. It can use among others "EAP-MSCHAPv2"; notably with EAP wrapper but without TLS. While auth succeeds, FreeRADIUS doesn't send MPPE keys back, and Win 7 then rejects the session. I noticed that rlm_mschap can be configured to calculate and send MPPE keys, while rlm_eap/types/mschapv2 does not; the two modules seem to be mostly independent. Is that something that can easily be added? BTW, a check back with a developer "Martin" from strongswan.org yielded: "Then I'd assume you are using FreeRADIUS :-). It does not include the MSK in MSCHAPv2 if used over EAP. IKEv2 however requires the MSK to calculate the AUTH payload. In its current form, you can't use FreeRADIUS for your setup, my apologies. One could extend FreeRADIUS to copy over the MPPE keys, but writing such a patch is not something I can do in a few minutes." Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

Removing local auth (freeradius server 2.1.9)
by Martin Richard 11 Jun '10

11 Jun '10

Hello, I've tried the doc, the wiki, and the ML archives but I can't find an answer to what must be a simple configuration thing.. I've compiled freeradius server 2.1.9 and only added two simples lines to $confdir/user: mrichard Cleartext-Password := "qwerty" mrichard2 Cleartext-Password := "qwerty" When starting radiusd -X (yes, I've looked at the output) and testing these 2 most simple accounts with radtest, the first one fails while the second one works. The difference being that there's a "mrichard" account on the box in /etc/passwd while "mrichard2" only exists in radiusd's config. Hence the output differences when calling "radtest thelogin qwerty localhost 666 testing123" (cut) : for mrichard: +- entering group PAP {...} [pap] login attempt with password "qwerty" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject for mrichard2: +- entering group PAP {...} [pap] login attempt with password "qwerty" [pap] Using clear text password "qwerty" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 79 to 127.0.0.1 port 60023 Of course, the first account works if I use the OS level password associated with it. After a bit of searching I found a reference in the ML archives to $confdir/sites-enabled/default and saw "unix" in there with the description saying it caches the hashes from /etc/passwd and its accompanying shadow. I've commented those lines and restarted the daemon. Now I get this in the PAP output for both users: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject I must be missing something rather obvious.. But how can I totally disable the lookup of OS accounts ? Thanks Martin

4 4

FR 2.1.7: Error: Failed binding to proxy address
by John Horne 11 Jun '10

11 Jun '10

Hello, We are running Freeradius 2.1.7 (on CentOS 5 - freeradius2-2.1.7-7.el5), and are seeing many of these messages in our log files: Fri Jun 11 11:44:19 2010 : Error: Failed binding to proxy address * port 1815: Address already in use The server is already running and so would already be bound to the port, so why is it trying to bind to it again? These seem to occur initially in ones or twos, but eventually the server stops responding completely to requests. At that point we have to restart the radiusd process. Is this known about and maybe fixed in 2.1.9? Or is something else going on here? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

3 4

RE: Looking for an editor for FreeRADIUS documentation
by Jack Martin 11 Jun '10

11 Jun '10

I would be willing to help as well-if its a collaboration. I can't code and this would be a way to give back. The money could be used someplace it's really needed. -----Original Message----- From: Ramm-Ericson, Johannes <Johannes.Ramm-Ericson(a)sonyericsson.com> Sent: Tuesday, May 18, 2010 3:14 AM To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: RE: Looking for an editor for FreeRADIUS documentation Hi, I'd definitely be willing to help out with this task. Particularly if it could be turned into a collaborative effort. Money is nice, however my primary motive would actually be to contribute to an outstanding piece of software that has been essential in my job. So, should I become involved in this effort you can happily use the money elsewhere. :) Best Regards, Johannes R-E -----Original Message----- Date: Tue, 18 May 2010 09:16:06 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Looking for an editor for FreeRADIUS documentation To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4BF23EB6.7080300(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 In the interest of making the project better, we're looking for an editor for the documentation. The existing documentation is an "ad hoc" collection of files thrown together over a decade of effort, and written by many different people. We'd like to organize the documentation ("doc/" directory), and clean it up. We're looking for an editor with the following skills: [The entire original message is not included]

5 6

RE: Looking for an editor for FreeRADIUS documentation
by Ramm-Ericson, Johannes 11 Jun '10

11 Jun '10

Alan DeKok wrote: > Arran Cudbard-Bell wrote: >> The problem with volunteer 're-factoring' work, is that although people mean well when they offer their >> assistance, it doesn't usually work out... They'll often spend a couple of weeks working on the task, >> get bored, figure they'll take a break and come back to it later, and it never gets completed. > I'd say the hard part is getting people to just write docs. It's not as sexy as programming, but it > has arguably more *positive* impact on the end user. I concede both points. Now it just gets down to showing that it won't happen this time. :-) > It looks like a good set of volunteers wanting to help. My suggestion > is to convert the docs to "Restructured text": > > http://docutils.sourceforge.net/rst.html Looks very straight forward. :) I'll be creating a github account for myself later this evening and will start getting my hands dirty after that. Best Regards, Johannes R-E PS. By the way; for the sake of not duplicating effort does Peter Nixon want to lead the way on this or is it just a simple free-for-all?

2 3

FR 2.1.9 Frequent SegFault, didn't happen with FR 2.1.8
by James J J Hooper 11 Jun '10

11 Jun '10

Hi Alan, All, Since upgrading to 2.1.9, FR is segfaulting frequently (every 20 minutes with load, every ~8 hours with less load). Attached -X at startup, and the last 100 lines before segfault. If someone can explain how to drive GDB (or any other method to track this down), I'm happy to try it. Thanks, James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk http://www.jamesjj.net --

4 12

VLAN info disappears
by Andras Dosztal 11 Jun '10

11 Jun '10

Dear FR users, I've configured FR2 (2.1.8) to authenticate users from the users file, and I ran into a strange problem. In the first case, I've configured it to direct a user to VLAN 129: user1 Cleartext-Password := "Default1234" Tunnel-type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "129", Termination-Action = "RADIUS-Request" User authentication works fine, but the user isn't directed to the correct VLAN, the switch port remains at its default VLAN. Debug log: http://pastebin.ca/1880327 In the second case, I've turned off 802.1X on the client, then I've set it's MAC address in the users file (of cource, mab is enabled on my Cisco switch): 000bcd0axxxx Cleartext-Password := "000bcd0axxxx" Tunnel-type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "129", Termination-Action = "RADIUS-Request" Authentication works, the PC is directed to its VLAN. What did I do wrong? Can you help me solve this issue? Thanks in advance. Regards, Andras

3 4

RE: LDAP groups
by Génaël VALET 11 Jun '10

11 Jun '10

Is there anybody who could help me on the below topic ? -----Message d'origine----- De : freeradius-users-bounces+genael.valet=diderot.org(a)lists.freeradius.org [mailto:freeradius-users-bounces+genael.valet=diderot.org@lists.freeradius.o rg] De la part de Génaël VALET Envoyé : mercredi 9 juin 2010 15:39 À : 'FreeRadius users mailing list' Objet : LDAP groups Hello, I use LDAP groups for EAP-PEAP Authentication in wifi WPA context. For now, I used a DEFAULT line in "users" file like this : DEFAULT ldap_1x-Ldap-Group != "radius" , Auth-Type := Reject Reply-Message = "ACCES REFUSE" I have a LDAP Group named "radius" but I don't know howto permit another one LDAP Group Somebody could help me ? G.VALET - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0