- Freeradius-Users - lists.freeradius.org

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi. Sorry for some errors in former mails. "Yes" parameter is the right one. Once i set this i obtain what i want: it works! I had misunderstood what parameter yes/no would have changed on setting. I already attach log file with *yes* setting. *So problem has been solved! :-)* Anyway . . . I see something strange in part of it: *address 172.16.68.10* I explain my configuration: a. remote NAS USG100 with publicIP 89.aa.bb.cc. LAN IP is 172.16.68.253 gateway for 172.16.68.0/24 network. it holds iformations about all AAA servers. b. my freeradius (with mysql) is behind a router (public IP 79.ss.dd.ss) that forwards 1812/1813 UDP to WAN Iface of my Fedora Server. Now . . . *172.16.68.10 is* the IP address of a Win2003 Server with WinRadius (MS Access DB) on. 172.16.68.16 is client i reach via SSL tunnel. From this one i, thru WEBLogIN (useraware of USG100), i provide username/password stored in my mysql server and authentication goes fine with freeradius. Why does it reports informations about other AAA servers? Is it an error of USG? Thanks in advance! Little abstracts about radiusd -x Setting . ... *readclients = yes* in /usr/local/etc/raddb/sql.conf, running #radiusd -X User-Name = "cactus" User-Password = "barilotto" NAS-IP-Address = 172.16.68.10 NAS-Identifier = "weblogin" NAS-Port = 15330 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.16.68.16"

2 1

Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi all. I'm pretty new with Freeradius, but it seems matching my targets :-) I set Freeradius with mysql server and Daloradius Management. After some troubles to install FR, it worked fine, at least as basical startup: i can authenticate remote users! For real it works if i use /raddb/clients.conf file, setting readclients = yes in /raddb/sql.conf. Once i set it to "no", autentication fails. I checked nas table structure and it's ok, the same as in /usr/local/etc/raddb/sql/mysql/nas.sql User are instead loaded fine from mysql users table. How could i solve it? Thanks in advance Here my configuration. Fedora Core 10 Freeradius 2.1.9 Daloradius 0.9-7 MySQL 5.0.88 Remote NAS: ZyXEL USG100 (2.21) Superataru --

3 5

little sql help required
by Strong, Mark 07 Jun '10

07 Jun '10

All, I've read the SQL_HOWTO, and have it working, however I'm trying to understand this bit in the example. group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } I've got two servers, each with its own mysql db (replicated to each other), and I'd like freeradius to fail over to the other boxes mysql server if its local one dies. So I'd like to understand what that group mysql example does, before I paste it into my configs. Looked at the docs, but can't find it (or something like it) described anywhere. I've got version 2.1.6, on Centos 4.7 Regards Mark Strong

2 2

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 06 Jun '10

06 Jun '10

Thank you for reply. I found the problem. I missed a field during nas table analysis. The field was "server, varchar(64). I added it. I had also to - clear clients.conf from NAS manually added to avoid duplicates; - set one NAS address, formerly added, as Host address instead of subnet. Now it works fine! Now backup of configuration and going to work on chiphering passwords and manage WiFi. Superataru. reply to . . "Your message doesn't have enough information to troubleshoot your problem. Run FreeRADIUS in debug mode (radiusd -X) and read the error messages. If you still can't solve your problem, send the debug output to the mailing list. Tim"

1 0

backup of external proxy
by Fred MAISON 06 Jun '10

06 Jun '10

Hello, When proxing some eap-type by real to an external radius, is it possible to configure a normal and a backup proxy server ? I saw (in proxy.conf comments) it was possible when proxying to a local virtual server, but I don't understand what to do for normal/backup externals radius we have to proxy to for a particular real. Best regards, Fred MAISON

2 1

username and attributes
by rosect190＠yahoo.com 06 Jun '10

06 Jun '10

I have two users (u1 and u2) and want to use PEAP to auth them. For each user, I will return an attribute. For example, attr1 for u1 and attr2 for u2. An interesting thing is that, when my out-tunnel user name is "anonymous", I do not see any attribute be returned although the auth is successful. Further testing shows, if I use user2's name (u2) as user1's out-tunnel name and use user1's name (u1) as user2's out-tunnel name, user1 will receive attri2 and user2 will receive attr1. It seems that the server picks attributes based on the out-tunnel name, not the real user name. In file /etc/raddb/users, I configure users as follows: u1 Cleartext-Password := "p1" Service-Type = 6 u2 Cleartext-Password := "p2" Service-Type = 4 I do not understand why. Is there anything I did not configure in the server? Thank you very much for any suggestion!

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowlegde. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David Hoepelman 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowledge. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User- Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

1 0

EAP-TLS vs X.509 certificate chains
by Paolo Barbato 04 Jun '10

04 Jun '10

Looking at the mailing list it's seems not possibile configure freeradius to use a CA chains certificate, instead of a single CA root. Since also Comodo distribute server certificate in that way I wonder if this could be managed in future release of freeradius. Comodo has been choosen by Terena TCS service that is used by almost all educational organization in Europe .. and many of them, like mine, use also FreeRadius. Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 1

expiration module and reply items
by Ana Gallardo 04 Jun '10

04 Jun '10

Hello, I'm working with freeradius 2.1.8 and I want to return an attribute when eexpiration module return 'userlock'. I try to add the item in expiration module: /etc/freeradius# cat modules-enabled/expiration # -*- text -*- # # $Id$ expiration { Reply-Message = "LA CUENTA HA EXPIRADO PARA %{%{Stripped-User-Name}:-%{User-Name}}" Codigo-Reject := Cuenta-Expirada } But it doesn't work. I also try using unlang in authorize section: authorize { . . . expiration if (userlock){ update reply { Codigo-Reject := Cuenta-Expirada } } pap } My debug info: rad_recv: Access-Request packet from host XXXX port 59252, id=177, length=71 User-Name = "prueba(a)temp.XXX.es" User-Password = "prueba" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 server XXX { . . . [expiration] Checking Expiration time: '1 Jun 2010' [expiration] Account has expired [expiration] expand: Password Has Expired -> Password Has Expired ++[expiration] returns userlock } Using Post-Auth-Type Reject +- entering group REJECT {...} . . . Sending Access-Reject of id 177 to 158.49.247.199 port 59252 Reply-Message = "Password Has Expired\r\n" Somebody can help me. Thak you and sorry for my english. ____________________ Ana Gallardo Gómez ____________________

2 2