- Freeradius-Users - lists.freeradius.org

Re: Expanding run-time variables and checking access_attr for allow
by tnt＠kalik.net 19 Nov '09

19 Nov '09

> The second question. > > If I put, ONLY FOR CHECK, the base_filter = > "(uniquemember=cn=nicolas.velazquez(a)uam.es,cn=users,dc=uam,dc=es)" the > LDAP > replies with No Such Object. But the radius authorization sends ok. > The misconfiguration of LDAP is not the question here. > The question here is: documentation says if the parameter not exists the > authorization doesn't work. It exists so it does work: > [uam_vpn] user nicolas.velazquez(a)uam.es authorized to use remote access Ivan Kalik

2 1

adding eap-tls/peap/ttls support to freeradius problem
by Tomas Pelka 19 Nov '09

19 Nov '09

Hi guys, have some problems with compiling freeradius with eap-tls/peap/ttls support. configure running: ./configure --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --with-rlm_eap_tls \ --with-rlm_eap_ttls \ --with-rlm_eap_peap \ --without-rlm_eap_tnc \ --without-rlm_otp \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-openssl \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --without-rlm_counter \ --without-rlm_ldap Gcc output: /usr/bin/libtool --mode=link gcc -release 2.0.4 \ -module -export-dynamic -o rlm_sql_log.la \ -rpath /usr/lib/freeradius rlm_sql_log.lo rlm_sql_log.c /usr/src/freeradius-2.0.4+dfsg/src/lib/libfreeradius-radius.la /usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la -lnsl -lresolv -lpthread libtool: link: cannot find the library `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la' or unhandled argument `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql/.libs/rlm_sql.la' make[7]: *** [rlm_sql_log.la] Error 1 make[7]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules/rlm_sql_log' make[6]: *** [common] Error 2 make[6]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules' make[5]: *** [all] Error 2 make[5]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src/modules' make[4]: *** [common] Error 2 make[4]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/src/freeradius-2.0.4+dfsg' make: *** [build-arch-stamp] Error 2 Am I missing something? Thanks for advice. -- Tom

2 2

Is there a simple way to activate accounts on demand ?
by Mazzz86 19 Nov '09

19 Nov '09

Hye guys, I'm using Freeradius on a MySQL database with DialupAdmin web interface. I would like to activate/desactivate users account on demand but i didnt find any easy way to do it. After reading some forums, I saw some tricks like updating the 'radcheck' table by putting "Reject" instead of the password. It's kind of annoying. If you guys have any ideas, let me know. Thanks. By the way, does someone know how to encrypt those passwords in 'radcheck' table to increase security ? -- View this message in context: http://old.nabble.com/Is-there-a-simple-way-to-activate-accounts-on-demand-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 18 Nov '09

18 Nov '09

Hi all, I am wondering if someone will be able to point me in the correct direction with a setup I am trying to achieve. Basically we are rolling out a new offering to our customers where we want to have our LAC's query our radius servers which will then proxy requests on to our customer's radius servers based on the domain used in the username. I have got all of the proxy'ing working within radius - nice and easy following the wiki and instructions - thanks. My problem is that the response I send to our LAC has to contain extra information depending on the domain. Is it possible to query a local mysql database for this extra information (these are cisco av pairs needed to establish the tunnels between the LAC and LNS) and add it into the Access-Accept message that is returned to the LAC from the radius? An example would of what I have at the moment is: Sending Access-Accept of id 6 to xx.xx.xx.xx port 51274 Framed-IP-Address = 192.168.0.1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Tunnel-Server-Endpoint:0 = "yy.yy.yy.yy" And I need it contain 3 extra lines that would be stored locally (in italics): Sending Access-Accept of id 6 to xx.xx.xx.xx port 51274 Framed-IP-Address = 192.168.0.1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Tunnel-Server-Endpoint:0 = "yy.yy.yy.yy" Tunnel-Type:0 = L2TP Tunnel-ID=DEFGH L2TP-Tunnel-Password=ABCDE" This is currently running on FreeRADIUS Version 2.1.7. I have read the documentation and the mailing lists but cant seem to find anyone who has had to do a similar thing. Kind Regards Dan Fisher Technical Manager get your data flowing ... DDI: 020 7099 8985 Tel: 0845 868 7848 Fax: 0845 868 7858 danfisher(a)fluidata.co.uk <mailto:danfisher@fluidata.co.uk> www.fluidata.co.uk <http://www.fluidata.co.uk/> This message is intended solely for the use of the individual or organisation to whom it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Fluidata Ltd. Fluidata accepts no responsibility for loss or damage arising from its use, including damage from virus.

2 1

Other authentication method installation after
by Wagner Pereira 18 Nov '09

18 Nov '09

Alan, What I got from your website, Deploying Radius, was I can choose other authentication method after I install freeradius using PAP. Am I right? In that case, what would be the impact in a server running? -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

2 1

clients.conf
by Peter Carlstedt 18 Nov '09

18 Nov '09

Hello everyone again! Well as you may understand from the Subject I have a question about how clients.conf works. I´ve read the documentation in the file about how to add a client but when i tired to add another client it stoped working. I will try to explain how I have setup the network. I have one radius server connected to a Netgear wired switch, from that switch I have a AP(Mikrotik) connected. What I am trying to do is to add the Mikrotik into the clients.conf file but when I do i get an error at startup(dont remember the error message). Right now im instead using client 192.168.118.0/24{ } which accepts all NASes in the subnet. What i wrote in clients.conf before i changed to include a whole subnet is: client Netgear{ ipaddr = x.x.x.x netmask = 24 secret = xxxxxx require_message_authentication = no } client Mikrotik { ipaddr = x.x.x.x netmask = 24 secret = xxxxxxx require_message_authentication = no } What I am wondering about is if I have done a correct setup when trying to add several stand alone clients? Best regards/ Peter > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 55, Issue 52 > To: freeradius-users(a)lists.freeradius.org > Date: Thu, 12 Nov 2009 08:43:56 +0100 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (Ivan Kalik) > 2. Re: I need some help with freeradius 2.0.4 (Wagner Pereira) > 3. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (Wagner Pereira) > 4. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > (tnt(a)kalik.net) > 5. SSL renegotiation ? (John) > 6. Re: FreeRadius with 3COM (Guk Victor) > 7. Microsoft: SmardCard or Certificate Auth (swatzy) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Nov 2009 19:30:35 +0000 > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB10DB.7040106(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Wagner Pereira wrote: > > Dear colleagues, > > > > I am introducing now a new information. Below is what is declared into my IOS - > > Cisco 6500. Is this correct? > > > Why don't you just read the cisco wiki page. > > > Ivan Kalik > Kalik Informatika ISP > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Nov 2009 17:42:15 -0200 > From: Wagner Pereira <wpereira(a)pop-sp.rnp.br> > Subject: Re: I need some help with freeradius 2.0.4 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB1397.9000002(a)pop-sp.rnp.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Ok, Ivan. I guess I removed that HTML craps now : ) > > Below is my new radgroupreply: > > mysql> select * from radgroupreply; > +----+-----------+---------------+----+-----------------------+------+ > | id | groupname | attribute | op | value | Prio | > +----+-----------+---------------+----+-----------------------+------+ > | 3 | pop-sp | Service-Type | := | NAS-Prompt-User | | > | 5 | reject | reply-message | := | Autentica??o recusada | NULL | > +----+-----------+---------------+----+-----------------------+------+ > 2 rows in set (0.00 sec) > > Hugs, > > -- > > Wagner Pereira > > PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo > CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo > http://www.pop-sp.rnp.br > (11) 3091-8902 > > > > tnt(a)kalik.net escreveu: > >> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> > >> > > > > Enough with that HTML!!!! It produces extraordinary ammount of crap as you > > can see: > > > > > >> I did what you recommended (I guess). See below:<br> > >> > > > > No, you didn't. But getting closer. > > > >> |  1 | pop-sp    | Framed-Compression | := | > >> Van-Jacobson-TCP-IP   > >> > > > > Remove *all* Framed attributes. > > > > > >> |  3 | pop-sp    | > >> Service-Type       | := | > >> NAS-Prompt            > >> |      | <br> > >> > > > > That should be NAS-Prompt-User. > > > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 3 > Date: Wed, 11 Nov 2009 17:57:18 -0200 > From: Wagner Pereira <wpereira(a)pop-sp.rnp.br> > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4AFB171E.4010105(a)pop-sp.rnp.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Ivan, > > I already read the Cisco wiki page and I implemented what they > recommend, but it's not working yet. > > -- > > Wagner Pereira > > PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo > CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo > http://www.pop-sp.rnp.br > (11) 3091-8902 > > > > Ivan Kalik escreveu: > > Wagner Pereira wrote: > >> Dear colleagues, > >> > >> I am introducing now a new information. Below is what is declared > >> into my IOS - Cisco 6500. Is this correct? > >> > > Why don't you just read the cisco wiki page. > > > > > > Ivan Kalik > > Kalik Informatika ISP > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Wed, 11 Nov 2009 22:01:33 -0000 (UTC) > From: tnt(a)kalik.net > Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <49743.87.194.16.13.1257976893.squirrel(a)www.kalik.net> > Content-Type: text/plain;charset=iso-8859-1 > > > I already read the Cisco wiki page and I implemented what they > > recommend, but it's not working yet. > > Does the debug now show Nas-Prompt-User in Access-Accept packet? If it > does - it's some problem on the router - debug ip ssh. > > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 5 > Date: Thu, 12 Nov 2009 11:01:44 +0800 (CST) > From: John <elmer_radius(a)yahoo.com.cn> > Subject: SSL renegotiation ? > To: freeradius-users(a)lists.freeradius.org > Message-ID: <145589.77590.qm(a)web15706.mail.cnb.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > I found??a new man-in-the-middle attack with SSL.? http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-d… > ? > I am afraid if freeRADIUS use SSL renegotiation?? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection.? > Does??freeRADIUS use SSL renegotiation ? > ? > Thanks. > John > > > ___________________________________________________________ > ????????????????? > http://card.mail.cn.yahoo.com/ >

6 16

Re: Book About Free-Radius Configurations
by INACIO ALVES 18 Nov '09

18 Nov '09

Thanks Alan Dekok, I think that I saw in your blog that you is writting a book about RADIUS. The project continues? And about the book http://www.amazon.com/Radius-Jonathan-Hassell/dp/0596003226/ref=pd_sim_b_3 do you know it? I'm need to buy some book to configure a freeradius server on my network. Thanks, Inácio Alves Bacharel em Matemática(UFC)/Técnico em Conectividade(IFCE) http://www.polluxweb.com/inacioalves/site

9 13

Re: Authenticate Many Sites on dynamic IPs through One Freeradius Server
by Charles (KOL) Goma 18 Nov '09

18 Nov '09

I have test-configured freeradius to work on my hotspot. It works fine and I am happy. I am planning to have about 17 of my sites authenticate through one freeradius server. These 17 HOTSPOTS are in different parts of the country and have dynamic IPs. 1. How do I configure that in clients.conf? 2. Bandwidth charges are different in most of the 17 sites. How can i set these billing difference in my setup. Any lead on these two will be highly appreciated. Charles

3 2

Expanding run-time variables and checking access_attr for allow
by Nicolás Velázquez 18 Nov '09

18 Nov '09

Hi all, We are running 2.1.3 and we'll upgrade soon for several reasons. Two of them can be the questions I'll explain now. We need to search the authorize check for users in one place of LDAP tree and the user password must be checked in another place. My config file is as follows: dictionary_mapping=/etc/raddb/ldapmap_vpn.conf ldap_connections_number=10 timeout=10 server="ldap://canela.ti.uam.es" port=389 identity="cn=uam_voip_admin,cn=users,dc=uam,dc=es" password="#######" base_filter = "(uniquemember=cn=%{User-Name},cn=users,dc=uam,dc=es)" basedn="dc=uam,dc=es" filter="(uid=%{Stripped-User-Name:-%{User-Name}})" default_profile = "cn=ACCESSO_CUDI,cn=Groups,dc=uam,dc=es" access_attr_used_for_allow = yes access_attr = "cn" The non-usual parameters to do what we need are base_filter and default_profile. But the problem is that base_filter doesn't expand. The debug shows us the process and base_filter doesn't expand. rad_recv: Access-Request packet from host 150.244.108.4 port 1025, id=69, length=158 User-Name = "nicolas.velazquez(a)uam.es" User-Password = "########" NAS-Port = 5259264 Called-Station-Id = "150.244.108.4" Calling-Station-Id = "150.244.2.23" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "150.244.2.23" NAS-IP-Address = 150.244.108.4 Cisco-AVPair = "ip:source-ip=150.244.2.23" server vpn_auth { +- entering group authorize {...} [suffix] Looking up realm "uam.es" for User-Name = "nicolas.velazquez(a)uam.es" [suffix] Found realm "uam.es" [suffix] Adding Realm = "uam.es" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [users_vpn] users: Matched entry DEFAULT at line 3 [users_vpn] expand: %{User-Name} -> nicolas.velazquez(a)uam.es [users_vpn] users: Matched entry nicolas.velazquez(a)uam.es at line 16 ++[users_vpn] returns ok [uam_vpn] performing user authorization for nicolas.velazquez(a)uam.es [uam_vpn] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [uam_vpn] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=nicolas.velazquez(a)uam.es) [uam_vpn] expand: dc=uam,dc=es -> dc=uam,dc=es rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap://canela.ti.uam.es, authentication 0 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as cn=uam_voip_admin,cn=users,dc=uam,dc=es/######## to ldap://canela.ti.uam.es rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=uam,dc=es, with filter (uid=nicolas.velazquez(a)uam.es) [uam_vpn] checking if remote access for nicolas.velazquez(a)uam.es is allowed by cn rlm_ldap: performing search in cn=ACCESSO_CUDI,cn=Groups,dc=uam,dc=es, with filter (uniquemember=cn=%{User-Name},cn=users,dc=uam,dc=es) rlm_ldap: object not found or got ambiguous search result [uam_vpn] default_profile/user-profile search failed [uam_vpn] looking for check items in directory... [uam_vpn] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [uam_vpn] user nicolas.velazquez(a)uam.es authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[uam_vpn] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop Found Auth-Type = UAM_VPN +- entering group UAM_VPN {...} [uam_vpn] login attempt by "nicolas.velazquez(a)uam.es" with password "#######" [uam_vpn] user DN: cn=nicolas.velazquez(a)uam.es,cn=Users,dc=uam,dc=es rlm_ldap: (re)connect to ldap://canela.ti.uam.es, authentication 1 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as cn=nicolas.velazquez(a)uam.es,cn=Users,dc=uam,dc=es/######## to ldap://canela.ti.uam.es rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [uam_vpn] user nicolas.velazquez(a)uam.es authenticated succesfully ++[uam_vpn] returns ok Login OK: [nicolas.velazquez(a)uam.es] (from client asa-vpn port 5259264 cli 150.244.2.23) } # server vpn_auth Sending Access-Accept of id 69 to 150.244.108.4 port 1025 User-Name = "nicolas.velazquez(a)uam.es" Class = "OU=########" Finished request 0. Is this a failure corrected in any of the versions form 2.1.3? Or am I doing anything wrong? The second question. If I put, ONLY FOR CHECK, the base_filter = "(uniquemember=cn=nicolas.velazquez(a)uam.es,cn=users,dc=uam,dc=es)" the LDAP replies with No Such Object. But the radius authorization sends ok. The misconfiguration of LDAP is not the question here. The question here is: documentation says if the parameter not exists the authorization doesn't work. Is the server using the cn string used in the request? Am I doing ANOTHER thing wrong? Thank you very much in advance, Nicolas Nicolás Velazquez Campoy Unidad Técnica de Comunicaciones Tecnologías de la Información. UAM http://rincon.uam.es/dir?cw=389407348632812

1 0

Re: help--- IPsec VPN on radius
by Yagnesh Dave 18 Nov '09

18 Nov '09

Hi, Found the problem, it is with the service type attribute. I am getting this error on the freeradius /usr/local/etc/raddb/users[24719]: Parse error (reply) for entry tatablue-vpn.vsnl.net: Unknown value outbound for attribute Service-Type How to rectify this problem of "outbound" service type. Regards, Dave On Wed, 18 Nov 2009 16:22:30 +0530 wrote >Hi, > > I am trying to configure this on Free Radius; > > # setup for IPSec VPDN, > ezvpn Password := "cisco" > Service-Type = outbound, > Cisco-Avpair = "ipsec:tunnel-password=cisco123", > Cisco-Avpair="ipsec:tunnel-type*esp", > Cisco-Avpair="ipsec:group-lock=1", > Cisco-Avpair="ipsec:key-exchange=ike", > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > test@ezvpn Password := "test123" > Cisco-Avpair="ipsec:tunnel-type*esp", > Cisco-Avpair="ipsec:group-lock=1", > Cisco-Avpair="ipsec:key-exchange=ike", > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > Now, When I run the freeRadius, I get this error in the log file > > /usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type > Errors reading /usr/local/etc/raddb/users > > > Please tell what is the correct config to get it working. > > Regards, > Dave. > >

1 0