- Freeradius-Users - lists.freeradius.org

Freeradius, PostgreSQL and One-Time-Password backends
by mikoi 24 Jun '09

24 Jun '09

Hello. I am trying to replace an old Cisco Secure ACS with Freeradius. My idea is to use PostgreSQL as a database where all information is added (users, nases etc), but instead of passwords i want Freeradius to ask a backend One-Time Password system (safeword) if a users profile contains a value. For instance: Auth-database = safeword or Auth-database=Portwise Is this possible to do and if so can you give some info how to configure this? Regards M -- View this message in context: http://www.nabble.com/Freeradius%2C-PostgreSQL-and-One-Time-Password-backen… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

Access provide to TWO Servers dependant on Group?
by Neville 24 Jun '09

24 Jun '09

Let me explain my setup. I have TWO Servers, with one running PoPtop+Radius plugin / freeradius 2.1.6 / SQL DaloRadius Setup Connection is INTERNET>PPP>FREERADIUS>LAN User X connects to Server A and authenticates against freedradius running on Server A and is provided with Access use mschap v2 authentication and this works fine.. What I would like to do is setup Server B to authenticate against freeradius on Server A, but ONLY allow access to Server B if the connecting user belongs to a specific Group. If group is the correct approach? I'm looking at setting up TWO Groups. Default Group to allow access to Server A only, but if you belong to GROUPX, you will be allowed access to both Server A and Server B. How do I setup this access in SQL against a user and what Check / Reply attributes, if any do I need to use? Many Thanks for your Support Nev

2 1

Variable name for Minute
by Sajeewa Warnakulasuriya 24 Jun '09

24 Jun '09

Hi all, I understand that variable %H is for request hour, I was wondering the variable name for request minute? This is so that I can rotate the sql relay log file every minute. Regards, Sajeewa Warnakulasuriya Systems Development Manager ispONE is a wholesale ISP built to help internet access resellers and independent ISPs to compete in the Australian marketplace through ONE Brand, ONE Provider, ONE Solution. Level 14 520 Collins Street Melbourne 3000 VIC Phone: 1300 663 400 Fax: 1300 665 400 E-Mail: sajeewaw(a)ispone.com.au Web: http://www.ispone.com.au/

3 8

RE: rlm_raw not included in compile
by Eric Geier 24 Jun '09

24 Jun '09

The module isn't being included after install (it's not with the other modules in the usr/lib/freeradius dir) When I run "./autoconf.sh", it says No Such File or Directory. Right now I'm trying this from Ubuntu 8.04. I've installed "autoconf" and "autoconf2.13" I found usr/bin/autoconf...so I thought I'd give that a try. When I run "usr/bin/autoconf" from the source root dir of FR, it says Warning AC_CONFIG_SUBDIRS you should use literals .../.../lib/autoconf/status.m4:919 AC_CONFIG_SUBDIRS is expanded from...configure.in:1120: the top level I see acconfig.h in the source root dir of FR; should I do anything with this? The FR installation notes say for me to use Debian build steps; should I make the same edits as you did to the debian /rules file? After doing these steps, I follow the debian build step: fakeroot dpkg-buildpackage -b -uc Thanks, Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Johan Meiring > Sent: Monday, June 22, 2009 9:26 AM > To: FreeRadius users mailing list > Subject: Re: rlm_raw not included in compile > > Eric Geier wrote: > > Johan, > > > > I'm a Linux/freeradius newbie, and I don't understand what you meant > by "had > > to run autogen.sh first". > > > > I had to do the following: > > 1) dump rlm_raw in src/modules > 2) run "touch src/modules/rlm_raw/configure" from the freeradius source > root directory. > 3) run "./autoconf.sh" from the freeradius source root directory. > 4) I use debian so I edited debian/rules > looked for the "configure" line, and added: > --with-modules=rlm_raw \ > --with-experimental-modules \ > If you do a manual compile, add this to you configure line. > If you use something else, ask them how to add it to configure. > > > > I'm actually using 1.1.7.so I don't think I need to make the two > changes you > > mentioned. > > > > Also, what did you mean by "touch src/modules/rlm_raw/configure" and > "added > > rlm_raw to debian configure by editing debian/rules" in a previous > post? > > > > Thanks! > > Eric > > > >> -----Original Message----- > >> From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > >> [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] > On > >> Behalf Of Johan Meiring > >> Sent: Friday, May 29, 2009 12:16 PM > >> To: FreeRadius users mailing list > >> Subject: Re: rlm_raw not included in compile > >> > >> Alan DeKok wrote: > >>>> Does anyone have a clue how to add rlm_raw to the current git tar > >> file? > >>> $ tar -zxf freeradius-server-2.1.7.tar.gz > >>> << add rlm_raw >> > >>> $ tar -zcf freeradius-server-2.1.7.tar.gz freeradius-server-2.1.7 > >>> > >> It wasn't that simple because rlm_raw did not contain a configure > >> script. > >> > >> You had to run autogen.sh first. > >> > >> > >>>> PS:he rlm_raw I'm using comes from > >>>> http://lists.cistron.nl/pipermail/freeradius-devel/2005- > >> January/007873.html > >>> That was before version 2.0 was released. You'll likely have to > >>> update the module to use the new API's && header files in 2.0. > >>> > >> Using my "copy and paste" method of c coding (I know VERY little > about > >> c) I maneged to copy the code from the old rlm_raw into rlm_example. > >> > >> I needed to make two changes to get it to compile. > >> > >> 1) replace strNcpy with strncpy > >> 2) replace radlib_safeprint with fr_print_string > >> > >> It compiled and IT WORKS!!! > >> > >>> Alan DeKok. > >> > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.339 / Virus Database: 270.12.87/2195 - Release Date: > 06/22/09 06:54:00

2 1

IP Pools How ?
by Dogus Yalman 24 Jun '09

24 Jun '09

Hello ; New to this great mailing list and the whole linux world so please bare with me. :) Im using FreeRADIUS Version 1.1.7 with fedora core 10 and my freeradius frontend is DMA Softlabs Radius Manager. http://www.dmasoftlab.com/cont/home My clients are authenticating through distrubuted remote pppoe servers on a wireless network. I want to use freeradius Ip Pool functionality to assign dynamic public IPs to customers since my frontend doesnt support that feature. Is there a step by step approach on how to do it ? is just modyfying the radius.conf and users file is enough? Do i have to create any sql tables for this ? Thanks and greetings from Northern Cyprus

2 1

FreeRADIUS and syslog message changes
by JR Mayberry 23 Jun '09

23 Jun '09

Hi, OK - so I'm using an proxy setup and need better logging. Sample messages Jun 23 13:54:59 localhost radiusd[23703]: Login OK: [rmayberr] (from client 0.0.0.0/0 port 1812) Assuming that 0.0.0.0/0 is coming from the clients file. Adding individual clients isn't an option. I want this log to include the Client-IP-Address or NAS-IP-Address instead of the clients file entry. I've tried other options like a perl module that looks at RADIUS attributes, but freeradius doesn't call post_proxy on an Access-Reject, so I can only log authentication accepts... Ideas how to get this accomplished? Thanks

3 2

Re: Re : Re : Re : Re : Radius+Huwaei switch + auto VLan, Assignment issue
by Guk Victor 23 Jun '09

23 Jun '09

You will place use-tunneled-reply=yes in peap config. This is right config 3Com 4500(V3.03.00): # domain default enable company # dot1x dot1x authentication-method eap undo dot1x handshake enable # radius scheme Radius server-type extended primary authentication x.x.x.x primary accounting x.x.x.x key authentication qwerty key accounting qwerty user-name-format without-domain # domain company scheme radius-scheme Radius vlan-assignment-mode string accounting optional # # interface Ethernet1/0/1 stp edged-port enable broadcast-suppression pps 3000 packet-filter inbound link-group 4999 rule 0 dot1x port-method portbased dot1x # File "users": username Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "2"

2 1

Re: NAS-IP-Address modified during Access-Request process
by kevin leblanc 23 Jun '09

23 Jun '09

On Mon, Jun 22, 2009 at 23:08, Ivan Kalik <tnt(a)kalik.net> wrote: > > I installed freeradius 2 but my problem is still there. > > To remember it : > > > > I configured Freeradius to look in openldap directory to authenticate and > > authorize an user. > > The authentication phase is OK > > During the authorize phase, a ldap search is done : if the user is member > > of > > a group identified by the host ip he wants to connect, the user is > > authorized. > > The problem is here : freeradius receives an Access-Request packet with a > > NAS-IP-Address (the good one) and to search in the ldap, it doesn't send > > the > > ip received in the packet but another one ! > > Dynamic expansion for Ldap and SQL-Group doesn't work in users file. I can > replicate this. But it works in unlang: > > if(Ldap-Group == "%{NAS-IP-Address}) { > ... > } > > will work just fine. > > Ivan Kalik > Kalik Informatika ISP > > :) It works fine ! To help users who have the same problem, I put these lines in authorize section : if(Ldap-Group == "%{NAS-IP-Address}") { ok } else { reject } Thanks ! -- KeV

1 0

sshd authentication
by maxim maxim 23 Jun '09

23 Jun '09

i try to do sshd authentication to external radius through a pam. on my linux i have freeradius client my packages: pam 1.0, pam_radius-1.3.17, openssh-4.3p2, freeradius-client-snapshot-20080830 my /etc/pam.d/sshd look like this: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth include system-auth #auth sufficient /lib/security/pam_radius_auth.so account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so My shared secret is configured in /etc/raddb/server file. The radiusclient.conf configured too sshd_config file: # $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # To disable tunneled clear text passwords, change to no here! PasswordAuthentication no ChallengeResponseAuthentication yes UsePAM yes Subsystem sftp /home/max/openssh-4.3p2/pc86//libexec/sftp-server when i try to connect to sshd i have log message of wrong password, i check it too on side of radius server.

2 2

Re : Radius+Huwaei switch + auto VLan Assignment issue
by Attou eric 23 Jun '09

23 Jun '09

Thanks very much for your answers. In our eap section, we had the following : copy_request_to_tunnel = no use_tunneled_reply = no Since we change these to : copy_request_to_tunnel = yes use_tunneled_reply = yes The Access-Accept message send VLAN attributes as below : Sending Access-Accept of id 43 to 192.168.100.5 port 5001 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "toto" MS-MPPE-Recv-Key = 0x69f0f1c436ccbe11df23099070ca2c3ceb6116c3246344a8d2c78c96a68fa146 MS-MPPE-Send-Key = 0x6aad292ef955ae61e910e51a9ae7d2b903f5e123c48dc4cc0e12f713490d2aa3 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 22 16:08:39 2009 : Debug: Finished request 10. Mon Jun 22 16:08:39 2009 : Debug: Going to the next request Mon Jun 22 16:08:39 2009 : Debug: Waking up in 4.0 seconds. Unfortunatly, the switch still not switching the port from VLAN 1 to VLAN 2. Maybe there is other misconfigurations on our switch or another settings in radius configurations ? Any ideas to help please! Best regards. ________________________________ De : "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 22 Juin 2009, 11h29mn 47s Objet : Re: Radius+Huwaei switch + auto VLan Assignment issue hi, have you set the copy tunnel = yes for the PEAP section in eap.conf? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 6