- Freeradius-Users - lists.freeradius.org

Remove AV pair in post_proxy/pre_proxy section
by R.Filatov＠ttk.ru 08 Jun '09

08 Jun '09

Hello! Example, this code based on rlm_perl don't work sub post_proxy { # For debugging purposes only delete $RAD_REPLY{"ERX-Ingress-Policy-Name"}; #return RLM_MODULE_OK; return RLM_MODULE_UPDATED; } Attribute ERX-Ingress-Policy-Name avalible in recive packet Best Regards Filatov Ruslan

2 1

How to activate the certificate revocation list I created
by Josh Hiner 08 Jun '09

08 Jun '09

Hello, I have been searching for documentation on activating a certificate revocation list I just created with openssl. It is a crl.pem signed by my ca cert. I just need freeradius to reference it so that the one certificate I revoked gets denied on authentication. Here is what I have so far in my eap.conf (I am running freeradius 2.1.3 on REHL) crl_file = ${raddbdir}/certs/makecertificates/issued/crl.pem check_crl = yes CA_path = ${raddbdir}/certs/makecertificates/issued/ Are these lines correct? Are any lines I have up there unnecessary? Also, do I need to have my CA certificate in the same directory as the crl.pem file? It seems to hint towards that in the eap.conf file. Thanks for any help

2 2

eap-peap username/password problem
by kalesameer 08 Jun '09

08 Jun '09

i have implemented eap-peap using freeradius-2.1.1. i am using windows XP machines as clients. when users try to connect to server using the peap protocol,they are asked for their username and password. my problem is that once the users are connected to the server,they are not asked for a username/password when they try to connect after logging out of the network.the username/password that was used to connect to network initially, is used automatically for subsequent purposes to connect to the network. is it a problem of the XP clients?or is the radius server caching all the requests so that the next time no username/password is required?is there any way so that the users are asked for a username/password every time they want to connect after disconnecting(logging out)? -- View this message in context: http://www.nabble.com/eap-peap-username-password-problem-tp23915126p2391512… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Re: Re: eap-peap username/password problem
by David Mitton 08 Jun '09

08 Jun '09

1 0

Duplicate SQL records versus unique constraints
by Christian Balzer 08 Jun '09

08 Jun '09

Hello, First of, been using freeradius for 5-6 years now and we are happy campers thanks to it. Freeradius 2.04 (Debian Lenny package), but I don't think this is very version specific. Configuration is set for direct (sql, not sql_log) logging of accounting records into mysql. We've got a number of what can only be described as "maniac" customers which fire off new sessions every minute or 2 and one of these has managed to create over 2000 "identical" sessions, as far as actsessionid and the default generation of acctuniqueid are concerned. It seems that the NAS in question is prone to recycle actsessionids under the onslaught of this user (within days at times). We are talking to the upstream access provider about this, but I don't think much of anything will come out of it. In this setting the default key generation for the acctuniqueid of: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" did little to stop the duplicates, since only the Acct-Session-Id is variable (when not re-used by the NAS), the rest are more or less static. We changed the Client-IP-Address to Framed-IP-Address in the key generation as this gives a much, much smaller chance of duplicates. But of course it does not guarantee uniqueness either. In the analysis of this event it became clear that the sql module will happily update any and all records that share the same acctuniqueid with a new stop and session time, even if these were not NULL or 0 respectively. Never mind that this whole scenario should not happen in the first place it seems that overwriting valid data in an already "complete" accounting record would be big no-no. Could anybody comment on this? Given this behavior and the still existing (albeit vastly smaller) chance of future duplicate records making it into the database I have a question: If we add a CONSTRAINT to enforce uniqueness for acctuniqueid in the DB, will the failure to insert an accounting record confuse the freerad sql module and will those failures percolate up towards the radius protocol level and thus result in the NAS keep on sending that accounting packet? Regards, Christian -- Christian Balzer Network/Systems Engineer NOC chibi(a)gol.com Global OnLine Japan/Fusion Network Services http://www.gol.com/ https://secure3.gol.com/mod-pl/ols/index.cgi/?intr_id=F-2ECXvzcr6656

3 7

Reply-message and supplicant
by Sergio Belkin 08 Jun '09

08 Jun '09

Hi, Is possible that Reply-message can be seen from laptops running the supplicant? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 27

Question on proxying requests
by Josh Hiner 07 Jun '09

07 Jun '09

Have a question on proxying requests in Freeradius. I know how to proxy requests to other radius servers via the proxy.conf based on domain etc.. I would like to have one radius server and authenticate off multiple domain controllers based on domain using ntlm_auth. Right now I see that you can only configure ntlm_auth in the mschapv2 module in /etc/raddb/modules. This works fine for one domain. But if a user from domain ISD wants to authenticate on our wireless, I want the radius server to authenticate on the ISD file server (its a samba server). If the user is in the HTN domain I would like the radius server to authenticate off the HTN domain controller. Or maybe ntlm_auth isnt the way to do this? Maybe I'm looking at this the wrong way? Any ideas to get this to work or any other better ideas? Thanks! -Josh

2 1

Prevent uid sharing or hot to allow use uid only once
by Sergio Belkin 06 Jun '09

06 Jun '09

Hi, Let's suppose that John Doe comes and login with jdoe uid, then Joe comes and wants to use wireless network, but he has not entry neither Ldap nor in radius users file, so he ask for jdoe that pass him its uid and password to login. Sorry if that sounds somewhat stupid but can we prevent that from radius? (please don't tell me to fire John Doe ;) ). Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 7

Re: Building a test tool
by Vinit Karandikar 06 Jun '09

06 Jun '09

Thanks for the prompt responses, Alan. I have a one follow up question before I head off and start poking through code, doxygen and writing some code. > > Vinit Karandikar wrote: > > >> So if I could run 10 copies of radclient in one process (each in a >> different thread for example), I can write code to co-ordinate what each >> thread should do for each test case. >> > > The server comes with a RADIUS API. You can use the API to create an > application that sends and receives RADIUS packets. > Aha ! Where can I find information on this API for what you correctly described as "very custom" development that I'm looking to do ? > >> Hope this illustrates the functionality I mentioned as desired in my >> original email. >> In BOTH cases, the AAA server is expected to forward RADIUS requests to >> a different network element and it behooves a test application to see >> both ends. >> > > What you're describing is a RADIUS simulator for a specific test > environment. That doesn't exist. It is a *very* custom piece of software. > > FreeRADIUS can do a lot of this, but you will still need to write all > of the custom rules for processing, timing, etc. > > > >> The point once again is just to ask if >> a) there is already a tool that can simulate multiple network elements >> and co-ordinate between them to know when to expect a packet and when to >> initiate traffic >> > > ... for your specific environment, and your specific test cases. > > The answer to that is "no". > > > > Alan DeKok. > > > ------------------------------ > >

2 1

RE: FreeRadius 2.1 + LDAP Authentication - mschap
by Mackey, Theral 05 Jun '09

05 Jun '09

[mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sminhas with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Needs NT/LM passwords (or plain-text) for mschap to work. See perl's Crypt::SmbHash on CPAN for an easy way to generate the hash from plaintext. Look at the samba schema for openLdap, and probably want to compile the smbk5pwd module for openLDAP as well (in the contrib section of the source) to keep your pwds sync'd (also check pam/nssldap conf for passwd changes using LDAP-exop if you let shell accounts change pwds too). -T ----------------------------- Message: 7 Date: Fri, 05 Jun 2009 14:47:36 -0400 From: Nik Alleyne <nalleyne(a)brontecollege.ca> Subject: FreeRadius 2.1 + LDAP Authentication To: freeradius-users(a)lists.freeradius.org Message-ID: <20090605144736.cpa0ghg1wk4ok4gk(a)mail.brontecollege.ca> Content-Type: text/plain; charset=ISO-8859-1 Hi Guys, I'm hoping someone can help me, because I have been fighting with this issue for days now. Environment: FC10 + FreeRadius 2.1 + OpenLdap 2.4. I've successfully setup Certificate Based authentication on my FreeRadius server and that works well. My problem is I have some users I want to authenticate via username and password (EAP-PEAP). I configured FreeRadius for such and my radtest (Access-Accept) works as well as my NTRadPing Utility (Access-Accept) when checked against the users in LDAP. However, I cannot seem to get my Windows XP Wireless Clients to authenticate. Please see my debug info below for a sample user "sminhas" who has a cleartext LDAP password as "it". Thanks for the help. ---------------- radiusd -X ---------------------..snip

1 0