- Freeradius-Users - lists.freeradius.org

re: Filtering in sites-enabled default file
by Nick Sparkes 03 Jun '09

03 Jun '09

Hello, I was wandering if anyone can help me. I am trying to set up freeradius 2.1.x In the authorized section of default, we have the following coding: if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { update request { Realm := "%{2}" } if(!"%{2}" || ("%{2}" == "worc.ac.uk") || ("%{2}" == "worcester.ac.uk") ){ update request { Realm := "worc" } } } else{ update request { Stripped-User-Name := "anonymous" Realm := 'local' } } switch "%{Realm}" { case "worc" { update control { Proxy-To-Realm := "worc" } update request { Realm := "worc" } # Don't do any proxy stuff here, request will be handled later. } case { update control { Proxy-To-Realm := "jrs" } update request { Realm := "jrs" } } } This should check the extension to the user name, if it is worc or Worcester it will use the realm "worc", if it is anonymous, use the "local" realm. Otherwise use the "jrs" realm. Which works fine. There is a problem, as our users are split into 2 separate section, staff & students. Above works fine for staff, as the realm "worc" handles this authentication. But we do need to filter the students & place these in another realm, "student". The staff login id is: Psna1(a)worc.ac.uk Whereas the student login is in the format: Psdn1_03(a)worc.ac.uk Would it be possible to filter on the format of the userid? The student id has `_02 on it. Regards, Nick.

2 1

Stop alive requests in a dead realm
by Santiago Balaguer García 03 Jun '09

03 Jun '09

Hi, I am using freeradius 2.1.3 for my AAA servers. I have a little problem when a third-patner RADIUS is dead. My problem is my freeradius send the following status packect every 2-5 seconds. Sending Access-Request of id 77 to 200.160.126.23 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.0 seconds. Cleaning up request 3 ID 151 with timestamp +723 Waking up in 2.9 seconds. I want to avoid this test because my partner tell me that I send too many trafic ('operator' is the realm name). proxy.conf file -------------- proxy server { default_fallback = yes } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 } home_server virtual.example.com { virtual_server = virtual.example.com } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm operator { type = radius authhost = 200.160.126.23 :1812 accthost = 200.160.126.23 :1813 secret = my_secret strip } _________________________________________________________________ ¿Quieres ver los mejores videos de MSN? Enciende Messenger TV http://messengertv.msn.com/mkt/es-es/default.htm

2 1

is it possible one certificate for only user
by Abdullah Dizdar 03 Jun '09

03 Jun '09

Hello; I have been using freeradius with CA, eap. I am also using OPENSLL certificates My question is that how to use only one certificate for only one user. How to configure my raddb.conf, eap.conf, users for only one user. Best regards,

1 0

Re: DISABLE THREAD_TLS
by Ming-Ching Tiew 03 Jun '09

03 Jun '09

--- On Tue, 6/2/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > > I am trying to compile freeradius on uclibc, it complains > of undefined symbol > __tls_get_addr. So I went to modify > src/include/autoconf.h, and commented > #define HAVE_THREAD_TLS 1, then the compilation was > successful. My question is > what do I missed from disabling THREAD_TLS ? Does it mean > performance impact ? > Will it mean freeradius will be slower, consuming more > memory or what ? > Apparently src/lib/log.c is the only source which uses HAVE_THREAD_TLS, and from the source I can see that once I disable HAVE_THREAD_TLS, in my case, the code will be USE_PTHREAD_FOR_TLS. Sorry this sounds like something for the developer folks but it remains as a user question:- What is the performance impact of disabling THREAD_TLS but USE_PTHREAD_FOR_TLS instead ? Thank you for your attention.

2 1

Configuring Freeradius with Ldap Windows Server 2003
by Hari Novferdianto 03 Jun '09

03 Jun '09

Hi, How configuring freeradius with ldap windows server 2003 ? I do in my freeradius, when I installed it is ./configure --prefix=/usr/local/freeradius --with-modules="rlm-ldap" Until I'm configured in radiusd.conf It's Still radiusd.conf[744] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory radiusd.conf[1956] Unknown module "ldap". radiusd.conf[1956] Failed to parse "ldap" entry. I'm confused now...

2 1

freeRADIUS
by Just E. Mail 03 Jun '09

03 Jun '09

I am trying to install freeRADIUS on a CentOS 5.3 machine with PostgreSQL-8.3.7. My plan is to first install freeRADIUS and test it then setup PostgreSQL as the backend to store data. Is there any freeRADIUS RPMS V#2.1.4 or newer for CentOS? Jennifer

6 19

windows2003+freeradius+ad
by miaowang 03 Jun '09

03 Jun '09

Hello, I install freeradius on WIN2003,i want use AD as user database, how to config radiusd.conf? LDAP or NTLM_Auth? I can not find NTLM_Auth on windows 2003 , LDAP=AD? thanks ! miao 2009-06-03 miaowang

1 0

DISABLE THREAD_TLS
by Ming-Ching Tiew 02 Jun '09

02 Jun '09

I am trying to compile freeradius on uclibc, it complains of undefined symbol __tls_get_addr. So I went to modify src/include/autoconf.h, and commented #define HAVE_THREAD_TLS 1, then the compilation was successful. My question is what do I missed from disabling THREAD_TLS ? Does it mean performance impact ? Will it mean freeradius will be slower, consuming more memory or what ? Regards.

1 0

firewall
by jon jon 02 Jun '09

02 Jun '09

Does your freeradius server have to have a rc.firewall? If so does freeradius come with a script for one? jon

3 3

Unlang to switch between ldaps
by Diego Martín Capello 02 Jun '09

02 Jun '09

Hello everyone, I'm using freeradius 2.0.4 with a ldap server as a backend for authentication of users to our wireless network. I've defined two ldap "servers" in the radiusd.conf file: ..... ldap ldap_uba { server = "ldap_server" basedn = "dc=uba,dc=ar" filter = "(&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}}))" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap ldap_ccc { server = "ldap_server" basedn = "ou=CCC,dc=uba,dc=ar" filter = "(&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}}))" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } .............. I want to switch between them based on the NAS-IP-Address of the arriving request, so I've used unlang in the authorize section: authorize { unix mschap eap { ok = return } files switch "%{NAS-IP-Address}" { case 192.168.168.11 { ldap_ccc } case { ldap_uba } } expiration logintime auth_log pap } Well, my problem is that freeradius doesn't assign or expand the NAS-IP-Address attribute with the correct value of the NAS IP which is requesting for authentication, could anyone help me with this little issue? POST of the debug mode of freeradius: rad_recv: Access-Request packet from host 192.168.168.11 port 1041, id=6, length=279 Message-Authenticator = 0x341f20c2e434d8cbd92d85defa321b38 Service-Type = Framed-User User-Name = "diego(a)ccc.uba.ar\000" Framed-MTU = 1488 State = 0x12b38bc817b592297c4cea524b70e440 Called-Station-Id = "00-13-46-7A-DB-63:REDI-UBA VLAN12" Calling-Station-Id = "00-02-72-78-90-5B" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206003b1900170301003091d34cda32a72417c4e5e093d71f2d82fc67e0f1f3dc1483aec15e433d54c5c950e88c2f64c3fd6d8ddf656af63496d1 NAS-IP-Address = 192.168.168.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "ccc.uba.ar" for User-Name = "diego(a)ccc.uba.ar" rlm_realm: No such realm "ccc.uba.ar" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 59 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - diego(a)ccc.uba.ar PEAP: Got tunneled EAP-Message EAP-Message = 0x0206001501646965676f406363632e7562612e6172 PEAP: Got tunneled identity of diego(a)ccc.uba.ar PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to diego(a)ccc.uba.ar PEAP: Sending tunneled request EAP-Message = 0x0206001501646965676f406363632e7562612e6172 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "diego(a)ccc.uba.ar" server inner-tunnel { +- entering group authorize ++[unix] returns notfound ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop expand: %{NAS-IP-Address} -> ++- entering switch %{NAS-IP-Address} +++- entering case rlm_ldap: - authorize rlm_ldap: performing user authorization for diego(a)ccc.uba.ar WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}})) -> (&(description=wireless)(mail=diego(a)ccc.uba.ar)) expand: dc=uba,dc=ar -> dc=uba,dc=ar rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.ccc.uba.ar:389, authentication 0 rlm_ldap: bind as / to ldap.ccc.uba.ar:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=uba,dc=ar, with filter (&(description=wireless)(mail=diego(a)ccc.uba.ar)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "pepe1234" rlm_ldap: looking for reply items in directory... rlm_ldap: user diego(a)ccc.uba.ar authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++++[ldap_uba] returns ok +++- case returns ok ++- switch %{NAS-IP-Address} returns ok ++[expiration] returns noop ++[logintime] returns noop expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.168.11/auth-detail-20090528 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.168.11/auth-detail-20090528 expand: %t -> Thu May 28 12:33:26 2009 ++[auth_log] returns ok rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0107002a1a0107002510a707e4f41d139b10e7d9860e8e17a80e646965676f406363632e7562612e6172 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48fe8ac948f9909b9915b8554a615778 PEAP: Processing from tunneled session code 0x8623f78 11 EAP-Message = 0x0107002a1a0107002510a707e4f41d139b10e7d9860e8e17a80e646965676f406363632e7562612e6172 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48fe8ac948f9909b9915b8554a615778 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.168.11 port 1041 EAP-Message = 0x0107004b190017030100409a85d96e6b404149561fbe6dfb464b692f986263d5215ec98e2d84f3c1961a462dbd097150d5bba0e0f8b29fe80e038f691dee73f0352576d1cec4fe36d9a3eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12b38bc814b492297c4cea524b70e440 Finished request 6. After making some test, debugging and drink lot of coffee I've solved the problem usign this fragment of code: switch "%{Client-IP-Address}" { case 192.168.168.11 { ldap_ccc } case { ldap_uba } } Freeradius does expand the Client-IP-Address attribute, however, I would like to know why it doesn't expand the NAS-IP-Adress attribute. Sorry for my english and lot of thanks......... -- Diego Martín Capello Administrador RedUBA Centro de Comunicación Científica Universidad de Buenos Aires

2 2