- Freeradius-Users - lists.freeradius.org

Correct operator in radcheck
by Santiago Balaguer García 23 Mar '09

23 Mar '09

Hi, I am several years working woth freeradius, bit recently I surgeg me a question: I do not want that johndoe account never connect from NASES with Client IP: * 195.56.53.23 * 96.53.26.59 * 56.15.86.35 * 56.15.86.36 I know I have to use the attribute Client-IP-Address, so radckech will content: username attribute op value ------------------------------------------------ johndoe Cleartext-Password := mypassword johndoe Client-IP-Address ?? 195.56.53.23 johndoe Client-IP-Address ?? 96.53.26.59 johndoe Client-IP-Address ?? 56.15.86.35 johndoe Client-IP-Address ?? 56.15.86.36 What is the correct op that I have to write? Thank you!! _________________________________________________________________ Descubre todas las formas en que puedes estar en contacto con amigos y familiares. http://www.microsoft.com/windows/windowslive/default.aspx

2 1

Help checking group membership with FreeRadius
by Josh Hiner 23 Mar '09

23 Mar '09

Currently we have a radius server that performs authentication off our samba domain controller for wireless users. This works great. I would like to limit users so they must be a member of the wireless group in order to connect. Since the /etc/group file is on a different server I believe I cannot use the etc_group module. Also, in order to use that module the user must have a valid account on the radius server as well. Any ideas on checking group membership? I use ntlm_auth in the mschap module for authentication in Freeradius ver 2.1.3-1. Here is the string in the users file to limit to the wireless group (its all on one line, email may wrap it): DEFAULT Called-Station-Id =~ "CCISD-REMC1", Group != "wireless", Auth-Type := Reject here is my ntlm_auth line: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=ISD --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" thanks for any help =D *** This Email was sent by a system administrator in REMC #1.

1 0

fake user and unregistered user forwarding
by Ümit AYDINLI(Teknotel) 23 Mar '09

23 Mar '09

Hi, Sory for bad English. Are we forward fake user and unregistered users to fake ip or redirect page. We are using freeradius on platform freebsd, databse server on postgresql. That is possible? Regards.

3 2

Reply with group attribute
by Markus Wernig 23 Mar '09

23 Mar '09

Hello all I'm terribly new to RADIUS, so please excuse my ignorance. What I'm looking for (and can't find in neither man nor wiki nor google) is how to send back the group an authenticated user is in together with the authentication result. I have a VPN gateway that authenticates users against freeradius, using the unix authentication scheme (the users are all real unix users on the freeradius server). All ok, works a charme. Now we have the requirement to apply different security settings to different user groups. The user groups are the unix groups the different users are in on the freeradius server. So I need the radius server to return the user's group information together with the Access-Accept. I'm sorry but for the life of me I can't find any information on how this is done. Could somebody please point me to the right direction? Thanks /markus

5 20

freeRaidus-PAM:: user password issue - Urgent help required
by krishna Mohan 23 Mar '09

23 Mar '09

Hi,I configured my FR server with PAM.When tried with radclient from localhost (where is FR is installed), user password is displaying in clear text; but when trying to authenticate the same user over network  (using ntradping), user password is showing in "unprintable chars". Following are my configs:radiusd.conf:------------1) pam {                #                #  The name to use for PAM authentication.                #  PAM looks in /etc/pam.d/${pam_auth_name}                #  for it's configuration.  See 'redhat/radiusd-pam'                #  for a sample PAM configurat! ion file.                #                #  Note that any Pam-Auth attribute set in the 'authorize'                #  section will over-ride this one.                #                pam_auth = radiusd        }2)  authenticate {     .......    pam ......   }clients.conf file:---------------client 127.0.0.1 {                secret          = testing123       &n! bsp;        shortname  &n bsp;    = localhost} client  192.168.100.192 {        secret          = testing123        shortname       = private-network-2}users file:----------John90                  Auth-Type = "Pam"                        Reply-Message = "Hello Welcome to Radius, %u"Following is the radius -X o/p:------------------------------rad_recv: Access-Request packet from host 192.168.200.196:4892, id=7, length=46        User-Name = "John90"        User-Password = "i\335T\334\227z\037\345?!<\014\024\220!\205" Processing the authorize section of radiusd.confmod! call: entering group authorize for request 1  modcall[authorize]: module "preprocess" returns ok for request 1  modcall[authorize]: module "chap" returns noop for request 1  modcall[authorize]: module "mschap" returns noop for request 1    rlm_realm: No '@' in User-Name = "John90", looking up realm NULL    rlm_realm: No such realm "NULL"  modcall[authorize]: module "suffix" returns noop for request 1  rlm_eap: No EAP-Message, not doing EAP  modcall[authorize]: module "eap" returns noop for request 1  modcall[authorize]: module "files" returns notfound for request 1rlm_pap: WARNING! No "known good" password found for the user.  Authentication may fail because of this.  modcall[authorize]: module "pap" returns noop for request 1modcall: leaving group authorize (returns ok) for request 1auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the userauth: Failed to valida! te the user.  WARNING: Unprintable characters in the password. ?& nbsp; Double-check the shared secret on the server and the NAS!Delaying request 1 for 1 secondsFinished request 1Going to the next request.......Verified the shared secret and it is given correctly in the request.Is there any configuration need to be done?Appreciate your help.Thanks,Sri

2 1

trying to use Post-Auth-Type REJECT to insert users
by Dave Sinclair 21 Mar '09

21 Mar '09

Hi, The high level goal is to have a new radius server "slurp" all the users on a DSL ATM aggregation link into a SQL database. We are taking over a bunch of users from a defunct ISP and don't have the UserName / Password data. What I'm thinking is that there should be a way to have Post-Auth-Type REJECT do two SQL insert commands. Then when the user tries to auth again there will be a valid user. Will this work ?? How to have two SQL statements run when this event is triggered??? Is there a better way ?? mucho thanks.;

4 4

How do I make FreeRadius,DaloRadius use PostgreSQL
by Sunday Olutayo 21 Mar '09

21 Mar '09

Please any help or resources on this? Sunday

2 1

Session-Timeout for disconnecting user
by Chris Li 21 Mar '09

21 Mar '09

Hi all, I am using Freeradius 2.1.3 to authenticate my users from AP via Active Directory. I have defined the time span that all users may login to the system in the users file: DEFAULT Login-Time := "Wk0630-0130,Wk1020-1033,Wk1240-1351,Wk1555-2359,Sa,Su" The logintime module calculates the number of seconds left in the time span, and sets the Session-Timeout to that number of seconds. How can i include Session-Timeout in the Access-Accept packet? Best Regards, Chris

2 1

Allow PEAP and TTLS, but reject TLS
by usawebbox＠fastmail.fm 21 Mar '09

21 Mar '09

I'm using Freeradius 2.1.1. My setup has been successfully authenticating TLS, TTLS, and PEAP for a while. Now I would like to deny TLS in the EAP negotiation, although the users will still have client certificates. I don't know how to reject TLS without breaking PEAP/TTLS. Those methods require the TLS block, which must then have the CA cert to validate the server certificate, and the server continues to use that to validate user certs. Problem: PEAP is my default EAP-type, but the client can nak it and choose EAP-TLS instead. I saw this comment in eap.conf: "If you do not use client certificates, and you do not want to permit EAP-TLS authentication, then delete this configuration item" (referring to CA_file) Unfortunately, this is not literally true. It sounded like a simple way to use the TLS block only to enable PEAP and TTLS, but if the CA cert is in "certificate_file" and the "CA_file" configuration item is deleted, EAP-TLS is still permitted as an authentication method. Note: I have read all the comments in this file, not just the one I quoted. If someone knows a way to do this, I would appreciate the knowledge. I suppose I would be willing to restrict the EAP-type only PEAP (or only TTLS) if that is the only way to reject EAP-TLS. Thank you. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Faster than the air-speed velocity of an unladen european swallow

2 1

Usernames with spaces
by Joeven Rex Dizon 21 Mar '09

21 Mar '09

I'm a relatively new freeradius user so I am not really an expert with it. I have two users in the racheck table: "admin" and "d6 40 1a 98". Both with passwords "admin198". Doing this: *radtest admin admin198 localhost 0 testing123* ..returns an Access-Accept packet. But doing this: *radtest "d6 40 1a 87" admin198 localhost 0 testing123* ..returns an Access-Reject packet. I wonder why the user with spaces in the username is being rejected. I've read somewhere that I need to specify "nospace_user". Can I edit that in the radiusd.conf? What should the value be: before, after or no? Our installed version is 2.1.0+dfsg-0ubuntu2, running on Ubuntu 8.10. The backend database we used is MySql. Thanks in advance. Joeven Rex L. Dizon

3 2