- Freeradius-Users - lists.freeradius.org

User-Id and Calling-Station-Id matching
by tech.subscriptions＠shepherdhill.biz 22 Feb '09

22 Feb '09

Hi, To prevent impersonation, we need to match User-Id and Calling-Station-Id during authentication. User-Id of the form 4371104 and Calling-Station-Id of the 234001014371104. Please how do I achieve this? Regards, Chris.

2 1

are multivalued LDAP-attibutes in authorization for replyItems possible?
by Tim Stone 22 Feb '09

22 Feb '09

Hello, I want to return to the radius client radius attributes from LDAP (authorization). I configured the module "LDAP" in radiusd.conf and the authorization in default site in the authorization section due to uncomment "ldap". Then i added my attribute mappings in the ldap.attrmap: replyItem Session-Timeout ldapTimeOut replyItem Idle-Timeout ldapTimeOut replyItem Colubris-AVPair ldapColAvPair and started the radiusd again. All working well, If a attribute is set in the LDAP-Account, the radius client is getting this too. But the ldapColAvPair is a multivalued attribute in LDAP. If I add more then one Value in LDAP for ldapColAvPair, the radiusd delivers only one (the first) to the radius client. Is this normal or can I configure the radiusd to return all values from the multivalued LDAP attribute? Thanx in advance, Tim Stone

3 3

How to Authenticate Mysql Users whit freeradius editing the users file
by Juan Pablo Botero 20 Feb '09

20 Feb '09

Hi. I had been installed freeradius 2.0.4 in debian 4.0 and with daloradius like web management interface Now i'm have an inconvenient with the users that i have in mysql. That users can autenthicate in mysql but, can't get authenticate completly; i think you know waht I mean. Freeradius don't authenticate with mysql, so it uses another ways like EAP, PAP an others. I had been edited the users file in the attribute auth-type with various values: Local, EAP, PAP, System... I got this when i try to loggin i got this: rad_recv: Access-Request packet from host 127.0.0.1 port 32814, id=68, length=212 Vendor-14559-Attr-8 = 0x312e302e3132 User-Name = "juanpal" User-Password = "juanpal" NAS-IP-Address = 192.168.181.1 Service-Type = Login-User Framed-IP-Address = 192.168.181.2 Calling-Station-Id = "08-00-27-0A-F7-67" Called-Station-Id = "08-00-27-C0-08-85" NAS-Identifier = "nas01" Acct-Session-Id = "499d9aa800000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Logoff-URL = "http://192.168.181.1:3990/logoff" Message-Authenticator = 0xd5b4b59894a7fbb350da9e2f90d9eb5c +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090219 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090219 expand: %t -> Thu Feb 19 13:13:58 2009 ++[auth_log] returns ok expand: %{Realm} -> ++[attr_filter] returns noop ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "juanpal", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 61 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry DEFAULT at line 201 ++[files] returns ok expand: %{User-Name} -> juanpal rlm_sql (sql): sql_set_user escaped user --> 'juanpal' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'juanpal' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'juanpal' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='juanpal' rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [juanpal/juanpal] (from client localhost port 1 cli 08-00-27-0A-F7-67) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 68 to 127.0.0.1 port 32814 Service-Type = Login-User Session-Timeout := 2400 Waking up in 4.9 seconds. Cleaning up request 0 ID 68 with timestamp +10 Ready to process requests. As you see, the user juanpal authenticate with mysql but the next step stop him My user file has this: DEFAULT Auth-Type := Local, Crypt-password = User-Password Fall-Through = yes Whit auth-type = System, the users need to be Systems users. Whit aut-type = ACCEPT, anyone can loggin. I don't know what try now, i had been google, read in many forums. Thanks a lot. -- Juan Pablo Botero Administrador de Sistemas informáticos http://jpill.wordpress.com eSSuX: http://slcolombia.org/eSSuX Linux Registered user #435293

2 8

newbie question for freeradius
by ipfreak 20 Feb '09

20 Feb '09

Hi all: i would like to use unix file /etc/passwd to authenticate users on my routers and somehow it always fails: rad_recv: Access-Request packet from host 192.168.10.101:61706, id=153, length=53 User-Name = "tester" User-Password = "test" NAS-Identifier = "lab_1" NAS-IP-Address = 192.168.6.1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_unix: GID too long in line: # $FreeBSD: src/etc/master.passwd,v 1.40.18.1 2008/11/25 02:59:29 kensmith Exp $ rlm_unix: [test]: invalid password rad_recv: Access-Request packet from host 192.168.10.101:61706, id=153, length=53 Sending Access-Reject of id 153 to 192.168.10.101 port 61706 here is the config for :users": DEFAULT Auth-Type = System Fall-Through = 1 i have user "tester" in /etc/passwd with password "test" in the freebsd box. Thanks in advance -- View this message in context: http://www.nabble.com/newbie-question-for-freeradius-tp22063719p22063719.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Secure FreeRADIUS & LDAP
by Dan Hawker 20 Feb '09

20 Feb '09

Hi All, I used to use FreeRADIUS *years* back (iirc pre v1) on Linux and it worked rather well :) Not touched it since, however have just started a new contract and there is a requirement to use a RADIUS server to connect to our LDAP box (Red Hat Dir Server) to in turn authenticate some users/equipment that can't auth directly, but due to the nature of the environment, all datastores and comms have to be secured/encrypted. As the host will be RHEL5, FreeRADIUS would seem the ideal candidate (comes with it, although a rather ancient 1.1.3 version by default, can upgrade if needed), however before I start installing and testing, wondered whether it will satisfy the secure part of the requirements. So... My questions... # Can freeradius talk to the ldap box using TLS/SSL (ldaps) # Can freeradius read hashed credentials from the LDAP store and then actually use them??? # There may be a requirement to use certificates for auth, can the ldap/freeradius module handle certs??? Am sure there will be other issues/questions but until then. TIA Dan -- -- Dan Hawker danhawker(a)googlemail.com --

3 3

Re: FreeRADIUS and Active Directory
by Mike Loosbrock 20 Feb '09

20 Feb '09

On Feb 19, 2009, at 11:11 AM, Tomas wrote: > Do I need to change my modules/mschap config? Currently I have: > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=% > {Stripped-User-Name:-%{User-Name:-None}} --challenge=% > {mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" As Ivan eluded to earlier, you need to use '--username=%{mschap:User- Name}' in your ntlm_auth command-line. The mschap module automagically turns 'host/PC1.ad.lab.com' into 'PC1$', (the username that AD uses to authenticate the machine). You may also need to specify the domain with '--domain=%{mschap:NT-Domain}'. Mike Loosbrock Bethel University Network Services 651-638-6723

1 0

daloRADIUS: Web Platform to manage FreeRADIUS
by liran tal 20 Feb '09

20 Feb '09

Hey Everyone, I here-by would like to recommend daloRADIUS as a web platform for managing many aspects of a FreeRAIDUS deployment, among them: Users, Groups, Realms, Attributes, Dictionaries and much more. For those of you who are unfamiliar with daloRADIUS, it also provides many other functionalities such as Graphs, Accounting, Reporting, Backups, Connectivity tests and others. I have been a part of this community for a very long time and I haven't publicly declared daloRADIUS until now because I wanted to wait for it to be at it's most stable stage where I truly think it is mature and feature-rich for both new comers and well established radius gurus. I will be happy to receive your feedback, for good and bad. We're currently at the stage of building a roadmap for the next version so this is the time to put your wish-list out. Thanks for your attention, Resources: Website: http://daloradius.sourceforge.net/ Official web: http://daloradius.com Regards, Liran.

2 3

Freeradius 2.1.3 : regular expression (=~) always matches ?
by marc fradin 20 Feb '09

20 Feb '09

I try to upgrade from 1.0.1 (fedora core 3) to 2.1.3 all seems to work fine except regular expressions in my users file for example DEFAULT User-Name =~ "anonymous" always matches but DEFAULT User-Name == "anonymous" is correctly filtered any idea ? thanks marc

2 1

How to get attributes from active-directory ?
by John 20 Feb '09

20 Feb '09

hi, Now my freeRADIUS(1.1.6) can talk to active-directory. How to get attributes (such as "Session-Timeout" and "Termination-Action" ..) from AD ? >From the debug, freeRADIUS use NTLM_AUTH to authenticate the username/password. Is there another tool for me to get the user's attributes? I am using Odyssey client with EAP-peap type. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

Unexpected closed sessions in database
by Marinko Tarlac 20 Feb '09

20 Feb '09

Hi friends. I have small problem with freeradius and accounting (with database). Something is closing opened sessions and I can't see what is the reason. It seems that accounting_onoff_query was triggered by "something" and acctterminatecause field is empty so I don't see anything. accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - \ unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ vrijeme = '%S' \ WHERE acctstoptime = 0 \ # WHERE acctstoptime IS NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" Session is still alive in NAS but just like I said, account. doesn't work. I'm using old sql schema so WHERE acctstoptime IS NULL \ is commented and replaced with WHERE acctstoptime = 0 \ in sql.conf i set no for deletestalesessions because I don't need this function. # Remove stale session if checkrad does not see a double login deletestalesessions = no FreeRadius is 2.1.3 Any ideas how to trace and solve this problem ? Thanks

4 6