- Freeradius-Users - lists.freeradius.org

Restrict access to certain groups
by kevin leblanc 16 Feb '09

16 Feb '09

Hi I have a Freeradius which checks if an user has right to connect to a network equipment via LDAP. For security reasons, i want to restrict access to certain users (network administrator). At the beginning, I wanted to do it by adding host attribute to a user, it will contain all allowed hosts he can connect : I don't find a solution. But, i found another way : in my schema I added an OU which contains all computers in the network, and to allow a user to connect to one of them, I make it "member of" this host. So, I want to check if the user is "member of" the host he try to connect, to give him corresponding access. I don't know if it's possible and how to do this (if it's possible). May I change users file ? radiusd.conf ? cleints.conf ? I'm lost whereas I'm on it since the last week :( thanx for all possible solutions -- KeV

1 2

Re: Session-timeout problem
by Mitul Modi 16 Feb '09

16 Feb '09

hi will, I have tried this configuration and it's working fine with radtest but Ever i am getting session time out value on AP side also but during the change request time . actually i want the session time out in accept-access time. is it the normal scenario? can you help me in this case? thanks, Mitul Modi On Fri, Feb 13, 2009 at 3:23 PM, Will D. Spann <willdspann(a)yahoo.com> wrote: > Mitul, > > >i have tried this thing but when i am doing so its taking this as a > default entry and giving error for user name and password > > >i have entered username and cleartext-password in user file. > > Could you post your users file (with any non-testing passwords starred out > of course)? > > My apologies; let me add a clarification. If your user entries in the > users file don't have the "Fall-Through = Yes" attribute set, putting the > DEFAULT section at the end of the file won't apply the Session-Timeout to > the users. However, it shouldn't cause an error. Have you tried testing > without the DEFAULT section, using a user with Cleartext-Password? I've > tested the following configuration on FreeRADIUS 2.1.1 with success. > > test Cleartext-Password := "testing" > Fall-Through = Yes > > DEFAULT > Session-Timeout = 60 > > Try testing this with radtest, such as the following, where "testing123" is > your shared secret and the server is running on localhost. This should > return an Access-Accept message with Session-Timeout specified. (I assume > you're also running the server with debug output, as "radiusd -X".) > > radtest test testing localhost 0 testing123 > > If you don't want to add the Fall-Through attribute to each of your user > entries, you could instead use the following modified DEFAULT section near > the top of the users file, before all the authorized user entries. I've > also tested this configuration. (Note the comma.) > > DEFAULT > Session-Timeout = <timeout>, > Fall-Through = Yes > > > >also i have configured the mysql database for authentication and > accounting. so at that time i am getting error "no User-password or > >CHAP-password" in request. > > Are you using both the users file and MySQL for authentication, or are you > testing each setup separately? I'd recommend getting FreeRADIUS working > with the users file alone before setting up database-based authentication. > > Will D. Spann > > >

1 0

FreeRADIUS LDAP HOWTO
by Andrew Hall 16 Feb '09

16 Feb '09

I'd just like to make other subscribers / searchers / admins pulling their hair out aware of the FreeRADIUS LDAP HOWTO available here... http://freeradius.org/radiusd/doc/ldap_howto.txt For some reason it doesn't seem to be linked to on any main website or wiki page - bizarrely including the HOWTO page... http://wiki.freeradius.org/HOWTO Perhaps this can be rectified? I wish I'd found it earlier ! Thanks.

5 6

Check for a attribute in the request
by Asin Silva 16 Feb '09

16 Feb '09

Hi All, I want to know if there is a way to check whether a particular attribute is present in the radius request? My server version is 2.1.1 Regards, Asin Get your new Email address! Grab the Email name you've always wanted before someone else does! http://mail.promotions.yahoo.com/newdomains/aa/

2 1

AW: Re: Migration from TACACS+ to RADIUS
by Thoralf Freitag 15 Feb '09

15 Feb '09

To your first question: You can give every user in Radius it's own priv-level. You can configure your Cisco that CLI access is only allowed with a priv-level x and higher. This would be the same like Tacacs. -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com *** Sent via Blackberry. *** http://www.biotronik.com ********************************************************************************* BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementaerin: BIOTRONIK Mess- und Therapiegeraete GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschaeftsfuehrer: Dr. Max Schaldach, Christoph Boehmer, Dr. Werner Braun, Dr. Lothar Krings ********************************************************************************* This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately. ----- Originalnachricht ----- Von: Norbert Wegener [norbert.wegener(a)siemens.com] Gesendet: 14.02.2009 12:05 CET An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Betreff: Re: Migration from TACACS+ to RADIUS Alan DeKok schrieb: > Nicholas R. Cappelletti wrote: > >> In the recent weeks, I have come across some downfalls to using TACACS+ such as no 802.1x authentication, no WPA integration, and the impossible integration into both Kerberos and LDAP. >> >> I hate to sound naive, but like many who need help, I'm new to RADIUS, its configuration, and its capabilities. With that said, I have a few questions concerning functionality that I had with TACACS+ and its equivalence in RADIUS. >> >> 1. How granular can I get with command authorization? Currently, TACACS+ is used for VPN authentication and device login, but not all those users should, or need, access to the CLI of the network equipment (We use both Cisco and HP devices). Eventually I would like to use the RADIUS setup for wireless authentication too. >> > > The hope is that we can add TACACS+ support to FreeRADIUS in a future > version. That will help with migration. > Can this be expected in the foreseeable future? Norbert Wegener > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

Migration from TACACS+ to RADIUS
by Nicholas R. Cappelletti 14 Feb '09

14 Feb '09

In the recent weeks, I have come across some downfalls to using TACACS+ such as no 802.1x authentication, no WPA integration, and the impossible integration into both Kerberos and LDAP. I hate to sound naive, but like many who need help, I'm new to RADIUS, its configuration, and its capabilities. With that said, I have a few questions concerning functionality that I had with TACACS+ and its equivalence in RADIUS. 1. How granular can I get with command authorization? Currently, TACACS+ is used for VPN authentication and device login, but not all those users should, or need, access to the CLI of the network equipment (We use both Cisco and HP devices). Eventually I would like to use the RADIUS setup for wireless authentication too. >From what I've read, setting "Service-Type = NAS-Prompt-User" will give the user the ability to login to the device, but how do I restrict them from enabling themselves? With the RADIUS setup I have currently, it's using Kerberos for authentication, and LDAP for authorization. 2. Can I set, for a user, a separate enable password? 3. With TACACS+ I have the ability to set a MOTD per device in the configuration, and modify that if need be from the TACACS+ configuration. Is there similar functionality in RADIUS? 4. Am I able to do any command accounting with Cisco equipment? I understand it is not possible with the ASA firewall line, but I haven't found a definitive answer about the router IOS images. If any one of these questions are answered, it will be greatly appreciated. Thank you for your time and any help you can offer me in advance. :) --- Nick nick(a)switchtower.org

4 4

Re: FreeRADIUS LDAP HOWTO
by Andrew Hall 14 Feb '09

14 Feb '09

Arran Cudbard-Bell wrote... > Maybe because it was written 6 years ago, and very few of the > freeRADIUS 1.* examples will still work with 2.... I see your point but why deny users access to this information ? Surely all that's required is a note informing them of this. I administer a legacy 1.x server so this helped me and may help others. Perhaps the original author (are they still about?) or someone else could update this document. On a similar note does anyone know if O'Reilly plan to update their RADIUS book? Both that and the LDAP book are now well out of date.

2 1

freeradius core dumped with segmentation fault
by bishal＠baayu.com.np 14 Feb '09

14 Feb '09

Hello all, I have freeradius 1.3 running on freebsd 6.0. Yesterday I did perl upgrade from 5.8.7 to 5.8.9 and I also upgraded the freeradius to 1.7.1 now whenever I try to run freeradius it core dumps with segmentatation fault. Below is the gdb output file. radius# gdb /usr/local/sbin/radiusd radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/libradius-1.1.7.so...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libradius-1.1.7.so Reading symbols from /lib/libcrypt.so.3...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.3 Reading symbols from /usr/lib/libpthread.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libpthread.so.2 Reading symbols from /usr/local/lib/libssl.so.4...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libssl.so.4 Reading symbols from /usr/local/lib/libcrypto.so.4...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libcrypto.so.4 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /usr/local/lib/rlm_exec-1.1.7.so...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/rlm_exec-1.1.7.so Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols found)...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0805f358 in lt_dlclose () [New LWP 100075] (gdb) bt #0 0x0805f358 in lt_dlclose () #1 0x0805f275 in lt_dlpreload_default () #2 0x08060a2a in lt_dladdsearchdir () #3 0x08060db8 in lt_dlopen () #4 0x08060f8d in lt_dlopenext () #5 0x08060cab in lt_dladdsearchdir () #6 0x08060e82 in lt_dlopenext () #7 0x080541d9 in find_module_instance () #8 0x08054967 in setup_modules () #9 0x08057c2d in main () (gdb) quit -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1

New "raddebug" command
by Alan DeKok 13 Feb '09

13 Feb '09

See git.freeradius.org (stable or master branch) for a new "raddebug" command. It requires: - raddb/sites-available/control-socket to be enabled, and r/w permission added - radmin to be in the $PATH - the user running raddebug to have permissions to connect to the socket, and to run commands - the user running raddebug to have group write access to $logdir. Then: $ raddebug prints all debug output to stdout for 10s. (default timeout) $ raddebug -t 0 prints all debug output to stdout until CTRL-C $ raddebug -u bob prints all debug output for user "bob" for 10s $ raddebug -i 127.0.0.1 prints all debug output for client 127.0.0.1 for 10s $ raddebug -c '((User-Name == bob) && (Packet-Src-IP-Address == 127.0.0.1))' prints all debug output for bob, when logging in via client 127.0.0.1, for 10s. This was at the request of a Network RADIUS customer. :) Enjoy. Alan DeKok.

1 0

Cisco NAS and server side ip pool management
by Sebastian Krieger 13 Feb '09

13 Feb '09

Hi, for many hours now I am trying to configure a Cisco router as a NAS to authenticate dialup users against freeradius and provide the ip address dynamically from a server based ip pool. The authentication part works fine and the ip address also gets selected from the pool and sent as Framed-IP-Address back to the NAS. The only thing is that the ip address seems not to be catched up by the NAS and provided to the dialup user. I test the dialup connection from a Windows XP machine with an ISDN card and there it always ends in an error message that the NAS didn't provide the IP information. It is absolutely no problem to use a static ip pool on the Cisco router instead of a server based ip pool management. Can someone please send me a working configuration example for a Cisco IOS based NAS? Thanks Sebastian

2 1