- Freeradius-Users - lists.freeradius.org

FreeRADIUS LDAP HOWTO
by Andrew Hall 16 Feb '09

16 Feb '09

I'd just like to make other subscribers / searchers / admins pulling their hair out aware of the FreeRADIUS LDAP HOWTO available here... http://freeradius.org/radiusd/doc/ldap_howto.txt For some reason it doesn't seem to be linked to on any main website or wiki page - bizarrely including the HOWTO page... http://wiki.freeradius.org/HOWTO Perhaps this can be rectified? I wish I'd found it earlier ! Thanks.

5 6

Check for a attribute in the request
by Asin Silva 16 Feb '09

16 Feb '09

Hi All, I want to know if there is a way to check whether a particular attribute is present in the radius request? My server version is 2.1.1 Regards, Asin Get your new Email address! Grab the Email name you've always wanted before someone else does! http://mail.promotions.yahoo.com/newdomains/aa/

2 1

AW: Re: Migration from TACACS+ to RADIUS
by Thoralf Freitag 15 Feb '09

15 Feb '09

To your first question: You can give every user in Radius it's own priv-level. You can configure your Cisco that CLI access is only allowed with a priv-level x and higher. This would be the same like Tacacs. -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com *** Sent via Blackberry. *** http://www.biotronik.com ********************************************************************************* BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementaerin: BIOTRONIK Mess- und Therapiegeraete GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschaeftsfuehrer: Dr. Max Schaldach, Christoph Boehmer, Dr. Werner Braun, Dr. Lothar Krings ********************************************************************************* This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately. ----- Originalnachricht ----- Von: Norbert Wegener [norbert.wegener(a)siemens.com] Gesendet: 14.02.2009 12:05 CET An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Betreff: Re: Migration from TACACS+ to RADIUS Alan DeKok schrieb: > Nicholas R. Cappelletti wrote: > >> In the recent weeks, I have come across some downfalls to using TACACS+ such as no 802.1x authentication, no WPA integration, and the impossible integration into both Kerberos and LDAP. >> >> I hate to sound naive, but like many who need help, I'm new to RADIUS, its configuration, and its capabilities. With that said, I have a few questions concerning functionality that I had with TACACS+ and its equivalence in RADIUS. >> >> 1. How granular can I get with command authorization? Currently, TACACS+ is used for VPN authentication and device login, but not all those users should, or need, access to the CLI of the network equipment (We use both Cisco and HP devices). Eventually I would like to use the RADIUS setup for wireless authentication too. >> > > The hope is that we can add TACACS+ support to FreeRADIUS in a future > version. That will help with migration. > Can this be expected in the foreseeable future? Norbert Wegener > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

Migration from TACACS+ to RADIUS
by Nicholas R. Cappelletti 14 Feb '09

14 Feb '09

In the recent weeks, I have come across some downfalls to using TACACS+ such as no 802.1x authentication, no WPA integration, and the impossible integration into both Kerberos and LDAP. I hate to sound naive, but like many who need help, I'm new to RADIUS, its configuration, and its capabilities. With that said, I have a few questions concerning functionality that I had with TACACS+ and its equivalence in RADIUS. 1. How granular can I get with command authorization? Currently, TACACS+ is used for VPN authentication and device login, but not all those users should, or need, access to the CLI of the network equipment (We use both Cisco and HP devices). Eventually I would like to use the RADIUS setup for wireless authentication too. >From what I've read, setting "Service-Type = NAS-Prompt-User" will give the user the ability to login to the device, but how do I restrict them from enabling themselves? With the RADIUS setup I have currently, it's using Kerberos for authentication, and LDAP for authorization. 2. Can I set, for a user, a separate enable password? 3. With TACACS+ I have the ability to set a MOTD per device in the configuration, and modify that if need be from the TACACS+ configuration. Is there similar functionality in RADIUS? 4. Am I able to do any command accounting with Cisco equipment? I understand it is not possible with the ASA firewall line, but I haven't found a definitive answer about the router IOS images. If any one of these questions are answered, it will be greatly appreciated. Thank you for your time and any help you can offer me in advance. :) --- Nick nick(a)switchtower.org

4 4

Re: FreeRADIUS LDAP HOWTO
by Andrew Hall 14 Feb '09

14 Feb '09

Arran Cudbard-Bell wrote... > Maybe because it was written 6 years ago, and very few of the > freeRADIUS 1.* examples will still work with 2.... I see your point but why deny users access to this information ? Surely all that's required is a note informing them of this. I administer a legacy 1.x server so this helped me and may help others. Perhaps the original author (are they still about?) or someone else could update this document. On a similar note does anyone know if O'Reilly plan to update their RADIUS book? Both that and the LDAP book are now well out of date.

2 1

freeradius core dumped with segmentation fault
by bishal＠baayu.com.np 14 Feb '09

14 Feb '09

Hello all, I have freeradius 1.3 running on freebsd 6.0. Yesterday I did perl upgrade from 5.8.7 to 5.8.9 and I also upgraded the freeradius to 1.7.1 now whenever I try to run freeradius it core dumps with segmentatation fault. Below is the gdb output file. radius# gdb /usr/local/sbin/radiusd radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/libradius-1.1.7.so...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libradius-1.1.7.so Reading symbols from /lib/libcrypt.so.3...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.3 Reading symbols from /usr/lib/libpthread.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libpthread.so.2 Reading symbols from /usr/local/lib/libssl.so.4...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libssl.so.4 Reading symbols from /usr/local/lib/libcrypto.so.4...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/libcrypto.so.4 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /usr/local/lib/rlm_exec-1.1.7.so...(no debugging symbols found)...done. Loaded symbols for /usr/local/lib/rlm_exec-1.1.7.so Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols found)...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0805f358 in lt_dlclose () [New LWP 100075] (gdb) bt #0 0x0805f358 in lt_dlclose () #1 0x0805f275 in lt_dlpreload_default () #2 0x08060a2a in lt_dladdsearchdir () #3 0x08060db8 in lt_dlopen () #4 0x08060f8d in lt_dlopenext () #5 0x08060cab in lt_dladdsearchdir () #6 0x08060e82 in lt_dlopenext () #7 0x080541d9 in find_module_instance () #8 0x08054967 in setup_modules () #9 0x08057c2d in main () (gdb) quit -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1

New "raddebug" command
by Alan DeKok 13 Feb '09

13 Feb '09

See git.freeradius.org (stable or master branch) for a new "raddebug" command. It requires: - raddb/sites-available/control-socket to be enabled, and r/w permission added - radmin to be in the $PATH - the user running raddebug to have permissions to connect to the socket, and to run commands - the user running raddebug to have group write access to $logdir. Then: $ raddebug prints all debug output to stdout for 10s. (default timeout) $ raddebug -t 0 prints all debug output to stdout until CTRL-C $ raddebug -u bob prints all debug output for user "bob" for 10s $ raddebug -i 127.0.0.1 prints all debug output for client 127.0.0.1 for 10s $ raddebug -c '((User-Name == bob) && (Packet-Src-IP-Address == 127.0.0.1))' prints all debug output for bob, when logging in via client 127.0.0.1, for 10s. This was at the request of a Network RADIUS customer. :) Enjoy. Alan DeKok.

1 0

Cisco NAS and server side ip pool management
by Sebastian Krieger 13 Feb '09

13 Feb '09

Hi, for many hours now I am trying to configure a Cisco router as a NAS to authenticate dialup users against freeradius and provide the ip address dynamically from a server based ip pool. The authentication part works fine and the ip address also gets selected from the pool and sent as Framed-IP-Address back to the NAS. The only thing is that the ip address seems not to be catched up by the NAS and provided to the dialup user. I test the dialup connection from a Windows XP machine with an ISDN card and there it always ends in an error message that the NAS didn't provide the IP information. It is absolutely no problem to use a static ip pool on the Cisco router instead of a server based ip pool management. Can someone please send me a working configuration example for a Cisco IOS based NAS? Thanks Sebastian

2 1

freeradius with PAM authentication
by robin 13 Feb '09

13 Feb '09

Can anyone help me to configure PAM authentication with freeradius ? can anyone have step by step guide for pam authentication or suggest me the tutorials to follow Any tips and guide on this issue will be highly appreciated. Thanks in advance

2 1

Regular expressions doesn't work in /etc/raddb/hints
by Victor Shkamerda 13 Feb '09

13 Feb '09

Hi, We are migrating from other RADIUS software to FreeRADIUS. In order to avoid changing existing users database objects, I'm trying to fix the User-Name attribute format in NAS request and it seems that preprocess module is the right place to do that. But after adding new default rule in the hints file I have discovered that it doesn't work. The rule is always matching my regular expression no matter what string I put into it. The regular expression is simply the string itself i.e. like "/string/". After looking through sources I found that in src/lib/valuepair.c in pairmove the operator T_OP_REG_EQ is commented out. Could it be the culprit or is there anything else that I should know? The FreeRADIUS version is 2.1.3 on SLES 10 compiled from sources. Best regards, Victor Shkamerda

2 5