- Freeradius-Users - lists.freeradius.org

Non Ldap Group members being rejected
by Godfrey Peart 08 Feb '09

08 Feb '09

At present I am using AD groups to assign roles to my users and rejecting users who are not members of the defined groups. This is being done via the users file which looks like this: #If you are not in either group, no access is allowed #FreeRADIUS 2.1 #These are the groups we are checking for Lunar Building staff DEFAULT Ldap-Group == "lunar-staff" Aruba-User-Role = "employee" DEFAULT Ldap-Group == "lunar-member" Aruba-User-Role = "member" DEFAULT Ldap-group != "lunar-staff", Auth-Type := Reject DEFAULT Ldap-group != "lunar-member", Auth-Type := Reject #End I now want to also include guest users whose credentials are in a MySQL database, what statement do I need to include in my users file to also allow the guest users to authenticate, since my current config allows only the Ldap Groups. I did have SQL working before I added the reject statements. thanks in advance.

2 1

Reject user by Calling-Station-Id
by Alex M 08 Feb '09

08 Feb '09

Hi, I'm using MySQL to store all configs. I want to reject some comuters by their MAC address (Calling-Station-Id) Ex: one user keeps creating new userrnames to avoid administratice actions, so I got bored playing tom and jerry with him and I just want to bun his MAC address regardless of what udername he/she whould use. I hope that is doable. Could some one point me in right direction here? Thanks a lot!

2 14

Bug in create-users.pl
by Michael Schwartzkopff 07 Feb '09

07 Feb '09

Hi, First of all: Sorry that I post the bug report here and not in bugs.freeradius.org, but that site doen't seem to answer. create-users.pl create a users file of the form: username Cleartext-Password := "some string" Class="0x0" where Class counts from 0x0 on. When I include radius.users in my users file and start radiusd -X I see: (...) /usr/local/etc/raddb/radius.users[2]: Parse error (reply) for entry kxyd: Hex string is not an even length string. /usr/local/etc/raddb/users[42]: Could not open included file /usr/local/etc/raddb/radius.users: Permission denied Errors reading /usr/local/etc/raddb/users /usr/local/etc/raddb/modules/files[7]: Instantiation failed for module "files" /usr/local/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } When I change the Class to Class="0x00" everything works fine. Greetings, Michael.

1 1

Regarding Failures in 2.1.3 radius server
by Abhijit Hari Raut 07 Feb '09

07 Feb '09

Hi, I am getting the following errors during authentiacation for my username new(a)future.com<mailto:new@future.com> Note that my client is 13.0.0.5 and radius clients password is FutureRadius. Packet is reaching radius server and discarded with reject message. Please check what i am missing. I am pasting the console output of /usr/local/sbin/radiusd -X main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 13.0.0.5 { require_message_authenticator = no secret = "FutureRadius" shortname = "fs" nastype = "other" } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### modules { } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 13.0.0.5 port 49152, id=21, length=95 User-Name = "new(a)future.com<mailto:new@future.com>" EAP-Message = 0x02010013016e6577406675747572652e636f6d Message-Authenticator = 0xc0813a0980c7aeafbba8283f892d0d7f NAS-Identifier = "fsNas1" NAS-Port = 4 NAS-Port-Type = Ethernet No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 21 to 13.0.0.5 port 49152 Waking up in 4.9 seconds. Cleaning up request 0 ID 21 with timestamp +55 Ready to process requests. Please find my clients.conf and users attached Thanks Abhijit ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

using IP address of vpn users in radius server
by Eric 07 Feb '09

07 Feb '09

Hi, I have a radius server that uses ldap server for authentication and authorization. The client of radius server is a vpn server. now they are working. I want to have two groups of vpn users in vpn server base on their IP addresses. Could radius server check IP address of users if it is valid or invalid and send an ip pool number for vpn server for each user in this architecture? how can I set it?

2 1

Calling-Station-Id
by Uwe Knop 07 Feb '09

07 Feb '09

Hallo, my system is Fredora Core 9. freeradius installed over yum. we have a problem with "Calling-Station-Id" in raddb/users with freeradius-2.0.5 this function properly (ISDN Phone Numbers) ... Calling-Station-Id =~ "$3311234$|$331345$|$3316789$" With freeradius-2.1.3 this don't worked. only this one works Calling-Station-Id == "3311234" The regular expression work no longer or what could this be thanks for any help uk

2 1

otp daemon for use with freeradius
by Norbert Wegener 07 Feb '09

07 Feb '09

in otp.conf an otpd is mentioned for use with freeradius. According to the licence the daemon can only be used with tokens from tri-dsystems. Is there another otpd around that is free? Thanks Norbert Wegener

3 3

VLAN assignment on PEAP
by Michael Schwartzkopff 06 Feb '09

06 Feb '09

Hi, When I use 802.1x and MD5 (PAP) I can add easily pass VLAN assignment back to the NAS using username Cleartext-Password := "password" Reply-Message = "Hello, misch", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 100 in the users file. When I switch the supplicant the PEAP-MSCHAPv2 I see these attributes beeing addes to the inner tunnel. The outer tunnel only has the EAP attributes and tehe switch doe not see the VLAN attributes. How is it possible to pass these attributes to the switch in the outer tunnel? Thanks for any help. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

2 1

command autho. is it possible?
by Hegedus Gabor 06 Feb '09

06 Feb '09

Hi all! I have read a lot of manual, example and post, but I still don't know what is the solutions. I have newest freeradius, and cisco devices(now AP). I want the user authentication to the cisco device by fr, It works, I configure the users file like this: test Cleadtext-Password := "test" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" The user get the level what i set. The enable level ( $enalXX$) works too. But don't know how can I set the command authorization, on the freeradius and cisco. The cisco commands what I set: aaa group server radius Radius-Servers server 10.10.10.10 auth-port 1812 acct-port 1813 aaa authentication login default group Radius-Servers aaa authentication enable default group Radius-Servers enable aaa authorization console aaa authorization exec default group Radius-Servers if-authenticated aaa authorization network default group Radius-Servers if-authenticated aaa session-id common In fact, at first time I just want set show running-config but disable configure command. using privilege levels is not good, both commands are on the same level(15). What is the solutions? I don't want use 2 server (tacacs+ and fr) for this. I saw something tacacs+ integration into freeradius but I don't know this is a good solution, an how can I configure. Thank you, Best regards Gabor

3 2

Matching Realms and Group-Membership
by Robert Borz 05 Feb '09

05 Feb '09

Hi, I've successfully set up freeradius and till now it is doing what I want - checking realms and prefixes and uses a postgres database backend. ;) Now I want to implement a check, that verifies if a user authenticating with 10000(a)realma.com is also in the group "realmA" and reject the request if this is not the case. This way I want to implement a "user X purchased product Y?" Already tried this: Adding in the radusergroup table: +------------------+-----------+-----------+ | username | groupname | priority | +------------------+-----------+-----------+ | 10000(a)realmA.com | realmA | 10 | +------------------+-----------+-----------+ And in the radgroupcheck table: +----+-----------+-----------+----+------------+ | id | groupname | attribute | op | value | |----+-----------+-----------+----+------------+ | 1 | realmA | Realm | != | realma.com | +----+-----------+-----------+----+------------+ And finally in the radgroupreply table: +----+-----------+---------------+----+-----------------------+ | id | groupname | attribute | op | value | +----+-----------+---------------+----+-----------------------+ | 1 | realmA | Auth-Type | := | Reject | +----+-----------+---------------+----+-----------------------+ And of course, my debug output says: rlm_realm: Adding Realm = "~^realmA.com$" I also tried adding "~^realmA.com$" as value in the radgroupcheck table with no success. I thought to already understood this concept... but adding "Auth-Type := Reject" in the radgroupcheck table works?! My expression in radgroupcheck also works - I verified this by adding "Reply-Message += Is this working?" within radgroupreply and the reply-message is added to the response. If anybody could assist me with this or just give me a hint it'd be great! Regards, Robert Borz.

2 1