- Freeradius-Users - lists.freeradius.org

pam_radius_auth
by Megan 24 Sep '08

24 Sep '08

Good Day, I am making an attempt to setup sudo authentication on a Centos 5.2 server to work with pam_radius_auth. I rwant ldap to handle my regular users (this works already) and I want my privileged users to authenticate through radius when they use sudo. I put the below in /etc/pam.d/sudo and it seems to work fine, except that I need an entry in /etc/shadow for any user who sudos. If i remove the user from /etc/shadow then I get a loop back to the radius authentication. If I remove the pam_unix.so entry for auth then I also get a loop back asking for a password when the radius server Accepted it. Any ideas? /etc/pam.d/sudo auth required pam_env.so auth required /lib/security/pam_radius_auth.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 Thanks, Megan

2 1

Re: freeradius 2.1.0 default mysql schema don't have nasidentifier table
by piston 24 Sep '08

24 Sep '08

And the reason is? i thought nasidentifier is quite important attribute. Anyway thanks for reply. ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, September 23, 2008 8:28:22 PM Subject: Re: freeradius 2.1.0 default mysql schema don't have nasidentifier table piston wrote: > freeradius 2.1.0 default mysql schema don't have nasidentifier table. And the mysql query in dialup.conf also don't have nasidentifier value. > > It is purposely left out the nasidentifier? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

Re: Re: How Can I use local /etc/passwd users for 802.1x
by Aydın KOÇAK 24 Sep '08

24 Sep '08

Hello Dear Ivan Kalik; Thank you for your help . Yes i install and i saw eap-ttls pap support Our problem theoricaly solved i will try install freeradius + LDAP and pap authentication support... Thank You, >SecureW2 supports EAP-TTLS PAP. > >Ivan Kalik >Kalik Informatika ISP

1 0

Re: How Can I use local /etc/passwd users for 802.1x
by Aydın KOÇAK 24 Sep '08

24 Sep '08

Hello Dear Ivan Kalik; Thank you for your response ; >From following link that you send indicate if i use eap-gtc everything is ok. But our switches does not support this protocol. http://deployingradius.com/documents/protocols/compatibility.html I think Finaly i can use EAP-MSCHAPv2 and NT hash(ntlm_auth) in this case i have use to samba . is it true ? and all users and password must be re-create . Last question PAP support all encryption include Unix crypt likewise my switches support pap but i can't find pap authentication support on windows-xp and secure-w2 . How can i find supplicant with support pap authentication for 802.1x ? Thank You, Akocak >Message: 2 >Date: Wed, 24 Sep 2008 10:35:06 +0100 >From: <tnt(a)kalik.net> >Subject: Re: How Can I use local /etc/passwd users for 802.1x > authentication >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <X4QzcHet.1222248906.0917230.tnt(a)kalik.net> >Content-Type: text/plain; charset=ISO-8859-2 > >You can't. Look at PEAP and EAP-MD5. > >http://deployingradius.com/documents/protocols/compatibility.html > >Ivan Kalik >Kalik Informatika ISP Dana 24/9/2008, "Ayd?n KO?AK" <akocak(a)turkom.com.tr> pi?e: >>Hello ; >>I need authenticate local /etc/passwd users with FreeRadius for wired and wireless network 802.1x authentication ? >>Is it posible ? >> >>Or i can migrate all local users to ldap server in this case is it posible ? Because i dare say 802.1x authentication not correctly work with encrypted password on ldap ? >> >>Could You please give information about this issue ? >> >>Thank You, >>Akocak. >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >>

2 1

AW: Acct-Input-Gigawords
by Lars 24 Sep '08

24 Sep '08

>>Is there a way (radius or ppp) to get the Accounting-Data on-the-fly >>(realtime) or maybe all 2 hours without disconnection the actual session of >>the user? >Depending on your NAS, you can send Accounting updates every 5 minutes ! The >attribute that NAS has to accept is called Acct-Interim-Interval. You can >set it to "300" ( 5 min ) ! Where can i set it up? I use rp-pppoe-server and ppp 2.4.4 on debian Regards & thx lars

2 1

(no subject)
by Arrigo Savio 24 Sep '08

24 Sep '08

Hi everybody. I installed Freeradius 2.1.0 on a Fedora 9 server. I installed dialup_admin to manage it: it partially works. I have some troubles in 2 sections: 1. Check Server. When I click on the menu, I see Wednesday, 24 September 2008, 12:36:31 CEST Server: 10.0.1.128:1812 (test user testuser) And nothing more. I can't see any log in radius logs. The same thing when I try to "test user" but it is the same page as above. 2. "Accounting" section. I can see the Select menus, but without any value inside. The strange thing is that If I select any rows (in a totally white list) the query is run. Basically, I have the option values, but not the tags in the list. Hope that someone had already fall in these problems. Regards Arryxyz

1 0

cleartext passwords against Active Directory
by Leese, MJ (Mark) 24 Sep '08

24 Sep '08

Hi, I need to authenticate employees at my lab onto our wireless network using a Captive Portal and our corporate database (Active Directory). The Access-Request from the Captive Portal contains a cleartext password but our Active Directory does not store cleartext passwords. Can someone please tell me what options I have? Is it possible to use rlm_krb, for example? I have used our RADIUS server to authenticate users against our Active Directory, but this was with ntlm_auth for users using 802.1X and MS-CHAP. Someone suggested I could authenticate the user with an LDAP bind, but I don't see how this would work. I'm running FreeRADIUS 1.1.4 but I can update to a newer version any time. Please help. I am running out of hair :) Thanks in advance, Mark.

2 1

How Can I use local /etc/passwd users for 802.1x authentication
by Aydın KOÇAK 24 Sep '08

24 Sep '08

Hello ; I need authenticate local /etc/passwd users with FreeRadius for wired and wireless network 802.1x authentication ? Is it posible ? Or i can migrate all local users to ldap server in this case is it posible ? Because i dare say 802.1x authentication not correctly work with encrypted password on ldap ? Could You please give information about this issue ? Thank You, Akocak.

2 1

Acct-Input-Gigawords
by Lars 24 Sep '08

24 Sep '08

Hi, i have 2 questions and i hope you'll help me. I use the freeradius in combination with mysql-server for accounting and authorizing. The first: how do i use the Acct-Input-Gigawords and Acct-Output-Gigawords Attributes with "FreeRADIUS Version 1.1.3" and "FreeRADIUS Version 1.0.2" and PPP 2.4.4? I set up the fields in the mysql-table but they do not get filled with data. The second: Is there a way (radius or ppp) to get the Accounting-Data on-the-fly (realtime) or maybe all 2 hours without disconnection the actual session of the user? Regards lars

3 2

..::Errors initializing modules::..
by Ing. Alfonso Reyes 24 Sep '08

24 Sep '08

Hi team. I'm having some issues with the configuration of the radius server, I'm getting the following: Error Initializing Modules. The thing is that my radius server has no issues with the configuration (eap.conf), and the instalation was succesful with mysql. I've checked the database looking for more information with no luck, I just found those two points and they are ok. http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg43172.h tml Attached configuration files and error. eap.txt correspond to the conf file found on the /etc/raddb/eap.conf Eap2.txt correspond to the conf file found on the /usr/local/etc/raddb/eap.conf Any ideas? Thanks for your help. Alfonso.

2 1