- Freeradius-Users - lists.freeradius.org

web based certificate management
by Tomoki Taniguchi 19 Aug '08

19 Aug '08

is there a good web based certificate management system that users of freeradius recommend? i need something that will apply the needed xpextensions and generate the necessary .p12 and .der certificates for a windows xp client. i am looking into editing the ebox-ca to generate the additional certificates, but would perfer not to have to go through the trouble if possible. TIA, Tomoki

2 1

final question about client certs using eap-tls (was: cert bootstrap bug?)
by Sergio 19 Aug '08

19 Aug '08

Hi, also was so many others. At this time i have got one eap module which authenticates users under a PKI. My client certs are issued by root ca (ca.pem) and everything works. I can manage the crl, because it is public, and authenticate any user against any server. So my question is, what's the final goal of signing certificates with server's? The only difference (i think) is about the crl managing, because in my case, the authority should provide the crl to the server administrators. I don't see any more difference. Thanks

1 1

Crash on x64?
by Alex Balashov 19 Aug '08

19 Aug '08

Greetings, I am running a very high-volume FreeRADIUS installation on RHEL 5 (not my choice), and noticed that FreeRADIUS was periodically dying after instantiating a great many worker servers. I looked at the output in GDB and got: Continuing. [New LWP 11400] [tcsetpgrp failed in terminal_inferior: Operation not permitted] (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 47272748113904 (LWP 11350)] [New Thread 1328978240 (LWP 11441)] [New Thread 1318488384 (LWP 11439)] [New Thread 1370937664 (LWP 11438)] [New Thread 1307998528 (LWP 11437)] [New Thread 1360447808 (LWP 11436)] [New Thread 1140160832 (LWP 11435)] [New Thread 1297508672 (LWP 11434)] [New Thread 1287018816 (LWP 11433)] [New Thread 1276528960 (LWP 11432)] [New Thread 1266039104 (LWP 11431)] [New Thread 1119181120 (LWP 11430)] [New Thread 1255549248 (LWP 11429)] [New Thread 1245059392 (LWP 11428)] [New Thread 1234569536 (LWP 11427)] [New Thread 1129670976 (LWP 11423)] [New Thread 1203099968 (LWP 11422)] [New Thread 1339468096 (LWP 11421)] [New Thread 1108691264 (LWP 11420)] [New Thread 1349957952 (LWP 11419)] [New Thread 1213589824 (LWP 11412)] [New Thread 1224079680 (LWP 11411)] [New Thread 1094392128 (LWP 11410)] [New Thread 1538775360 (LWP 11406)] [New Thread 1528285504 (LWP 11405)] [New Thread 1517795648 (LWP 11404)] [New Thread 1192610112 (LWP 11403)] [New Thread 1507305792 (LWP 11402)] [New Thread 1496815936 (LWP 11401)] [New Thread 1486326080 (LWP 11400)] [New Thread 1475836224 (LWP 11399)] [New Thread 1465346368 (LWP 11398)] [New Thread 1454856512 (LWP 11397)] [New Thread 1444366656 (LWP 11396)] [New Thread 1433876800 (LWP 11395)] [New Thread 1423386944 (LWP 11394)] [New Thread 1412897088 (LWP 11393)] [New Thread 1161140544 (LWP 11392)] Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to Thread 1486326080 (LWP 11400)] 0x00002afe89997d19 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 (gdb) Continuing. Program received signal SIGABRT, Aborted. 0x00002afe8ad3d155 in raise () from /lib64/libc.so.6 Is this a bug in the x64 libdl? -- Alex -- Alex Balashov Evariste Systems Web : http://www.evaristesys.com/ Tel : (+1) (678) 954-0670 Direct : (+1) (678) 954-0671 Mobile : (+1) (706) 338-8599

4 10

Realms and proxying
by Dean, Barry 19 Aug '08

19 Aug '08

I currently have a realm defined: realm liv.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } I now have one of my departments, which for various complex reasons, has been allowed to have its own user accounts. They have the subdomain name "csc.liv.ac.uk". I want to proxy RADIUS to their server. If I add: realm csc.liv.ac.uk { type = radius authhost = server.csc.liv.ac.uk:1812 accthost = server.csc.liv.ac.uk:1813 } Is this position dependant? Does it have to appear before the liv.ac.uk realm to prevent "user(a)csc.liv.ac.uk" being caught by the first realm? I have: realm suffix { format = suffix delimiter = "@" } in radius.conf. --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

2 1

Locking accounts after failed attempts. pam_tally ?
by Mark Tunnell 19 Aug '08

19 Aug '08

Is there a way to disable radius access for a user after a specified number of incorrect passwords using the standard Unix passwd system? I have pam_tally running and it correctly increments on failed SSH login attempts. However, failed Radius attempts do not increment the counter. Is there a way to make pam_tally work with Radius or do I need to find another way to do this? Thanks, Mark

2 1

FreeRadius, MySQL, MAC Authentication w/ Dynamic VLAN
by James Taylor 19 Aug '08

19 Aug '08

Hello everyone! I am currently tasked with a new project where I have been asked to move our currently working 'users' file into a manageable MySQL DB (we have over 500 user entries so it's understandable). Below you will find a currently working entry from the 'users' file. Mac-addresss Auth-Type := local, User-Password == "password" Calling-Station-ID == "mac-address", Airespace-Wlan-Id = 5, Airespace-Interface-Name = Wireless WLAN Name, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE:802, Tunnel-Private-Group-ID = VLAN-ID As you can tell this is a wireless user and of course I have the dictionary attributes added (like I said it is currently a working users file) but my question is how to take this information and add it to the MySQL radius.radcheck database? From what I am seeing the ID is a primary key and must be unique and there is only one attribute field. I may be asking this incorrectly but, does the DB read the rows starting with the ID 1 being the first user and continue down until the next user entry and return all the rows into Radius for authentication? If you have any possible pointers it would be greatly appreciated! Thank you everyone! James Taylor FCIP Networks

3 6

Limiting a user to a specific realm
by Lisa Casey 18 Aug '08

18 Aug '08

Hi Folks, I know there's an easy way to do this, but I've googled a bit this morning and can't quite figure it out. We are running Freeradius with a users file (no database). I have several realms defined, each with a fallthrough like so: DEFAULT Realm == realm1.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm2.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm3.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 I also have these 3 realms defined in the realms file. The way things are setup now, username bob could log in as bob(a)realm1.com or bob(a)realm2.com or bob(a)realm3.com and as long as bob supplied the correct password he would be granted access and that's been fine up until now. What I'ld like to do is to fix it so that only certain usernames could log on as username(a)realm3.com (leave realm1.com and realm2.com as they are). So anyone with a correct username/password could log in using realm1.com or realm2.com but only bob, jane and alex could log in with realm3.com. I suppose I could add an entry in my users file as so: bob Realm=realm3.com, Auth-Type = Local, Password == xxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 Would that work? How would I define realm3.com earlier in my users file? Would this work or is there a better way? Thanks, Lisa Casey

2 1

LDAP backend and Password Encryption
by Phillip Heller 18 Aug '08

18 Aug '08

Hello, Relatively new to both freeradius and ldap here. I'm using the Centos Directory Server, which defaults to SSHA encryption on the userPassword attribute. I'm using freeradius to authenticate unix logins (via pam_radius_auth), VPN (cisco asa) logins, and router/switch vty logins. freeradius verifies existence of the user in various ldap groups, and based upon that logic, either proxies off to a cryptocard server for one-time-password authentication, or authenticates directly against the userPassword attribute value. It would seem that freeradius does not authenticate against SSHA. I did try a few other encryption policies (crypt, md5) and set the password_header value appropriately. This is with version 2.0.5. Any help would be greatly appreciated! Regards, Phil

2 6

LDAP group-checking - missing user-dn in filter
by Jason Long 18 Aug '08

18 Aug '08

This morning I'm attempting to upgrade my FreeRadius install from 1.1.7 to 2.0.5. I'm having an issue with LDAP group-checking. Here's my scenario: I authenticate users with LDAP (eDirectory). In addition, I do some LDAP group-checking to determine which RADIUS attributes I want to return to the network device. This happens in the "users" file, with lines like: DEFAULT Ldap-Group == students Aruba-User-Role = student DEFAULT Ldap-Group == employees Aruba-User-Role = employee This was working in 1.1.7. But now I'm on 2.0.5, and after converting the config files, this is how it is behaving: users: Matched entry DEFAULT at line 13 rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=person)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.messiah.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius2/etc/raddb/certs/messiah-ca.crt rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=ldap-radius,o=mc/*** to ldap.messiah.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in t=mc-tree, with filter (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=students)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group students not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=employees)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() ++[files] returns ok I can see the issue here... the filter is messed up. expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=). Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration... Jason

2 3

per client certificate
by Tomoki Taniguchi 18 Aug '08

18 Aug '08

Is there a way to setup freeradius with EAP so that each wifi-client has their own certificate to connect to the wifi network? i want to be able to just disable a specific certificate if one one the laptops is stolen or lost. but the howtos i have come across so seem to be a setup where all wifi-clients use the same certificate to authenticate against an access point. is what i am trying to accomplish even possible? Please help. TIA, Tomoki

3 4