- Freeradius-Users - lists.freeradius.org

Re: A way to use LDAP only for authentication
by Ivan Kalik 13 May '08

13 May '08

Yes. List ldap only in inner-tunel. Ivan Kalik Kalik Informatika ISP Dana 13/5/2008, "Konstantin KABASSANOV" <Konstantin.Kabassanov(a)lip6.fr> piše: >Hello, > >Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if >there is a way to allow all users in the authorize section of radiusd.conf >(without doing ldap requests) and make the ldap request only in the >authenticate section. It is useful for instance to avoid multiple ldap >requests during authorization process in particular when a number of >radius-request/challenges are exchanged between Access points and radius >server. > >Thanks. > >Konstantin >_____________________________________________________________________ > >Konstantin KABASSANOV >LIP6/CNRS >104, avenue du Président Kennedy, 75016 Paris, France >Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 > >E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com >Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html >_____________________________________________________________________ > > >

1 0

error freeradius-client-1.1.6.tar.bz2
by Deep Purple 13 May '08

13 May '08

Hello Fedora core 5 rpm -Uvh freeradius-client-1.1.6-0.i386.rpm /var/tmp/rpm-tmp.72946: line 1: fg: no job control error: %post(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 rpm -e freeradius-client /var/tmp/rpm-tmp.45576: line 1: fg: no job control error: %postun(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 --------------------------------------------- radiusclient.spec 1.rename freeradius-client-snapshot freeradius-client 2.marking #%doc doc/* BUGS COPYRIGHT README README.radexample rpmbuild -bb radiusclient.spec --------------------------------------------- Summary: FreeRADIUS Client Software Name: freeradius-client Version: 1.1.6 Release: 0 Obsoletes: radiusc radiusclient radiusclient-ng Group: Productivity/Networking/Radius/Clients License: Artistic License Packager: Peter Nixon URL: http://www.freeradius.org/ Source0: %{name}-%{version}.tar.bz2 BuildRoot: %{_tmppath}/%{name}-%{version}-build Prefix: %{_prefix} Requires: %{name}-libs = %{version}-%{release} %description A portable, easy-to-use and standard compliant library suitable for developing free and commercial software that need support for a RADIUS protocol (RFCs 2128 and 2139). %package libs Summary: A portable, easy-to-use and standard compliant library for RADIUS protocol (RFCs 2128 and 2139). Group: Development/Libraries %description libs The package contains the shared library of FreeRADIUS Client %package devel Summary: Header files, libraries and development documentation for %{name}. Group: Development/Libraries Requires: %{name}-libs = %{version}-%{release} %description devel This package contains the header files, static libraries and development documentation for %{name}. You need to install %{name}-devel if you want to develop applications using %{name}. %if 0%{?suse_version} > 930 %debug_package %endif %prep %setup -q %build %define localstatedir /var/lib rm missing %if 0%{?suse_version} > 900 %{suse_update_config -f} %endif libtoolize --force aclocal automake -ac autoconf CFLAGS="$RPM_OPT_FLAGS -Wall" \ CXXFLAGS="$RPM_OPT_FLAGS -Wall -fmessage-length=0" \ %configure \ --localstatedir=%{localstatedir} \ --enable-shadow \ --with-secure-path make %install [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} make "DESTDIR=$RPM_BUILD_ROOT" install rm -f $RPM_BUILD_ROOT/%{_sbindir}/login.radius rm -f login.radius/Makefile* rm -f login.radius/migs/Makefile* rm -f %{buildroot}%{_libdir}/*.la %post %{run_ldconfig} %postun %{run_ldconfig} %clean [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} %files %defattr(-, root, root) #%doc doc/* BUGS COPYRIGHT README README.radexample %dir %{_sysconfdir}/radiusclient %{_sysconfdir}/radiusclient/dictionary %{_sysconfdir}/radiusclient/dictionary.* %config(noreplace) %{_sysconfdir}/radiusclient/radiusclient.conf %config(noreplace) %{_sysconfdir}/radiusclient/issue %config(noreplace) %{_sysconfdir}/radiusclient/port-id-map %config(noreplace) %{_sysconfdir}/radiusclient/servers %{_sbindir}/* %files libs %defattr(-, root, root) %{_libdir}/*.so.* %{_libdir}/*.so %files devel %defattr(-, root, root) %{_libdir}/*.a %{_includedir}/*.h %changelog * Sun Jan 06 2008 Peter Nixon - Update to match upcoming freeradius-client release * Sun Nov 19 2006 Peter Nixon - Converted spec from radiusclient package to work with FreeRADIUS Client - Split out separate -devel and -libs packages * Wed Jan 25 2006 - mls(a)suse.de - converted neededforbuild to BuildRequires * Thu Nov 18 2004 - ro(a)suse.de - fixed file list * Sat Jan 10 2004 - adrian(a)suse.de - add %%defattr * Thu Jul 31 2003 - mjancar(a)suse.cz - use %%run_ldconfig * Thu May 29 2003 - mjancar(a)suse.cz - remove Makefiles from documentation * Wed May 28 2003 - mjancar(a)suse.cz - update to 0.3.2 - move localstatedir to /var/lib - remove unpackaged files from buildroot * Wed Apr 02 2003 - ro(a)suse.de - fixed patch radiusclient-0.3.1-fix.dif * Tue Apr 02 2002 - postadal(a)suse.cz - fixed to compile with autoconf-2.53 * Wed Mar 20 2002 - postadal(a)suse.cz - secfix (VU#589523 -buffer overflow in the function that calculates message digests) - fixed login.expamle, README.SuSE * Thu Jan 10 2002 - cihlar(a)suse.cz - use %%{_libdir} * Tue Nov 06 2001 - cihlar(a)suse.cz - fixed to compile with automake 1.5 * Wed Jun 06 2001 - cihlar(a)suse.cz - fixed to compile with new libtool * Mon Mar 26 2001 - cihlar(a)suse.cz - moved whole files from dif - fixed to compile * Wed Nov 29 2000 - smid(a)suse.cz - renamed: raduisc => radiusclient * Wed May 24 2000 - cihlar(a)suse.cz - fixed to compile - added BuildRoot * Sun Apr 09 2000 - bk(a)suse.de - added suse update config macro * Mon Sep 13 1999 - bs(a)suse.de - ran old prepare_spec on spec file to switch to new prepare_spec. * Thu Jun 10 1999 - kukuk(a)suse.de - Remove %%dir for doc tree * Sun Mar 01 1998 - tmg(a)suse.de - README.SuSE again * Tue Feb 10 1998 - tmg(a)suse.de - initial spec file - fixed paths in radiusclient.conf - login.example - simplistic example login.radius script - README.SuSE ________________________________________________________ 180도 달라진 야후! 메일 - 두둥! 새로운 야후! 메일에서는 메시지를 여기저기 끌어다 놓을 수 있답니다. http://kr.content.mail.yahoo.com/cgland

1 0

A way to use LDAP only for authentication
by Konstantin KABASSANOV 13 May '08

13 May '08

Hello, Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if there is a way to allow all users in the authorize section of radiusd.conf (without doing ldap requests) and make the ldap request only in the authenticate section. It is useful for instance to avoid multiple ldap requests during authorization process in particular when a number of radius-request/challenges are exchanged between Access points and radius server. Thanks. Konstantin _____________________________________________________________________ Konstantin KABASSANOV LIP6/CNRS 104, avenue du Président Kennedy, 75016 Paris, France Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html _____________________________________________________________________

1 0

OpenSSL Security in Debian & Ubuntu since 2006
by Alan DeKok 13 May '08

13 May '08

If you have generated SSL certificates on Debian or Ubuntu since 2006, you should seriously consider re-creating them. http://lists.debian.org/debian-security-announce/2008/msg00152.html https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-May/000705.… This applies to SSH keys, too. Alan DeKok.

2 2

stripping domain from username (for wifi authentication on Windows XP)
by Ryan Pugatch 13 May '08

13 May '08

Hello everyone, I am using freeradius to have my wifi network use my LDAP credentials for authentication. However, Windows has this glorious default setting that automatically passes the domain username and password to the radius server to authenticate for wifi access. While I can easily uncheck a box to make that behavior not happen, it would be great if I could just have radius accept those credentials. The windows domain and radius both use the same LDAP directory. The only issue is Windows sends the username as DOMAIN\\username. Is it possible to have freeradius ignore the DOMAIN\\ part of the username? Thanks in advance. Ryan Pugatch

3 4

Regarding: FreeRADIUS sending Access-Reject if no response to proxied Access-Request
by Joakim Bentholm 13 May '08

13 May '08

> Doug Hardie <bc979(a)lafn.org> wrote: >> > Why? What's so problematic about the Access-Rejects? >> >> Because the NAS will not switch over to the alternate radius server >> which is probably working properly. > > Ok... so does the proxying server mark *all* home servers as dead? > > The problem is that if the NAS is using the same RADIUS server for > other purposes, (i.e. packets which are't proxied), then it can fail > over to the backup, even though parts of the server still work... > > If there's *no* way for the server to authenticate *any* packets, > then that's reasonable grounds for pretending to be dead. Any other > partial "live" system means that your local site will have to > determine what packets to reply to, and why. > > I'm willing to add a patch where a module can mark a packet "no > reply". It's then up to you to have a site-local module to mark some > packets. But that knowing *when* to do that is up to you, and is > *very* site-specific. Adding patches to the server core to support > one site's configuration is problematic. > > Alan DeKok. Link to the thread above. http://lists.cistron.nl/pipermail/freeradius-users/2004-April/030887.html Hello, Anyone who knows if and where the patch mentioned above can be. I found this discussion thread, but I do not know where and how to find the the patch, if available. This would solve our problem with an unresponsive user resource management server accessed through a customised module in FreeRadius. FreeBSD version 6.3 FreeRADIUS Version 1.1.7 Best Regards, Joakim Bentholm

2 1

Multiple instances of attribute in tunnelled reply
by Konstantin KABASSANOV 13 May '08

13 May '08

Hi, I think that I have a similar problem when freeradius has to send Access-Accept with multiple Cisco-AVPair="ssid=..." entries. Do you think it will be fixed in the near future ? Thanks. Konstantin _____________________________________________________________________ Konstantin KABASSANOV LIP6/CNRS 104, avenue du Président Kennedy, 75016 Paris, France Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html _____________________________________________________________________

1 0

Move from text to SQL(Postgresql)
by Tuc at T-B-O-H.NET 13 May '08

13 May '08

Hi, I've got a new install, and I have it working fine with plain text files. I'm trying to go this time to Postgresql (Don't ask....) and I'm just not having a good time of it. I don't get why its doing the following (2.0.4 with Postgresql 8.1.11) : Ready to process requests. User-Name = "tuc" User-Password = "ICANSEE" NAS-IP-Address = 192.168.3.128 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tuc", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop expand: %{User-Name} -> tuc rlm_sql (sql): sql_set_user escaped user --> 'tuc' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='tuc' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='tuc' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "ICANSEE" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [tuc/ICANSEE] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> tuc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Why does it head to crypt? I have in radcheck : Welcome to psql 8.1.11, the PostgreSQL interactive terminal. Type: \copyright for distribution terms \h for help with SQL commands \? for help with psql commands \g or terminate with semicolon to execute query \q to quit radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+--------- 2 | tuc | Cleartext-Password | := | ICANSEE (1 row) radius=> Thanks, Tuc

4 8

Re: Load testing tool recommendation
by Anders Holm 13 May '08

13 May '08

In my tests, radclient has been /slower/ the radtest processes forked from a Perl script. 100 requests using my forking Perl script takes 2.2 seconds to complete. 100 requests using radclient takes ~8x, i.e 16.7+ seconds to complete. I'm using the variants included with 2.0.3 .. Using both -c and -p for radclient does not appear to actually fire off requests in parallel, then again, I have no immutable evidence showing this, other then the time it takes to complete. My test consists of a very simple auth request, only containing user name and password. Nothing else. Still, at this stage, the client side hosts are closer to a nuclear meltdown, whereas the server side is barely flinching. I want to be able to generate enough traffic to shoot the server down, or at least start seeing it get close to a crawl. I may be doing something wrong with the radclient, that is a possibility as well ... //anders ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 9, 2008 4:26:37 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: Load testing tool recommendation http://wiki.freeradius.org/Radclient Ivan Kalik Kalik Informatika ISP Dana 9/5/2008, "Anders Holm" <anders.holm(a)sysadmin.ie> piše: >So, I'm building a complete solution, from scratch. > >As such, the business owners have some requirements on how many requests it should be handle today per second and "some point in the future" as well. > >Would there be any good load testing tools, or some handy way to figure out how many tps my current setup can handle? > >I've got a dirt simple Perl script that forks out x radtest processes and I'm just right now seeing how many a second I can ship. Problem being, the RADIUS server is happily letting me melt down to "client" systems, without breaking a sweat. I'd like to load the server, not the clients .. :) I want to see where it eventually breaks down, which seems a task in its own right. > >Any pointers would be much appreciated. I'd rather have something I can fire off from command line then a GUI solution, for obvious reasons. > >Cheers! > >//anders > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 6

Parser problem?
by Norbert Wegener 13 May '08

13 May '08

I don't want the module saneusername to be executed, when the username either contains "HOST" or ends with ".net" or contains "@". Therefore in 2.0.4 I have this code in sites-available/default: authorize { if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) { saneusername } ...... Starting radiusd -X ... rad_recv: Access-Request packet from host 149.246.185.169 port 60938, id=0, length=168^M User-Name = "HOST/02G1-67.us002.mycompany.net"^M NAS-IP-Address = 10.10.20.77^M Calling-Station-Id = "00-00-00-00-00-02"^M Framed-MTU = 1400^M NAS-Port-Type = Wireless-802.11^M Connect-Info = "CONNECT 11Mbps 802.11b"^M EAP-Message = 0x0200002301484f53542f303247312d36372e75733030322e7369656d656e732e6e6574^M Message-Authenticator = 0x1836592939950fab657ec0d5568883c4^M With that User-Name I would expect the module not be executed. +- entering group authorize^M ++? if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ ))^M expand: %{User-Name} -> HOST/02G1-67.us002.mycompany.net^M ?? Evaluating ("%{User-Name}" =~ /HOST/) -> TRUE^M ? Converting !TRUE -> FALSE^M expand: %{User-Name} -> HOST/02G1-67.us002.mycompany.net^M ? Evaluating ("%{User-Name}" =~ /.net/) -> TRUE^M Skipping ("%{User-Name}" =~ /@/)^M ++? if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) -> TRUE^M ++- entering if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ ))^M expand: [-] -> [-]^M saneusername: Changed value for attribute User-Name from 'HOST/02G1-67.us002.mycompany.net' to 'HOST/02G167.us002.mycompany.net'^M Now unfortunately the username has been changed. +++[saneusername] returns ok^M ++- if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) returns ok^M ++? if ("%{sqlnastype:SELECT UserName from usergroup where UserName = '%{User-Name}' }" == "" )^M What do I have to change to make it work as expected? Norbert Wegener

2 1