- Freeradius-Users - lists.freeradius.org

Re: Radius MAC filtering with EAP-PEAP
by Alan DeKok 27 Feb '08

27 Feb '08

Era wrote: > Could you please assist me to find my fault. I have test user with laptop. I > want to restrict access for this laptop. In users file I added wrong mac > address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 > credentials. Did you read the documentation for the "users" file? > Here is my users file: > > testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" What do you think this entry does? > Here is my checkval config: I don't think you need to use the "checkval" module. In 2.0, you can just write the logic you want in "unlang". Alan DeKok.

2 1

header enrichment
by mauro 27 Feb '08

27 Feb '08

Hi all i would like to know if freeradius can help to enrich the user header for that mobile services that needs some particular params as for connection type ( 3g, gprs...). Somebody has experience in this ? thanks ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

Complex redundant ldap setup
by Capelle, Mark (PCMC-GB) 27 Feb '08

27 Feb '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

4 3

Re: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

>Could you please suggest me how can I check MAC filter(via Radius) and after >that do EAP-PEAP authorization? > Read your NAS documentation. Ivan Kalik Kalik Informatika ISP

2 1

Radius MAC filtering with EAP-PEAP
by Alexey Eronko 27 Feb '08

27 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. How can I use Radius MAC filtering and EAP-PEAP simultaneously in one network. Could you please suggest me how can I check MAC filter(via Radius) and after that do EAP-PEAP authorization? Thank you Alexey

1 0

Expiration Value
by Tim White 26 Feb '08

26 Feb '08

I'm attempting to use Expiration to expire user accounts after a set time period. What format does the Date/Time (Value field) have to be? From what I can see it's in the format of "Monthname Day Year Hour:Min:Sec". So for example "March 24 2008 00:00:00". But it appears that in this format you can't use normal SQL datetime operators to see if it's expired (for example, to run a SQL query to remove all expired accounts). Can someone who has it working please let me know what format they use for Expiration value, and how they can use MySQL comparison operators with it? (Ether 2.0.2 or 1.1.7). Thanks Tim

5 10

Segmentation Fault on RH EL4 x86_64 with 2.0.2
by Reynolds, Walter 26 Feb '08

26 Feb '08

I am having a problem that I am not sure where to look for a solution. I install Freeradius via src with the straight 'configure', 'make' and 'make install'. No real problems show up during the install that are obvious so I configure and run the server with a local account. All good and fine still. Next I configure for Kerberos authentication which all works well....IF I am not in debug mode. If I enter debug mode however I always Segfault when the server enters the rlm_krb5 module. Thu Feb 21 11:33:34 2008 : Debug: +- entering group Kerberos Thu Feb 21 11:33:34 2008 : Debug: modsingle[authenticate]: calling krb5 (rlm_krb5) for request 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 182896438976 (LWP 21233)] 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) Quit (gdb) info threads * 1 Thread 182896438976 (LWP 21233) 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) thread apply all bt full Thread 1 (Thread 182896438976 (LWP 21233)): #0 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 No symbol table info available. #1 0x00000037e454364f in krb5_get_in_tkt_with_password () from /usr/lib64/libkrb5.so.3 No symbol table info available. #2 0x0000002a95bb0491 in krb5_auth (instance=0x6c5f90, request=Variable "request" is not available. ) at rlm_krb5.c:298 r = Variable "r" is not available. The hardware from gromit (where I get this) Linux gromit.umnet.umich.edu 2.6.9-67.0.1.ELsmp #1 SMP Fri Nov 30 11:57:43 EST 2007 x86_64 x86_64 x86_64 GNU/Linux Hardware on other box where it works: Linux engin-test1.ns.itd.umich.edu 2.6.9-1.667 #1 Tue Nov 2 14:41:25 EST 2004 i686 i686 i386 GNU/Linux Running freeradius 2.0.2. I have pointers that this could be anything from Krb libraries, the rlm_krb to autoconf files. I am not sure exactly what I am seeing here or why it is only when running in debug. I have tried using various installs from specifying library for rlm_krb5 to using broad library direction to local system tools. Always comes back with the Secmentation fault with kerberos like the trace listed above. Any help would be great. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

Step 1: Configuring PAP fails with: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by Russell D. Mitchell 26 Feb '08

26 Feb '08

I've installed freeradius-server-2.0.2 onto a Fedora Core-5 machine, and tried to perform the first step as described in: http://deployingradius.com/documents/configuration/pap.html. Both radiusd and radtest were executed with root priviledges. The only change to config files was to add 'bob Cleartext-Password := "hello"' to /etc/raddb/users, to the top of the file. As you can see at the end of the radiusd output, the failure appears to be due to: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. But, I thought this was supposed to 'just work'. Here's the output from 'radtest bob hello localhost 0 testing123' Sending Access-Request of id 172 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=172, length=20 And here's the output from 'radisud -X': Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32775, id=172, length=55 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1:32775 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 47c459c7 Nothing to do. Sleeping until we see a request.

3 7

RE: PEAP LDAP password problem
by Alexey Eronko 26 Feb '08

26 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. Another very important question is : can I use MAC and EAP-PEAP simultaneously in one network. Alexey Eronko -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alexey Eronko Sent: Tuesday, February 26, 2008 5:30 PM To: FreeRadius users mailing list Subject: RE: PEAP LDAP password problem Thank you for detailed explanation. I'll try to reenter all users password in NTpassword attribute. Could someone give me link to appoporate openldap guide. Where I can find howto do MAC filtering on Freeradius? Thank you -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alan DeKok Sent: Tuesday, February 26, 2008 2:10 PM To: FreeRadius users mailing list Subject: Re: PEAP LDAP password problem Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok.

2 1