- Freeradius-Users - lists.freeradius.org

Event-timestamp conversion
by manIP 13 Dec '07

13 Dec '07

Hi all, I have a problem when I receive a "Event-Timestamp" attribute. The provider assures me that he sends it in seconds (...elapsed since Jan 1st 1970) but My radius server "convert it into a date. For instance, the operator has sent Event-Timestamp = 1197392955 and I receive Event-Timestamp = "Dec 11 2007 12:09:15 EST". How I could deactivate that conversion because I want that attribute is seconds? Many Thanks!!

2 1

RSA SecurID Authentication
by Arran Cudbard-Bell 13 Dec '07

13 Dec '07

Hi, Just wondering if anyone on here had some experience with authenticating against a SecurID management server. I think the easiest way would be just to proxy to the RSA RADIUS Server (Funk), but I see there are some PAM modules available from RSA. So if anyone been successful using either of these methods, FR Version and Method (PAM,Proxy) info would be greatly appreciated. Seems like something useful that could go into the wiki. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

4 3

MAC or user auth
by CoMeC 12 Dec '07

12 Dec '07

Hi, I try to configure such a solution: Authorization via MAC Address (with no username required) - if the machine is using a valid IP Address, it is automatically allowed to surf. (I know there is a Calling-Station-id attribute in radcheck) But I need also a support for username/password authentification (via WWW) too. When I try to log in only with MAC, I get a Radius responce "no username", and the machine is denied. How/where in radiusd.conf can I make changes? Thx in advance, Best regards, CoMeC

3 7

RE: Example listed in huntgroup file does not work
by Reynolds, Walter 12 Dec '07

12 Dec '07

Replying to both suggestions inline, but neither will work. >> >> Try this: >> >> alphen NAS-IP-Address =~ '^192\.168\.2\.[56]$' >> User-Name == test1, >> User-Name == test2 >> Problem is in real deployment the IPaddress will be varied from different subnets. >> Regards, >> Frank Ranner >> > Date: Tue, 11 Dec 2007 22:28:54 +0100 > From: <tnt(a)kalik.co.yu> > > Example is fine. "Reply" items apply only to the huntgroup under which > they are listed. They won't apply to others even with the same name. But I guess here is my problem. How do you assign more than one NAS to a huntgroup? > Try this (not sure if Huntgroup-Name works in preprocess): > > alphen NAS-IP-Address == 192.168.2.5 > alphen NAS-IP-Address == 192.168.2.6 > let_in Huntgroup-Name == alphen > User-Name == test1, > User-Name == test2 This did not work as is. > > Normally, you would add those users to a group and use Huntgroup-Name > check in radgroupcheck. But this uses SQL which we are not using and would prefer not to. > > Ivan Kalik > Kalik Informatika ISP > > Dana 11/12/2007, "Reynolds, Walter" <waltr(a)umich.edu> pi?e: > > >I have tried to set up a huntgroup to match based on the example that > is > >given in the file itself, but am not getting expected results. I want > >to limit the users that can connect to specific NAS's which works well > >if there is only one NAS in the huntgroup, but does not work for more > >than one. So I am sure that there is something simple I am missing > > > >Following is what I have. It will prevent user test3 from > >authenticating on 192.168.2.6, but not .5 > > > > > >alphen NAS-IP-Address == 192.168.2.5 > >alphen NAS-IP-Address == 192.168.2.6 > > User-Name == test1, > > User-Name == test2 > > > >So why does the authorize section not see the first NAS listed in the > >huntgroup? I have many boxes that need the same users while limiting > >all others. This could be done with a huntgroup for each NAS, but > then > >if a user changes I am forced to modify every huntgroup. I am using > >1.1.6. Thanks. > > > > > >--- > >Walt Reynolds > >Principal Systems Security Development Engineer > >Information Technology Central Services > >University of Michigan > >(734) 615-9438 > >

2 1

RE: MAC or user auth
by CoMeC 12 Dec '07

12 Dec '07

Ok, Sorry for unsufficent informations. :) For both authentifications methods there will be 2 separate NAS (one for username/pass auth and one for MAC auth) As NAS I will use Mikrotik routers. The thing is - router will lease DHCP Address to a clients machine. - router sends Calling-Station-id Attribute in Access-Request, so I know the client's MAC In radcheck I have for example a user "John" with attribute Calling-Station-id := MAC I would like freeradius to ignore username and only check table for MAC. If he found a valid MAC, then it knows that the user is "John" and it can send an Access-Accept with parameters. I know that radius can authenticate a Username with MAC. But how to make radius ignores the username? So, if Radius found no Calling-Station-id:=MAC attribute, and it has got Username, then it has to authenticate user using username and password. :) Is it possible? And if not would you advice me another solution? Thanks, Best regards, CoMeC :) On Wed, 12 Dec 2007 13:13:34 +0100, "Edvin Seferovic" <edvin.seferovic(a)kolp.at> wrote: >>Authorization via MAC Address (with no username required) > > This is being done by your NAS ! Username is usually the MAC address. > >> if the machine is using a valid IP Address, it is automatically allowed > to > surf. >> (I know there is a Calling-Station-id attribute in radcheck) > > IP address has to be given by DHCP or your NAS. FreeRADIUS has nothing to > do > with the firewall rules ( NAT etc ). > >>But I need also a support for username/password authentification (via > WWW) > too. > > This also depends on your NAS ! > >>When I try to log in only with MAC, I get a Radius responce "no > username", >>and the machine is denied. > > Run freeradius in debug mode ( freeradius -X ) and see what attribute is > used for MAC address and use it as i.e. username. > > You should send us more information about your NAS. Nobody will be able to > help you in other case. > > Regards, > E:S > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

RE: rlm_eap: Identity does not match User-Name...
by Michael Patzer 12 Dec '07

12 Dec '07

if anybody has the same problem, here's the solution.. i've installed 2.0.0-pre2 and made just the following changes to radiusd.conf: mschap { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response} --domain=%{mschap:NT-Domain}" } after that averything works fine, so i started to add my perl-module to every section. after that it fails with the same error as pre1. so i remove "perl" from the authorize section - where it wasn't realy required, and now everything works fine. i think this will also works with pre1, but now i'll stay on pre2 :-) for 2.0.0 final: the sample "ntlm_auth"-line in radiusd.conf won't work! thx for help, Alan. regards, michael

2 1

rlm_eap: Identity does not match User-Name...
by Michael Patzer 12 Dec '07

12 Dec '07

hi, i found the same question and also this topic already on the mailinglist, but no solution which works for me. i'm already debugging this thing the whole day, without any solution. i'm using 802.1x with clients: winXP sp2 method: EAP-MSCHAPv2 server: 2.0.0-pre1 it works all fine, as long as i'm not supply any domain-name. if i supply a domain-name it immediately fails with rlm_eap: Identity does not match User-Name, setting from EAP Identity. could anybody help me with that? and yes, there is no entry in "users" for EAP. thx michael ****************** * DEBUG LOG ****************** rad_recv: Access-Request packet from host 192.168.0.240 port 1645, id=66, length=149 User-Name = "DOMAINXYZ\\mipa" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-E2-D8-3D-81" Calling-Station-Id = "00-80-C8-39-16-92" EAP-Message = 0x0202001601454e54455250524953455c7061747a6572 Message-Authenticator = 0xfe2f2b31d8a812b6338524fe5618414e NAS-Port-Type = Ethernet NAS-Port = 50001 NAS-IP-Address = 192.168.0.240 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns noop for request 0 perl_pool: item 0x816a2d8 asigned new request. Handled so far: 1 found interpetator at address 0x816a2d8 rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 00-80-C8-39-16-92 rlm_perl: Added pair Called-Station-Id = 00-1A-E2-D8-3D-81 rlm_perl: Added pair Message-Authenticator = 0xfe2f2b31d8a812b6338524fe5618414e rlm_perl: Added pair User-Name = DOMAINXYZ\\mipa rlm_perl: Added pair EAP-Message = 0x0202001601454e54455250524953455c7061747a6572 rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 192.168.0.240 rlm_perl: Added pair NAS-Port = 50001 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Auth-Type = EAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x816a2d8 modcall[authorize]: module "perl" returns ok for request 0 modcall[authorize]: module "expiration" returns noop for request 0 modcall[authorize]: module "logintime" returns noop for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 radius_xlat: 'DOMAINXYZ\\mipa' attr_filter: Matched entry DEFAULT at line 11 modcall[post-auth]: module "attr_filter.access_reject" returns updated for request 0 modcall: group REJECT returns updated for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 66 to 192.168.0.240 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 66 with timestamp 475edfcb Nothing to do. Sleeping until we see a request.

2 1

ip assignment without ip pool
by hadi golestani 12 Dec '07

12 Dec '07

Hello, I need to assign static ips to serveral users but not all of theme, and I feel it's a bad way to define an ip pool for each of theme. how to assign a specific ip address to a user?

2 5

Example listed in huntgroup file does not work
by Reynolds, Walter 12 Dec '07

12 Dec '07

I have tried to set up a huntgroup to match based on the example that is given in the file itself, but am not getting expected results. I want to limit the users that can connect to specific NAS's which works well if there is only one NAS in the huntgroup, but does not work for more than one. So I am sure that there is something simple I am missing Following is what I have. It will prevent user test3 from authenticating on 192.168.2.6, but not .5 alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 User-Name == test1, User-Name == test2 So why does the authorize section not see the first NAS listed in the huntgroup? I have many boxes that need the same users while limiting all others. This could be done with a huntgroup for each NAS, but then if a user changes I am forced to modify every huntgroup. I am using 1.1.6. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

3 2

RE: powerfull manager?
by Edvin Seferovic 11 Dec '07

11 Dec '07

>I love GPL, but unfortunatelly there is too few software being developed >for Radius... That was my problem too ! >All I need is actually: >- bandwith, time, volume limitation >- username/password authentication >- MAC authentication (but here is a trick - few MAC's for a one "billing" >user) >- card generator Almost everything covered ! >And of course something that would allow me to print bills ;) I have PDF generation :) > Do you know anything, that would do that? Not at the time of writing this. PhpMyPrePaid has some of interesting features. >I suppose, that as your project is a Uni project, you can't make it as GPL? Actually I am developing it for my company and my BS project is about data accounting and anomaly detection in systems that use RADIUS ! I'll let you know ! Anyone interested in supporting this project ? Regards, E:S

1 0