- Freeradius-Users - lists.freeradius.org

FreeRADIUS as proxy to Windows IAS
by Clive Gould 31 Jul '07

31 Jul '07

Hi I'd be grateful to hear from anyone out there who has got Freeradius (on a Linux box) running as a proxy server successfully validating usernames and passwords against a Windows IAS server using the MSChapv2 protocol. I have the Freeradius server up and running on CentOS 4.5, but can't get it to validate against the IAS server successfully. Please feel free to contact me off list. Thanks in advance. Clive

4 3

[OT] Out of Office AutoReply: Re[2]: Adding a NAS via SQL
by Claudiu Filip 30 Jul '07

30 Jul '07

[Out of Topic AutoReply] ATMEL is still in vacation! ARM rulz :) Claudiu Filip @: claudiu(a)globtel.ro Http://www.globtel.ro T:+40344880100 F:+40344880113 This is a forwarded message From: Ulrich.Hofacker(a)hno.atmel.com <Ulrich.Hofacker(a)hno.atmel.com> To: claudiu(a)globtel.ro Date: Monday, July 30, 2007, 7:11:02 PM Subject: Out of Office AutoReply: Re[2]: Adding a NAS via SQL ===8<==============Original message text=============== danke für ihre mail, aber ich bin bis einschliesslich 19.08.2007 nicht im büro. wenden Sie sich bei dringenden anfragen bitte an ito.admins(a)hno.atmel.com. i'm out of office until 19.08.2007 in urgent cases please send your email to ito.admins(a)hno.atmel.com Ulrich Hofacker IT2 ===8<===========End of original message text===========

1 0

Using the various User-Password, Chap-Password, etc... with MySQL
by liran tal 30 Jul '07

30 Jul '07

Hey everyone, I was wondering if someone can clearly explain the use of different Password attributes when they're used in a scenario where MySQL is involved. The basic case of User-Password is clear. When the attribute in the radcheck table is User-Password then it's value is the password in clear text and the op is == What about Cleartext-Password? I've added this attribute with op of := and value password in clear text and used radtest as a test, and it results in just re-transmission of Access-Request queries, and basically not working. What about Chap-Password, MD5-Password, SHA1-Password, what are their corresponding values and op like? As a side note, I remember reading somewhere the use of the PASSWORD('somepass') function in MySQL for radcheck's password attributes but I'm really not sure in which context was it. Thanks, Lir.

3 4

SQL usage ideas
by Roy Walker 30 Jul '07

30 Jul '07

I think I have a pretty good idea of how the sql structure works for radius. Here are some ideas I have: It looks like the clients query is cached at startup (guessing this since I don't see thousands of queries to the nas table like I do to the other tables). One really useful option would be to add an option to read some of the database tables into the radius servers memory on startup. This would be EXTREMELY useful for my case in that I am using groups and could set the radgroupcheck and radgrouprely tables (since they just about never change, and I would be willing to deal with a restart if they did need to change) to load into memory on the radius server and still allow me to dynamically add/remove users from groups. Would be a good idea to offer this to every read only table (some like radpostauth just would not make sense), some may not be used often, but you never know. Thoughts? Roy

4 6

OpenSER + Freeradius accounting
by Marc LEURENT 30 Jul '07

30 Jul '07

Good Morning, I have some trouble accounting openser calls with freeradius. Calls are accounted, but only AcctSessionId / AcctUniqueId are stored in the database, UserName and Realm fields are empty! Any idea? Thanks My openser.cfg looklikes: # -- acc params (with radius )-- modparam("acc", "radius_config", "/etc/radiusclient-ng/radiusclient.conf") modparam("acc", "radius_flag", 1) modparam("acc", "radius_missed_flag", 2) modparam("acc", "early_media", 1) modparam("acc", "report_cancels", 1) modparam("acc", "detect_direction", 1) modparam("acc", "service_type", 15) # Radius service type used for accounting : 15 = (SIP) modparam("acc", "radius_extra", "Sip-Src-IP=$si; SIP-Method=$rm")

3 2

Wrong behaviour of rlm_ldap module + users file
by inverse 30 Jul '07

30 Jul '07

Hi, this problem is simple (everything not shown here is v1.1.6 out-f-the-box radiusd configuration): users file line: john.doe(a)test.com Auth-Type := EAP, User-Password == "a", Ldap-Group == "wifi" this is a test line, john.doe(a)test.com uses EAP-MD5 , but I want to check if he's in the Ldap-Group named 'wifi'. radiusd.conf lines, ldap section: filter ="(uid=%{User-Name})" edir_account_policy_check=no password_attribute = userPassword groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" This is where I actually suck. I think this is correct, but it won't work as expected because: rad_recv: Access-Request packet from host 149.132.5.108:35285, id=0, length=160 User-Name = "john.doe(a)test.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001f0170616f6c6f2e676169617264656c6c6940756e696d69622e6974 Message-Authenticator = 0x14b3675352d738629cc1bb21695f3122 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20070726' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20070726 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "test.com" for User-Name = "john.doe(a)test.com" rlm_realm: Found realm "test.com" rlm_realm: Proxying request from user john.doe to realm test.com rlm_realm: Adding Realm = "test.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 31 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=test,dc=com radius_xlat: '(uid=john.doe(a)test.com)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.test.com:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/crl/root.pem rlm_ldap: bind as cn=ldapreader,ou=servizi,dc=test,dc=com/blargh to ldap.test.com:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=test,dc=com, with filter (uid=john.doe(a)test.com) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid\3djohn.doe(a)test.com\2cou\3dusers\2cdc\3dtest\2cdc\3dcom))' This is where the problem arises. I don't want to check if uid=john.doe(a)test.com esists. rlm_ldap wants to, but that's not what I told him to do. I never told rlm_ldap to verify if john.doe(a)test.com is an LDAP user. Now he is, but only because I created him. rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=test,dc=com, with filter (&(cn=wifi)(&(objectClass=GroupOfNames)(member=uid\3djohn.doe(a)test.com\2cou\3dusers\2cdc\3dtest\2cdc\3dcom))) rlm_ldap::ldap_groupcmp: User found in group wifi and THIS is what I want rlm_ldap to do. I want to check this and only this, since john.doe(a)test.com is a member of wifi and doesn't exist anywhere else in the LDAP tree. He isn't a user. He's just an object in group wifi. That's what happens in my production environment. john'doe's login fails because the first useless search fails. I know I'm doing something horribly wrong, and I can't find out what's my major malfunction. Help! rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry john.doe(a)test.com at line 32 Bye, Inverse.

2 5

LDAP errror in dialup admin page
by Bishal 30 Jul '07

30 Jul '07

I am trying to use freeradius 1.1.7 in Freebsd 6.2 with openldap 2.3.37 for authentication and mysql for accounting. While creating new user I get following error in dialup admin page: Warning: file(/usr/local/etc/raddb/ldap.attrmap) [function.file]: failed to open stream: Permission denied in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 4 Warning: Invalid argument supplied for foreach() in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 5

2 2

Re: "WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I didn't mean the real WPA key (that's why I put them in brackets). I wanted a key (a pass of some predefined user) in radius server. And the user in raduis server is deleted X hours after it's first login. Is this possible, or am I missing the point completely? Ferd0 ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, July 29, 2007 5:46:00 PM Subject: Re: "WPA keys" that expires after use Hi, > The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. err, if the WPA key only becomes active AFTER they've reached the RADIUS server - then HOW are they to connect to the wireless in the first place - as the WPA key is required for the layer 2 link to come alive(!) AAA would be able to give you this 'very low level' type of authentication. what you COULD do with AAA is to use SSL certs....eg EAP-PEAP/EAP-TLS with WPA-enterprise. and then once the cert has been used, expire it. alternatively use WPA as you are currently doing but enforce another control method to get online - such as a SOCKS5 proxy. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better Heartthrob. Get better relationship answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545433

2 1

"WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I would like to setup a wirelless network in my shop for my customers. And instead of giving them WPA Shared Key, which is valid until I change it manually, I would like to give them a "WPA key, which is valid only for x hours". The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. This way, I could forgetet about changing WPA key manually every week, stop worring that my key was spred to much, etc. Is this possible with FreeRadius server? If yes, is there any "how-to" on this subject? Or do you recomend any other aproach? Ferd0 ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

2 1

OCSP support at FreeRadius
by Frank Büttner 29 Jul '07

29 Jul '07

Hello, does anyone know when FreeRadius will support OCSP at the eap-tls module? Because crl's are not very useful, you have the restart the radius daemon every time when you will revoke an certificate or when an new crl comes out in it normal turn. Frank

2 1