- Freeradius-Users - lists.freeradius.org

catch-all line at the end of users file?
by Brian Johnson 06 Jun '07

06 Jun '07

Hello again all, Thanks to the folks who responded to my earlier plea with regards to authenticating many Cisco devices using radius. I'm trying to weigh my options and see which direction I want to go. One Idea I had after sending mail to the list was, have a sort of "catch-all" line at the end of the users file, so that if the radius server hears a request from a device where the client-ip-address isn't specified already in the file, it would look in our custom group file for authorized users and allow them entry. Here's an idea of what I'm thinking: DEFAULT Auth-Type = Kerberos Fall-Through = 1 DEFAULT Client-IP-Address == 10.0.0.60, Huntgroup-Name == group1 DEFAULT Client-IP-Address == 10.0.0.226, Huntgroup-Name == group2 DEFAULT Called-Station-Id == 5551234, Custom-Group == "dept800" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Session-Timeout = 28800, Idle-Timeout = 28800, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Called-Station-Id == 5551234, Auth-Type := Reject ... and at the end: DEFAULT Custom-Group == "routerfolk" DEFAULT Auth-Type := Reject My thinking is, if the request comes from a device where the client-ip-address is specified, then it will let it through. If it comes from a device where the client-ip-address is not specified, then it will hit the next to the last line of the file, check the custom-group file and see if the user exists in it. If they do, they're authenticated on the device. If they don't exist in the file, then they'll hit the last line and be rejected. However, what I've found in practice is, even if a request is heard from a device where the client-ip-address is specified above, they're still being rejected by the last line. Is there any way that I can tell the last line to reject *only* if there isn't a match previous to it? Thanks again for any help! Brian -- Brian Johnson "And I will be even more undignified than this, and will be humble in my own sight." (2 Samuel 6:22)

2 1

multiple server certificates in EAP-TLS
by Aller Ventosa, Manuel 06 Jun '07

06 Jun '07

Hi Has got Anybody a freeradius server working with multiple server certificates? I've tried the configuration explained below but freeradius returns error messages. Module: Instantiated eap (eap1) eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/home/certificados/store/CAX-CA2" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "test" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap2: Module instantiation failed. radiusd.conf[1597] Unknown module "eap2". radiusd.conf[1597] Failed to parse "eap2" entry. Any help is good Thanks Manel ------------------------------------------- 2. Re : Multiple server certificates in EAP-TLS or EAP-TTLS (Eshun Benjamin) Message: 2 Date: Wed, 30 May 2007 05:22:30 +0000 (GMT) From: Eshun Benjamin <bkeshun(a)yahoo.fr> Subject: Re : Multiple server certificates in EAP-TLS or EAP-TTLS To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <796452.32991.qm(a)web26001.mail.ukl.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" There was a post on this by Mike; You'll have to set up two instances of the EAP module. The first instance will have the TLS submodule set up with the information for Cert1.pem (and the appropriate key and CA cert). The second instance will have its TLS submodule set with the info for Cert2.pem. It will look something like this: modules { ... eap eap1 { ... tls { certificate = Cert1.pem ... } } eap eap2 { ... tls { certificate = Cert2.pem ... } } } authorize { ... eap1 } authenticate { ... eap1 eap2 } Then, this is one of the few instances where you'll need to manually specify the Auth-Type in the users file, like this: DEFAULT Called-Station-ID = "00112233445566:SSID1", Auth-Type := eap1 DEFAULT Called-Station-ID = "00112233445566:SSID2", Auth-Type := eap2 Or, better yet, use regexes (this should work): DEFAULT Called-Station-ID =~ ":SSID1$", Auth-Type := eap1 ================================================== Benjamin K. Eshun DISCLAIMER: Este mensaje contiene información propietaria de la cual parte o toda puede contener información confidencial o protegida legalmente. Esta exclusivamente destinado al usuario de destino. Si, por un error de envio o transmisión, ha recibido este mensaje y usted no es el destinatario del mismo, por favor, notifique de este hecho al remitente. Si no es el destinatario final de este mensaje no debe usar, informar, distribuir, imprimir, copiar o difundir este mensaje bajo ningún medio. --------- DISCLAIMER: This e-mail contains propietary information some or all of which may be legally protected. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail. If you are not the intended recipient you must not use, disclose, distribute, copy, print or relay this e-mail. ***************************************************************************

1 0

Proxy based on username
by Loffredo Tullio 06 Jun '07

06 Jun '07

Hello, I need to proxy AA request from some users. Therfore, the proxy is based on the string "username@realm", and non only on the realm... Do you have any suggestion in order to configure such feature? Thank you and regards Tullio Loffredo -------------------------------------------------------------------- CONFIDENTIALITY NOTICE This message and its attachments are addressed solely to the persons above and may contain confidential information. If you have received the message in error, be informed that any use of the content hereof is prohibited. Please return it immediately to the sender and delete the message. Should you have any questions, please contact us by replying to webmaster(a)telecomitalia.it. Thank you www.telecomitalia.it --------------------------------------------------------------------

3 2

Re: sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Ivan, Thanks for the reply. I've tried that configuration too, but there was some problem (don't remember exactly), and finally decided to keep all the information in the database. With best regards, Andrew. > Why not you use huntgroups: > > HGdial NAS-IP-Address == dial NAS IP > SQL-Group = dialup, > ... other dial groups > > HGWiFi NAS-IP-Address == WiFi NAS IP > SQL-Group = wifi, > ... other wifi groups > > etc. > > Ivan Kalik > Kalik Informatika ISP

1 0

sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Gurus, I need to set up FR with SQL (Postgres) backend storing all users/groups information except clients.conf. Groups are mission-critical, because the same user can come from different NASes (WiFi, Dial-Up, VPDN) and should get different settings (IP addresses etc). Access to different services is granting through radusergroup table, where user belong or not belong to corresponding group. If user doesn't belong do group 'dialup' but come from Dial-Up NAS, it should be rejected even with correct password. That access idea seems to me very simple, but I've spend many days getting it to work state. First of all, i realized that documented rlm_sql `read_groups' directive don't affect on sql_config structure read_groups member. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 104a105,106 > {"read_groups", PW_TYPE_BOOLEAN, > offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, Well, that didn't fix the problem. Now rlm_sql successfully find the user in radcheck table, setting found=1, and then check groups. The problem is that found remains =1 in case of group check failure (rlm_sql_process_groups returns 0). diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c This patch fixes that issue (line numbers are correct for original file without first patch): 988a989,991 > } else { > /* no matched group found => decline the user */ > found = 0; Well, that also didn't fix the problem. Now rlm_sql returns RLM_MODULE_NOTFOUND, but for FR it doesn'd mean 'reject the user immediately', and after processing of next modules, the user is accepted without any groups. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 1044c1044 < return RLM_MODULE_NOTFOUND; --- > return RLM_MODULE_REJECT; After that patch the FR (CVS 20070605) is working as expected. here is some database data: radchek table contains only user passwords: # select * from radcheck; id | username | attribute | op | value ----+-------------+----------------+----+------------------------------------ 1 | guest | Crypt-Password | == | $....... ... radreply table is empty radusergroup table contains user to groups mappings: # select * from radusergroup; username | groupname | priority -------------+---------------+---------- guest | dialup_guests | 3 ... radgroupcheck table contains attributes to distinguish NASes, set Pool-Names and some other unimportant things: # select * from radgroupcheck; id | groupname | attribute | op | value ----+----------------+------------------+----+------------------ 3 | dialup_guests | NAS-IP-Address | == | 192.168.0.1 7 | dialup_guests | Pool-Name | := | dialup_pool ... radgroupreply table contains nothing special: # select * from radgroupreply; id | groupname | attribute | op | value ----+---------------+-----------------+----+------- 1 | dialup_guests | Session-Timeout | := | 900 ... I'm pretty sure that there is more straight way to do the same thing. If someone have another solution, please tell. I would be happy if this info will help somebody. Any comments are greatly appreciated. Best regards, Andrew.

2 1

RE: EAP-TLS problem
by Wolfgang Burger 06 Jun '07

06 Jun '07

On Tue, 5 Jun 2007 17:37:23 +0100 (BST) shantanu choudhary <shantanu_843(a)yahoo.co.in> wrote: > If u know really gud online help >available please let me kno Try http://homepage.mac.com/andreaswolf/public/wpaeap.html It won´t make you understand certificates. But it allows you to set up a running solution. >From there, it´s easier to figure out, what you have actually done with all those scripts. Regards Wolfgang Burger

1 0

Dynamic VLAN-Assigning with Dell PowerConnect 3448
by André Graf 06 Jun '07

06 Jun '07

Hi List Since hours i am trying to get dynamic vlan-assigning working with a Dell PowerConnect 3448 Switch and Freeradius 1.1.6. In my Users-File I have the following Default-Entry (like seen in some other tutorials, often used with Cisco-devices). DEFAULT Auth-Type := EAP Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 110 The authentication succeed, but I don't fall in to the defined VLAN. (I always fall in to the Switch-Default-VLAN #1) Are there some kind of "special" settings with this DELL-Switch or is there an other solution for my problem? Thank you for your answers! Greetings Andre

2 2

EAP-TLS problem
by shantanu choudhary 06 Jun '07

06 Jun '07

hi all, i m trying to get EAP-TLS working for free radius, but i m not able to figure out how to handle all those certificates. Can u tell me how are u using those certificates and are u using openssl for generating those certificates and do need to run openssl explicitly along with radius server to check client certifiates, and how to transfere those certificates to client. there is lot of help available and i tried few with some unsuccessful attempts. If u know really gud online help available please let me know... regards shantanu --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

2 1

configuration
by parfait kouassi nda 06 Jun '07

06 Jun '07

i want to configure my freeradius server to be a proxy server! can i have the config of the modification of freeradius's files? My proxy's server must turn with IAS of windows server 2003! thanks! _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

3 4

log file for eap-tls with free radius 1.1.6
by anoop_c＠sifycorp.com 05 Jun '07

05 Jun '07

Hi In log file i am not able to get anyhting.First time i got one log saying its started and all. After that if again i start the server no logs are coming.But if i run in debug mode (RADIUS -X) its throwing all procedure and user is able to connect also Due to this i am unabe to change my prodution server from Navis radius to free radius Regards Anoop

1 0