- Freeradius-Users - lists.freeradius.org

Re: freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

How do i tell my users not to send CHAP-Password ? Is pap allowed in the authorize section in 1.1.6 ? Thank you for the fastest answer i've ever expected ! ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. http://new.toolbar.yahoo.com/toolbar/features/mail/index.php

2 1

freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

How do i tell my users not to send CHAP-Password ? Is pap allowed in the authorize section in 1.1.6 ? Thank you for the fastest answer i've ever expected ! ----- Original Message ---- From: Peter Nixon <listuser(a)peternixon.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 10:28:34 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem On Thu 17 May 2007, vik wrote: > Hello, > > I have 1.1.3 server version. Please update to 1.1.6 > I would like to be able to store encrypted passwords on my computer, but i > can't. I've read about everything dealing with this problem, but still i > cannot manage to succeed. > > In my users file i have > > DEFAULT Auth-Type := PAP > Fall-Through = Yes This bit is not necessary.. > gogo User-Password := "my_encrypted_password_using_md5" > .... > > Here i've tried also with Crypt-Password, but it doesn't work either. You do need to use Crypt-Password... > Still i have in the debugs: > Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot > use "CHAP-Password". > > Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i > have disabled all chap options in the radiusd.conf. Because your users are sending you CHAP passwords. If you don't support them, tell your users to send use PAP instead.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. http://new.toolbar.yahoo.com/toolbar/features/mail/index.php - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Pinpoint customers who are looking for what you sell. http://searchmarketing.yahoo.com/

1 0

radiusd, radtest, radclient
by leebra girl 17 May '07

17 May '07

i have pptpd connection, i want to implement with radius, but actually i still confuse with 3 argument, that is radiusd, radclient, and radtest i read the manual page about that, i think radiusd work on server side..?? and radclient and radtest, is use for user to connect into radius server....?/??is that right?? but, i have my client is windows XP, how can i use radclient and radtest for that??? thanks

2 1

freeradius + pap + md5 (or encrypt) problem
by vik 17 May '07

17 May '07

Hello, I have 1.1.3 server version. I would like to be able to store encrypted passwords on my computer, but i can't. I've read about everything dealing with this problem, but still i cannot manage to succeed. In my users file i have DEFAULT Auth-Type := PAP Fall-Through = Yes gogo User-Password := "my_encrypted_password_using_md5" .... Here i've tried also with Crypt-Password, but it doesn't work either. Still i have in the debugs: Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot use "CHAP-Password". Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i have disabled all chap options in the radiusd.conf. Here i have my radiusd.conf: http://bozadjiev.free.fr/files/radiusd.conf and users file: http://bozadjiev.free.fr/files/users Thank you for the time you'll spend reading, regards. ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

2 1

LDAP Group Support
by Clark J. Wang 17 May '07

17 May '07

I've read through the rlm_ldap wiki (http://wiki.freeradius.org/Rlm_ldap) and the sample radiusd.conf in FreeRADIUS package but I still don't know how to make LDAP Group work. Is there any more detailed examples? Thanks.

2 1

Re : Attributes mapping between LDAP and RADIUS
by Eshun Benjamin 17 May '07

17 May '07

Jian Wang wrote: > Is there an RFC standardizing the attribute mapping between LDAP and > RADIUS? look at this doc; http://docs.sun.com/source/806-4252-10/mapping.htm ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan Dekok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 16 Mai 2007, 9h28mn 38s Objet : Re: Attributes mapping between LDAP and RADIUS Jian Wang wrote: > Is there an RFC standardizing the attribute mapping between LDAP and > RADIUS? No. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

EAP-TLS Inner/Outer identity
by Keith Moores 16 May '07

16 May '07

I'm trying to find a solution to a wireless authorization issue. Background When using EAP-TLS both Windows (XP/Vista) and Mac OS supplicants by default set the outer identity equal to the user certificate Subject Alternative Name - Principle Name (OID 1.3.6.1.4.1.311.20.2.3) when it exists (not the Common Name). This is somewhat similar to S/MIME using the Subject Alternative RFC822 Name (not the Common Name). This is significant usability benefit as users don't have to enter a separated user name to connect, which in my experience a lot of supplicants require. During authentication the outer identity becomes the User-Name in FreeRadius and can be used for authorization (such as LDAP). Independently the certificate (which contains the inner identity) can be validated. We use client certificates for access to multiple services (web sites and more than one wireless networks), thus need the ability to control access to each independently. i.e. One class of users does not have any access to a particular wireless network with their user certificate but does have access to another wireless network (and/or web resources) with their user certificate. CRL are not the solution in this case as they invalidate the user certificate for all uses. Problem The outer identity can be set by the user to anything the user wants, meaning it shouldn't be trusted/used for an authorization lookup. In FreeRadius it does not appear possible to directly lookup authorization based on the inner identity, only to check the inner identity Common Name against a the outer identity, i.e. check_cert_cn = %{User-Name} Our Common Names are not unique (which seems typical of other CAs as well) so there may be two certs for different users that have the Common Name "John A. Smith" which is why our CA populates the Subject Alternative Name - Principle Name (among other fields) with the users unique user ID. http://middleware.internet2.edu/hepki-tag/pki-lite/hepki-tag-pkilite- profile-current.html#PrincipalName http://support.microsoft.com/default.aspx?scid=kb;en-us;281245 In Cisco ACS land we could accomplish this with "Certificate SAN Comparison" http://www.cisco.com/en/US/products/sw/secursw/ps2086/ products_configuration_guide_chapter09186a0080721d80.html#wp999517 Questions Is there a way to perform an authorization lookup based on the EAP- TLS inner identity Subject Alternative Name - Principle Name? Any chance for adding support for checking the outer identity against the Subject Alternative Name - Principle Name, i.e. check_cert_san = % {User-Name} I found this old comment in list archives, does the same answer still hold on access to other certificate fields? > Alan DeKok freeradius-users(a)lists.freeradius.org > Fri, 08 Apr 2005 12:46:31 -0400 > > =?iso-8859-1?Q?Alejandro_Mart=EDnez_Marcos?= <almartinez(a)sgi.es> > wrote: > > I would need an option "check_cert_uid" instead of > "check_cert_cn", > > because my client certificates don't have a cn. Is it possible > at the > > moment? In other case, how can we achieve it? > > Source code edits. > > The TLS module should really export a way to check all fields in the > certificate, via something like %{tls:....}. That way the > "check_cert_foo" stuff could go away. > > Alan DeKok. Thanks in advance, -Keith ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

1 0

Trying to apply a simple proxy_reply law
by Marc Miranda (GOWEX) 16 May '07

16 May '07

Hello freeRADIUS friends! First of all, thank you all for your great labour developing such a great software. I have a doubt and it's very important for us to resolve it ASAP. We've installed freeRADIUS in its Version 1.0.2. Our problem is that we want to apply that rule: ACCESS RADIUS --------> OUR PROXY -------------------> HOME RADIUS <-----------------------------------------------------| (Filter) If an auth packet from a home RADIUS in our proxy it's been sent to the access RADIUS, we want that Session-Timeout attribute has a maximum of 3600 seconds. That's why we want to apply the following algorithm: If Session-Timeout is null, we want to proxy it with a value of a 3600 seconds If Session-Timeout is greater than 3600 we want forward it with 3600 seconds If Session-Timeout is smaller or equals to 3600, we want to respect it I'm sorry if that's trivial, but I've been a long time reading all kind of forums and specs, docs and faqs and I can't find the solution: The problem is: * Users file only seems to work as a filter for incoming request, not outcoming ones * Attr_filter module doesn't allow to write an attribute if and only if that's NULL (not even with '=' operand which hypothetically assigns a value only when it does not exist [in users file]) * Attr_rewrite doesn't seem to work unless you put the new_attribute parameter to yes (is that a bug) and I'm not sure if its possible to use it if attribute is not attached per se Hence my doubt. I will be very pleased if you could help me. Thanks a lot in advance!!!

2 3

1.1.6 xlat :- broken
by Mike Sturdee 16 May '07

16 May '07

I have a freeradius box (version 1.1.0) with the following (working) group lookup.. On updating to 1.1.6 it appears the %{Stripped-User-Name:-%{User-Name}} part is broken.. I see in cvs there is an update to head, "radiusd/src/main/xlat.c (1.115): make ':-' work again".. I have not had luck trying to merge relevant changes to the 1.1 branch.. Could this be fixed in stable? -- radiusd.conf: ldap { ... gid = %{ldap:ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectClass=%{Realm}))} groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(|(gidNumber=${gid})(memberUid=%{Stripped-User-Name:-%{User-Name}})))" do_xlat = yes ... } Debugging output: rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=domain,dc=com' radius_xlat: Running registered xlat function of module ldap for string 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name' rlm_ldap: - ldap_xlat radius_xlat: 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(uid= rlm_ldap: ldap_search() failed: Bad search filter: (&(uid= rlm_ldap: Search returned error rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_search() failed: Bad search filter: (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error Thanks, -Mike

1 0

radrelay.conf - can't parse properly
by Milan Holub 16 May '07

16 May '07

Hi Alan, based on cvs head from May 10 2007: having following listen entry in radrelay.conf: listen { type = detail detail = /var/log/freeradius/radacct/radrelay/detail max_outstanding = 100 identity = radrelay } "radrelay personality" of freeradius can't parse the config properly: `freeradius -X -n radrelay` ends up with: /etc/freeradius/radrelay.conf[111]: No detail file specified in listen section when debugging: (gdb) run -X -n radrelay Starting program: /usr/sbin/freeradius -X -n radrelay [New Thread 1024 (LWP 24967)] Config: including file: /etc/freeradius/radrelay.conf FreeRADIUS Version 2.0.0-pre0, for host i386-pc-linux-gnu, built on May 10 2007 at 14:04:03 Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no snmp = no max_request_time = 30 cleanup_delay = 5 max_requests = 65536 allow_core_dumps = no log_stripped_names = no log_file = "/var/log/freeradius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/var/run/radiusd/radrelay.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { syslog_facility = "daemon" } } port = 1812 listen { type = "detail" identity = "radrelay" listen { max_outstanding = 100 } [Switching to Thread 1024 (LWP 24967)] Breakpoint 1, detail_parse (filename=0xbfffe550 "/etc/freeradius/radrelay.conf", lineno=111, cs=0x807b898, this=0x8150fb0) at listen.c:1227 1227 if (!data->filename) { (gdb) print data $1 = (listen_detail_t *) 0x8150fe0 (gdb) print data->filename $2 = 0x0 (gdb) print data->vps $3 = (VALUE_PAIR *) 0x0 (gdb) print data->fp $4 = (FILE *) 0x0 (gdb) print data->state $5 = 0 (gdb) print data->timestamp $6 = 0 (gdb) print data->client_ip $7 = {af = 0, ipaddr = {ip4addr = {s_addr = 0}, ip6addr = {in6_u = {u6_addr8 = '\0' <repeats 15 times>, u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, u6_addr32 = {0, 0, 0, 0}}}}} (gdb) print data->max_outstanding $8 = 100 (gdb) print data->outstanding $9 = (int *) 0x0 (gdb) continue Continuing. /etc/freeradius/radrelay.conf[111]: No detail file specified in listen section Program exited with code 01. Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 5