- Freeradius-Users - lists.freeradius.org

VLAN Queries
by Jacob Jarick 03 May '07

03 May '07

Salutations all, I will be attempting VLAN assignment tomorrow via FR + ADS + cisco wap. 1st Question: Is it possible to assign VLAN based solely on what ldap server authorized it. (The sites we are looking @ have 1 domain server for staff and 1 for students). 2: Ive been looking @ Mat Ashfields email query regarding vlans, it looks nice and straight forward to me, my only query: Is the ldap group automatically fetched or is some extra configuration needed under the ldap modules or ldap.attrbmap. Mats Example: DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=176, Tunnel-Type=VLAN, Fall-Through = no DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=177, Tunnel-Type=VLAN, Fall-Through = no Thanks for the info.

2 2

Problem with mysql authorization
by Ian Truelsen 02 May '07

02 May '07

I am trying to set up mysql authorization, but am having some problems. I have set up sql.conf which seems to be correct, based on the output: -- Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "xxxx" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" To me, that looks like it is correct. I have added info to the radcheck table: +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ Now, I try to test with radtest: brentwood-internet ~ # radtest ian tester localhost 1812 testing123 Sending Access-Request of id 88 to 127.0.0.1 port 1812 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=88, length=20 So, not so good. rad_recv: Access-Request packet from host 127.0.0.1:2048, id=88, length=55 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 That looks like the query is being processed as I would expect. The rest of the output: radius_xlat: 'ian' rlm_sql (sql): sql_set_user escaped user --> 'ian' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ian' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ian' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [ian]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [ian/tester] (from client localhost port 1812) So, I am not sure what is going on. When I run the command in mysql, I get the correct output, as I would expect: mysql> select id, -> UserName, Attribute, Value, op from radcheck where Username = 'ian' order by id; +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ 1 row in set (0.00 sec) Any thoughts on what I missed here? Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 2

Missing Huntgroups Man Pages
by Norman Zhang 02 May '07

02 May '07

Is huntgroups(5) removed from FreeRADIUS? I googled but all end up with dead links and downloaded 1.1.6 source, can't find it in there either. Please help. Norman

1 0

problem with Dell connection manager?
by Matt Ashfield 02 May '07

02 May '07

HI All We are running our wireless using FR to authenticate against LDAP. A user can login on a laptop, no problem, but when he then goes to a Dell laptop which uses a Dell Connection Manager program, it fails. The odd thing is is that in both cases there is an Access-Accept packet going out, except for the Dell, it does not assign a vlan (which is probably why it's failing). Since it's the same userID loggin in, I'm not sure why the vlan is not being passed. The only thing I can see is that the username field in the Access-Request is preceeded by "\\" in the case of the Dell, and not so in the case of the working laptop. Here's the Access-Request from the one that works: rad_recv: Access-Request packet from host 172.17.0.1:20001, id=166, length=144 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-15-E9-D9-94-85" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010008016d6461 User-Name = "mda" NAS-Port = 4596 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 And here is the Access-Request from the one that does not work (notice the username field): rad_recv: Access-Request packet from host 172.17.0.1:20001, id=161, length=146 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-13-02-77-97-CB" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010009015c6d6461 User-Name = "\\mda" NAS-Port = 4593 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 In both cases there is an access-accept, but vlan is only returned in the case of the first one. Any ideas on a workaround? Thanks for any advice. Cheers Matt Ashfield mda(a)unb.ca

2 2

Re : EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

I have appended the intermediate cert to the server cert but I got the same result. ----- Message d'origine ---- De : "Reimer Karlsen-Masur, DFN-CERT" <karlsen-masur(a)dfn-cert.de> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 2 Mai 2007, 9h40mn 59s Objet : Re: EAP-TTLS PEAP MCHAPv2 Hey. Append all intermediate CA certificates onto the end of the file specified with the "certificate_file" option in the eap.conf files eap->tls section. This file usually hold your RADIUS server certificate and can additionally hold the chain certificates as well. Eshun Benjamin wrote: > > I am using an enterprise certificate which has intermediate CA. The root > CA is well known (verisign) and already on the MAC keychain access(3.3) > by default. MAC recognises the certificate and its validity but > complains of "The server certificate is not trusted because there > are no explicit trust settings". If I click continue or always trust it > works fine but I want to get rid of this prompt without clicking > continue or always trust to give it smooth and uninteractive log on. -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

Any one has an idea of how to get rid of "The server certificate is not trusted because there are no explicit trust settings" on MAC OSX 10.4.9 without selecting "always trust these freecertificate" ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

4 3

Re : EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

I am using an enterprise certificate which has intermediate CA. The root CA is well known (verisign) and already on the MAC keychain access(3.3) by default. MAC recognises the certificate and its validity but complains of "The server certificate is not trusted because there are no explicit trust settings". If I click continue or always trust it works fine but I want to get rid of this prompt without clicking continue or always trust to give it smooth and uninteractive log on. ----- Message d'origine ---- De : Guy Davies <aguydavies(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Avril 2007, 20h54mn 41s Objet : Re: EAP-TTLS PEAP MCHAPv2 Or, if you're using an Enterprise CA with a self signed cert, then make sure that the CA's cert is installed on your Mac. I do this at home and it's fine once you've installed the CA's cert. Rgds, Guy On 30/04/07, Peter Nixon <listuser(a)peternixon.net> wrote: > On Mon 30 Apr 2007, Eshun Benjamin wrote: > > Any one has an idea of how to get rid of > > "The server certificate is not trusted because there are no explicit > > trust settings" > > > > on MAC OSX 10.4.9 without selecting "always trust these freecertificate" > > Yep. Buy a certificate that your machine trusts :-) > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re: No available IP Addresses in the pool ...
by Florin 02 May '07

02 May '07

Hi Thibault, Hi Alan, Thank you very much for coming back to me on this. > If not, confirm that the pool module name is defined in > the acctounting{} section of radiusd.conf and that your > NAS sends accounting Stop messages. The accounting is performed on a different machine (physically) so no poolname is be defined under the acctounting{} section. Which also means that the machine I have problems with will never see accounting packets. For some security reasons outside of my control, this setup cannot be changed. I'll have a look at the rlm_ippool_tool tool. Thanks. > I wonder what it would take to convince RedHat to use a > version that wasn't almost THREE YEARS out of date. Will the latest version of freeradius **really** help in this scenario ? How ? Could it automatically free up IP addresses from the pool based on a timer ? I cannot go "astray" from RHEL binaries and compile a new freeradius version on a production server (24x7x365) without a hell of a good reason. I hope you can understand me. Thanks again guys and I am looking forward for your opinions :-) Regards, Florin

3 2

Different Groups
by Norman Zhang 02 May '07

02 May '07

Is there a way to set FreeRADIUS to authenticate against specific group of users for certain devices. For example, DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" DEFAULT Group == fw-admin cisco-avpair := "shell:priv-lvl=15" Can I have the PIX to authenticate only against group fw-admin? Norman

2 3

Configure freeradius with authentication
by vicente barrientos 01 May '07

01 May '07

2 1