- Freeradius-Users - lists.freeradius.org

User /etc/shadow for Authentication
by Norman Zhang 26 Apr '07

26 Apr '07

How do I setup users tester-a to use /etc/shadow for authentication? Currently I have tester-a Auth-Type := Local, User-Password == "superuser" cisco-avpair = "shell:priv-lvl=15", Service-Type = Administrative-User Norman

4 8

Re: mysql ms-chap
by Tom Whitehouse 26 Apr '07

26 Apr '07

> Date: Thu, 26 Apr 2007 10:53:51 +0200 > From: Jean Frontin <frontin(a)irit.fr> > Subject: mysql ms-chap > To: freeradius-users(a)lists.freeradius.org > Message-ID: <5.0.2.1.2.20070426104358.00c2ce40(a)mailhost.irit.fr> > Content-Type: text/plain; charset="iso-8859-1"; format=flowed > > Hello, > > I'm using 802.1X protocol and user passwords are stored in "smbpasswd" > file. When I want to add a user I must restart radius. Rather than having to restart freeradius you can set hashsize = 0 for the passwd module which forces it to reread the file for every request rather than storing it in memory. Note that the comment # hashsize - hashtable size. If 0 or not specified records are not # stored in memory and file is red on every request. is incorrect (in version 1.1.1) as hashsize defaults to 100 rather than 0 if not present. Tom -- Tom Whitehouse Department of Computer Science, University of York Heslington, York YO10 5DD, United Kingdom email: tomw(a)cs.york.ac.uk | Fax: +44 1904 432767 http://www.cs.york.ac.uk | Voice: +44 1904 434725

1 0

Accept users by NAS-IP-Address
by Svend Eriksen 26 Apr '07

26 Apr '07

It worked fine, thank you. Is it possible to reject users except when they have a valid NAS-IP-Address? For example if a user is not member of a group, or if they are only member of groups which doesnt contain the NAS-IP-Address? I found the 'notfound-reject' for request that doesnt contain NAS-IP-Address (in my case). reg Svend >>/ The problem occurs when I want a group to contain several NAS. How can I />>/ make freeradius accept the login if the NAS-IP-Address from the user, is />>/ one of several listed in a group that a user is member of? /> >==> read info about checkval module in radiusd.conf. > >checkval { > item-name = NAS-IP-Address > check-name = NAS-IP-Address > data-type = ipaddr >} > >* enable the module in section authorize > >and in your radgroupcheck you have to do something like this: > >mysql> select * from radgroupcheck where attribute like 'NAS-IP-Address'; >+----+---------------+----------------+----+-----------------+ >|/ id | GroupName | Attribute | op | Value | />+----+---------------+----------------+----+-----------------+ >|/ 83 | config_common | NAS-IP-Address | += | 1.2.3.4 | />|/ 84 | config_common | NAS-IP-Address | += | 1.2.3.5 | />+----+---------------+----------------+----+-----------------+ > >then if your your user will be in group called "config_common"(whatever >you choose) then checkval module will perform checking base on multiple >values found for NAS-IP-Address. Please mind the "op" field especially!

1 0

Re : mysql ms-chap
by Eshun Benjamin 26 Apr '07

26 Apr '07

Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? yes it is possible ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Jean Frontin <frontin(a)irit.fr> À : freeradius-users(a)lists.freeradius.org Envoyé le : Jeudi, 26 Avril 2007, 10h53mn 51s Objet : mysql ms-chap Hello, I'm using 802.1X protocol and user passwords are stored in "smbpasswd" file. When I want to add a user I must restart radius. Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

mysql ms-chap
by Jean Frontin 26 Apr '07

26 Apr '07

Hello, I'm using 802.1X protocol and user passwords are stored in "smbpasswd" file. When I want to add a user I must restart radius. Does anybody have import passwords into a mysql table. Is it possible or is it a bullshit ? Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Cryptocard .tok?
by Andreas Anderson 26 Apr '07

26 Apr '07

Hi Guys, can someone tell me how i can get the DES key from the .tok files? While searching i found numerous references to a utility from bugtrack, but the utility itself is nowhere to be found. If someone on the list still has it i would really appreciate a copy ;-) Is there any other way to use the Cryptocards in freeradius (installing their Java-Monster aside)? Regards, Andreas _________________________________________________________________ Live Search delivers results the way you like it. Try live.com now! http://www.live.com

1 0

typo in raddb/Makefile
by Milan Holub 26 Apr '07

26 Apr '07

Hi Alan, due to missing `;` and typo in variable in raddb/Makefile you can't build *deb package. Here is a patch: Index: raddb/Makefile =================================================================== RCS file: /source/radiusd/raddb/Makefile,v retrieving revision 1.17 diff -u -r1.17 Makefile --- raddb/Makefile 24 Apr 2007 15:35:12 -0000 1.17 +++ raddb/Makefile 25 Apr 2007 12:19:26 -0000 @@ -43,8 +43,8 @@ fi chmod 640 $(R)$(raddbdir)/naspasswd $(R)$(raddbdir)/clients.conf if [ ! -d $(R)$(raddbdir)/certs ]; then \ - $(INSTALL) -d -m 750 $(R)$(raddbdir)/certs \ - for x in Makefile README xpextensions ca.cnf server.cnf client.cnf; do \ + $(INSTALL) -d -m 750 $(R)$(raddbdir)/certs; \ + for i in Makefile README xpextensions ca.cnf server.cnf client.cnf; do \ $(INSTALL) -m 640 certs/$$i $(R)$(raddbdir)/certs; \ done; \ fi Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 7

RE: Freeradius-Users Digest, Vol 24, Issue 100
by Tamba Ben-Jusu 26 Apr '07

26 Apr '07

Hi All, I run freeradius on an Ubuntu platform and have been using it to deliver both authentication and bandwidth enforcing for its client. Now I want to deliver a dedicated bandwidth to a certain client, please help me with information on how to achieve this. Thanks Tamba

3 2

RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate
by Marcelo Augusto Rodrigues Pimentel 26 Apr '07

26 Apr '07

Marcelo Augusto Rodrigues Pimentel wrote: > OK. But I?m trying to use peap to make an encrypted tunnel validating the server certificate and then I want to authenticate the clients whith EAP-TLS using client/server certificate. The TLS tunnel is working fine, but the second part of EAP-TLS authentication not. > What second part of EAP-TLS? The server supports authenticating via client certificates, and nothing else. I said two parts, because those parts of my configuration uses TLS: The first part is making the encrypt tunnel using PEAP --> Only validates server certificate to create the tunnel. The second part is the authenticathion inner the tunnel with EAP-TLS --> Mutual validation of client and server certificate. This configuration is like Geroge Ou said below: ... PEAP-EAP-TLS is an improved version of the original EAP-TLS protocol that goes further to encrypt client digital certificate information. Both PEAP-EAP-TLS and EAP-TLS have the same server and client side digital certificate requirements. ... Reference: Wireless LAN security guide --> Level 3: Medium to large Enterprise WLAN security" http://www.lanarchitect.net/Articles/Wireless/SecurityRating/ Thank´s ! > So .... in the peap section in the eap.conf, what I?ve to configure for default eap type? Is tls ? > No. You can leave it alone. It's fine. > If I configure tls, I?ve to create a tls section in the peap section or the tls section of the eap.conf is enough. I?ve attached my eap.conf file. > If you want to use just TLS, you don't need the PEAP section. If you want to use PEAP, you need the TLS section. The comments in the "eap.conf" file explain this. "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail."

4 6

Re: Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 25 Apr '07

25 Apr '07

Ok, that's what I thought (about the root Certificate not being pleasing to XP). FYI: I'm using a version of Linux by Novell called SLES (SUSE Linux Enterprise Server) version 9 Service Pack 3 and the FreeRADIUS is from Novell's Web site (freeradius-1.0.2-0.i586.rpm, freeradius-devel-1.0.2-0.i586.rpm). I've done my Certificate work by using SLES' YaST, "Security and Users", "CA Management". I simply exported the root cert using this CA Management GUI. This worked great with Cisco's ADU configuration tool. If someone could give me the quickest and easiest way to creating a root certificate that's works with Windows XP, that would be great. I have another CA running on a Windows 2003 server, can I make use of this CA somehow? Thanks for any help. Marc >>> A.L.M.Buxey(a)lboro.ac.uk 4/25/2007 1:33:00 PM >>> hi, rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select okay. so thats the main issue. were your certificates generated with the XP extensions? how have you configured the native supplicant? it doesnt need much configuring.... just disable fast-connect, disable user guest account, use machine auth (if you're not doing machine) and click the MSCHPv2 stuff and deselect the 'use windows username/password' if you cannot use those. then its up to you to ensure the cert is in the store and you verify or dont verify your radius cert. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0