- Freeradius-Users - lists.freeradius.org

PEAP/EAP-TLS with client and server certificate
by Marcelo Augusto Rodrigues Pimentel 24 Apr '07

24 Apr '07

Hi, I´m trying to configure freeradius with PEAP + EAP-TLS, but I´m making some confusion to configure the radiusd.conf (sections authorize and authentication) and eap.conf. Have someone implemented this configuration? In the eap.conf file the default eap type is TLS or PEAP? What I´ve to configure in the authorize and authentication sections? I´ve attached my conf files below. Best Regards ... FreeRADIUS Version 1.0.1 eap.conf eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types # EAP-TLS tls { private_key_password = xxxxxxxxxxx private_key_file = ${raddbdir}/certs/freeradius_key.pem certificate_file = ${raddbdir}/certs/freeradius_cert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = tls } #tls { #private_key_password = xxxxxxxxxx #private_key_file = ${raddbdir}/certs/freeradius_key.pem #certificate_file = ${raddbdir}/certs/freeradius_cert.pem #CA_file = ${raddbdir}/certs/demoCA/cacert.pem #dh_file = ${raddbdir}/certs/dh #random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #} #mschapv2 { #} } radiusd.conf (only authorize and authentication sections) . . . # Instantiation instantiate { } # authorize { preprocess files mschap eap } # Authentication. authenticate { Auth-Type MS-CHAP { mschap } eap } . . . "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail."

2 1

Add a secondary ldap server to radiusd.conf
by Hubert Kupper 24 Apr '07

24 Apr '07

Hello, how can I add a secondary ldap server to radiusd.conf for failover? Regards Boert

3 5

FR + ADS 2003 + ntlm_auth (including config files)
by Jacob Jarick 24 Apr '07

24 Apr '07

radius -X -f: http://pastebin.ca/455389 config files: http://rapidshare.com/files/27607850/config.tgz.html Hello All, I have gone back to ntlm_auth for the time being instead of ldap due to the incredibly frustrating lack of good documentation (if there are good docs, link it or shutup). None of the howtos/ tutorials I have followed end in success its always some ldap error of some kind. At least 1/2 the FR + LDAP howtos say to set DEFAULT Auth-Type := LDAP which I have been told by Alan is incorrect. I followed Alans Active Directory Intergation tutorial and everything is setup as the guide says, But eap fails with this message: " rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. " I had this the 1st time I followed the pdf but I did find another howto that said to add something else and that got it working, but for the life of me I cant find it again. On another note Id like to volenteer to help update some of the documentation out there on FR, some is horribly out of date and makes for a very frustrating introduction for people.

2 1

Requesting Decent Freeradius + ADS 2003 + LDAP howto
by Jacob Jarick 24 Apr '07

24 Apr '07

Ok, I have read them all - the wiki's the unrelated novell howtos for edirectory bought a Oriellys book on ldap (their FR + LDAP howto is incorrect apparently) and googled countless times. The articles on http://wiki.freeradius.org/LDAP arent much help they just re-itterate whats in the config files and rlm_ldap doesnt seem to mention setting the users file. http://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/radius.html The above article instructs you to set Auth-Type =: LDAP which is wrong I have been told by alan (but what is correct then ?). I am about to start from fresh again just to make sure its not config setting I have changed and forgot to fix. But I would appreciate any good howtos others may have found and of course any answers / information you guys can provide. Thanks again.

2 3

SCRIPT to convert the radacct details log files into mysql or csv file.
by Goke Aruna 23 Apr '07

23 Apr '07

hi all, I have an sql.conf as below and for almost three weeks now, its not logging my calls as successful calls again except some few ones but the detailed log files shows that they are successful calls. am using freeradius-1.1.4, mysql-5.0.18 on fedora core 5. my sql.conf is as below. 1. I will be glad if someone can throw light on why is the disparity in the two detail files and mysql entries. 2. how to manually restore all the lost db entry from the detailed log files. thanks *extract of sql.conf* accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Quintum-h323-disconnect-cause}', TrunkIdIn = '%{Quintum-Trunkid-In}', remoteip = '%{Quintum-h323-remote-address}', TrunkIdOut = '%{Quintum-Trunkid-Out}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, remoteip, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, TrunkIdIn, TrunkIdOut, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Quintum-h323-remote-address}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Quintum-h323-connect-time}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Quintum-Trunkid-In}', '%{Quintum-Trunkid-Out}', '%{Acct-Delay-Time}', '0')" accounting_start_query_alt = "UPDATE ${acct_table1} SET AcctStartTime = '%{AcctStartTime}', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Quintum-h323-connect-time}', remoteip = '%{Quintum-h323-remote-address}', TrunkIdOut = '%{Quintum-Trunkid-Out}', TrunkIdIn = '%{Quintum-Trunkid-In}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', remoteip = '%{Quintum-h323-remote-address}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Quintum-h323-disconnect-cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Quintum-h323-disconnect-time}', TrunkIdIn = '%{Quintum-Trunkid-In}', TrunkIdOut = '%{Quintum-Trunkid-Out}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into ${acct_table2} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, remoteip, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, TrunkIdIn, TrunkIdOut, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Quintum-h323-remote-address}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Quintum-h323-disconnect-time}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Quintum-h323-disconnect-cause}', '%{Service-Type}', '%{Quintum-Trunkid-In}', '%{Quintum-Trunkid-Out}', '0', '%{Acct-Delay-Time}')"

1 0

FR + LDAP + PAM + encryption question
by Jacob Jarick 23 Apr '07

23 Apr '07

>From my recent thread with Alan, I have gathered that ldap only supports PAP. PAP sends the password in plain text. Is it possible to encasuplate PAP inside another protocol say EAP to prevent from packet sniffers etc. Failing that is it possible to asign vlans bases on ldap primary group via the ntlm_auth method.

2 2

FR + LDAP + ADS 2003 password questions
by Jacob Jarick 23 Apr '07

23 Apr '07

here is a 57kb tar.gz of my /etc/raddb folder containing all configs. http://rapidshare.com/files/27470184/20070420_ldap_working.tar.gz.html -- Hello I have been reading everything I can get my hands on to resolve this problem Im having. The error message related to this problem: Attribute "User-Password" is required for authentication. Now I have just read through "doc/rlm_ldap" again and the 4th last paragraph made me wonder if this current method Im trying is supported. " LDAP and Active Directory ------------------------- Active directory does not return anything in the userPassword attribute, unlike other LDAP servers. As a result, you cannot use Active Directory to perform CHAP, MS-CHAP, or EAP-MD5 authentication. You can only use PAP, and then only if you list "ldap" in the "authenticate" section. To do MS-CHAP against an Active Directory domain, see the comments in radiusd.conf, about "ntlm_auth". You will need to install Samba. " Is it true that the only way to authenticate against active directory is using ntlm_auth ?. I have been specifically asked not to use the ntlm_auth method against AD out of security cocerns from having samba installed. I cant see the risk of having samba installed myself if no directorys are being shared (please correct me if Im wrong). I have enabled anonymous LDAP searches on the ADS. On friday I added this line to ldap.attrmap: "checkItem userPassword User-Password" And it worked for that day, I came back after the weekend copied configs across to my 2nd linux machine and retryed but it failed with the old error metioned above. I tried on the test server and it now fails as well with the same error (possibly server was reset over the weekend or something, I dunno). My test shows that anonymous search is definitely working ldapsearch -h 10.1.1.11 -b 'dc=tfxschool,dc=internal' -x -LLL -s sub 'objectclass=*' I dont have access to the machines atm (finished work for the day) but I did notice that down the bottom of ldap.attrmap I still have these entrys which were suggested by a thread I found on google (same error message). Im wondering if these lines will be adversly effecting my entry above and/or ldap authentication in general. " checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem User-Password lmPassword " Thanks in advance people, I really appreciate the help I have been getting on this mailing list. It has been an epic struggle for me so far (learning perl + snmp + cisco was easier) but I havent given up hope yet !

2 4

Radisus and OTP inetegration
by Ouahiba MACHANI 23 Apr '07

23 Apr '07

Hi all, I have to find a solution that integrates the use of OTP (One Time Password ) as a second factor authentication in addition to the first factor authentication (witch is generally username and password) to an existing authentication System. This solution should be integrated easily to the existing authentication system regardless the protocol used for authentication (Rdius, Kerberos, Http, EAP, etc) and regardless the OS. My questions are: 1- What are the possibilities and the facilities offered by FreeRadius?? 2- I though about tow solutions : a- Developing a plug-in that could be integrated to the existing authentication system. This plug-in will interact with the OTP-Server for otp validation. b- Installing a radius server in front of the existing IT system. This server will be configured in a way it will redirect first factor authentication requests (exple : username/password) to the existing authentication system and the OTP second factor authentication to the OTP services Server hosted and give access to user only when this 2 factors are valide. I have no idea about Radius. And these are general ideas and I want someone to tell me if these solutions are possible and how to proceed. Wats is best or better to do? Is there any other solution? Waiting for your response. Thanks in advance.

1 0

Problem with realm
by Christian Hohmann 23 Apr '07

23 Apr '07

Hi, I'm trying to configure freeradius for Authentication with username and pwd. It works if I enter the information directly, but if i configure the client to authenticate with username and password, it transmitts HOSTNAME\USERNAME. I discovered realms, but i can't get it work. I hope that you can help me with a hint, i added my radiusd.conf below. Regards - Christian ################ prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = root group = root max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { chap { authtype = CHAP } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } preprocess { ascend_channels_per_line = 23 with_ntdomain_hack = no } files { usersfile = ${confdir}/users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } attr_filter { attrsfile = ${confdir}/attrs } expr { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } } instantiate { exec expr } authorize { preprocess chap mschap ntdomain eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique ntdomain files } accounting { detail unix radutmp } session { radutmp } post-auth { } _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

2 1

Cannot run radiusd - error loading shared libraries
by eugene＠snowball.co.za 23 Apr '07

23 Apr '07

Platform Suse 9.0 No error on compile. When I try: # /usr/local/sbin/radiusd I get: /usr/local/sbin/radiusd: error while loading shared libraries: libradius-1.1.4.so: cannot open shared object file: No such file or directory The file appears to be there: # whereis libradius-1.1.4.so libradius-1.1.4: /usr/local/lib/libradius-1.1.4.la /usr/local/lib/libradius-1.1.4.so Please provide assistance. Kind regards, Eugene

3 2