- Freeradius-Users - lists.freeradius.org

RE: Simple EAP flow support!
by Josh Howlett 07 Mar '07

07 Mar '07

You will need to modify the code. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Diameter K > Sent: 07 March 2007 18:53 > To: freeradius-users(a)lists.freeradius.org > Subject: Simple EAP flow support! > > Hi All, > I want to configure free-radius to handle a simple EAP > described below. > > 1. Radius receives a IDENTITY message. The IDENTITY message > contains a encrypted certificate. > 2. The server decrypts and validates the Certificate and send > out a EAP-Success or EAP-Failure. > > Is there any way i can configure freeradius to achieve this > flow or would i have to modify the code. As i understand the > standard flows are much more complicated(with challenge), > which i dont want. > > > Thanks & Regards, > Shiv > > >

1 0

redundancy/failover support for LDAP xlat
by Kenneth Marshall 07 Mar '07

07 Mar '07

Dear FreeRADIUS users, I am working on setting up LDAP failover for my radius servers. I currently have two instances defined in the modules section: ldap ldap1 {...} ldap ldap2 {...} and have a redundant section in authorize: redundant { ldap1 ldap2 } This is correctly making the connection to the ldap server. However, in the users file I am using the ldap_xlat process to send the appropriate Class definition back to the network gear: DEFAULT Auth-Type = Kerberos, NAS-IP-Address == x.y.z.g Class = "OU=%{ldap:ldap:///dc=rice,dc=edu?Class?sub?uid=%u}" The problem is that that this does not work unless I define a specific instance for the xlat process. This does not allow it to failover to the working server. Does anyone have any ideas about how to implement such functionality? Ken Marshall

2 1

Re: Logging based on port request came in on
by Walt Reynolds 07 Mar '07

07 Mar '07

Maybe you can help clear me up on something, if it is not in the 1.1.X version, how was it able to be used in this thread? http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-March/05160… Based on the date of the thread he must have been on 1.1.0 or earlier. > Date: Wed, 07 Mar 2007 14:36:48 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Logging based on port request came in on > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45EEBFF0.50202(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Walt Reynolds wrote: >> > So is there any way to use Packet-Dst-Port attribute in the freeradius >> > internal dictionary? > > It's in the CVS head, not in 1.1.x. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

Users file giving me headaches :)
by Marcelus Trojahn 07 Mar '07

07 Mar '07

Hello folks, For quite some time now I'm struggling with a problem I have no clue how to solve... Consider the following: zro Auth-Type := MD5, User-Password := 9bb05e8970a8c18991d3048f3f5ad976, Calling-Station-Id == 00:16:EC:54:2E:C4, Simultaneous-Use := 1 Mikrotik-Rate-Limit = "128k/192k 128k/384k 64k/64k 1/8" This is an example of an user account on my ISP. As you can see we also check the "Caller-ID" (MAC address) on the authentication process of our PPPOE customers. The problem is: we also provide free dialup connection to these customers. When connected via dialup we get the phone number as CallerID so, obviously, it doesn't match the MAC address and the authentication fails. Is there any way I can instruct the Radius to do like a logical OR check? Like: if (NAS-IP-Address != "10.200.200.2") { Calling-Station-Id has to be 00:16:EC:54:2E:C4 } else { Ignore the Calling-Station-Id, check only the password } Maybe it is just ask too much... For now, I've been ignoring the dialup users, allowing them to authenticate with any login or password using this in the begging of users file: DEFAULT NAS-IP-Address == 10.200.200.2, Auth-Type := Accept This way is not good because many people are now using our service without even being customers... My only option, if I can't solve this, is to make a secondary Radius server just to authenticate them. -- Marcelus Trojahn --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 000722-1, 07/03/2007 Tested on: 7/3/2007 11:49:19 avast! - copyright (c) 1988-2007 ALWIL Software. http://www.avast.com

2 1

Re: Logging based on port request came in on
by Walt Reynolds 07 Mar '07

07 Mar '07

> Date: Wed, 28 Feb 2007 19:35:48 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Logging based on port request came in on > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45E5D994.2070801(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Walt Reynolds wrote: >> Hello, >> >> I have freeradius 1.1.2 set up to listen on both ports 1812/1813 and >> 1645/1646. This is simply to separate user and admin login. What I >> would like to do is to add logging based on the port. I could add >> %{NAS-Port-Type} to the Detail such as: >> >> detailfile = ${radacctdir}/%{NAS-Port-Type}/auth-detail-%Y%m%d >> >> The problem with doing this as it uses the string "Wireless-802.11" or >> "Virtual". I would instead like to use the port the request came in on > > NAS-Port-Type is, as you've discovered, the port type of the session > being authenticated/accounted > >> (1812 or 1645) or even modify that string value. I tried to add the >> string %(request:Packet-Dst-Port) (from the >> dictionary.freeradius.internal) in the detailfile, but comes back blank. > Since it is in this dictionary, is there something I would have to do > You'll need a sufficiently recent version of the server for that to > work, and IIRC the "preprocess" module needs to be run (you should > always run it) Well, I am using 1.1..2 version of Freeradius. I also am preprocessing, though I am not sure that would be needed here. As this is a variable defined in the dictionary file, I was under the impression that I could use it. Either way, here is the section from the config: preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_cisco_vsa_hack = yes } I had added this to the hints files as well, but did not seem do anything: > >> Am I misreading this in some way. I assume that internally freeradius >> knows what port the request came in on. > > What version are you running? > > 1.1.2 -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 2

Help with multiple attributes sent with accounting request
by Normando Marcolongo 07 Mar '07

07 Mar '07

Hi! We are using freeradius 1.0.4, I'm receiving this kind of accounting from our access points: rad_recv: Accounting-Request packet from host 195.32.84.44:32771, id=215, length=221 User-Name = "normando(a)wifi.user" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "micso(a)wifi.ap" NAS-IP-Address = 192.168.1.2 Acct-Status-Type = Start Calling-Station-Id = "00-16-CB-BD-1F-54" Called-Station-Id = "00-03-52-DC-5A-60" Event-Timestamp = "Mar 2 2007 16:09:38 CET" Acct-Delay-Time = 0 Acct-Session-Id = "30965f0f" Acct-Authentic = RADIUS Framed-IP-Address = 172.21.7.65 Colubris-AVPair = "ssid=micso.wifi" Colubris-AVPair = "nat-port-range=5000-5049" WISPr-Location-Name = "micso(a)wifi.ap" Using rlm_sql *only the first "Colubris-AVPair" attribute is being logged*: radius_xlat: 'INSERT into radacct (`Colubris-AVPair`, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASIdentifier,NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress,ClientIPAddress, AcctStartDelay, AcctStopDelay) values('ssid=3Dmicso.wifi', '137281aa', '73ff613a5a1e65ff', 'normando(a)wifi.user', '', '192.168.1.2', 'micso(a)wifi.ap', '1', 'Wireless-802.11', '2007-03-02 16:24:51', '0', '0', 'RADIUS', '', '', '0', '0', '00-03-52-DC-5A-60', '00-16-CB-BD-1F-54', '', '', '', '172.21.7.65', '195.32.84.44', '0', '0')' Is there a way to log both? Obviously we are interested in the second attribute (Colubris-AVPair = "nat-port-range=5000-5049") :-) Thank you for your time. Normando

2 1

Re: wrong user name is stored in mysql radacct table
by Zeli Kartzman 07 Mar '07

07 Mar '07

On Fri, 2007-03-02 at 17:13 +0100, Alan DeKok wrote: > Zeli Kartzman wrote: > > i was thinking the NAS had something to do with it. is there any way i > > can get the NAS to send me the correct user name? we are using cisco > > aironet for access points running IOS 12.3. > > No... what I said was that's what the USER is using to log in. The > NAS just sends what the user types. > > > or is there any other way to get the correct user name into the table? > > thanks > > Get the users to type something else? > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > so what you're saying is that effectively a user can get around the simultaneous user limit and login as many times as they want -- all they have to do is type a new outside identity each time and as long as the tunneled PEAP identity is correct they will be allowed to login? bz

2 1

radius 1.1.5 not comming up
by awaneesh kumar 07 Mar '07

07 Mar '07

Hi I have downloaded radiis version 1.1.5. I am unable to bringup the the server. it goinf down. Please find the trace below. exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Segmentation fault What could be the issue ? Thanks in advance. --------------------------------- Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains.

1 0

Re : ldap passwords?
by Eshun Benjamin 07 Mar '07

07 Mar '07

Hello, Sorry to bother you again. Where should I apply the Crypt-Password? Should I apply it in radiusd.conf or in the ldap.attrmap file? Do the changes in ldap.attrmap CheckItem Crypt-Password userPassword CheckItem User-Password userPassword ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Tim Tyler <tyler(a)beloit.edu> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mardi, 6 Mars 2007, 17h45mn 42s Objet : Re: ldap passwords? Ivan, Sorry to bother you again. Where should I apply the Crypt-Password? Should I apply it in radiusd.conf or in the ldap.attrmap file? What line were you referring to? My ldap database stores the password in userPassword field. I assume that I should keep password_attribute = userPassword in the radiusd.conf file, correct? Tim At 04:51 PM 3/5/2007, you wrote: >Use Crypt-Password not User-Password. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 5/3/2007, "Tim Tyler" <tyler(a)beloit.edu> pi¹e: > > > Freeradius experts, > > I am trying to configure freeradius to use openldap as a backend > >for authentication, but I can't seem to get the passwords to > >authenticate. It seems to have no problem binding and finding the > >username (uid). I am using crypt passwords in the ldap userPassword field: > >userPassword:: e1NTSEF9aXBWQklEYnZYSU9RdWl2V0ZtdGR5MWxIWFFsZWVCMjQ= > > > > I am not using any radius attributes. I simply want to allow any > >uid to authenticate. I get these results: > > > >rad_recv: Access-Request packet from host > 144.89.40.8:59881, id=60, length=59 > > User-Name = "tylertj" > > User-Password = "xxxxxx" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1812 > >rlm_ldap: - authorize > >rlm_ldap: performing user authorization for tylertj > >rlm_ldap: ldap_get_conn: Checking Id: 0 > >rlm_ldap: ldap_get_conn: Got Id: 0 > >rlm_ldap: (re)connect to ldap.beloit.edu:389, authentication 0 > >rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer > >rlm_ldap: starting TLS > >rlm_ldap: bind as / to ldap.beloit.edu:389 > >rlm_ldap: waiting for bind result ... > >rlm_ldap: Bind was successful > >rlm_ldap: looking for check items in directory... > >rlm_ldap: looking for reply items in directory... > >rlm_ldap: user tylertj authorized to use remote access > >rlm_ldap: ldap_release_conn: Release Id: 0 > >rad_recv: Access-Request packet from host > 144.89.40.8:59881, id=60, length=59 > >Sending Access-Reject of id 60 to 144.89.40.8:59881 > > > > > > What might I be doing wrong? I presume that the ldap server > >doesn't have to store the passwords in plain text, correct? I can > >store them in md5 or SHA1 hash if I want, correct? I did uncomment: > > > >authenticate { > > Auth-Type LDAP { > > ldap > > } > > > > Am I wrong to think this is now a password issue? > >Tim > > > > > > > > > > > >Tim Tyler > >Network Engineer - Beloit College > >tyler(a)beloit.edu > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

radwho not disply online users
by satish patel 07 Mar '07

07 Mar '07

dear all I have installed freeradius with mssql but after few error i have run this command on my shell # echo " " > /var/log/radius/radutmp after runing this command now i run this command [root@radius ~]# radwho Login Name What TTY When From Location [root@radius ~]# no data display since one week what is the problem in radwho ???? is there any option to recover this command $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 2