- Freeradius-Users - lists.freeradius.org

(no subject)
by Jorge Martinez de Salinas Vazquez 30 Jan '07

30 Jan '07

Hello everybody! We are trying to assign configuration parameters to the supplicants based on RADIUS decision. I would like to know is someone else is working on it and if there is an easy way to send this parameters directly to the supplicant. I have read the RFC 4014 which shows a way to assign network configuration to the supplicant through a DHCP server, but it is very specific (just networking options). Thanks in advance.

2 1

radiusd and oracle accounting
by Dourty, Brian R. (IATS) 30 Jan '07

30 Jan '07

We have configured our radius servers to send accounting information to an Oracle database. It works our really well except when the oraclce database server isn't available (I.E. maintenance or cold backups). The radius process dies when it loses connectivity to the oracle server. Has anyone else noticed this problem? Any suggestions on how to make radiusd more robust and able to recover from this? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

4 4

RE: LAN accounting
by Josh Howlett 29 Jan '07

29 Jan '07

> >>>I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a > >>>LAN accounting? > >>It means that i use them without dialing? > > > > the name "dialup"_admin is a bit misleading. You can as > well manage LAN users > > with them. > > It's a generic user management system. > > agree if RADIUS is used to authenticate users, > but they're asking about accounting. > Besides there's no way to prevent connection to LAN switches > with RADIUS Yes - 802.1x > and restrict internal communication between local hosts. Kinda - Dynamic VLAN allocation. Josh.

2 1

EAP-TTLS inner auth methods for 802.1x
by James Lever 29 Jan '07

29 Jan '07

I have configured a working EAP-TLS system and am now migrating to use EAP-TTLS (with both client side certificates and a password authentication mechanism). I'm stuck trying to work out how to avoid sending the password unhashed to the server and think that some form of CHAP/MSCHAPv2 might be the right way to go. My current thoughts are that I should use PAP with SHA1 or SSHA1 but I seem to get the right config (if it is even possible). So, with this problem, can anybody suggest a way to use SHA1/SSHA1 or some other form of cryptographically secure, non-cleartext password within the inner authentication mechanism of EAP-TTLS for use in WPA2 Enterprise/802.1x. If this is feasible/possible, are there any gotcha's with the various supplicants to getting this to work from the client side and avoiding sending the passwords in cleartext (inside the EAP-TLS tunnel). Also, while I'm here, any suggestions for an appropriate backend password store so that there is never a cleartext password except for the initial entry (password change) on the server side would be appreciated. cheers, James

3 4

PEAP Fast Reconnect
by King, Michael 29 Jan '07

29 Jan '07

Does FreeRADIUS support PEAP Fast Reconnect?

3 3

rlm_python
by Peter Nixon 29 Jan '07

29 Jan '07

Hi Guys Is anyone actually using rlm_python in production? Unlike rlm_perl we don't seem to have any example code or any decent documentation. I am looking at using it myself and just looking for some feedback.. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 5

3Com SuperStack3 4400
by diego＠gigadata.it 29 Jan '07

29 Jan '07

Hi, I'm authing about 60 3com 4400 switch with mysql. Everithing goes ok until the switch sends a particular request to the server. This is the request: rad_recv: Access-Request packet from host 10.10.0.219:2049, id=57, length=87 User-Name = "a3Com" User-Password = "a3Com" NAS-Port-Type = Virtual NAS-IP-Address = 10.10.0.219 Service-Type = Administrative-User Framed-MTU = 1024 Message-Authenticator = 0xebe1ebfa3372940ad96d932c10457ff8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 84 modcall[authorize]: module "preprocess" returns ok for request 84 radius_xlat: 'a3Com' rlm_sql (sql): sql_set_user escaped user --> 'a3Com' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 84 modcall: group authorize returns ok for request 84 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [a3Com] (from client XXXXXXXXX port 0) Sending Access-Accept of id 57 to 10.10.0.219:2049 Finished request 84 Going to the next request This is OK, but switch says "The RADIUS Authentication service is not responding." The strange thing is the userame a3Com that i've never seen in any switch configuration. Is something related to including dictionary.3Com in dictionary file ? I've googled a lot and searched in 3Com knowledge base but can't find anything.

3 2

2GB problems
by Tas Dionisakos 29 Jan '07

29 Jan '07

I have setup a captive portal with mysql,chilli, and freeradius. My portal allows users access base on data use (quota), I am using the rlm_sqlcounter (from freeradius 1.1.4) to measure the usage on login. The problem Im having is that if I assign a quota more than 2gb freeradius sees the bytes in a negative value for some reason, I have attached rad logs. This is the line I dont understand (rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0). Yet in mysql its fine! Any help with this will be greatly appreciated! rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=195 User-Name = "will" User-Password = "pass" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-16-CB-BE-3A-41" Called-Station-Id = "00-14-5E-18-83-D9" NAS-Identifier = "nas01" Acct-Session-Id = "45b7e66b00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x0444eede46ea26a2629277905eb408f7 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "will", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'will' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'will' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): - sql_xlat radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0 modcall[authorize]: module "mb" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 -- ************************************* Tas Dionisakos IT Manager St Mary’s College and Newman College The University of Melbourne T: 03 9342 1708 M: 0439 655 565 E: tas(a)newman.unimelb.edu.au C: (0o (||||)(||||) o0) *************************************

3 3

expiration attribute as an offset?
by liran tal 28 Jan '07

28 Jan '07

Hey guys, Is it possible to set the expiration attribute to be of an offset type? Instead of entering an absolute date is it possible to enter the duration of which the user will be allowed from the first time that he logins? Say I set an offset of +30 days, and the user logins for the first time only 6 months from now. So once he login'ed once then the counter will start counting 30 days from his first login and then expire the account. Thanks.

5 15

TTLS-PAP authentication with LDAP bind
by Richard Hesse 28 Jan '07

28 Jan '07

First off, I'd like to say thanks in advance to anyone who can help me here. I've spent the past few days searching the list archives and other sites for information on how to accomplish this. The overwhelming message from these searches was that "it should just work" and that "the server will figure out what to do." Sadly, that's not the case here. My goals here are straightforward: -Authorize the user in LDAP if a corresponding entry exists (just checking against uid, nothing fancy). -Support TTLS-PAP and PEAP-GTC. The default Macintosh configuration supports PEAP-GTC with no config. SecureW2 will be used for TTLS-PAP on Windows clients. -Authenticate the user's clear-text password via a simple LDAP bind encrypted via TLS. No userPassword attribute checking here. A simple bind is all. Using version 1.14. Here's my eap.conf with comments stripped out: eap { default_eap_type = ttls timer_expire = 10 ignore_unknown_eap_types = no cisco_accounting_username_bug = no gtc { challenge = "Password: " auth_type = PAP } tls { private_key_password = foo private_key_file = ${raddbdir}/certs/key.pem certificate_file = ${raddbdir}/certs/cert.pem CA_file = ${raddbdir}/certs/sf_issuing.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = gtc } peap { default_eap_type = gtc } } Relevant sections of radius.conf are: ldap { server = "myserverentry" basedn = "myDN" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/intCA.pem tls_require_cert = "demand" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess suffix ntdomain eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } If I force the Mac or Windows supplicants to use TTLS-PAP, the request is never passed to radiusd. I don't know what's going on but my AP (Aruba 200) seems to be detecting that something isn't right with its AAA server and not passing the request on. If I change the supplicants to use their default settings, the requests are sent to FreeRadius, but the requests fail. Again, the Aruba seems to think that something is wrong and presents its certificate instead of my server's. At one point, I had the clients seeing the server's certificate but I can't seem to get back in that state. So I don't think my AP is broken, I'm pretty sure it's my FreeRadius config that's broken. The users file is unchanged and the proper entries are in clients. Yes, I've run the server in debug mode (there are no requests coming in). Thanks, -richard ____________________________________________________________________________________ Have a burning question? Go to www.Answers.yahoo.com and get answers from real people who know.

2 1