- Freeradius-Users - lists.freeradius.org

authorize and authenticate in proxy
by Ana Gallardo Gómez 22 Jan '07

22 Jan '07

Hello!I want to use Freeradius as a proxy Radius server, and I think that my Freeradius don´t have to do authorize and authenticate: my Freeradius have to proccess request with realm "@unex.es", the others request have to be proxyed. My configuration is:radiusd.conf: authorize { preprocess suffix files Autz-Type LDAP_UNEX_ES{ ldap_unex_es } mschap eap } authenticate { ldap_unex_es Auth-Type MS-CHAP { mschap } eap } users: DEFAULT Autz-Type = "LDAP_UNEX_ES" proxy.conf: realm unex.es { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = other_server_1 accthost = LOCAL secret = ****** nostrip } realm DEFAULT { type = radius authhost = other_server_2 accthost = LOCAL secret = ****** nostrip }- I want to define two instances of "realm DEFAULT", in case one of then fails. It is posible?- Have my freeradius to do authorize and autheticate when request have to be proxyed?- I think that in users file I have to distinguish between request with realm "@unex.es" to set Autz-Type = "LDAP_UNEX_ES" and the others...I´m lost with proxy... I need help. Thank you.Sorry for my english. _________________________________________________________________ Prueba algunos de los nuevos servicios en línea que te ofrece Windows Live Ideas: tan nuevos que ni siquiera se han publicado oficialmente todavía. http://ideas.live.com

2 1

mschap and ldap auth-type together no more working
by LALOT Dominique 22 Jan '07

22 Jan '07

Hello, I had a problem with ippool, but it is a NAS problem. I wanted to do further checks so I upgrade to newer versions: freeradius 1.0.2-4sarge3 stable (I come from this one) freeradius 1.1.3-3 testing freeradius 1.1.2-1bpo1 sarge-backports Before, I was able to do LDAP or MSCHAP automatically. I had and entry in users lalot Auth-Type := ldap Framed-IP-Address = XXX, Framed-IP-Netmask = 255.255.255.0, Fall-Through = Yes If I put mschap in users, it's working for mschap.. The two new ones have the same problem. That's may ne due to an incomplete update.. I don't put all the logs: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=xxx,dc=fr, with filter (uid=lalot) rlm_ldap: looking for check items in directory... rlm_ldap: Adding supannaffectation as Pool-Name, value Pharo & op=21 rlm_ldap: Adding ntPassword as NT-Password, value XXX & op=21 rlm_ldap: Adding lmPassword as LM-Password, value XXX & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lalot authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 11 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 11 and before: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password You can notice the diff rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' and then rad_check_password: seems confused.. Any ideas?. Config: authorize { preprocess files ldap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap } authenticate { Auth-Type LDAP { ldap } Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } } -- Dominique LALOT Ingenieur Systeme et Reseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 3

freeradius + mysql + Cisco-AVpair
by satish patel 22 Jan '07

22 Jan '07

Dear all I have freeradius setup with cisco vpdn with mysql. i am useing cisco-avpair attributes for rate-limit to my user traffic it is working fine with /etc/raddb/user file but when i put this attribites in mysql databases it is not working so now i need help to implement this attributes in mysql so what is op code or what is special configuration for this task Otherwise it is possible to put Group attributes in user file and user information in mysql ???? u get it my query user group create on /etc/raddb/user and users in mysql then my porpse will be solve but it is possible or not and how do it possibel ??? Satish Patel Tulip IT Services Delhi --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

RE: help
by John Wan 22 Jan '07

22 Jan '07

Hi Alan, Many thanks for your help. I have followed all the instructions from http://deployingradius.com. I do not know why I have had the CHAP authentication. I would like to use MS-CHAP authentication instead of CHAP, and do you have any tipps for me for this kind of setup (MS-CHAP)? Any hint would be great - thank you! Many thanks again. Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, 18 January 2007 6:16 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > Hi Alan, > > Now everything works but the Active Directory authentication,Please > see the following output from "$ Radiusd -X" when a wireless client > uses "administrator" logon into the chillispot web logon page: > > > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, > length=223 > User-Name = "administrator" > CHAP-Challenge = 0xa784482e8ac92fd573e87bbbad9ca58f > CHAP-Password = 0x00f54cc04e288eec67feff0b13e9448bd2 See my web page. You CANNOT do CHAP authentication to AD. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

encrypted password - radius over WAN
by Agent Smith 22 Jan '07

22 Jan '07

I'd like to implement pam_radius module on some of our Linux boxes but I am worried about password (pam_radius can only do PAP) being captured and misused since the radius server is at central office and clients are all over the place. I read (http://www.cisco.com/warp/public/480/10.html#comp_packet_encry) that radius encrypts passwords using the secret key between radius server and client, is this true with FR? I suppose I can build some stun or openvpn tunnels between linux clients and FR but before I go down that road, I'd like to know if its necessary. ____________________________________________________________________________________ Don't get soaked. Take a quick peak at the forecast with the Yahoo! Search weather shortcut. http://tools.search.yahoo.com/shortcuts/#loc_weather

2 1

Freeradius, wireless access point and password authentication
by Roberto 22 Jan '07

22 Jan '07

Hello, I'm new to freeradius... I want to realize a sort of hot spot using freeradius, mysql (with a graphical interface creating users on it) and some access points (linksys, d-link, etc...). I correctly installed and integrated freeradius and mysql. Now the problem is to use the access points as NASes, and to realize an authentication system which prompts the client computers ( with Windows XP ) for a password in order to associate with the AP. I cannot use certificates to join the AP, because the client computers belongs to occasional visitors, and installing certificates on each client would be little practical. I made different trials, with no success. Thank you in advance for any help, and sorry for my bad english.... :-)

4 6

Freeradius Postgres and Pap problem
by Jack Allan 21 Jan '07

21 Jan '07

Hi To All If in postgressql.conf, I set num_sql_socks to a number x, then when I run NTRadPing (or any other Radius client), I am only able to successfully authenticate a user x times. After this, rlm_sql gives up the ghost (at least I think???) and I need to restart the freeradius server for anything to work. When I run in debug mode, it seems as if the sockets are being closed once used (at least thats what it says on the output). What is happening is that no attributes are being passed to rlm_pap. I am currently using freeradius version 1.1.3. I should also mention that I have two instances of the SQL module - one for authentication, the other for accounting. Also, I am using postgresql 8.2. This is baffling me, and trawling through the mailing lists is not yielding an answer. Thanks in advance to anyone that can help me out. Jack

6 7

3Com-User-Access-Level Not Applied
by Alexandre Soares 20 Jan '07

20 Jan '07

Hi All, I using the freeradius version 1.1.4 + a switch 5500-EI from 3Com to apply a resource called switch login. But the attribute 3Com-User-Access-Level is not applied after Authorization processes to valid user, the dictionay used is correct and configuration too, see in attach file, please help me. thks

3 11

rate-limit entry in mysql
by satish patel 20 Jan '07

20 Jan '07

dear all I have tested rate-limit with user file but whn i was try it with mysql but i didnt get respond it is not working with mysql is any op code for it or any special configuartion for this URGENT my mysql entry is mysql> select * from radgroupcheck; +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | 1 | 64KB | Simultaneous-Use | = | 1 | | 2 | 64KB | Cisco-Avpair | := | \"lcp:interface-config#1=rate-limit output 128000 10000 10000 conform-action continue exceed-action drop\" | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ i have test it with diff , diff op code = := == += but it is not working :( Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: Best practices for redundant servers
by Aaron Paetznick 19 Jan '07

19 Jan '07

Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers. This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well. I was not aware of radsqlrelay. I think this gets me closer to what I need than anything else. I can't guarantee which server the NAS will choose to log to at any given time. Therefore, I may need to use radsqlrelay on each server to keep the others in sync. Does this seem like a sensible plan? --Aaron Nicolas Baradakis wrote: > Aaron Paetznick wrote: > >> I've been struggling with this problem for a couple of weeks, and I >> thought I'd pass it along to the mailing list. Basically I'm trying to >> answer the following question. Given multiple identical dedicated >> servers each running Linux and MySQL, how can I configure FreeRADIUS for >> maximum stability, reliability, and performance? The question, it >> seems, is not as easy as is sounds. > > I've already setup FreeRADIUS on multiple redundant servers, but never > had the time to write a HOWTO. The main guideline is: > > 1. Use LVS in a "direct routing" setup to dispatch the RADIUS requests. > http://www.linuxvirtualserver.org/VS-DRouting.html > > 2. Use MySQL replication for the authorize database, so each FreeRADIUS > server connects to a local, read only database. > http://dev.mysql.com/doc/refman/5.1/en/replication.html > > 3. Use radsqlrelay for the accounting database, so the accounting data > is written to a central database without slowing down the RADIUS > servers. radsqlrelay is to be found in the FreeRADIUS source tarball, > you could read the "rlm_sql_log" and "radsqlrelay" manpages for more > details. >

8 10