- Freeradius-Users - lists.freeradius.org

freeRadius auth. with Active Directory and LDAP
by Robert 29 Nov '06

29 Nov '06

Hi I want that my freeRadius validates users against Active Directory with LDAP. For configuration reasons, I can't use NTLM. Did any of you guys already configured a freeRADIUS and AD with LDAP ? Is this posible? Thanks in advance ,

3 2

Freeradius, EAP-TTLS ans eDirectory
by Mariano Morano 29 Nov '06

29 Nov '06

Hi all, We are working in a RFP and one of the customer's requirement is that we must support EAP-TTLS with Freeradius integrated with eDirectory as back-end. We were reading the Novell documentation and at the Novell page, there appears "How to integrate Novell® eDirectoryTM 8.7.1 or later with FreeRADIUS 1.0.2 on wards to allow wireless authentication for eDirectory users." and it not mntions EAP-TTLS (only EAP-TLS) SO, Some questions: 1) First, can we use Freeradius with EAP-TTLS and eDirectory as back end ? 2) if we can waht version of frereadius should we use ? 3) Ca someone send us information about how do that? I would appreciate any hel ASAP Thanks in advance.

2 3

RE: RADIUS PAP-SecurID Access-Challenge
by david＠mitton.com 29 Nov '06

29 Nov '06

I'm sorry, The other day I said that there is nothing "unusual" about SecurID RADIUS authentication. I'm so used to EAP, I forgot about the PAP auth with a SecurID value as a password. If the RSA Authentication Manager, finds that the token is in New Pin or Next Tokencode mode, it will issue an Access-Challenge message with the Reply-Message attribute explaining the next step. The client is expected to display the text, and prompt the user, then send another Access-Request with the response in the password attribute. This exchange can continue through several steps, until an Access-Accepted or -Rejected is received. Only a few RADIUS test clients can actually deal with this. I don't know (off the top of my head) which production clients we recommend. Of course, for the best security the EAP-POTP method is our recommended authentication protocol. Dave.

3 2

RE: Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 28 Nov '06

28 Nov '06

Hi Kevin, I am running debug with the -X flag - in this instance, I only included the output I thought relevant (probably a mistake). Complete output from the radius authentication request (with 3 attempts set) is as follows: rad_recv: Access-Request packet from host 10.150.19.134:2250, id=0, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.150.19.134:2250, id=0, length=49 Discarding duplicate request from client ROSSpc:2250 - ID: 0 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 456c68e0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.150.19.134:2250, id=0, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 456c68e7 Nothing to do. Sleeping until we see a request. I may be missing something obvious, but for the life of me I cannot see what it is. My head is starting to hurt now! Ross -----Original Message----- From: freeradius-users-bounces+ross.mcowat=first-utility.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+ross.mcowat=first-utility.com@lists.fre eradius.org] On Behalf Of Kevin Bonner Sent: 28 November 2006 16:40 To: FreeRadius users mailing list Subject: Re: Unable to authenticate freeradius using PostgreSQL On Tuesday 28 November 2006 11:00, Ross McOwat wrote: > Other tables are empty. Running freeradius in debug mode, the following > output is given when attempting an authentication request using > NTRadPing: That output is very brief for "debug" mode. You are using the -X flag, right? If not, do so and you'll see why it's dying in the rlm_sql module. Kevin Bonner

2 1

Quarantining a System using Freeradius
by Dev Anand 28 Nov '06

28 Nov '06

Hi All , Is it possible to quarantine a system by placing it in different vlan by OpenRadius ? If so can somebody guide me on the steps that can be tried . The situation is like this : System already having an IP address , but found to be infected with a virus-worm. So it needs to be quarantined automatically . Thanks in advance, -Deva

5 5

Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 28 Nov '06

28 Nov '06

Hello all, I'm running freeradius-1.0.1-3.RHEL4, and trying to authenticate using postgresql-7.4.8-1.RHEL4.1. My freeradius daemon loads with no problems, and everything appears ready-to-go. However I cannot authenticate against data stored in my Postgres database. My database is setup as follows: radius=# select * from radcheck; id | username | attribute | value | op ----+-----------+---------------+-----------+---- 1 | ROSStest3 | User-Password | bdwnlc274 | == 2 | ROSStest4 | User-Password | nntlpa401 | == (2 rows) radius=# select * from radreply; id | username | attribute | value | op ----+-----------+-------------------+---------------+---- 1 | ROSStest3 | Framed-IP-Address | 10.150.19.134 | := 2 | ROSStest4 | Framed-IP-Address | 10.150.19.134 | := (2 rows) radius=# select * from usergroup; id | username | groupname ----+-----------+----------- 1 | ROSStest3 | static 2 | ROSStest4 | static (2 rows) Other tables are empty. Running freeradius in debug mode, the following output is given when attempting an authentication request using NTRadPing: rad_recv: Access-Request packet from host <my ip address>:1859, id=28, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 I'm running a trace against my database, and no output is given when attempting a radius query, so I'm assuming that freeradius is not even reaching the database. The error... rlm_sql (sql): SQL query error; rejecting user ...would seem to confirm this. However I'm not sure what part of the configuration files I need to change to rectify this. At a guess, I would say it's the following line in postgresql.conf: sql_user_name = "%{User-Name}" I've tried all sorts of entries in here, without success. Any assistance would be appreciated - apologies for the long entry above! Ross McOwat

3 2

Radius attributes and APs
by Manuel Sánchez Cuenca 28 Nov '06

28 Nov '06

Can anybody tell me any Access Point which understand and enforce some radius attributes returned by freeradius, such as Session-Timeout. Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

5 8

Problem with pam_radius_auth
by Maurizio Pederneschi 28 Nov '06

28 Nov '06

Hi, I'm testing Freeradius in order to autenticate squid user trough PAM module. My architecture is: SQUID SERVER --> PAM_AUTH_RADIUS --> FREERADIUS --> SQL DB All work fine but frequently in /var/log/messages I see this message: Safesquid: pam_radius_auth: radius server 212.80.192.120 failed to response Safesquid: pam_radius_auth: All radius servers failed to response What can I check to solve this problem? Thank's, Maury76

2 1

Expiration
by Sean 28 Nov '06

28 Nov '06

Hi, Just a quick question. Is expiration := Never valid in radcheck? At the moment I set dates a few years into the future for accounts that I don't want to expire, but I'm sure that they'll come back to haunt me later. Regards, Sean Bracken

3 3

Ldap attributes
by "Jóhann B. Guðmundsson" 28 Nov '06

28 Nov '06

I was wondering what is the proper way to enable ldap attributes in radius.conf for example Ldap-Group groupmembership_attribute = radiusGroupName will then other ldap attributes be matched in the same way? Ldap-Callingstationid callingstationid_attribute = radiusCallingStationId Ldap-Realm realm_attribute = radiusRealm etc etc.... Cant seem to find any documentaition about this! Maybe a chapther in your book Alan :) Best regards Johann B.

2 1