- Freeradius-Users - lists.freeradius.org

freeradius confirmation
by Galatóczki István 16 Oct '06

16 Oct '06

Hi All! I use freeradius with pppoe-server and mysql. If I connect to freeradius, the radius server give confirmation. The content of confirmation : Attributes + Values ex: Framed- Ip-Address, Reply_message etc... These attributes and values is in the my radreply table, in mysql. I modified dictionary file, and I add new attributes to dicrionary and radreply table, but the server not use these new attributes and radius confirmation not content these. Why? Thanks your answers. Steve

1 0

block users on-the-fly
by Guilherme Franco 16 Oct '06

16 Oct '06

Hi, Does anyone already have a program to block freeradius on-the-fly? ie: user has PAID = YES in radcheck table. Whenever I set PAID = NO, the user would no longer authenticate the next time he/ she logs in. OK, this works, but, if the user is already loged in, even if I set PAID = NO, the user would not be rejected (for obvious reasons). This is important because the grand number of Router mode ADSL users, that never logs out. I'm building a program to verify every x minutes the database and if PAID = NO, return a flag to freeradius and then reject the user. Is there any other means to do that? Thanks.

4 7

WPA authentication works only with MacOS clients
by Josh Shamir 16 Oct '06

16 Oct '06

Hello all, I'm using WPA with EAP-TTLS and PEAP with a MacOS .Authentication works fine (even if enough slowly). The problem is that I can't authenticate WinXP client. I've readed that for using EAP-TTLS are required some other supplicant like SecureW2. Is SecureW2 required also for PEAP? Thanks for attention Best Regards, Josh

3 4

RE: Re:Help: How to authenticate additional attribute
by Garber, Neal 16 Oct '06

16 Oct '06

> Cisco AP's have a "dot11 location" config. stmt., I should also have mentioned that the "snmp server-location" config. stmt. controls the Location-name. For more info, see http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124newft /124t/124t2/ht_wispr.htm

1 0

Re: NAS Documentation
by Kevin Bonner 16 Oct '06

16 Oct '06

I read the mailing list... please send there in the future. On Sunday 15 October 2006 03:04, affora deeb wrote: > do u know about IAS windows server 2003 configuration with NORTEL NAS Nope, don't have a clue. I try to avoid any windows that can't stand against a harsh external environment. Maybe someone else on the list can help you with the issues you're finding. -Kevin

1 0

Autoreply: Reid Canavan is on vacation.
by Reid Canavan 16 Oct '06

16 Oct '06

I will be out of the office starting 10/16/2006 and will not return until 10/23/2006. I will respond to your message when I return.

1 0

Re: Pam radius authentication
by danieldinu＠rdslink.ro 16 Oct '06

16 Oct '06

anyone??? pls!!! no suggestions at all ? :( Pe 12 Oct 2006, la 12:46, danieldinu(a)rdslink.ro a scris: > >Hello! > >I try to authenticate ssh users logins using pam_radius_auth.so. >On my RedHat 9 I have the following setup: >- freeradius server > - users file: > test Auth-Type := Local, User-Password == "test" > > - clients.conf > client 127.0.0.1 { > secret = secret > shortname = localhost > } > >-pam radius module > - cat /etc/pam.d/sshd >#%PAM-1.0 >auth required pam_securetty.so >auth sufficient pam_radius_auth.so debug >auth required /lib/security/pam_unix_auth.so >account required pam_radius_auth.so debug >password required pam_stack.so service=system-auth >session required pam_stack.so service=system-auth >session required pam_limits.so >session optional pam_console.so > -cat /etc/raddb/server > 127.0.0.1 secret 1 > > >- pam_radius_auth.so is copied in /lib/security >-I created linux user test with home directory /home/test , without setting up a password >- freeradius started with radiusd -X > >Problem is that, when I trie to connect to this machine using ssh, the radius server receives the request, processes it, sends access-accept, but the ssh session is ended, without the user being really logged in !!! I don't know the reason why the user gets rejected... > >tail -f /var/log/secure >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: authentication succeeded >Oct 12 11:06:27 D-Server sshd[26585]: Accepted password for test from 10.243.30.42 port 2847 ssh2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got user name test >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Sending RADIUS request code 1 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: authentication succeeded >Oct 12 11:28:30 D-Server sshd[26590]: Accepted password for test from 10.243.30.42 port 2881 ssh2 > >from radiusd -X : >rad_recv: Access-Request packet from host 127.0.0.1:27615, id=253, length=97 > User-Name = "test" > User-Password = "test" > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = "sshd" > NAS-Port = 26590 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "512wyse83.cosmote.rom" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry test at line 80 > modcall[authorize]: module "files" returns ok for request 0 >modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type Local >auth: type Local >auth: user supplied User-Password matches local User-Password >Sending Access-Accept of id 253 to 127.0.0.1 port 27615 >Finished request 0 > >thank you! > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: module for deleting attributes
by Nicolas Baradakis 16 Oct '06

16 Oct '06

Lars Ricken wrote: > How can I understand you developed module for deleting attributes > from incoming radius requests. Can You send it to me via email or > give a link where I can download it.It's very important for me. I don't think there's any point in deleting attributes in the incoming request. Just don't check those attributes in authorize, that's all. If you've configured FreeRADIUS as a proxy, you want to delete the undesired attributes from the proxy request, not the incoming request. In this case you could use the attr_filter module in the pre-proxy section. See the rlm_attr_filter(5) manpage. PS: Please don't reply to freeradius-devel, this is a question for the freeradius-users mailing list. -- Nicolas Baradakis

1 0

Machine + User Authentication
by Muhammad Hammad 16 Oct '06

16 Oct '06

Hello everyone I would appreciate if anybody could tell me whethere FreeRADIUS supports the following scenario or not. Currently, we have Foundry FastIron Edge 2402 switch. What we need is to deploy 802.1x user AND machine authentication. 1) If (Machine authentication is successfull) then (If User authentication is successfull) Drop the user in their respective VLAN. 2) If (Machine authentication is successfull) then (If User authentication is NOT successfull) Drop the user in their default restricted VLAN. 3) If (Machine authentication is NOT successfull OR there is no machine certificate) Drop the user in their default restricted VLAN OR Dont allow access to the switch port. Now the question I want to ask is, whethere FreeRADIUS supports the third case i.e. to disallow access OR drop in restricted vlan if machine authentication fails. Cisco Machine Access Restriction 4.0 for Windows ( http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_data_sheet09…) claims to support the abaove scenario. It would be great if someone could also tell me the relative parameters/configuration for the above particular case, if FreeRADIUS supports it. Regards Hammad

1 0

Accounting-Response Log ??
by Rio Yang 16 Oct '06

16 Oct '06

Hi, I have two radius servers. (Freeradius and Juniper SBR). Freeradius server be a radius proxy to proxy all auth/acct requests to Juniper SBR. Then I sometimes found there are some accounting-stop request don't arrival to Juniper SBR. Because Freeradius server and Juniper SBR is in the different subnet and through firewall. I think this problem may cause by firewall. In the radius accounting communication model there should have request and response. Is freeradius log the accounting-response result ? How to enable it ? I want to this log to identify the problem. Thanks. Rio Yang

1 0