- Freeradius-Users - lists.freeradius.org

Re: NAS Documentation
by Kevin Bonner 16 Oct '06

16 Oct '06

I read the mailing list... please send there in the future. On Sunday 15 October 2006 03:04, affora deeb wrote: > do u know about IAS windows server 2003 configuration with NORTEL NAS Nope, don't have a clue. I try to avoid any windows that can't stand against a harsh external environment. Maybe someone else on the list can help you with the issues you're finding. -Kevin

1 0

Autoreply: Reid Canavan is on vacation.
by Reid Canavan 16 Oct '06

16 Oct '06

I will be out of the office starting 10/16/2006 and will not return until 10/23/2006. I will respond to your message when I return.

1 0

Re: Pam radius authentication
by danieldinu＠rdslink.ro 16 Oct '06

16 Oct '06

anyone??? pls!!! no suggestions at all ? :( Pe 12 Oct 2006, la 12:46, danieldinu(a)rdslink.ro a scris: > >Hello! > >I try to authenticate ssh users logins using pam_radius_auth.so. >On my RedHat 9 I have the following setup: >- freeradius server > - users file: > test Auth-Type := Local, User-Password == "test" > > - clients.conf > client 127.0.0.1 { > secret = secret > shortname = localhost > } > >-pam radius module > - cat /etc/pam.d/sshd >#%PAM-1.0 >auth required pam_securetty.so >auth sufficient pam_radius_auth.so debug >auth required /lib/security/pam_unix_auth.so >account required pam_radius_auth.so debug >password required pam_stack.so service=system-auth >session required pam_stack.so service=system-auth >session required pam_limits.so >session optional pam_console.so > -cat /etc/raddb/server > 127.0.0.1 secret 1 > > >- pam_radius_auth.so is copied in /lib/security >-I created linux user test with home directory /home/test , without setting up a password >- freeradius started with radiusd -X > >Problem is that, when I trie to connect to this machine using ssh, the radius server receives the request, processes it, sends access-accept, but the ssh session is ended, without the user being really logged in !!! I don't know the reason why the user gets rejected... > >tail -f /var/log/secure >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: authentication succeeded >Oct 12 11:06:27 D-Server sshd[26585]: Accepted password for test from 10.243.30.42 port 2847 ssh2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got user name test >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Sending RADIUS request code 1 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got RADIUS response code 2 >Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: authentication succeeded >Oct 12 11:28:30 D-Server sshd[26590]: Accepted password for test from 10.243.30.42 port 2881 ssh2 > >from radiusd -X : >rad_recv: Access-Request packet from host 127.0.0.1:27615, id=253, length=97 > User-Name = "test" > User-Password = "test" > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = "sshd" > NAS-Port = 26590 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "512wyse83.cosmote.rom" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry test at line 80 > modcall[authorize]: module "files" returns ok for request 0 >modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type Local >auth: type Local >auth: user supplied User-Password matches local User-Password >Sending Access-Accept of id 253 to 127.0.0.1 port 27615 >Finished request 0 > >thank you! > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: module for deleting attributes
by Nicolas Baradakis 16 Oct '06

16 Oct '06

Lars Ricken wrote: > How can I understand you developed module for deleting attributes > from incoming radius requests. Can You send it to me via email or > give a link where I can download it.It's very important for me. I don't think there's any point in deleting attributes in the incoming request. Just don't check those attributes in authorize, that's all. If you've configured FreeRADIUS as a proxy, you want to delete the undesired attributes from the proxy request, not the incoming request. In this case you could use the attr_filter module in the pre-proxy section. See the rlm_attr_filter(5) manpage. PS: Please don't reply to freeradius-devel, this is a question for the freeradius-users mailing list. -- Nicolas Baradakis

1 0

Machine + User Authentication
by Muhammad Hammad 16 Oct '06

16 Oct '06

Hello everyone I would appreciate if anybody could tell me whethere FreeRADIUS supports the following scenario or not. Currently, we have Foundry FastIron Edge 2402 switch. What we need is to deploy 802.1x user AND machine authentication. 1) If (Machine authentication is successfull) then (If User authentication is successfull) Drop the user in their respective VLAN. 2) If (Machine authentication is successfull) then (If User authentication is NOT successfull) Drop the user in their default restricted VLAN. 3) If (Machine authentication is NOT successfull OR there is no machine certificate) Drop the user in their default restricted VLAN OR Dont allow access to the switch port. Now the question I want to ask is, whethere FreeRADIUS supports the third case i.e. to disallow access OR drop in restricted vlan if machine authentication fails. Cisco Machine Access Restriction 4.0 for Windows ( http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_data_sheet09…) claims to support the abaove scenario. It would be great if someone could also tell me the relative parameters/configuration for the above particular case, if FreeRADIUS supports it. Regards Hammad

1 0

Accounting-Response Log ??
by Rio Yang 16 Oct '06

16 Oct '06

Hi, I have two radius servers. (Freeradius and Juniper SBR). Freeradius server be a radius proxy to proxy all auth/acct requests to Juniper SBR. Then I sometimes found there are some accounting-stop request don't arrival to Juniper SBR. Because Freeradius server and Juniper SBR is in the different subnet and through firewall. I think this problem may cause by firewall. In the radius accounting communication model there should have request and response. Is freeradius log the accounting-response result ? How to enable it ? I want to this log to identify the problem. Thanks. Rio Yang

1 0

Mobile Phones Radius Authentications
by nsuralullec 16 Oct '06

16 Oct '06

Hi to all; I'm setting up GPRS with radius authentication. Authentication accepted when using the GPRS phone as modem for internet connections(PPP). Authentication fails when using GPRS WAP applications. GPRS phones security features was enabled including the username and password but the radius server keeps on rejecting connections. Is there any similar cases thats being resolved? Thanks for any replies... Regards, NUS __________________________________ What will the world find in 2020? Leave a part of your 2006 in the Yahoo! Time Capsule. Contribute now! http://timecapsule.yahoo.com/capsule.php?intl=ph

3 6

Any luck with 802.1x authentication using TTLS with MSCHAPv2 ?
by Mohammed Petiwala 16 Oct '06

16 Oct '06

Hi Alan, Mak: I tried the patch on both freeRADIUS 1.1.2 and freeRADIUS 1.1.3 - had seen similar problems with wpa-supplicant and freeRADIUS with EAP-TTLS/MS-CHAPv2 and hence had to enable wpa_workaround flag to get past the issue... (which was incorrect) But Mak's patch resolves the issue and now I can get EAP-TTLS/MS-CHAPv2 to work successfully without the workaround. I would suggest this patch go in as high-priority fix as part of the next release as it resolves the existing issues with the inner phase-2 mschapv2. Thx. Regards, Mohammed. Mak Moussa mmoussa at mmoussa.com Thu Oct 12 19:06:59 CEST 2006 Previous message: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? Next message: rewriting Frame-IP-Netmask Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Thanks to Alan Buxey for reattaching the files in a tgz file. Resending again. Mak -----Original Message----- From: freeradius-users-bounces+mmoussa=mmoussa.com at lists.freeradius.org [mailto:freeradius-users-bounces+mmoussa=mmoussa.com at lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, October 12, 2006 5:44 AM To: FreeRadius users mailing list Subject: Re: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? "Mak Moussa" <mmoussa at mmoussa.com> wrote: > He tested the patch successfully using v1.1.3 on Linux and both TTLS-mschap > and TTLS-mschav2 authentications worked fine. > I tested the patch using v1.1.2 on Freebsd 5.3 and got the same successful > authentications. Great. > Please review the attached patch for any additional improvements as needed. Hmm... > Content-Disposition: attachment; > filename="winmail.dat" Could you attach the files in a *standard* format (i.e. non-Outlook), or put them on a web page? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Windows XP, mschap and the NAS
by duckeo 16 Oct '06

16 Oct '06

I think I have set up freeradius correctly to use MSCHAP, but the only way I thought I could test it is with the real client, i.e. Windows XP 'dialing in' (via a IP wireless VPN through EVDO). Running FreeRadius in debug mode, and using the default Windows XP settings I only get a CHAP request come through. Is it possible that the NAS sitting in between the client and the internal FR server can only pass on MS-CHAP, or is there some negotiation that goes on as to what the client sends off? When I force it to use MS-CHAP in Windows XP, I don't even see the request come through to FR. Any help on this?

1 0

RE: Re:Help: How to authenticate additional attribute
by Garber, Neal 15 Oct '06

15 Oct '06

> when the radius server authenticates the user, or whenever it is re-associated again to the AP, > it will prompt the user to enter the password and location coordinates. This may prove difficult if you are using the std. Windows supplicant since it caches credentials. We use WinXP with PEAP/MS-Chapv2 and I don't get reprompted for a password when it reauthenticates. I believe Vista has the capability to NOT cache wireless credentials. You perhaps could also have something delete the reg. key where the credentials are stored - that would force it to prompt again.. Perhaps you are using another supplicant that won't have this issue and that you could modify to prompt for additional information (loc.coord.)..?? Also, if location coordinates are generally known (10,10 = bldg 10/office 10 and 100,100 equals bldg 100, office 100), then how do you prevent users from entering the wrong coordinates in order to bypass your check? Even if your scheme isn't as simple as I described above, if the location coord. of a place is constant, over time people will learn the coordinates and they won't be useful as an additional security check. Are these numbers randomly generated or does each set of coordinates statically refer to a specific location (that's what I meant when I was asking the meaning of the coordinates)? If they're random, how will the information be given to the users? > Thereafter, the radius server will check on the password and the location coordinate. > If either is not right, it will reject the connection. > The server will maintain a set of legitimate location coordinates in a file > and it will be updated by another program automatically. Well, assuming you have a way to prompt, capture and send the "location coordinate" in the radius request, I would use rlm_perl during authorize and have it compare the location coordinate attribute to data in the file. You can easily return RLM_REJECT if the user hasn't specified a valid location coordinate. If you are planning to bury the information inside another attribute, you should check out attr_rewrite and hints as they have the ability to modify/create request attributes. As a caveat, this may not be the best approach though as I have only been using FR for a short time. > In the future, the coordinate may be derived by a system. If you're trying to authorize by physical location, have you thought about controlling to which AP's they are authorized to connect (e.g., by Huntgroup-Name or NAS-IP-Address)? Also, Cisco AP's have a "dot11 location" config. stmt., that could be used to automatically pass static information as part of the radius requests (each AP would always pass the same static info though unless the config. was changed). If this would work for you, the user wouldn't need to enter anything (and they couldn't spoof the location coordinates). Does this help you?

1 0