- Freeradius-Users - lists.freeradius.org

internet users based on time+ath
by Marwan Sultan 24 Jul '06

24 Jul '06

Hello people, I'm On FreeBSD 6.1R its acting as a internet gateway for a comlex of 30 appartments. the internet to this box is connected thro a dsl and its up/running, Well, We want to bill whoever sharing our internet connection on a monthly bases so basically, I want to release internet access based on time+auth. and to manage those users. I have been told to use freeradius + nocat ? well, im not familiar with such stuff, although im a network admin, so decided to email your list, in a hope that kindly someone will help me of HOWTO. is it correct freeradious will do what we wants? do i need to install any extra packages? or only freeradious will do the trick, of auth users, and manage them? Please advice me with lot of thanks. Marwan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

i don't know radius security function. help me please!
by 나종현 24 Jul '06

24 Jul '06

1 0

EAP-TTLS MD5 hashed Passwords in MySQL Database for WPA-802.1x auth
by Christian Poessinger 24 Jul '06

24 Jul '06

Hello, I'm trying to setup a System to authenticate WLAN users via EAP-TTLS with md5 crypted passwords, stored in a sql database. I'm using MySQL as the Backend and it works great when the passwords are stored in cleartext or UNIX crypt. When i convert the password from crypt to md5 and change pap encryption_scheme to md5 it doen't work anymore. As I have to use the SQL attribute field with 'Crypt-Password' in it, it seems that it wants to use crypt passwords and not md5. I tried to change it to 'md5-password' but well ... that wasn't the answer. Here is the error: --------- modcall: entering group PAP for request 4 rlm_pap: login attempt by "foo" with password bar rlm_pap: Crypt-Password attribute but encryption scheme is not set to CRYPT modcall[authenticate]: module "pap" returns fail for request 4 modcall: leaving group PAP (returns fail) for request 4 auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 TTLS: Got tunneled Access-Reject --------- Anyone has an Idea how to use the MD5 hashed Passwords in the Database with EAP-TTLS for authentication? I appended my radius configuration. Thanks. ----------- CONFIG ------------ eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { private_key_file = /etc/ssl/rad.pem certificate_file = /etc/ssl/rad.pem CA_file = /etc/ssl/ca.pem dh_file = /etc/ssl/rad.dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } modules { pap { encryption_scheme = md5 } } authorize { preprocess suffix eap files sql } authenticate { Auth-Type PAP { pap } eap } users-file DEFAULT Auth-Type = PAP Fall-Through = 0 -------- END OF CONFIG -------------

1 0

LDAP macAddress attribute for MAC-Address filters
by luigi natalino 24 Jul '06

24 Jul '06

Hi, I need to implement MAC-Address filters,every user may have multiple MAC-Address. I'm using freeradius with openldap. Can i use ldap macAddress attribute to make this filters? How does Radius understand this attribute? Are request same modifications to ldap.attrmap, and if so what are the modifications to be made? Thanks in advance Bill Wood _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

romel invites you to join Zorpia
by romel 24 Jul '06

24 Jul '06

Hi ! Your friend romel from Bangalore India, just invited you to his online photo albums and journals at Zorpia.com. About romel : Know Me Know Fun No Me No Fun So what is Zorpia? It is an online community that allows you to upload unlimited amount of photos, write journals and make friends. We also have a variety of skins in store for you so that you can customize your homepage freely. Join now for free! Please click the following link to join Zorpia: http://www.zorpia.com/cgi/signup.cgi?invitation_key=7d3391e3c6586a56fcd14ad… This message was delivered with the romel's initiation. If you wish to discontinue receiving invitations from us, please click the following link: http://www.zorpia.com/cgi/signup.cgi?action=optout&email=freeradius-users@l…

1 0

using previous DN in DEFAULT
by Rohaizam Abu Bakar 24 Jul '06

24 Jul '06

Hi.. Freeradius 1.1.2 OS : FreeBSD 6.1 Referring to below debug logs and config.. I'm planning to have 2 DEFAULT entries in users.. One that read LDAP tree ou=DIALUP & one ou=RADIUS but 1st DEFAULT entry will only be matched if it contain attribute "jaringService = REAL" in ou=DIALUP.. Other than that it will match 2nd entry... But the problem is that although first DEFAULT is NOT matched, and matched 2nd DEFAULT (Auth & Autz Type LDAP), it will still bind using ou=DIALUP (from 1st DEFAULT) to LDAP.... >>>rlm_ldap: user DN: >>>uniqueIdentifier=10614,ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my The problem happen when both LDAP tree has entry with same uid... but different password and belong to different person. users:- ==== ## NEW Dialup (REAL TIME) DEFAULT ldapdialup1-Ldap-Group == "REAL", Autz-Type := DIALUP, Auth-Type :=DIALUP ## NORMAL DIALUP DEFAULT Autz-Type := LDAP, Auth-Type := LDAP radiusd.conf ======== ldap ldap1 { basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap ldap2 { basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap ldapdialup1 { basedn = "ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my" groupname_attribute = jaringService groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap ldapdialup2 { basedn = "ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my" groupname_attribute = jaringService groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } Autz-Type LDAP { redundant { ldap1 ldap2 } } Autz-Type DIALUP { redundant { ldapdialup1 ldapdialup2 } } Auth-Type LDAP { redundant { ldap1 ldap2 } } Auth-Type DIALUP { redundant { ldapdialup1 ldapdialup2 } } debug:- ===== rad_recv: Access-Request packet from host xxxxxxxxxxxxxxx:60005, id=41, length=46 User-Name = "bacang" User-Password = "xxxxxx" rad_rmspace_pair: User-Name now 'bacang' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '/' in User-Name = "bacang", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 0 rlm_realm: No '@' in User-Name = "bacang", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bacang" rlm_realm: Proxying request from user bacang to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my' radius_xlat: '(uid=bacang)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to xxxxxxxxx:389, authentication 0 rlm_ldap: bind as cn=xxxxxxxxx,ou=Applications,dc=jaring,dc=my/xxxxxxxxxxx to xxxxxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my, with filter (uid=bacang) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(uid=bacang)(objectclass=radiusprofile))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my, with filter (&(jaringService=REAL)(&(uid=bacang)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group REAL not found or user is not a member. users: Matched entry DEFAULT at line 23 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for bacang radius_xlat: '(uid=bacang)' radius_xlat: 'ou=RADIUS,ou=People,dc=jaring,dc=my' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to xxxxxxxxxx:389, authentication 0 rlm_ldap: bind as cn=xxxxxxxxx,ou=Applications,dc=jaring,dc=my/xxxxxxxxxxx to xxxxxxxxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=RADIUS,ou=People,dc=jaring,dc=my, with filter (uid=bacang) rlm_ldap: checking if remote access for bacang is allowed by dialupAccess rlm_ldap: Added password {CRYPT}Y3EhshegMNPxA in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user bacang authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: leaving group LDAP (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bacang" with password "xxxxxxxx" rlm_ldap: user DN: uniqueIdentifier=10614,ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my rlm_ldap: (re)connect to xxxxxxxxxxxxxx:389, authentication 1 rlm_ldap: bind as uniqueIdentifier=10614,ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my/xxxxxxxxx to xxxxxxxxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap1" returns reject for request 0 modcall: leaving group redundant (returns reject) for request 0 modcall: leaving group LDAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [bacang] (from client sysadmin port 0)

1 2

Different IP addresses
by Giuseppina Venezia 23 Jul '06

23 Jul '06

Hi, I have a WI-FI connection with freeRADIUS+OpenLDAP+Chillispot. I have to manage two groups of people. The first group have hit to all the resources of the LAN, the second group can use only the http protocol. There is a simple solution to do this? I have thinked to assign some different IP class to each group, and manage the rule with iptables. If this is the only solution, how i can assign different IP classes? Best regards. Giusy

1 0

not so quiet anymore...
by Thor Spruyt 23 Jul '06

23 Jul '06

;-)

1 0

MySQL
by PhilT 23 Jul '06

23 Jul '06

I have been using FreeRadius with users entered into the config files, and now wish to migrate to using MySQL. Have MySQL, FreeRadius etc running under SuSE 8.1 on a test box. So far the only user in the MySQL database that authenticates OK is one that has the same username / password under Linux on the box concerned. Otherwise I get modcall[authorize]: module "sql" returns OK users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns OK modcall:group authorize returns OK rad_check_password: Found Auth-Type System auth: type "System" modcall: entering group authenticate modcall[authenticate]: module "unix" returns notfound modcall: group authenticate returns notfound auth: Failed to validate the user. The succesful file based users say "Found Auth-Type Local" which I guess is a clue to my problem. What do you helpful people need to know next ? Phil -- View this message in context: http://www.nabble.com/MySQL-tf1989114.html#a5458881 Sent from the FreeRadius - User forum at Nabble.com.

1 0

Re: proxy request when database is referering to ldap server
by sumi thra 22 Jul '06

22 Jul '06

> > Hi Alan, > > Please find the configuration in the users file & proxy.conf file. Please > let me know if i am missing or wrong configuration is done is achieve my > objective. > > Radiusd.conf file: > modules { pap { encryption_scheme = clear } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = /var/log/radius/radwtmp } mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no } ldap ldap_primary { server = 1.1.1.1 port = 1234 identity = "kjd" password = sdkjf basedn = sdjkf filter = "kjgf" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 #password_header = "{SHA}" password_attribute = fdsjk groupname_attribute = dj groupmembership_filter = "kjf" groupmembership_attribute = jkl timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = no } ldap ldap_secondary { server = 2.2.2.2 port = 1234 identity = "kjd" password = sdkjf basedn = sdjkf filter = "kjgf" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 #password_header = "{SHA}" password_attribute = fdsjk groupname_attribute = dj groupmembership_filter = "kjf" groupmembership_attribute = jkl timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = no } passwd etc_passwd { filename = /var/etc/passwd format = "*User-Name::User-Password" delimiter = : } passwd etc_group { filename = /var/etc/group format = "~Group-Name::*,User-Name" delimiter = : } realm suffix_oblic { format = suffix delimiter = / ignore_default = no ignore_null = no } realm prefix_oblic { format = prefix delimiter = / ignore_default = no ignore_null = no } realm suffix_at { format = suffix delimiter = @ ignore_default = no ignore_null = no } realm prefix_at { format = prefix delimiter = @ ignore_default = no ignore_null = no } realm suffix_percent { format = suffix delimiter = % ignore_default = no ignore_null = no } realm prefix_percent { format = prefix delimiter = % ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string #notfound-reject = no } preprocess { huntgroups = ${confdir}/huntgroups hu_int32_ts = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } .. .. } instantiate { #exec #expr ldap_primary ldap_secondary } authorize { preprocess #etc_passwd #etc_group chap mschap suffix_oblic prefix_oblic suffix_at prefix_at suffix_percent prefix_percent files redundant { ldap_primary ldap_secondary } eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } #unix eap } post-auth { } pre-proxy { } post_proxy { eap } Users file: -------------- # primary ldap group policy configuration # WLAN Allow policy for the groups DEFAULT ldap_primary-Ldap-Group == "sales",VSA-Attr-4 =~ "1",Login-Time := "Any0000-2359" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1 DEFAULT ldap_primary-Ldap-Group == "marketting",VSA-Attr-4 =~ "2",Login-Time := "Any0000-2359" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 10 # WLAN Deny policy for the groups DEFAULT ldap_primary-Ldap-Group == "sales",VSA-Attr-4 =~ "2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32",Auth-Type:=Reject DEFAULT ldap_primary-Ldap-Group == "marketting",VSA-Attr-4 =~ "1|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32",Auth-Type:=Reject # secondary ldap group policy configuration # WLAN Allow policy for the groups DEFAULT ldap_secondary-Ldap-Group == "sales",VSA-Attr-4 =~ "1",Login-Time := "Any0000-2359" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1 DEFAULT ldap_secondary-Ldap-Group == "marketting",VSA-Attr-4 =~ "2",Login-Time := "Any0000-2359" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 10 # WLAN Deny policy for the groups DEFAULT ldap_secondary-Ldap-Group == "sales",VSA-Attr-4 =~ "2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32",Auth-Type:=Reject DEFAULT ldap_secondary-Ldap-Group == "marketting",VSA-Attr-4 =~ "1|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32",Auth-Type:=Reject anonymous Anonymous DEFAULT Realm != "NULL" DEFAULT Auth-Type := Reject Proxy.conf file --------------------- proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm user\(a)myorg\.com { authhost = 192.168.2.2:1812 accthost = 192.168.2.2:1813 secret = symbol123 nostrip } the request was proxied to 192.168.2.2 but it still tries to connect to ldap_primary Please correct me if im doing any wrong configuration. Thanks. On 7/19/06, Alan DeKok <aland(a)nitros9.org> wrote: > > > > "sumi thra" <sumi.techno(a)gmail.com> wrote: > > > What you are saying is correct. But, i want proxy the request for some > > users > > > and for others i still want to use ldap .. in that case the users file > > will > > > have the policy for using LDAP & the proxy.conf file will have the > > realms > > > configured. > > > > That's pretty trivial to do. > > > > > When the server finds a matching realm, why is it trying to do ldap > > > authentication? ie, why the users policy is getting applied? > > > > Because you told it to. > > > > Read the debug log. It *will* tell you what's going on. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > >

2 1