- Freeradius-Users - lists.freeradius.org

RE: mpd+freeradius+AD
by Егоров Сергей 28 Jun '06

28 Jun '06

>This is Framed-IP-Address in radius dialect. Thanks for explaining freeradius basic concepts. I understood, that to assign IP to user I should use users freeradius file. But I couldn't configure it correctly. Now I have only one line in this file DEFAULT Auth-Type := MS-CHAP I've add another string (for user test), but it doesn't correct test Auth-Type := MS-CHAP, Framed-IP-Address = 192.168.10.65, Fall-Through = Yes That should I fix? -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Monday, June 26, 2006 5:09 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: mpd+freeradius+AD On Monday 26 June 2006 14:04, Егоров Сергей wrote: > Thanks for reply. > > >You can use one of the three firewalls avaliable in the base system(ipfw, > > >ipf and pf), however mpd comes with a small dictionary that uses > > ipfw(8) >and you can easily define some filter bound to an interface > > (bound to a >username) via a radius reply attribute, let filter be a > > pipe(for bandwidth >control) or a packet filtering expression. > > That's fine for filtering vpn users access to local net. But how could I > assign specific IP for specific user in AD? > > > Your questions don't clearly tell where your problem is. > >Active Directory? mpd? or FreeRADIUS? You should define > >them better in order to get help from the list. > > My goal is to replace VPN server, based on win2003, with FreeBSD one. WIN > 2003 can do 1 and 2 in my questions, so I have to realize how to setup this > in mpd + freeradius. I already authenticate users from AD group: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00} > --require-membership-of=EXAMPLE+VPN_Allowed". > > But I have several vpn groups and need to setup timeouts on each one. setup timeout? This looks like Session-Timeout in radius dialect. > Also > I need to I assign specific IP for specific user in AD. This is Framed-IP-Address in radius dialect. > Looks like > FreeRadius should respond for this. Yes, you have to have basic understanding of what radius is. All of these are very basic setup. I don't know how FreeRADIUS interacts with AD and what info it should get from AD. So, try searching (or asking) for active directory and FreeRADIUS. Keep the mpd part out of it, since it will add unneeded complexity. Or perhaps start from setting up mpd and FreeRADIUS. And then you could add AD. A few suggestions, Nikos

1 0

using radius with samba
by Wutz, Josef 28 Jun '06

28 Jun '06

Hello, I have freeradius version 1.1.2 and a samba installation with version 3.0.23. My Samba works as a Windows NT 4.0 PDC. Now I want that the radius sends authentication requests to the samba. So that I can logon on on the radius server with my samba domain login. What parameter in radiusd.conf I have to change that this function works? Thank you very much for your help Josef

1 0

dial-up admin and authentication time
by Pelusa Vali 27 Jun '06

27 Jun '06

hi list, i have 2 questions, hope could help. 1) trying to use dial-up admin in my wlan, i installed it and created tables, first filled them manually with some users, later filled new users using dial-up interface, but i only can see first user's statistics, any other user, even connected, is not show. any body knows where am i failing?? 2) time of authentication is too long, i guess, i use madwifi and hostapd, first time clients connect authentication could take 5-6 minutes, after 10 minutes they are disconnected (don't know why) and re-authenticated, it takes now, 1-2 minutes. are there any parameter i should change or why is it happening??? thanks for your time and help. _______________________________________________________________ Halloween Humour: What do you call a skeleton that pushes your doorbell? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=136

1 0

Please help !!!
by Kartthik Raghunathan 27 Jun '06

27 Jun '06

I have freeradius setup for wireless client access againt the active directory and its working good. Now using the same FR trying to authenticating pptp clients against AD using Dlink firewall. While the pptp client connect to the dlink fw, getting this error message "the remote server doesnt support the support the encryption type". The dlink support guys told that the encryption on the freeradius server is not correct. Do you guys think this makes sense ? Note: In dlink fw, the mppe encryption has been enabled. Does freeradius support this encryption type too ? -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1

Mysql with crypted password
by Alessandro Agostini 27 Jun '06

27 Jun '06

Hi to all, I have successfully installed secure2 with 3Com WX1200 switch and AP 3Com 2750, with authentication PEAP-EAP/MSCHAPv2. Authentication radius ask to mysql tables the credentials stored in plain text. Now, my problem is: I don't like plain text password in my MySQL Table. So I ask you. Which is the possible scenario to have crypted password stored in MySQL. Thank you Alessandro Agostini

2 3

Radius
by Grant Wright 27 Jun '06

27 Jun '06

Message: 1 Date: Fri, 23 Jun 2006 11:09:27 -0400 From: "Alan DeKok" <aland(a)nitros9.org> Subject: Re: Radius Logs To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060623150927.CAFE116E49(a)mail.nitros9.org> "Grant Wright" <grant(a)wo.co.za> wrote: > I use the RADIUS logs to calculate usage for a client. What I want to do is > separate the internal FTP traffic (which is classified as free traffic) from > the rest > > of the traffic so that I can charge the client accordingly. >>Unless the NAS sends information saying what is FTP and what isn't, >>this is impossible. >>Alan DeKok. Thank you for your reply Alan. I am able to mark the FTP packets but I am unsure how to pass this to the RADIUS server. It at all possible

1 0

basic handling of multiple EAP-Methods by freerad
by Rainer Brinkmann 27 Jun '06

27 Jun '06

Hello, we wonder, how a freeradius can request a client to use a fixed EAP-Method: so its defined: Client starts with EAP-Start-Msg Radius wants EAP-Identity Client answers with Username or Hostname NOT using a special EAP-Method Radius now starts communiucating with the first EAP-Packet, using the special EAP-Method Question: you run in your wireless LAN many SSIDs: SSID1 shall use EAP-TTLS SSID2 shall use EAP-TLS (high-secured Net like personal Data) what logic starts the right inner-EAP-Protocol, cause neither the AccessPoint(WLAN-Controller), nor the radius server know, what Method to use, when there are many enabled. e.g. on a cisco-Radius, that runs with enabled PEAP and TLS, but there's no special attribute defined to control that thanks for reply, Rainer Brinkmann University-Clinicum Hamburg / Germany

2 1

Re-write Attributes based upon NAS-Port-Type and LDAP authorization response
by Bill Carr 26 Jun '06

26 Jun '06

Hello Folks, I've posted something similar to this in the past and my question was answered rather tersely. I'm hoping a little more detail will invoke the type of kind responses I'm used to in the Open Source Community. I've got FreeRadius on RedHat ES3 authenticating users to OpenLDAP. So far we've simply been authenticating users via 802.1x on Wired Switch ports and we've now added new equipment for WIFI which requires the RFC3580 attributes (instead of the Filter-ID we've populated in our LDAP schema). I believe it should be relatively simple to perform the following check's to "re-write" my attributes for the WIFI Gear. I can base the decision to re-write on the NAS-Port-Type received. My pseudo-code thought process is outlined below (I'm not a coder, would never profess to be; thus my post!): if NAS-Port-Type == "Wireless - IEEE 802.11" then Tunnel-Medium-Type == IEEE-802 Tunnel-Type == VLAN if Filter-ID =~ "Internet-Restricted" then Tunnel-Private-Group-ID == 155 (or the Restricted VLANID) elseif Filter-ID =~ "Allow-All" then Tunnel-Private-Group-ID == 156 (or the Allowed VLANID). endif endif My reading thus far has lead me to test my reply attribute requirements from the "users" file and that works perfectly. If someone could point me in a simple direction on how to strip/rewrite the attributes based on the 'authorization' reply from LDAP, I'd be indebted. I've seen examples of profiles stored on LDAP, but I'm curious how I could choose a different profile based upon the "NAS-Port-Type" received in the Access-Request Here's what I did in the "users" file to test successfully (I don't know that it's of any value but to demonstrate what I'm trying to accomplish). testuser User-Password == "user", NAS-Port-Type == "Wireless-802.11" Tunnel-Medium-Type == "IEEE-802", Tunnel-Type == "VLAN", Tunnel-Private-Group-Id == "155" testuser User-Password == "user", NAS-Port-Type == "Ethernet" Filter-ID == "Enterasys:version=1:policy=Internet-Restricted" admin User-Password == "admin", NAS-Port-Type == "Wireless-802.11" Tunnel-Medium-Type == "IEEE-802", Tunnel-Type == "VLAN", Tunnel-Private-Group-Id == "156" admin User-Password == "admin", NAS-Port-Type == "Ethernet" Filter-ID == "Enterasys:version=1:policy=Allow-All" Thanks to all in advance. Bill

2 1

RE: Malfunctioning Nomadix
by Rob Parker 26 Jun '06

26 Jun '06

Hi, I've seen this with our Nomadix USG and AG series devices as well - often the NSE will send requests multiple times, but I can never understand why. There are a few other bugs in the RADIUS code in Nomadix as well, for example I have never managed to get round robin working as I would expect (50% to each server). With our RADIUS setup the multiple stop or start packets do not cause any problems as the session ID is unique so a duplicate cannot be inserted into our accounting database. I am in discussions with developers at Nomadix at the moment about stability issues, and I have also mentioned these RADIUS issues to them as well - hopefully they will be fixed soon! Which devices and firmware versions do you have this problem with? rob. -----Original Message----- From: Santiago Balaguer García [mailto:santiagoawa@hotmail.com] Sent: 22 June 2006 12:48 To: freeradius-users(a)lists.freeradius.org Subject: Malfunctioning Nomadix Hi, I have a possible bug in Nomadix devices but I am not sure and it is a RADIUS problem. These hotspots normally works fairly, however some of them sometimes have a strange behavior. Nomadix sends more then one authentication requests to RADIUS server for disconnecting. It write the same entry several times in my DB, this fact corrupts my stadistics. I send you several accounts in the attachment with this case in a same hotspot Nomadix. _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

3 2

Problems with Redundant Proxy config with FreeRadius 1.0.1-2.FC3.1 (Fedora Core 3)
by Shaun Mccullagh 26 Jun '06

26 Jun '06

Hi, I would like FreeRadius to proxy requests to two radius servers. Normally requests should go to a primary(kiezel1i), but if this is unavailable it should send requests to a secondary(kiezel2i). I'm using the config at the bottom of this message. If I shut the primary down, FreeRadius never forwards the requests to the secondary. Have I made a mistake in my config? How does FreeRadius determine if the Primary is unavailable? TIA Shaun proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 180 default_fallback = no post_proxy_authorize = yes } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm erbi.nl { type = radius authost = LOCAL acchost = LOCAL } realm zzl-ra.nl { type = radius authhost = kiezel1i:1812 accthost = kiezel1i:1812 secret = xxx ldflag = fail_over } realm zzl-ra.nl { type = radius authhost = kiezel2i:1812 accthost = kiezel2i:1812 secret = xxx ldflag = fail_over } Op dit e-mailbericht is een disclaimer van toepassing, welke te vinden is op http://www.xb.nl/disclaimer.html

1 0