- Freeradius-Users - lists.freeradius.org

RE: win2003 Active Directory authentication
by Chris Liles 08 May '06

08 May '06

Yes you can do use the ldap module of freeradius to hit your AD, I am doing this now. Yes you can do ssl/tls for encryption between the radius server and AD. Windows server 2000 does not support tls, only ssl. It is similar to setting up mm_mod_auth_ldap for apache. You will need an ldap browser to browse your domain to find out the correct search filters for everything. The only thing I can't figure out is how to check for group membership. I posted to the mailing list, but no one has responded yet :-( There is good documentation on the wiki. Look for my previous post about not getting groups working to see my config files. -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 Tel: (404) 942-5334 Fax: (404) 815-7708 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Frank Smith Sent: Monday, May 08, 2006 11:55 AM To: freeradius-users(a)lists.freeradius.org Subject: win2003 Active Directory authentication I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain. I can authenticate using ldap, no? Also, is this insecure due to clear text? Any other ideas for what I want here? Thanks!

1 0

cisco ap350(WLAN) vs freeradius with PEAP
by Gabor Szelei 08 May '06

08 May '06

Hi, Ive been trying to get $subject working. My last state is the client has been authenticated, but no traffinc is going through. Does anyone have a working config for Cisco350 with PEAP? What kindof reply is CISCO expecting from radius? br, Gabor Szelei

2 1

Re: PLS Help I get no response for 2 monthe (missing
by Assa Tal 08 May '06

08 May '06

Hi Stepan 10x for your prompt respond I Used radrelay and it works fine the point is that I would like to do it without additional proccess Like u said with the hint file where can I get this patch for the hint file ? And how do I tell him not to look for User-Name 10x in adv Tal assa To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. PLS Help I get no response for 2 monthe (missing User-name attribute) (Assa Tal) 2. Re: PLS Help I get no response for 2 monthe (missing User-nameattribute) (Stefan Winter) 3. cisco ap350(WLAN) vs freeradius with PEAP (Gabor Szelei) 4. Re: Special characters in users file (sumi thra) 5. Re: FreeRadius + MySQL & Encrypted passwords (Miguel Angel Quiles) ---------------------------------------------------------------------- Message: 1 Date: Mon, 8 May 2006 09:50:45 +0300 From: "Assa Tal" <Tal.Assa(a)comverse.com> Subject: PLS Help I get no response for 2 monthe (missing User-name attribute) To: <freeradius-users(a)lists.freeradius.org> Message-ID: <FE225DCF1021F34FB2269676A45BB8814434AF(a)il-tlv-mail01.comverse.com> Content-Type: text/plain; charset="us-ascii" Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

problems with hints file
by wekz 08 May '06

08 May '06

Hi all, I use freeradius1.1.1 + ldap. And peap or eap-tls for authorization. I've been trying to use hints.file for changing the User-Name. When a laptop user which is in a domain tries to do a peap authentication, windows sends a User-Name that follows this pattern (at least the ones I've seen): DOMAIN\5c\5cLOGIN I'm trying to catch up the LOGIN name so the radius can perform a search in ldap. I've modify hints.file including this line: DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "%{2}" The problem is that this rule matches but it changes the User-Name for an empty string. If I put a string instead of %{2} it does change it right. DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "JOHNDOE" I don't know if that is a bug or if there's something I'm doing wrong and didn't realize. ¿? Thanks.

2 2

PLS Help I get no response for 2 monthe (missing User-name attribute)
by Assa Tal 08 May '06

08 May '06

Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

ldap group checking against active directory
by Chris Liles 07 May '06

07 May '06

Hello mailing list! I have tried to search the archive and the web for the answer to my question but I am unable to find the answer..... I'm sure someone here has run into this before. I am attempting to setup the good old freeradius + active directory + access point to get peap going scenario. I have freeradius setup fine to use ldap to auth the user, and it works. I am attempting to setup finer access control (well really simple) to check if the user is a member of a group before allowing access. Here are some configs: radiusd.conf ldap { server = "domaincontroller.my.domain.com" identity = "adreader" password = "test1234" basedn = "cn=users,dc=my,dc=domain,dc=com" filter = "(sAMAccountName=%u)" port = 636 start_tls = no tls_mode = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" timeout = 4 timelimit = 3 net_timeout = 1 } In my users file all I have is: DEFAULT Ldap-Group == "badgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have access" When I use NTRadPing to test with a user that is in "badgroup" I still get an Access-Accept back. I can do an ldap search using the groupmembership_filter and I get back all the groups my test user is in so I know that isn't the problem. Of course when I do my search I replace the %{Ldap-UserDn} with the actual "cn=username,<what I have for basedn>" Also I have the groupmembership_attribute defined because from what I gather from the docs, it is used if the groupmembership filter fails. Anywho, when I send an auth request while watching the debug output I don't see anything about checking for group/groupmembership/etc. If I change my filter "filter = "(sAMAccountName=%u)" to also check for the group name, everything will work, but of course I would like to use the users file. I've got TLS set to no and port set to 636 because I am using a crap-tacular windows 2000 domain, which doesn't support TLS :-( I think I am missing something or something isn't quite right. Anyone have any ideas, or has anyone gotten ldap group checking to work against active directory?? Thanks -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309

1 0

db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

cannot find db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

freeradius and IDLE time or sth like that
by Przemysław Backiel 06 May '06

06 May '06

hello, I want to kick of user when he is in idle for some time. I am using FreeRADIUS 1.1 and accounting in SQL how can I do that? I suppose that I will have to add something in radcheck or radreply table. So, what I have to add? -- Z powazaniem Przemyslaw Backiel

1 0

Missing User-Name attribute causing a segfault in attr_rewrite
by Dennis Skinner 05 May '06

05 May '06

Hello, I finally got around to upgrading our RADIUS servers to FR 1.1.1. Everything is working well except we seem to have a customer somewhere who is able to attempt to auth without sending a User-Name attribute and a blank User-Password. I'm not sure at this point if it is an attempted exploit or just a badly coded client. Here is an attempt: --- Walking the entire request list --- Cleaning up request 1 ID 88 with timestamp 44512aa3 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21674, id=218, length=203 Framed-Protocol = PPP User-Password = "" Calling-Station-Id = "##########" Called-Station-Id = "##########" NAS-Port-Type = Async Cisco-NAS-Port = "Async172" NAS-Port = 172 Connect-Info = "28800/26400 V34+/V44/LAPM (53333/26400)" Cisco-AVPair = "v92-info=V.92 QC MOH/QC Full Train Success/0/0" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 2 rlm_attr_rewrite: Could not find value pair for attribute Realm modcall[authorize]: module "fix_realm" returns noop for request 2 The very next line is the segfault. Here is my "fix_realm" module: attr_rewrite fix_realm { attribute = Realm searchin = packet searchfor = "blue.*$$" replacewith = "bluefrog.com" ignore_case = yes new_attribute = no max_matches = 1 append = no } (we used to use both bluefrognet.net and bluefrog.biz, so this attempts to normalize everyone since the username in the db is always user(a)bluefrog.com) I think the fact that there is no realm may be causing the segfault. Unfortunately, I have no idea how to recreate the situation myself and I have yet to try to track down the customer. I didn't see this problem listed on bugs.freeradius.org and don't recall seeing mention of it on the list. The other thing I changed in the authorize section of the config file is that I moved the suffix (and fix_realm) higher in the list (as you can probably tell from the debug output). Here is my authorize section: authorize { suffix fix_realm preprocess chap mschap eap files redundant { # slave first sql2 sql1 handled } } My old config wasn't using huntgroups, so I didn't need to fix_realm before preprocessing. I need to do that now, hence suffix and fix_realm are at the top. I will continue to dig at this problem from my end, but I thought maybe Alan or someone could modify radclient to send a packet like above and see if they can recreate the bug (or better yet, have a look at the code and go, "oh yeah, that is why that happened"). My C coding skills have all but rusted solid at this point. Let me know if you need any more information. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 6