- Freeradius-Users - lists.freeradius.org

LDAP auth and different use of access_attr
by John Keimel 27 Feb '06

27 Feb '06

I've a FreeRADIUS server (1.0.2, from debian stable) that is set up to authenticate users of a VPN into the network. I've presently got the firewall talking to FreeRADIUS which then talks to LDAP and check the existence access_attr: vpntype If the users profile has the attribute of vpntype in it, they're let in. What we'd rather do is allow access based on the value of access_attr . So rather than just allowing if it exists, we might later pass on some extra rights to people in different groups. vpntype: foo or vpntype: bar vpntype: baz - whatever those values might be. Am I looking in the wrong spot for this ? Is access_attr: the right place to put such a setting? Or is there someplace else. I've done some basic searches of the mail archive, but I think my barking up the wrong tree may be causing my searches to be too broad. Pointers towards fine tuning my search or possibly some threads on this, would be welcome. Thanks j

2 1

logging Access-Reject messages
by Geoff Silver 27 Feb '06

27 Feb '06

Hi everyone, I have no trouble logging Access-Request and Access-Accept messages, but neither rlm_detail nor "log_auth = yes" seems to log Access-Reject messages. I feel quite silly asking this, but is there something special I need to do to get these logged? My radiusd.conf file looks like: authorize { preprocess detail auth_log attr_filter files } authenticate { Auth-Type System { unix } } preacct { preprocess acct_unique files } accounting { detail } session { } post-auth { reply_log } I'm happy to send any extra config you'd like - just let me know. Alternately, I'm happy to patch the code to allow this if someone knows the right place to do it. Thanks for any ideas!

2 2

Disconnect the user if reach the limit
by Yudi Wijaya 27 Feb '06

27 Feb '06

Hello , I create HotSpot system with MikroTik, FreeRADIUS + MySQL But i have problem : How to disconnect user when reach the usage limit (ex: 50 hours, 50 MBytes)? depends on they prepaid registration, so it will stored at RADIUS (MySQL Database). Everyone can register via web based hmmm.. if it possible, how to give user information when they reach the limit like "Time's Up", etc. Does it using RadKill ? but, actually i don't know how to use it. thanks before.. -- Best regards, Yudi Wijaya

2 3

freeradius authorization without "username"
by ???????, ?? ???????? 27 Feb '06

27 Feb '06

I have a freeradius, and I need "Calling-Station-Id" for authorization. This is the one attribute, which I select in the radiusd.conf checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } (But in fact, I do not use this) Why, when freeradius rescieve the access-request packet, and "username" field is empty, then we got access-denied? I use SQL authorization module. In the database (I use it as a blacklist, id Calling-Station-Id exist in the list, then access denied.): +----+------------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+------------+-----------+----+--------+ | 2 | 3339222222 | Auth-Type | == | Reject | | 1 | all_users_not_in_black_list | Auth-Type | == | Accept | +----+------------+-----------+----+--------+ >From sql.conf: authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE Username = IF(Username='%{SQL-User-Name}','%{SQL-User-Name}','all_users_not_in_black_list') \ LIMIT 1" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = 'all_users_not_in_black_list' \ ORDER BY id" So, info from radiusd in debug mode: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:1812, id=182, length=113 NAS-Identifier = "ggsn2" User-Name = "" User-Password = "" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "3339222225" Acct-Session-Id = "d45d6126057478b1" Acct-Multi-Session-Id = "d45d61260000b77a" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail.log' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail.log expands to /usr/local/var/log/radius/radacct/auth-detail.log modcall[authorize]: module "auth_log" returns ok for request 0 rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 0 modcall: leaving group authorize (returns invalid) for request 0 Invalid user: [/] (from client ggsn2 port 0 cli 3719248521) Sending Access-Reject of id 182 to XXX.XXX.XXX.XXX port 1812 I don't care, what kind of username do we have! How I can avoid this problem? :-( Can someone help me with this quesion? Here is the part of my radiusd.conf file: <...skipped...> modules { checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } # Livingston-style 'users' file # files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/acct-detail.log detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/auth-detail.log detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/reply-detail.log detailperm = 0600 } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Calling-Station-Id} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } } instantiate { } authorize { auth_log # See "Authorization Queries" in sql.conf sql } authenticate { } accounting { detail radutmp } session { radutmp } # Post-Authentication post-auth { reply_log } ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

2 1

re: Client certs with MSCHAPV2 in PEAP
by Norbert Wegener 27 Feb '06

27 Feb '06

>"Dave Huff" <dbhuff at yahoo.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ > For EAP-TLS to work, the client certs have to be />>/ > signed by the server cert. />>/ Signed by the server cert or by the CA cert? I have a CA that signed the />/> server and client certs, and the eap.conf file knows where server and CA />/> certs are. / > If you're using 1.0.x, that won't work. It doesn't do certificate >chains. The client cert MUST be signed by the server cert. Using a >CA to sign them, both won't work. > > I'm not even sure it will work in 1.1.0, to be honest. > > Alan DeKok In 1.1.0 I have chained client certificates and for me EAP-TLS works, if the client does not require the server to authenticate itself. The client cert is not signed by the server cert. It seems to be neccessary,that if you have a root ca and an issuing ca, the CA_file must contain the certificates of both of them. If the client requires the server to authenticate itself, the whole process fails. Norbert Wegener

1 0

how to confirm locally??
by pelusa vali 27 Feb '06

27 Feb '06

hi everybody, i'm using debian sarge kernel 2.6.13, openssl 0.9.8a, hostapd 0.5.1, freeradius 1.0.5, madwifi-ng-r1406, i want to use eap-tls in my wlan and over my own ap over linux. so i can install and configure all programs (except hostapd, so instead compile myself i installed it from .deb format), now i have my certificates and programs running but when try to connect a windows client i get this error: "Received packet from (my freeradius server ip direction) with invalid Message Authenticator (invalid signature) (shared secret is incorrect)". i generate certifictes using winxp extensions. so my question is: is there any way i can test my certificates from freeradius?? any command? or may be install wpa-supplicant over my debian and test from there (authenticator and supplicant in same machine??). If clients try to connect without freeradius and hostapd running it's possible, but with these two programs clients lost immediately ip direction and show a message of "Error authenticating". could any body try to help? thanks in advance for your help and time. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0

Open Authentication for a realm
by John Oxley 27 Feb '06

27 Feb '06

Hi, I am still quite new to radius so please forgive me if I make invalid assumptions or this question has been answered somewhere. I want to have open authentication on a realm and setup an IP pool for that realm. So if your username is anything@foo, you will be authenticated, no matter what your password is and you will be given an IP from the pool 10.0.0.0/24. Where in the config files do I have to put this? I'm running FreeRadius 1.0.4 on FreeBSD 4.11-STABLE. Regards, -John

2 2

Re: Freeradius + Microsoft Active Directory
by Sandworm 27 Feb '06

27 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Natalia Escalera" <nescalera(a)gmail.com> wrote: >I have another question, how can we avoid referrals coming from AD >Ldap server? How can we specify those settings? >From the list archives: See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkQCP0sACgkQmw4BJyaatJ0v0wCfVh0g2C1mTgdDxuV6qzBqg8FxTnsA nilt8+Zkbe4sXvs8HCpieRZ7kZQd =B4JO -----END PGP SIGNATURE-----

2 1

RE: Adding Ascend-Data-Filter to MySQL
by Jonathan De Graeve 27 Feb '06

27 Feb '06

> But when I add the same Ascend-Data-Filter information above into mysql > database file (radgroupcheck table), although authenticates fine, I don't > get "Ascend-VSA-Data-Filter=\0x01\0x01\0x01 ...." in attribute dump. > Below is what is added to the table: > > GroupName Attribute op Value > -------------------------------------------- > Dialup Auth-Type := LOCAL > Dialup Service-Type = Framed-User > Dialup Framed-Protocol = PPP > Dialup Framed-Compression = Van-Jacobsen-TCP-IP > Dialup Ascend-Data-Filter += "ip in forward tcp est" > Dialup Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20" > Dialup Ascend-Data-Filter += "ip in forward tcp dstport = 25" > Dialup Ascend-Data-Filter += "ip in forward" > It should be in radgroupreply table J.

2 1

TNC Compliance
by Robert Myers 26 Feb '06

26 Feb '06

Is FreeRadius TNC compliant? -Bob

2 1