- Freeradius-Users - lists.freeradius.org

Changing default reply from server when denied using Login-Time
by Drew S. Dupont 20 Dec '05

20 Dec '05

How can you change the default reply message sent back from the server when a user tries to login outside the allowed time? I am specifically asking about the message: Reply-Message = "You are calling outside your allowed timespan\r\n" that is returned when trying to login when using the Login-Time parameter for a user. I understand there is a "Reply-Message" field one can use in the user record. However, in our system it is only used when they are deactivated by the admin/manager and should not be populated otherwise. Is the only solution to recompile the freeradius server with that message changed? Or am I missing some param. or file where it could be changed? Thank you, Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

failed eap-type/tls???
by pelusa vali 20 Dec '05

20 Dec '05

hi everybody, well i'm trying to implement an ap over linux, i use madwifi-ng, debian sarge kernel 2.6.13 and freeradius supplied with debian installation cd's; i'd like to add more security so i decided to use hostapd and freeradius, first i generate my own certificates using openssl, and my hostapd configuration refer to freeradius files and directories; here is my radiusd.conf file: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = root group = root max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 192.168.50.1 port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = before lower_pass = before nospace_user = before nospace_pass = before security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } and here eap.conf file: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = wlanserver private_key_file = /etc/freeradius/certs/miscerts/private/cakey.pem certificate_file = /etc/freeradius/certs/miscerts/cacert.crt CA_file = /etc/freeradius/certs/miscerts/cacert.pem dh_file = /etc/freeradius/certs/dh random_file = /etc/freeradius/certs/random fragment_size = 1024 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } well the problem is: when i run freeradius -X i get this error: rlm_eap:Failed to link EAP-Type/tls: rlm_eap_tls.so:cannot open shared object:no such file or directory radiusd.conf[9]:eap:instantation failed so could any body help me?? why occurs this error and how could i solve it?? thanks for your help. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

2 1

Authorize a group by multivalued "Service-Type" (in MySql)
by Hamzeh Motahari 20 Dec '05

20 Dec '05

2 1

Plain text password file
by Alexander Lund 20 Dec '05

20 Dec '05

Can somebody explain howto use rlm_passwd and a textfile with this setup: name:password:group and so on the order can be any way around, spaces can also be present. Any pointers will be gladly excepted. A sweet tutorial will result in a free night out in Borås, Sweden /Alex -- When there is no solution, there is no problem.

2 3

Freeradius RPM for SUSE 10.0 or 9.3
by LeRoy DeVries 19 Dec '05

19 Dec '05

Does anyone here on the list have the RPM for freeradius /w experimental modeles to share with me. I would be very greatfull. I would compile it however, SUSE won't let me compile the program because of interdependancy errors and it's like chasing my tail so I gave up. ---- LeRoy

8 23

pam_radius_auth
by John Kelly 19 Dec '05

19 Dec '05

The pam_radius_auth README says "It allows ... password change requests." But the USAGE file says "Password changing is not implemented." That sounds contradictory.

1 0

UltaMonkey 3 and FreeRadius
by Hugues Lepesant 19 Dec '05

19 Dec '05

I all, I want to build a high availability radius plateform based on OpenSource software. To do so I've patched /usr/sbin/ldirectod with Matteo Bertato && Horms' patch found here http://lists.community.tummy.com/pipermail/linux-ha-dev/2005-September/0116… It works fine, I make the load balancing for both auth [1812] and accounting [1813]. But I've a strange behavior when freeradius started as daemon, server are nerver enabled for auth by ipvsadm. I must start freeradius in debug mode (-X) on the radius server to be enabled by the load-balancers. Even if I can make some successfull radtest from the load-balancers, and the log of ldirectord seems to be ok. I'm not sure it's UlraMonkey fault, I have tested with the last freeradius version and it the same :( Does any one have anye idea for where it can come from ? Best regards, hugues Distrib Debian sarge Freeradius 1.0.2-4 and 1.0.5 from source ultramonkey 3-1um.1 ipvsadm 1.24+1.21-1 Kernel 2.6.13.4 -- Hugues Lepesant ---------------------- Ingénieur Exploitation VeePee Tel : +33 1 73 02 68 02 119 rue de Paris 92772 Boulogne Cedex FRANCE

2 1

RE: FreeRadius cannot Authenticate to Windows AD
by Alhagie Puye 19 Dec '05

19 Dec '05

Michael, Try querying Active Directory with the "ldapsearch" utility. Here is an example. ldapsearch -LLL -h 1.2.3.4 -x -b 'dc=domain,dc=com' '(samaccountname=backops)' -D backops -w passofbackops This will make sure that the credentials are correct or not. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Phil Mayers > >Sent: December 16, 2005 1:55 AM > >To: FreeRadius users mailing list > >Subject: Re: FreeRadius cannot Authenticate to Windows AD > > > >Michael Calizo wrote: > >> Hi, > >> > >> Same thing has happened, I still can not authenticate to > >WindowsAD. > >> Same Error is displayed when i debug radiusd.... > >> > >> I put quotes arround password.. > >> > >> radtest user 'mypass' 192.168.1.1:1812 > ><http://192.168.1.1:1812> 1812 > >> testing123 > >> or > >> radtest user 'mypass' 192.168.1.1:1812 > ><http://192.168.1.1:1812> 1812 > >> testing123 > >> > >> > >> What do you think is the problem? > >rlm_ldap: bind as > >cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to > >192.168.1.1:389 > >rlm_ldap: waiting for bind result ... > >rlm_ldap: LDAP login failed: check identity, password > >settings in ldap section of radiusd.conf > > > >...that's pretty clear. The "identity"/"password" combo you > >have is wrong. Or AD thinks it's wrong. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

5 6

Re: Freeradius-Users Digest, Vol 8, Issue 82
by Stefan Adams 19 Dec '05

19 Dec '05

Hey, guys! Thanks for the great replies!! I like what you suggested better than what I've come up with in the mean time. I think what I came up with will work, it just seems messy/wrong/inefficient. What do you think? modules { ldap { : filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=%{Called-Station-ID}))" : } attr_rewrite getssid { attribute = Called-Station-Id searchin = packet searchfor = ".................:" replacewith = "" ignore_case = yes new_attribute = no } } authorize { # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 preprocess eap getssid ldap } This cuts off the first 17 bytes and then a colon of the Called-Station-ID (My AP transmits a dash separated MAC followed by a colon and then the SSID). Then it uses this rewritten Called-Station-ID and uses that as a filter in the LDAP search. Therefore, if the SSID a user tries to connect to is not listed as an attribute of the user's LDAP object, the user is denied. Does that make sense? But I am definitely going to try implementing the suggestions from Dusty and Alan (below). Thanks, guys!! Stefan > Date: Mon, 19 Dec 2005 11:02:33 -0500 (EST) > From: Dusty Doris <freeradius(a)mail.doris.cc> > Subject: Re: Authorization > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219104900.T19542(a)mail.doris.name> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > > Let's say I have 2 groups: students and faculty. > > I want to authorize authenticated members of the LDAP group > > cn=students,ou=Groups IFF their Access-Request Called-Station-ID =~ > > "/:StudentWLAN$/" > > I want to authorize authenticated members of the LDAP group > > cn=faculty,ou=Groups IFF their Access-Request Called-Station-ID =~ > > "/:FacultyWLAN$/" > > > You left out your ldap part? Anyway it should look something like this. > > groupname_attribute = cn > groupmembership_filter = "(&(objectclass=GroupOfNames)(member=%{Ldap-UserDN}))" > > Of course you'll have to change that to fit with how your directory is > structured. Once you've got that part down, then in the users file you > could do something like this. > > DEFAULT Called-Station-ID =~ "/:StudentWLAN$/", Ldap-Group == "students" > > DEFAULT Called-Station-ID =~ "/:FacultyWLAN$/", Ldap-Group == "faculty" > > DEFAULT Auth-Type := Reject > > That would look to see if Called-Station-ID matches that regex. If so, it > would look to see if they are in the Ldap-Group of students. Your > groupmembership filter and groupname_attribute should look for a group > named cn=students and then see if the DN of the user is in it. > > If not, it would fall through to the Reject statement. Now, there are > other things going on outside of ldap that I don't really know about, so a > copy/paste of what I wrote might not work. But, it should help lead you > in the right direction. > > I'd give it a shot running in debug mode (radiusd -X) and then you can see > the exact queries that are taking place and what is happening. You can > then go back and modify those ldap group statements and the users file to > fit what you need. > > Once you've got it started if you need more help, please post debug output > and what you would expect vs what you got and we can probably help sort it > out. > > ------------------ > > Message: 6 > Date: Mon, 19 Dec 2005 11:47:24 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Authorization > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219164724.55C0717115(a)mail.nitros9.org> > > Stefan Adams <stefan(a)borgia.com> wrote: > > I have read all the man pages and /docs and am having a difficult time > > understanding the authorization. I keep wanting to write > > "if...elseif...else" stuff but I'm pretty sure that doesn't apply to > > FreeRADIUS config files. > > Unfortunately, yes. > > > How would I configure the checkval module? Is it even necessary to use the > > checkval module? How would I conifgure the users file? Is the users file > > even necessary? > > I wouldn't configure the checkval module. Just the "users" module, > something like: > > DEFAULT LDAP-Group == faculty, Called-Station-Id != "faculty", Auth-Type := Reject > > DEFAULT LDAP-Group == students, Called-Station-Id != "students", Auth-Type := Reject > > > P.S. I don't know who to direct compliments to, but the FreeRADIUS code is > > probably the most beautifully structured source code I have ever read. It > > is SO easy to read and extremely consistent! It's phenomenal! > > You can thank everyone who contributed so far. :) > > Alan DeKok.

2 1

Segmentation fault in 1.1.0-pre0
by Norbert Wegener 19 Dec '05

19 Dec '05

freeradius-1.1.0-pre0 crashes, when sending an Sending Access-Accept: Program received signal SIGSEGV, Segmentation fault. 0x4027ae77 in memset () from /lib/i686/libc.so.6 (gdb) bt #0 0x4027ae77 in memset () from /lib/i686/libc.so.6 #1 0x00000020 in ?? () #2 0x401f83eb in rad_vp2attr (packet=0x0, original=0x0, secret=0x0, vp=0x0, ptr=0x0) at radius.c:256 #3 0x00000000 in ?? () (gdb) The complete output of radiusd -AX is available at: http://www.wegener-net.de/fr/typescript Norbert Wegener

2 2