- Freeradius-Users - lists.freeradius.org

Can mysql and mssql being used at the same time?
by Andres Pazos 14 Nov '05

14 Nov '05

Is it possible to have user@realm1 authenticated against MSsql and user@realm2 authenticated against MySql? thanks in advance.

2 1

FR1.0.5: EAP + LDAP + crypted passwds ??
by aab+freeradius＠drexel.edu 14 Nov '05

14 Nov '05

Ok, I skimmed through the mailing list notes last night (mostly via Google) and found a number of notes that said it was only possible to do EAP authentications against an LDAP server if the server has either cleartext passwords or NT hashes in it. Some of those notes were very old and the ldap_howto.txt doc is also rather old with no reference of 802.1x, so I'm hoping to get an updated answer. My LDAP choices are the AD domain controllers and our iPlanet LDAP servers - the iPlanet servers have crypted passwords and no NT hash info, so I believe they're out of this(?) The AD LDAP might have a way for me to make use of PEAP or TTLS, but I'm running into a bit of trouble with the user binding at this time. I'm back to reading, but figured I'd include my AD/LDAP config just in case someone sees something blindingly wrong with it. andrew. :radiusd.conf: ldap { server = "domaincon.test.drexel.edu" basedn = "dc=drexel,dc=edu" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } :eap.conf: tls { # private_key_password = whatever private_key_file = ${raddbdir}/certs/keycert.pem certificate_file = ${raddbdir}/certs/keycert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes copy_request_to_tunnel = no use_tunneled_reply = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 }

2 1

Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! Yes! I did it! ;) My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory (on 2003 Server). Without ntlm_auth! Below I have added a short summary how I realized it here. But now I have a question and I can't solve it for myself. I want to retreive some group informations from AD. In an users account I find several values "memberOf" and the DN of the group, where the user belong to. Now I want to give access via freeradius only to some special groups. I have figuered out, that there are these parameters: groupname_attribute, groupmembership_filter and groupmembership_attribute combined with some entries in the users-file. I've read the doc/rlm_ldap, but I didn't find any deeper hints or explanation. Questions: 1. Where can I find some docs about the %{...} Values in groupmebership_filter? Which one should I use in combination with my AD? 2. Which value should I use then in the users-file? 3. Is there anyone who can give a little help in further authenticating with group? -------------short summary how to authenticate vs. ActiveDirectory ----------------------- /etc/raddb/radiusd.conf [...] ldap { #servername with an AD-Server running Win2003Srv server = "adsrv.qsc.de" #The Useraccount for querying AD (anonymous query is disabled) identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" #The password for the Query-User password = 'xxxxxx' #base DN for user search; all our Users are in ou=employees. Without this "ou=...", no user will be found. \ #I don't understand why basedn = "ou=employees,dc=qsc,dc=de" # I've copied the below string, because I didn't understand the meanings of the %{...} filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" # I had to increase the timeouts timeout = 40 timelimit = 30 net_timeout = 10 } The users-file left on default, no changes. I hope, I could help some people trying to use AD for radius. And, I hope, someone will help me with my user-problem. Greets Christian

3 2

EAP-AKA
by Rajeshwari Krishnappa 14 Nov '05

14 Nov '05

Hi all, Can some one please tell me if the current version of free radius supports EAP-AKA? If so, how can we set it up to work with x-supplicant on Linux? Thanks Rajeshwari __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Proxy replies not getting to/past proxy
by Kristina Pfaff-Harris 14 Nov '05

14 Nov '05

Hi, all. First, let me say that if the answer to this is in the lists or the docs or rlm_whatever.c, please let me know. I've been searching for a few days, but either I'm not using the right queries to find my answer, or it's not there. (Ain't that always the way?) :-) We recently upgraded from a hacked-n-patched in-house version of FR 0.8.1 to the release version 1.0.5 (which currently has almost all the hacks we needed, and we decided to do without the single one that it doesn't). All configuration files are the same with the exception that we're using the new dictionary. We also use the MegaPOP visp dialup thingy, where users dial into a MegaPOP number as "Login(a)ourdomain.com" and get proxied to our radius servers for authentication. The problem is that with FR 0.8.1, our custom Radius attributes were getting sent back to the proxy and applied to the user. As soon as we implemented 1.0.5, this does not happen and all users are assigned a generic PPP profile regardless of what we have for them here. I would have just bugged the MegaPOP folks (and, indeed, I've done so and now I'm waiting on an email from them to see if they have any ideas), but since it's pretty clearly something that changed between 0.8.1 and 1.0.5, I thought I'd see if anyone here could point me in the right direction. Anyway, any ideas or pointers to docs/code appreciated. Thanks! Kristina

2 3

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 14 Nov '05

14 Nov '05

Mark, You are now able to pass authorization strings to the Netscreen successfully? Are you still using the formats <(NS-Admin-Privilege = "Read-Only-Admin") (NS-Admin-Privilege = "Read-Write-Admin")>? For some reason, all of my authentications fail once I enable remote authorization on the Netscreen. If you have a chance, please post your configuration. Thanks. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Mark Tunnell Sent: Friday, November 04, 2005 4:32 PM To: FreeRadius users mailing list Subject: Re: Newbie question re. dictionary files. I got it! It turns out that not all the dictionary files in /usr/local/share/freeradius directory are included by default. Once I added "$INCLUDE dictionary.netscreen" to the /usr/local/share/freeradius/dictionary file, everything started working. Thanks to everyone who responded, Mark - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

pb w/ accounting: wrong username (anonymous) used
by Markus Krause 14 Nov '05

14 Nov '05

hi all! my setup: radius server: freeradius v.1.0.5 on sles 9, user db in mysql clients: windows xp sp2 intel pro 2200bg * using intel pro/wireless software * using secure w2 user can connect via a foundry ironpoint 200, but accounting does not work as the username used as entry in the mysql table radacct is always "anonymous"! the table radpostauth does contain entries from both "anonymous" and "user1". how can i fix this? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4

Re: Free Radius and Mobile IP
by jbarnell 14 Nov '05

14 Nov '05

This is a good string to start. We are likely to commit to MobileIP in the near future. I would like to better understand how to implement in a freereadius environment ---------- Original Message ---------------------------------- From: "Stefan A." <lists(a)saitc.de> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Date: Mon, 14 Nov 2005 08:55:16 +0100 >All, > >is Mobile IP a Subject for Freeradius? >Has anybody a running Mobile IP environment to talk about the configuration >of the RADIUS server and possibly about other topics of Mobile IP? > > >Thanks. > >Stefan > > > > > ________________________________________________________________ Sent via the WebMail system at barnellts.com

1 0

memory leaks with rlm_perl? (FreeRADIUS bug #221)
by Bjørn Mork 14 Nov '05

14 Nov '05

Hello, I wonder if you were able to resolve this bug? ref http://bugs.freeradius.org/show_bug.cgi?id=221 The reason I ask is that I've just experienced a serious memory leak after upgrading from 1.0.1 to 1.0.5, and we do use rlm_perl so that is one module to suspect. It seems that a colleague of mine has had the same experience previously too, trying to upgrade to 1.0.4. We don't really _know_ that rlm_perl is the cause, though... I will attempt to track the bug down further and provide a test configuration that will demonstrate the problem. Just wondered if you had some ideas we might test first. FWIW, we've been running 1.0.5 on a test server for a couple of months without trouble at all. The problems first showed up when upgrading the heavily loaded production servers. Our configuration was not changed at all on upgrade. I will eventually provide it to aid recreating the bug, but I need som time first to remove all private data from it. Sorry about that. Feel free to ignore me until I've been able to do this work. Just wanted to give an early warning in case someone has the magic solution at hand. Bjørn

3 3

RE: Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 14 Nov '05

14 Nov '05

Garrett's hint : https://list.xs4all.nl/pipermail/freeradius-users/2005-November/048278.html solved this problem ... I've used: CLFAGS="-I../include -I/usr/sfw/include/openssl" ./configure --prefix=/usr/local/freeradius --localstatedir=/var/ --sysconfdir=/etc and "make && make install" finished successfully. great thanks reiko

1 0