- Freeradius-Users - lists.freeradius.org

Newbie question re. dictionary files.
by Mark Tunnell 04 Nov '05

04 Nov '05

I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a NetScreen5. I'm able to authenticate accounts just fine. Now I'd like to begin pulling administrative privileges from the Radius server, but I haven't figured out how to do that. I've referenced the dictionary.netscreen file in my clients.conf file, nastype = netscreen, but I'm embarrassed to say I can't figure out the format for including the dictionary attributes for a user in my users file. I've tried various permutations like: markt Auth-Type := Local, User=Password == "testing" NS-Admin-Privilege = "Read-Only-Admin" and: markt Auth-Type := Local, User=Password == "testing" Netscreen-NS-Admin-Privilege = "Read-Only-Admin" Nothing's working. Can some one show me the correct syntax? Thank you, Mark

2 5

regexp and Group
by pepe lopez 04 Nov '05

04 Nov '05

Hi! I am using the 1.0.5 freeradius version. radiusd -v radiusd: FreeRADIUS Version 1.0.5, for host , built on Nov 1 2005 at 16:22:00 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I am trying to use regular expressions with the Group attribute, but its not working the way I expected. This is how my users file looks like: DEFAULT Auth-Type := Accept Fall-Through = Yes DEFAULT Group =~ "^test.*" Reply-Message = "%{0}", Fall-Through = No DEFAULT Huntgroup-Name == "as_totalcontrol" Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.255, Framed-IP-Address = 255.255.255.254, Framed-Routing = None, Framed-MTU = 1500, Reply-Message = "as_totalcontrol", Framed-Compression = Van-Jacobson-TCP-IP, Fall-Through = No First I tried a radtest with user test which belongs to group test groups test1 test1 : test_group_2 radtest -d /etc/raddb/ test1 test1 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 86 to 172.20.0.88:1812 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=86, length=27 Reply-Message = "test1" I ran freeradius in debug mode (radiusd X) This is the output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=86, length=63 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user test1 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 123 radius_xlat: 'test1' modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'test1' Sending Access-Accept of id 86 to 172.20.0.88:34613 Reply-Message = "test1" Finished request 1 Going to the next request Then I tried this: groups paraprueba paraprueba : test radtest -d /etc/raddb/ paraprueba parapeuba 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 98 to 172.20.0.88:1812 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=98, length=79 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP This is radiusd output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=98, length=68 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "paraprueba", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user paraprueba to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 147 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'as_totalcontrol' Sending Access-Accept of id 98 to 172.20.0.88:34613 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP Finished request 2 It seems as if the regular expression was matching the UserName attribute instead of the Group attribute. I also tried using regular expressions with the User-Name attribute and they worked as expected. Is it possible to use regular expressions with Group? And if it is so what am I doing wrong? Thanks in advance. Kind regards --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click. --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 1

how to use ntlm_auth
by mlopez＠uabc.mx 03 Nov '05

03 Nov '05

>> I have configured freeradius+ldap+802.1X for a wireless lan, but i >> can't get it to work because of mschap, and i dont have windows domain. > Then why the heck are you using ntlm_auth? It's only purpose is to >do MSCHAP authentication to a Windows domain controller. Because the configuration for 802.1X, using the 802.1X howto and http://vuksan.com/linux/dot1x/802-1x-LDAP.html, said that needs to configure peap and peap use mschap (....mmmm {thinking} but don't said nothing about ntlm) how the mschap module can perform authentication itself?? or how can i use 802.1X/peap and ldap ??? can i use it??? thank you in advance Manuel Lopez

3 2

Question about logging
by Lisa Casey 03 Nov '05

03 Nov '05

Hi Folks, You'll probably think this question is a bit nuts. With FreeRadius 1.01 on FreeBSD 5.3, is there any way of logging all authentication requests to radius.log EXCEPT requests from a particular username? Or alternatively, log all authentication requests EXCEPT those from a particular client (this would solve the same problem I have). I don't think this can be done, but you folks know a lot more about this than I do! Thanks, Lisa Casey -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.12.7/160 - Release Date: 11/3/2005

2 1

RE: expiration
by Serge Lhermitte 03 Nov '05

03 Nov '05

Thanks a lot. After some more troubleshooting, it appears it is not the release_1_0 which is having a problem but rather the fact that I was trying to compile it on a 64 bits machine. I'll work it out. About the Expiration being handled by the server core, I'll double check this as well. Cheers. S. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: jeudi 3 novembre 2005 10:56 To: FreeRadius users mailing list Subject: Re: expiration Serge Lhermitte wrote: > I am trying to get a working version of freeradius that includes the > expiration module. It seems this module doesn't exist in 1.0.x versions. I think the check item "Expiration" is handle by the server core (in auth.c), therefore you don't need a module. If you get version 1.0.5, it should work. > I actually succeeded a while ago, getting the following CVS > > $ cvs -d :pserver:[EMAIL PROTECTED]:/source checkout -r release_1_0 radiusd That's strange: the module rlm_expiration doesn't exist in this branch of the CVS. > However, it has not been compiling any longer for a couple of weeks now > and unfortunately, I didn't keep the sources at that time. There're only bugfixes in branch "release_1_0", and there's currently no known problems. Please detail your setup and post error messages. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using counters or Password-Retry attribute (RFC2869)
by Martin.Ward＠uk.neceur.com 03 Nov '05

03 Nov '05

Hi all, I am having another go at trying to implement a "maximum login attempts" using FreeRadius. >From what I can glean from the documentation and files I (currently) have two choices: 1. Use the Password-Retry attribute as per RFC2869. This attribute is used in Access-Reject packets (according to my O'Reilly book) and as I understand it is simply a number that is set in the Radius server which states how many times a user is allowed to attempt to login before they are locked out. The lock-out function is done by the FreeRadius client and clearly this client must understand and utilise the Password-Retry attribute for it to have any effect. I have no idea if my Radius client uses this attribute or not since I can't find a sensible place to store the attribute, at least I've tried it in various places and none of them work but this may simply be due to the fact that the client just ignores this attribute. 2. Use the counter module. While this might not be the way the modules was intended for use I have been thinking I could have it count the number of password failure attempts and when that value reaches a limit, say 3, the FreeRadius system rejects logins for that ID from then onwards. Investigating this option shows that I am missing a number of things: a. The counter should only be incremented when a password attempt fails. b. Ideally the counter should reset when the user logs in correctly, but it would be acceptable for the counter to be reset once a week or once a day or something like that. I know I can reset the counter at a given time ('reset' attribute of the counter module) but resetting it at a successful login would be best. So I guess I ma asking three questions. 1. Where should I put the Password-Retry attribute in the FreeRadius config files so that I can prove or disprove that the Radius client is using this attribute. 2a. How do I use the counter module to increment a counter only on Access-Reject? 2b. Can I reset the counter value on Access-Accept? Thanks fellows, |\/|artin -- Senior Network Consultant, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

1 0

expiration
by Serge Lhermitte 03 Nov '05

03 Nov '05

Hi, I am trying to get a working version of freeradius that includes the expiration module. I actually succeeded a while ago, getting the following CVS $ cvs -d :pserver:[EMAIL PROTECTED]:/source checkout -r release_1_0 radiusd However, it has not been compiling any longer for a couple of weeks now and unfortunately, I didn't keep the sources at that time. Thanks SL.

2 1

802.1x
by Alex M 02 Nov '05

02 Nov '05

What is the difference between plain Radius identification compare to 802.1x? What are additional functionality that 802.1x gives to radius? Thanks!

4 9

RE: 802.1x
by Seferovic Edvin 02 Nov '05

02 Nov '05

I hate quoting but "IEEE 802.1X is an IEEE standard for port-based network access control, part of the IEEE 802 (802.1) group of protocols. It provides authentication to devices attached to a LAN port, establishing a point-to-point connection or preventing access from that port if authentication fails. It is used for certain closed wireless access points, and is based on the EAP, Extensible Authentication Protocol (RFC 2284). RFC 2284 has been obsoleted by RFC 3748" Says it is a standard for port-based network access control, and as far as I know - is has nothing to do with PORTS on a user machine. by "port-based" it is not meant the port on a user machine, but the ports on an access hardware like a switch. I hope I could help you out of dilemma ! Regards, Edvin -----Original Message----- From: Alex M [mailto:alexm@lrcommunications.net] Sent: Mittwoch, 02. November 2005 23:07 To: edvin.seferovic(a)kolp.at; 'FreeRadius users mailing list' Subject: RE: 802.1x Wikipedia well, can it show me how to block ports like port 88 on user side? Yea I should learn how to use goggle he he.... -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Wednesday, November 02, 2005 4:42 PM To: 'FreeRadius users mailing list' Subject: RE: 802.1x Maybe you should learn how to do a research with google ;) or just use an encyclopedia... http://en.wikipedia.org/wiki/802.1x have fun ! Regards, Edvin -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: Mittwoch, 02. November 2005 22:34 To: 'FreeRadius users mailing list' Subject: RE: 802.1x That what I started with... but it returns me all very very expansive enterprise equipment, and other junk... well I maybe I'm using wrong keyword but goggle doesn't give me anything I'm looking for -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Oliver Graf Sent: Wednesday, November 02, 2005 4:14 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: 802.1x On Wed, Nov 02, 2005 at 11:10:20AM -0500, Alex M wrote: > Now im totally lost... > Can u give me an example what 802.1x does? Can u use google? Oliver. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: 802.1x
by Jeff Reilly 02 Nov '05

02 Nov '05

2 1