- Freeradius-Users - lists.freeradius.org

RE: Walled Garden for Users Without Realms.
by Alexander C. Fossa 19 Sep '05

19 Sep '05

Hi James, Exactly what I have been trying to do for about 6 months, but keep getting distracted by doing something else. What software do you use for the wildcard DNS? Any example configs? Regards, Alexander Fossa -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of McCain, Al Sent: 19 September 2005 14:26 To: FreeRadius users mailing list Subject: RE: Walled Garden for Users Without Realms. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of James Wakefield (Sunet Sysadmin) Sent: Sunday, September 18, 2005 6:27 PM To: FreeRadius users mailing list Subject: Re: Walled Garden for Users Without Realms. G'day Al, We're doing the same thing here changing a dial-up number and migrating off of the NASes that serve that number. My approach is: * Match customers who need to be placed in the walled garden, this is easy enough for our situation, as they're in the huntgroup comprised of the old NASes. I could also match Called-Station-Id if I wanted. * Send specific attributes for those users, giving them a short session timeout (say 5, 10 minutes) which, if they fail to see or heed our message, will motivate them to call helpdesk and get sorted out, and also setting their primary DNS server to one which resolves every hostname to one of your IP addresses using a wildcard zone or some such. If this DNS server is already providing other services, you'll want to use a view for walled garden users, which you may need to facilitate by putting them into a specific subnet. What attribtues you use, exactly, will depend on your NAS gear. * On that IP address that you're resolving * to, is a webserver which displays the message you wish the walled garden users to read. If this webserver already serves other pages, you'll need to do some URL rewriting to send them to the appropriate page eg: using Apache's mod_rewrite. This way, any request for a web page will display your message. Personally, I find the easiest approach is to just dust off a box that's not being used and put the wildcard DNS and webserver on it - it's only got a couple of very simple functions to perform and it's not a critical service. You may also want to consider applying packet filtering to walled garden users as they'll still be able to reach the entire Internet by IP address, though the session timeouts make that only a moderate concern in our situation. You could also do a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. McCain, Al wrote: >Hi. > >I was wondering if there was a way to place users in a Walled Garden if >they try to Auth without a Realm. >We are currently running FreeRADIUS Version 0.9.3. Our users are stored >in MySQL. > >Company: >I work for an ISP. We seem to aquire new properties every few months. > >Current structure : > >We have multiple instances of RADIUS running: one for each domain. (I >have NO clue who set it up this way). > >I would like to consolidate these intances into one, and force our >users to use realms. > >Problem: > >We can't just force the customers to use realms. We would need to >notify them of the changes. (This can prove tricky). > >What I would like to see: > >Aside from contacting the customer about changes, I would like to send >the users to a web page after they log in without a realm. The page >would tell them that they need to log in with realms. I believe this >is called hURL'ing, however I cannot seem to find any documentation. > >Has anyone ever done this, or know if it can be done ? > >Any help is greatly appreciated. > >Thanks, >Al > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Very good idea James. I will test that out. -Al - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

PAM, Postgres, Freeradius
by Mark Olliver 19 Sep '05

19 Sep '05

Hi All, I am looking at using a postgres database as the backend storage system for freeradius and I think I have this part configured correctly. Does anyone have any scripts for creating simple user a/c's into the database? The second more important thing is that I want to use PAM to authenticate against the freeradius server. This is because I have many different servers and need to keep a consistent list of users on all systems. This I can do by replicating the postgres database, however I can not directly (safely to my knowledge) do this with out going via pam. Can anybody who has this working please give me an example of how they did this and what there pam.d files look like now. Thanks Mark Mark Olliver BSc (Hons) MBCS Thermeon Europe Ltd e-Card www.thermeoneurope.com/e-Card/mpo Email mpo(a)thermeoneurope.com Web www.thermeoneurope.com Support 0906 515 0908 Int. Support +44 1293 864 341 Support Email support(a)thermeoneurope.com Support Site www.thermeoneurope.com/rt Sales +44 1293 864 334 Sales Email sales(a)thermeoneurope.com

2 1

Re: PAP and clear text
by Stefan.Neis＠t-online.de 19 Sep '05

19 Sep '05

Hi, > You must have missed the information in RFC 2865 (RADIUS), which is also > a Fine Manual. The PAP password is XOR'd with the MD5 hash of the > shared secret and the authenticator. Yes, that's a bit clearer than saying "the password is hashed", since it also shows that the process is reversible and you can easily obtain the cleartext password from the "obfuscated" password. > You've been reading about the protocol prior to the RADIUS client's > involvment. The same thing applies to CHAP, just to head you off. No, not quite. Here, the password is (essentially) used as a key to compute the hash value of a challenge. Most notably, this means you (or the server) have no way whatsoever to get back to the clear text password from what is transmitted to the server. Regards, Stefan

2 1

NAS Specific Attributes
by Jonathan De Graeve 19 Sep '05

19 Sep '05

Hello, I'm searching a way to sent specific attributes to certain nas devices. I'm already using huntgroups in combination with an mysql backend for user and accounting storage and accept or deny user access based on the SQL group the user is in and which Huntgroup the calling nas matches. Group IT has HuntgroupName ~= ^(vpn|ras)$ I want to give VPN Nasses extra attributes like CES-Group and Session-Timeout Any idea's on how to do this? J. --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

1 0

RE: Walled Garden for Users Without Realms.
by McCain, Al 19 Sep '05

19 Sep '05

-----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of James Wakefield (Sunet Sysadmin) Sent: Sunday, September 18, 2005 6:27 PM To: FreeRadius users mailing list Subject: Re: Walled Garden for Users Without Realms. G'day Al, We're doing the same thing here changing a dial-up number and migrating off of the NASes that serve that number. My approach is: * Match customers who need to be placed in the walled garden, this is easy enough for our situation, as they're in the huntgroup comprised of the old NASes. I could also match Called-Station-Id if I wanted. * Send specific attributes for those users, giving them a short session timeout (say 5, 10 minutes) which, if they fail to see or heed our message, will motivate them to call helpdesk and get sorted out, and also setting their primary DNS server to one which resolves every hostname to one of your IP addresses using a wildcard zone or some such. If this DNS server is already providing other services, you'll want to use a view for walled garden users, which you may need to facilitate by putting them into a specific subnet. What attribtues you use, exactly, will depend on your NAS gear. * On that IP address that you're resolving * to, is a webserver which displays the message you wish the walled garden users to read. If this webserver already serves other pages, you'll need to do some URL rewriting to send them to the appropriate page eg: using Apache's mod_rewrite. This way, any request for a web page will display your message. Personally, I find the easiest approach is to just dust off a box that's not being used and put the wildcard DNS and webserver on it - it's only got a couple of very simple functions to perform and it's not a critical service. You may also want to consider applying packet filtering to walled garden users as they'll still be able to reach the entire Internet by IP address, though the session timeouts make that only a moderate concern in our situation. You could also do a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. McCain, Al wrote: >Hi. > >I was wondering if there was a way to place users in a Walled Garden if >they try to Auth without a Realm. >We are currently running FreeRADIUS Version 0.9.3. Our users are stored >in MySQL. > >Company: >I work for an ISP. We seem to aquire new properties every few months. > >Current structure : > >We have multiple instances of RADIUS running: one for each domain. (I >have NO clue who set it up this way). > >I would like to consolidate these intances into one, and force our >users to use realms. > >Problem: > >We can't just force the customers to use realms. We would need to >notify them of the changes. (This can prove tricky). > >What I would like to see: > >Aside from contacting the customer about changes, I would like to send >the users to a web page after they log in without a realm. The page >would tell them that they need to log in with realms. I believe this >is called hURL'ing, however I cannot seem to find any documentation. > >Has anyone ever done this, or know if it can be done ? > >Any help is greatly appreciated. > >Thanks, >Al > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Very good idea James. I will test that out. -Al

1 0

Re: FreeRadius Proxying and Message-Authenticator
by Paolo Rotela 19 Sep '05

19 Sep '05

I wonder if it is correct to discard a packet based on the presence of an attribute witch use is not defined by any standard. I've read the "aboba-radext-fixes" and I see that FR is calculating Message-Authenticator in Accounting packets this way. But there is no RFC about it... RFC2869 describes how to handle incorrect or missing Message-Authenticator in Access-* packets, it doesn't say that you must discard an Accounting packet with invalid Message Authenticator, because as you say there is no standard about how to calculate it. I suggest at least a configuration option that can help to avoid this compatibility issue, giving the user the option of accepting or not "incorrect" MAs in Accounting. I'll try to find out the algorithm used by Cisco... If I happen to be successful, I'll post it. Thanks Date: Tue, 13 Sep 2005 17:57:05 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FreeRadius Proxying and Message-Authenticator To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050913215705.0B8CA170D2(a)mail.nitros9.org> "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> wrote: > Hi. I've downloaded FR 1.0.5 whch is supposed to have a bugfix for > Message-Authenticator handling in Accounting-* messages. The issue is that the suggested method of calculatin Message-Authenticator MAY NOT be the same as what Cisco's using. Because there's no standard, Cisco may be doing almost *anything*. > I'am missing something? If you can find out the algorithm used by Cisco, we may be able to update FreeRADIUS to handle it. Until then, there isn't much we can do. Ing. Paolo Rotela Jefe Técnico Blue Telecom

3 9

Re: Problems with oracle
by chabral - 19 Sep '05

19 Sep '05

Ilia, No, I were'nt doing that! That seems to have solved the problem. I'd not found that tip on the doucmentation. Now I'm having an invalid user oracle error, but I'll see it with the DBA. Thanks a lot, -- chabral Message: 8 Date: Sat, 17 Sep 2005 11:47:45 +0600 (YEKST) From: Ilia Chipitsine <ilia(a)paramon.ru> Subject: Re: Problems with oracle To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050917114703.M40140(a)office.paramon.ru> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed using oracle require setting enviroment variable ORACLE_HOME before you start radiusd, did You do that ? Cheers, Ilia Chipitsine >Hi, >I'm trying to use freeradius 1.0.1 with oracle 9i. I successfully (i think) >compiled freeradius with oracle support. I've the files: > >/usr/local/etc/raddb/oraclesql.conf >/usr/local/lib/rlm_sql_oracle-1.0.1.so >/usr/local/lib/rlm_sql_oracle.so >/usr/local/lib/rlm_sql_oracle.la >/usr/local/lib/rlm_sql_oracle.a > >The problem is when I start "radiusd -X" I see the lines: > >rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and >linked >rlm_sql (sql): Attempting to connect to > TR_RADIUS@oracle:1521/(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=oracle)(PORT=1521)))(CONNECT_DATA=(SID=TESTSID)(SERVER=DEDICATED))) >rlm_sql (sql): starting 0 >rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 >rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) >rlm_sql (sql): Failed to connect DB handle #0 >rlm_sql (sql): starting 1 >rlm_sql (sql): starting 2 >rlm_sql (sql): starting 3 >rlm_sql (sql): starting 4 >rlm_sql (sql): Failed to connect to any SQL server. >Module: Instantiated sql (sql) > >Any help? > >-- >chabral > > >- List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html >

1 0

Intel PEAP client "Roaming Identity"
by Ben Thompson 19 Sep '05

19 Sep '05

Hi We have a 802.1x/PEAP wireless network using freeRADIUS 1.0.1 on RedHat AS 4. It is important for us to know who is using the network at any given time so the accounting logs are very useful to us. The other day someone came along with a laptop using an Intel wireless adapter and client software. In the configuration settings for this program there was a place to enter a username and password for PEAP authentication and there was also a field named "Roaming Identity" which as default was set to "anonymous(a)myabc.com". The client conected up fine, but when I checked the RADIUS accounting logs I noticed that the username for that client was listed as anonymous(a)myabc.com instead of the one I expected. After a bit of googling in found this link on the Dell website which describes that the roaming identity is only required for MS RADIUS servers :- http://support.dell.com/support/edocs/network/P72721/en/UtilAdv.htm Could anyone advise me whether it is possible to configure my server so that the actual username used get's logged in the accounting records instead of this roaming identity string? Many Thanks Ben Thompson

3 3

How to get the server to respond with Access-Challenge ?
by Saravanan Ramaswamy 19 Sep '05

19 Sep '05

Hi, I would like to know how to make the RADIUS server (freeRADIUS 1.0.0-pre3) to send a challenge to the NAS. That is, instead of getting Access-Accept or Access-Reject, I want to see Access-Challenge. What do I need to set in the user's profile ? I tried looking thru the FAQ and some archives but could not find anything. RFC 2865 states that "if the server decides to send a challenge ..." - I want to know what makes the server to send the challenge. I am using the plain ascii/pap/chap/mschap kind of authentications. Any help appreciated. Thanks, Sarav __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

Walled Garden for Users Without Realms.
by McCain, Al 18 Sep '05

18 Sep '05

Hi. I was wondering if there was a way to place users in a Walled Garden if they try to Auth without a Realm. We are currently running FreeRADIUS Version 0.9.3. Our users are stored in MySQL. Company: I work for an ISP. We seem to aquire new properties every few months. Current structure : We have multiple instances of RADIUS running: one for each domain. (I have NO clue who set it up this way). I would like to consolidate these intances into one, and force our users to use realms. Problem: We can't just force the customers to use realms. We would need to notify them of the changes. (This can prove tricky). What I would like to see: Aside from contacting the customer about changes, I would like to send the users to a web page after they log in without a realm. The page would tell them that they need to log in with realms. I believe this is called hURL'ing, however I cannot seem to find any documentation. Has anyone ever done this, or know if it can be done ? Any help is greatly appreciated. Thanks, Al

2 1