- Freeradius-Users - lists.freeradius.org

radius timeout
by Callis 09 Sep '05

09 Sep '05

Hi all I have freeradius-1.0.1-1 (with Petr Nixon's patch) running on FC-3 and using a postgresql backend to collect cisco AAA (stop only) records. My cisco IOS is 12.3(2)T2. I see a lot of radius timeout on my cisco router while the ping times is < 10ms and my radius timeout is set to 50. I even went further to connect the radius server and the router back to back with a cross cable and still have some timeouts. What could be wrong with my configs? Any help will be appreciated. Thank you.

3 3

Need to conditionally update user data in authentication process (mysql) - Clues?
by Mark Elkins 09 Sep '05

09 Sep '05

Hi I need to conditionally update some user data whilst in the authentication process - I'm looking for clues as how to do this. Background: I'm providing vouchers with a username and password on them. The first time the voucher details are used - I need to update that users details (change their group, add an expiry date - etc). All my users are in groups and its only users in a particular group that I want this to happen too... Everything is in MySQL. Sort of... pre_authorize_check = "UPDATE useracct SET groupname='newgroup', expireaccount='now() + 30 days' IF (SELECT groupname FROM useracct WHERE Username='%{Stripped-User-Name}' AND realm='%{Realm}' ) == 'voucher_group'; ie - If the person trying to login is a member of my 'voucher_group', make some changes to their SQL details first.... then authenticate them as normal... How would I do something like this? This process would only ever happen once to a user in the lifetime of their account, unlike repetitively logging in and using the service afterwards. ps - I also want to send them some welcoming e-mail at the same time and as their username@realm is actually their e-mail address .. the address is easy...but the process of doing so? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

About update of CRL
by Kouji Amemiya 09 Sep '05

09 Sep '05

Hi, all! I use FreeRADIUS-1.0.4 and OpenSSL on cygwin in Windows XP for EAP-TLS. I want to ask a question about the specification of FreeRADIUS. If CRL is updated, FreeRADIUS should be rebooted? When CRL was updated, I executed "c_rehash" command only. But the new CRL's information was not updated for FreeRADIUS. Or is there any other method? Please help me. Best regards, amemiya

1 0

listuser@peternixon.net
by Lee Bobby 09 Sep '05

09 Sep '05

thank u for your reply.I have resolved this problem. you are right.FreeRADIUS can't find the oracle library. by the way,are you familair with OID.w wanna keep in touch with u. my msn:bjldlee@hotmail.com bobby from beijing

1 0

Mixed-mode authentication enviornment
by Daniel Corbe 08 Sep '05

08 Sep '05

Hello, I have a FreeRADIUS server authenticating against an LDAP back-end. Some of my applications (such as my SIP proxy server) currently require DIGEST-MD5 authentication and others (such as my E-Mail server, and my Cisco routers) do not. Ideally I'd like everything to work harmoneously. Since the SIP server requires DIGEST authentication, the Auth-Type attribute is present and it is set to DIGEST which forces FreeRADIUS to attempt a digest authentication. Once this fails an Access-Reject packet is sent back to the RADIUS client Is there a way to configure FreeRADIUS so it first attempts a DIGEST authentication, and when that fails, we go ahead and attempt normal authentication? Thanks. -Daniel

2 15

RE: one question
by Guy Davies 08 Sep '05

08 Sep '05

Hi Richie, Simply look in the /usr/local/share/freeradius/dictionary file. It includes a load of $INCLUDE lines pointing to each of the dictionary.foo files. All you need to do is add $INCLUDE dictionary.fortinet to that file and make sure that the file dictionary.fortinet is in the correct format and is located in the same directory. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Richie Lee Sent: Thu 09/08/05 7:58 PM To: freeradius-users(a)lists.freeradius.org Subject: one question My company is a security vendor company(www.fortinet.com). How to add dictionary.fortinet to the server's list of vendor dictionaries in later freeradius version? Does anyone know it? _________________________________________________________________ Designer Mail isn't just fun to send, it's fun to receive. Use special stationery, fonts and colors. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by Guy Davies 08 Sep '05

08 Sep '05

Here my doubt: I am using EAP-TLS I generated a client Certificate with CN "redes" then I add at LDAP database a user with these atributes cn: redes uid: redes radiusGroupName: academicos ..others Attributes but without userpassword and in the users file i add: DEFAULT Ldap-Group == academicos, Simultaneous-Use := 1 Aruba-User-Role = "STAFF", A user with client certificate can access at Wireless network and get the Role STAFF perfectly, but the process of authentication and authorization seems like very very redundant, is normal that?. I attach the file of process auth. [GD] Hi Alfonso, The authentication and authorization are different things. Authentication is asking may this user connect. Authorization is asking once this user has connected (i.e. Authentication has passed) what may they do (e.g. what type of user are they [student/staff], what VLAN should they be associated with, what is their access level [e.g. on Cisco routers = 1 to 15]) That allows you to provide more than a simple yes/no answer to the request to login. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

need somehelp plz
by kdr akm 08 Sep '05

08 Sep '05

hi all i.am new in radius system and i need help to make auth by mac address for my users and thanks --------------------------------- Click here to donate to the Hurricane Katrina relief effort.

1 0

RE: Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by Guy Davies 08 Sep '05

08 Sep '05

Hi Alfonso, See inline... >-----Original Message----- >We decide to use freeRADIUS as Radius Server on a Big >wireless Network (in a university ) >with about five hundred APs, but there are some >questions (maybe basic questions) >I need from your help to understand them better. > >1. About certificates >In the first stage we will use EAP-PEAP authentication >with Primary and backup Radius Servers. >I think to do next: >At the Primary Server, I will generate the root, >Primary Server and Backup Server certificates, > then I will copy the root and Backup Server >certificates to Backup server, That's correct?. >or I have to generate one more time the root and >backup server certificates >in the backup server. No, you don't need another root. I'd normally run the CA (root) on a different (highly secured) box but that's not mandatory. You really only need one (well backed up) root server. You also need to distribute the root cert to all the clients. They will use the root cert (used to sign the RADIUS servers' certs) to authenticate the RADIUS servers. If the root cert has been signed by a global root CA, then the clients only need the certificate from the global root CA. >2. At the second stage we will implement a PKI and >we'll use EAP-TLS and my doubt is about > LDAP data base and simultaneous-use, for example >with EAP-PEAP I add the next lines to users file : > >....... >DEFAULT Ldap-Group == group1, Simultaneous-Use >:= 1 > Aruba-User-Role = "ESTUDIANTE", > >DEFAULT Ldap-Group == group2, Simultaneous-Use >:= 1 > Aruba-User-Role = "PROFESORES", >DEFAULT .... >..... > >And work perfectly, But what happen if we use EAP-TLS >--> client certificates, exists any way to obtain the >same results? If you are providing each client with a certificate signed by your CA and the RADIUS servers both have the certificate of the root CA, then they'll be able to authenticate the clients based on the signature of the root CA. LDAP is used for authorization anyway so you'll use that independently based on the username in the certificate CN. >,if it is affirmative, how can I do it (some >references, howto's) >!!because when I use EAP-TLS I don't need to add >nothing at users file nor in LDAP data base!!. You can add authorization in the LDAP database. It is not used (by EAP-TLS or PEAP/MS-CHAPv2) for authentication. Note, if you're using PEAP/MS-CHAPv2 and LDAP and you want to store the password in the LDAP database, it *must* be in plain text. > >3. Finaly exists some advantages If I use Solaris >instead a Normal PC with Linux(Debian). Hardware and OS support, maybe. There are certainly PCs out there that can match a (probably much more expensive) Solaris box for performance. You'll need to ensure that you've got GCC compiled for your Solaris box (AFAIK, it's not supplied in the base OS) so it's a bit of a pain to get going. In that respect, a good Linux or BSD distribution on a high spec server PC may be the better bet. >Your help will be very important for me!! >Thanks in advance > >NOTE: simultaneous-use work perfectly with some NAS, >with ARUBA NAS don't do it, but I thing need some >little changes in the checkrad.pl script. > >Alfonso Celestino >DGSCA,UNAM > > >__________________________________________________ >Correo Yahoo! >Espacio para todos tus mensajes, antivirus y antispam ¡gratis! >Regístrate ya - http://correo.yahoo.com.mx/ >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Digest test
by Iandc Davies 08 Sep '05

08 Sep '05

All, Have run the test as suggested in the doc/rlm_digest file and have got an odd output message from freeradius saying it can't find the Digest-Nonce element. In the radiusd.conf file I'm authenticating but not authorizing digest. Users file has the following: #--- test Auth-Type := Digest, User-Password := "test" Reply-Message = "Hello, reply with digest." #--- Any ideas ? I've enabled debug on radclient with the following output. ================================================== ./client.sh Sending Access-Request of id 178 to 127.0.0.1:1812 User-Name = "test" Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7" Digest-Realm = "\001\013testrealm" Digest-Nonce = "\002\n1234abcd" Digest-Method = "\003\010INVITE" Digest-URI = "\004\034sip:5555551212@example.com" Digest-Algorithm = "\006\005MD5" Digest-User-Name = "\n\006test" rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=178, length=47 Reply-Message = "Hello, reply with digest." Total approved auths: 0 Total denied auths: 1 Total lost auths: 0 ================================================ Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32943, id=178, length=140 User-Name = "test" Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7" Digest-Attributes = 0x010b746573747265616c6d Digest-Attributes = 0x020a3132333461626364 Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x041c7369703a35353535353531323132406578616d706c652e636f6d Digest-Attributes = 0x06054d4435 Digest-Attributes = 0x0a0674657374 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 19 modcall[authorize]: module "files" returns ok for request 0 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 ERROR: No Digest-Nonce: Cannot perform Digest authentication modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 178 to 127.0.0.1:32943 Reply-Message = "Hello, reply with digest." Waking up in 4 seconds... ===================================================================== Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1