- Freeradius-Users - lists.freeradius.org

concurrent TTLS and PEAP usage
by Artur Hecker 31 Aug '05

31 Aug '05

hi we have a Wifi 802.1X network with both TTLS and PEAP users (TTLS/PAP mostly for non-windows machines, PEAP/MSCHAPv2 for windows machines). (we also have TLS users, but that's out of scope). both work like a charm. however, we'd like to prevent PEAP accounts to log in with TTLS and vice-versa (that's a pure policy decision - one user profile should specify exactly one auth method). this works mainly because we store clear text passwords for both MSCHAPv2 and PAP. assuming e.g. two users user_peap with PEAP/MS-CHAPv2 and user_ttls with TTLS/CHAP, we would like to modify the profile of the user user_peap so he can't change the exterior method to TTLS/PAP and vs. note that we don't necessarily use exterior names (since e.g. MS Windows machines do not permit to specify an alternative user name for the exterior EAP tunnel). we naively try to specify EAP-Type == PEAP for user_peap and == TTLS for user_ttls but that breaks both methods (which seems normal since this EAP-Type definition is not correct for the internal EAP method which however uses the same user name). i thought about specifying tunneled attributes as check items. it turns out that FR does not show them in the log and I believe that these are not the same for the PEAP and TTLS anyway. thus the question to the list: how can I specify an "PEAP/MS-CHAPv2 only" user profile? how can i specify a "TTLS/PAP only" user profile? thanks artur

3 5

FreeRadius different authorization and authentication methods
by Jason Carr 31 Aug '05

31 Aug '05

Hello, I'm attempting to use a FreeRadius server for authentication of wireless using 802.1x. I would also like to use a SQL database for authorization. I've done some limited testing without success. It looks like the authorization method also is the authentication method, for example if I use sql for the authorization and eap for the authentication, the authentication request fails: modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Even though the config file states: ... authorize { preprocess sql } authenticate { eap } ... Any assistance would be greatly appreciated. -- Jason Carr Carnegie Mellon University Network Development

2 6

using AND logic instead of OR logic with authorization?
by Michael Hare 31 Aug '05

31 Aug '05

Hello- I'd like to authorize users based on their Calling-Station-Id via a local users file and authenticate/authorize (simple access allowed flag) via an ldap server. The reason I need to double authorize is because I do not have rights to add/edit any data in the remote ldap server. I need the authorization to essentially be an "AND" (ie, I need both authorizations to return true in order to accept the user). Is this possible? I've tried doing this within a single radius instance, and I've also tried having the ldap interaction happen via a radius proxy without success. Here is my users file DEFAULT Calling-Station-Id =~ "^144\.92\." Service-Type = NAS-Prompt-User Here is what a debug looks like rad_recv: Access-Request packet from host 144.92.44.114:4447, id=30, length=123 User-Name = "mdhare" User-Password = "mypass" NAS-Port = 2905 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: No '@' in User-Name = "mdhare", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 it as at this point I'd like authorization to stop, but it continues. What am I doing wrong? modcall: group authorize returns updated for request 0 Sending Access-Request of id 0 to 144.92.254.243:1812 ... ... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=30 Service-Type = NAS-Prompt-User Proxy-State = 0x3330 I'd be happy to provide configuration and output that I have now for testing, but there's no sense in being verbose if this isn't possible in general. Thanks- -Michael -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188

1 0

krb5 documentation
by Joachim Selke 31 Aug '05

31 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I want to do user authentication by Kerberos 5. Therefore I was happy to see that FreeRADIUS contains the krb5 module. But I wasn't able to find the documentation for this module. Can somebody give me a link or an example on how to use this module? Thanks, Joachim - -- B. Sc. Joachim Selke Universität Hannover, Fachgebiet Theoretische Informatik Appelstraße 4, 30167 Hannover, Germany Web: <http://www.thi.uni-hannover.de/> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDFbdiq7fYj4TsIUwRAlgaAKC0ES/ZQodcsti6rVH17bSGHP3hRgCgt9Ji a3CQ0y4yfff4Wc8LW/W0kxg= =fUZH -----END PGP SIGNATURE-----

2 1

GPL
by Velikanov 31 Aug '05

31 Aug '05

I told my colleagues about the advantages of FREERADIUS+ORACLE. BUT, they say, that it is GPL violation. IS that true? Thanks.

2 1

Re: Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

MS-CHAP-Use-NTLM-Auth = No
by Jamie Crawford 31 Aug '05

31 Aug '05

Hi, I'm trying to have a local user in my users file called "guest" password "guest". If the user is not "guest" forward on the user to domain authentication. I'm having trouble when authenticating "guest" when it comes to the mchap authentication, although I have the "MS-CHAP-Use-NTLM-Auth = No", it still runs the ntlm_auth command against my domain controllers, which I don't have a "guest" account, and I don't want a "guest" account on my dc's, so it automatically rejects because I dont have a "guest" account on my domain. If I comment out the ntlm_auth command in radiusd.conf, it works fine, but of course my domain authentication doesn't work now. Any help is appreciated!!! Thanks, jamie guest User-Password == "guest", MS-CHAP-Use-NTLM-Auth = No, Filter-Id =Filter-Id =enterasys:version=1:policy=guest_basic" DEFAULT Auth-Type = System Filter-Id = "enterasys:version=1:policy=faculty_staff", Fall-Through = 1 Redhat AS4 Freeradius 1.0.4 Supplicants XP SP1,SP2 PEAP NT4 DOMAINS Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

1 0

Multiple VSA pairs
by Peter Hicks 31 Aug '05

31 Aug '05

Hello I'm using FreeRADIUS with MySQL for accounting and authentication. >From a Cisco 2651XM router, I have multiple Cisco-AVPair attributes send in accounting packets: rad_recv: Accounting-Request packet from host 192.168.167.14:1646, id=186, length=201 Acct-Session-Id = "00009E13" Cisco-AVPair = "isakmp-group-id=cg-ectvpn" Framed-IP-Address = 172.16.33.119 Cisco-AVPair = "isakmp-initator-ip=82.104.97.16" User-Name = "pwh" Cisco-AVPair = "connect-progress=Auth Open" Acct-Authentic = RADIUS Acct-Status-Type = Start Cisco-NAS-Port = "FastEthernet0/1" NAS-Port = 1 NAS-IP-Address = 192.168.167.14 Acct-Delay-Time = 0 When trying to refer to these in a SQL INSERT statement for accounting (where if the AVPair is 'isakmp-initiator-ip', it gets stripped and the address inserted), the AVPairs overwrite each other. Is there a workaround for this, or is the behaviour of a Cisco IOS router 'broken' for sending the same attribute twice in the same packet? Best wishes, Peter.

2 1

hi
by shruti kukkar 31 Aug '05

31 Aug '05

Hi all I am new to the freeRadius and wish to study the code of the server. Please tell me abt the code structure so as to be able to study and understand the code properly. Thanks Shruti --------------------------------- Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE! http://in.mail.yahoo.com

3 3

Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

All, I am using freeradiusd 1.0.4 on RedHat Linux 9 and have just run the digest test suggested in the doc area through radclient. As it stands, I receive a code 3 reply (Access-Reject). The instruction for the test tells me to do the following: 1. In the /etc/raddb/users file insert entry as below :- test Auth-Type := Digest, User-Password = "test" Reply-Message = "Hello, test with Digest" 2. Initiate radclient with a file called digest (i.e. radclient -f digest localhost auth testing123) User-Name = "test", Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7", Digest-Realm = "testrealm", Digest-Nonce = "1234abcd", Digest-Method = "INVITE", Digest-URI = "sip:5555551212@example.com", Digest-Algorithm = "MD5", Digest-User-Name = "test" The command line holds the shared secret as defined in clients.conf file. However for this test to work, I had to insert a User-Password = "xxxx" (where xxxx is the actual password), into the digest file. After this I get a code 2 reply (Access-Accept). A radiusd -X dump shows freerad trying to do a unix authentication via the rlm_unix module. I've tried to comment out any instances of unix authentication from the radiusd.conf file but with the same results. Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1