- Freeradius-Users - lists.freeradius.org

Authorize with EAP-TLS, but use LDAP for authentication to check user's group membership
by Petar Marinkovic 03 Jan '17

03 Jan '17

I am quite a freeradius noob, so in advance, my apologies if this question of mine doesn't make too much sense. I have a mixed environment, mostly Windows users, but also Linux and Macs, and requirement is to implement a 802.1x wired authentication for DHCP clients, with dynamic VLAN assignment. As a first layer of security, I've implemented this solution https://wiki.freeradius.org/guide/mac-auth with both mac authentication (reading allowed MAC addresses) and then proceeding with EAP-TLS (with certificates issued from Windows Active Directory Certificate Services). I've created machine certificate for freeradius server (2.2, running on CentOS 6) in AD CS, converted that one and root CA, and set up everything per that solution, and I can successfully authenticate with any Windows or Linux client with allowed MAC and user having their certificate. Now, I would like to add LDAP, in order to check the user's group permissions, and to set up dynamic vlan assignment per group membership (if a HR person is member of "HR" group, put him in VLAN 10, for example). I have Juniper access switches, so this solution should work. But, I am seeking advice from you here guys on how to proceed. I've installed LDAP module, and configured my settings in /etc/raddb/modules/ldap but where should the configuration for this takes place? Currently, my /etc/raddb/sites-available/default config looks the same as on the link above, and I am not sure if I can use the username of authorized user (which is in form of username(a)domain.com from the Windows user certificate) with LDAP to check the groups of that authorized user and assign him the correct VLAN? I've googled around, but what I found didn't help me much, so any help is more than appreciated! I guess it's easier to switch to MAC and LDAP and bypass EAP-TLS, but since we're already issuing certificates to users (and they use those Windows AD certificates for other services as well), I would like to use them here as well for authorization with MAC addresses. Thanks in advance!

2 2

rlm_ldap not populating Stripped-User-Name
by Arnab Roy 03 Jan '17

03 Jan '17

Hi , Just wondering if one of you could help me with a strange issue that has suddenly appeared. Freeradius Version: 3.0.11 It looks like rlm_ldap has suddenly stopped picking up the Stripped-User-Name value, my config looks like bellow user { filter = "(samAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=domain,dc=com" access_positive = yes } All was working fine with this server for a while. The same filter is working fine in other modules like mschap and ntlm_auth. The exapnsion of the filter returns no value for the Stripped-User-Name parameter. Here is the grepd version of radiusd -X Any points where I could start looking would be much appreciated as to why it suddenly stopped. # Loaded module rlm_ldap # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "172.20.0.40" port = 389 identity = "bindaccount" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { scope = "base" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" cacheable_name = yes cacheable_dn = yes } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 chase_referrals = no rebind = no net_timeout = 10 res_timeout = 10 srv_timelimit = 1 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name}} --domain=%{%{mschap:NT-Domain}:-removed.com} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" passchange { } -- # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 10 spare = 20 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 30 spread = no } Do let me know if you would like to see some additional configuration files. Many Thanks Arnab

2 2

rlm_eap module
by Peter Balsianok 02 Jan '17

02 Jan '17

Hi, How can i prevent to compile rlm-eap module ? Thx.

2 3

HUNTGROUP WITH SQL
by Jose Quezada 31 Dec '16

31 Dec '16

Hi Everyone, I'd like your help. I'm working to link certain user to a NAS I made the radhuntgroup table (groupname, nasipaddress...) and the internal AVP sql-hubtgroup-name but I need the Unlang Code that work... Thank in advance

1 0

WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
by Narender Yadav 30 Dec '16

30 Dec '16

Hello Everyone, I am new to FreeRADIUS world and got stuck at one point. My setup: - FreeRADIUS server o Users mentioned in ‘/usr/local/etc/raddb/mods-config/files/authorize’ § test Cleartext-Password := "welcome" o clients mentioned in ‘/usr/local/etc/raddb/clients.conf’ § client x.x.x.x{ § secret=test § } § Where, x.x.x.x is the IP address of RADIUS client machine - RADIUS client o RADIUS server is defined in ‘/etc/raddb/server’ § y.y.y.y test 2 § where, y.y.y.y is the IP address of RADIUS server *we have one application server where RADIUS client is already built and its working fine with newly configured RADIUS server. The issue is with RADIUS client that I have setup.* when trying to login to RADIUS client machine using user ‘test’, I am getting below error in debug logs: I have checked again and shared secret is same on NAS and RADIUS server. -------------------------------------------------------------------------------------------------------------------------------------- (1) Received Access-Request Id 33 from x.x.x.x:44896 to 10.222.34.65:1812 length 90 (1) User-Name = "test" (1) User-Password = "\010\n\r\177INCORRECT" (1) NAS-IP-Address = 10.222.34.227 (1) NAS-Identifier = "sshd" (1) NAS-Port = 3874 (1) NAS-Port-Type = Virtual (1) Service-Type = Authenticate-Only (1) Calling-Station-Id = "115.113.149.70" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: ERROR: Cleartext password "? ?INCORRECT" does not match "known good" password (1) pap: Passwords don't match (1) [pap] = reject (1) } # Auth-Type PAP = reject (1) Failed to authenticate the user (1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 33 from 10.222.34.65:1812 to x.x.x.x:44896 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 33 with timestamp +132 Ready to process requests *Regards,* *Narender Yadav*

3 3

EAP-AKA , EAP-SIM configuartion
by Avichal Agarwal 30 Dec '16

30 Dec '16

hi I want to configure EAP-AKA and EAP-SIM configuration on my Ubuntu-16 machine, MY free radius server version is 2.2.8 $ sudo freeradius -v freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. I am following the link [1]http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for- EAP-AKA-configuration-td5717980.html But I am getting error: main{ user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary Errors reading dictionary: dict_init: /etc/freeradius/dictionary[34]: d ict_addattr: Duplicate attribute name EAP-Type-AKA [cid:XOK0LK7CT9SZ@namo.co.kr] [update?userid=avichal.a&do=bWFpbElEPTIwMTYxMjI5MTQzODE1ZXBjbXM1cDdkMDU 2ZTBkNDk4Y2M2ZTA0NjE2ZWY2MzNmMjIxYzg2ZSZyZWNpcGllbnRBZGRyZXNzPWZyZWVyYW RpdXMtdXNlcnNAbGlzdHMuZnJlZXJhZGl1cy5vcmc_] References 1. http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for-EAP-AKA…

2 1

Unknown or invalid value "Crypt-Local" for attribute Auth-Type"
by Christoph Schwabl 30 Dec '16

30 Dec '16

Hello, I am currently trying to upgrade from freeradius 1.x (which is running for about 10 years) to freeradius 3.0.12. The freeradius is used for shell access to Cisco routers. I am using MySQL and the tables looks like: mysql> select * from radgroupreply; +----+-----------+--------------+----+-------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------+ | 3 | lanmgmt | Cisco-AVPair | = | shell:priv-lvl=15 | | 4 | lanmgmt | Service-Type | = | NAS-Prompt-User | | 5 | readonly | Cisco-AVPair | = | shell:priv-lvl=2 | | 6 | readonly | Service-Type | = | NAS-Prompt-User | +----+-----------+--------------+----+-------------------+ mysql> select * from radcheck; +----+------------------+----------------+----+------------------------ ----------+ | id | username | attribute | op | value | +----+------------------+----------------+----+------------------------ ----------+ | 2 | testusersql | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | | 3 | testuserdisabled | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | +----+------------------+----------------+----+------------------------ ----------+ mysql> select * from radgroupcheck; +----+-----------+-----------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+-------------+ | 24 | lanmgmt | Auth-Type | := | Crypt-Local | | 25 | disabled | Auth-Type | := | Reject | +----+-----------+-----------+----+-------------+ mysql> select * from radusergroup; +------------------+-----------+----------+ | username | groupname | priority | +------------------+-----------+----------+ | testusersql | lanmgmt | 1 | | testuserdisabled | disabled | 1 | +------------------+-----------+----------+ In the debug it is possible to see the reason. Rejects because of: "(0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type" The corespondig debug (freeradius -X) part: ... (0) sql: SQL-User-Name set to 'testusersql' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Crypt-Password := "cc03e747a6afbbcbf8be7668acfebee5" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type (0) sql: ERROR: Error parsing user data from database result (0) sql: ERROR: Error retrieving check pairs for group lanmgmt rlm_sql (sql): Released connection (1) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.53-0+deb8u1, protocol version 10 (0) [sql] = fail (0) } # authorize = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testusersql (0) sql: SQL-User-Name set to 'testusersql' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) ... I know there is something wrong with the Auth-Type, but I am not aware how to solve it, even it is working under v1.x fine and also check already the documentation (e.g. http://wiki.freeradius.org/config/Auth%20Type) Is there some file where I need to specify Crypt-Local as Auth-Type? Thx br Christoph

2 1

Freeradius 3.0.12 problems - redis and mysql pool connections
by Michal Tomaszewski 28 Dec '16

28 Dec '16

Hello Alan, I found 2 problems in freeradius 3.0.12 To be short: Our several freeradius servers are using MySQL cluster (percona) and redis master/slave mapped to local port using HA Proxy on each freeradius server. So in fact each Freeradius sees 1 local port for MySQL and 1 local port for redis. We are not using server pool and load balancing definition in Freeradius in order to have strict control on which database server is used for all writes from several Freeradius servers. To be sure Freeradius is starting when redis or sql is not started yet (or not available for a while) in both redis and sql pool definition we have to use: pool { start = 0 but we also want to have min number of connections defined higher than 0 (e.g. in a standard way): min = ${thread[pool].min_spare_servers} So min > start. When server (sql or redis) becomes available Freeradius opens some connections. After restart of sql or redis Freeradius should open new connections to those servers as old connections are not longer available. And we have 2 errors #1 When redis becomes unavailable for a while (restart of redis-server or simple restart of HA_Proxy) Freeradius does not check that connection is no longer available and keeps those invalid connections till lifetime time. In fact in such situation old connection should be discarded and new connection shall be opened. Standard lifetime in mods-available/redis is set to 86400 so redis module is not able to read/write anything from redis-server for 24 hours. In /var/log/freeradius/radius.log there are only ERRORs when there is redis write command, there is no error information when there is (unsuccessful) read command. To see that debug mode shall be started. So in fact redis module is not verifying redis valid/invalid connection state. Changing lifetime to e.g. 60 helps to force redis module start working (in 60 second from redis-server restart) but that is just a workaround not a solution. #2 In var/log/freeradius/radius.log we have lots of errors: ERROR: SQL query failed: no connection It seems that error shows up when connection is closed by e.g. idle-timeout... Example: Thu Dec 22 15:48:35 2016 : Debug: attribute --> User-Name Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{User-Name} Thu Dec 22 15:48:35 2016 : Debug: (81) --> h274_xxxxxxxxxxxxxx Thu Dec 22 15:48:35 2016 : Debug: (81) SQL-User-Name set to 'h274_xxxxxxxxxxxxxx' Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Reserved connection (4) Thu Dec 22 15:48:35 2016 : Debug: (81) Executing select query: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('585be1cc00000004', 'e2a5c5294e55743ffc9169de47d5de4a', 'h274_xxxxxxxxxxxxxx', '274', '3625', '3799789', '', '192.168.176.1', '00000004', 'Wireless-802.11', FROM_UNIXTIME(1482418115 - 1460), FROM_UNIXTIME(1482418115), FROM_UNIXTIME(1482418115), 1460, '', '', '', '0' << 32 | '129433', '0' << 32 | '1435982', 'h274-xxxxxxxxxxxxxx', 'EC-9B-F3-19-4A-F2', 'Lost-Carrier', '', '', '192.168.176.5') Thu Dec 22 15:48:35 2016 : ERROR: (81) SQL query failed: no connection Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Released connection (4) Thu Dec 22 15:48:35 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{sql: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{User-Name}', '%{LOCATION-HotspotID}', '%{LOCATION-DeviceID}', '%{LOCATION-FELogin-Id}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%l - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%l), FROM_UNIXTIME(%l), %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') } Thu Dec 22 15:48:35 2016 : Debug: (81) --> freeradius log looks like: radius1:~$ tail /var/log/freeradius/radius.log Thu Dec 22 15:59:45 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : ERROR: (164) ERROR: SQL query failed: no connection Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:51 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : ERROR: (172) ERROR: SQL query failed: no connection We tested to set freeradius use mysql directly, without haproxy and using default values in mods-availables/sql (including pool { start value) but it did not change this strange behavior. Any help would be appreciated... Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

3 5

Multiple realms and network validation with WPA2 Enterprise
by Henti Smith 27 Dec '16

27 Dec '16

Good morning all. I've searched a bit and while I found some information about how the client validates the SSID using certificates, it's not entirely clear how to make sure a fake SSID cannot steal user/pass from clients. As per previous mails, we're running EAP method TTLS with PAP 2nd phase against a Kerberos oracle. We're using CA signed wildcard cert for our internal network. Do we need to use a username@domain username structure to validate the realm (I assume using the domain_realm config in /etc/krb5.conf) use SSL to validate the radius server it's communicating with ? Does that also mean we can have multiple domains pointing to multiple realms using seperate realms and domain_realm configurations ? Regards Henti -- --

6 9

custom attributes per realm/proxy after auth.
by Benedikt Sveinsson 24 Dec '16

24 Dec '16

Current running environment: freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 postgres 9.3 Hi all I’m running FR for a number of BRAS’es and I’m working on implementing BNG service (cisco XR) Up to now, we have been able to do realm processing on the BRAS’es them self, just used radius for auth, but have to go to a centralised solution. We have number of proxy connections to 3rd party radius servers, based on domain name, and for each of those 3rd parties, I need to be able to reply to the NAS(BNG) number of radius attributes(AV pairs, tunnel info etc.. ) this is the flow: BNG -> my radius -> 3rd party radius 3rd party radius (auth only) -> my radius (adds attributes) -> BNG can someone point me in the right direction where this is configured - Benedikt

3 4