- Freeradius-Users - lists.freeradius.org

[SOLVED] Re: LDAP bind user authentication
by jopo jopo 12 Oct '14

12 Oct '14

> Then at the bottom of the authorize section, add this: > > if (User-Password) { > update control { > Auth-Type := ldap > } > } > > Finally, in the authenticate section, insert just 'ldap' at the top and change the Auth-Type PAP stanza from the default to the below (which allows you to use the LDAP bind with things like EAP-TTLS/EAP-GTC, which uses PAP): > > Auth-Type PAP { > # pap > ldap > } > This was exactly the thing that was missing. I didn't try this solution because it clearly says in the config files "Auth-Type = LDAP is almost always wrong". Is the section Auth-Type LDAP { ldap } now obsolete? Why is it there in the first place, since the comment above sounds to me pretty much like what i want. > If you use FreeRADIUS 3.0.x, this becomes a *LOT* easier and straight-forward. The FreeRADIUS guys have built a repository for all major Linux platforms, so you can upgrade to the newest without waiting for your distribution to catch up. Didn't knew that, maybe i'll upgrade. Thanks for the notice.

3 3

Fwd: free radius 3.0.2 not reading nas clients from daloradius db
by Abdullah 12 Oct '14

12 Oct '14

Hello I have setup freeradius 3.0.2 with dalorad and coovachilli. I have searched a lot but couldnt find a solution to my issue. The issue is that it is not reading from the database. When i try to login, *Ignoring request to auth address * port 1812 as server default from unknown client (192.168.211.195) port 46623 proto udp* i have made entries in the nas table for the client. when reading from the radius conf file, it works but when trying to read from db this issue pops up. Please help. Attaching radiusd -X log Please advise

4 16

Configuring Windows 7 for a WPA2-Enterprise (EAP-TLS) Secured Wireless Network
by Jasvinder S. Bahra 12 Oct '14

12 Oct '14

Hi, I have setup a WPA2-Enterprise secured WiFi Access Point that authenticates connections via FreeRadius v3.0.4, using EAP-TLS running on a FreeBSD machine. Please note that I generated a CA certificate, a server certificate, the various client certificates and the Diffie Hellman file using the ssl-admin tool. I created a client certificate for an android device by creating a "one-step request/sign" in ssl-admin, and then created a keyfile bundle using openssl via a command that looks something like this... openssl pkcs12 -export -out client_android.p12 -in ./active/client_android.pem -inkey ./active/client_android.key -certfile /usr/local/etc/ssl-admin/active/ca.crt I imported the generated file onto the device, and it can now successfully access the secured wireless network. I now need to do something similar for a Microsoft Windows 7 machine. From what I have been able to determine, I need to install two certificates - a CA certificate in the machines trusted root certificate authority store, and a client certificate in the machines personal certificate store. I installed the ca.crt file in the trusted root certificate authority store. I generated a client certificate using ssl-admin again, and then created a bundle file, via a command that looks something like this... openssl pkcs12 -export -out client_win7_bundle.p12 -in ./active/client_win7.crt -inkey ./active/client_win7.key I then installed the bundle file in the personal certificate store. On the client machine, I then navigated to Control Panel > Network and Sharing Centre > Manage wireless networks > Add button > Manually create a network profile. I entered a network name, selected "WPA2-Enterprise" for the security type, AES as the encryption type, and clicked the Next button. I then clicked Change connection settings and then the Security tab. I changed the network authentication method to "Microsoft: Smart card or other certificate". I then selected advanced settings, and changed the authentication method to computer authentication. I clicked OK and then clicked the Settings button. In the Trusted Root Certification Authorities list, I selected the CA certificate installed earlier, and then OK'd all the dialogs to save the configuration. Unfortunately, whenever I try and connect to the network, the connections fails to establish. If I run freeradius in debug mode, it clearly displays the access request whenever I connect from my android client. However, when the windows client tries, freeradius doesn't seem to respond. To me, that strongly suggests the problem is on the windows side of things. Does anyone have any suggestions for a way forward? Regards, Jazz

2 2

LDAP bind user authentication
by jopo jopo 12 Oct '14

12 Oct '14

Hello there, I spend countless hours on this topic. The farthest i could get was this topic from 2008: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg49999.… Freeradius version: 2.1.12 on debian Basically followed this guide: http://jitendrakumaryogi.blogspot.de/2013/10/step-by-step-free-radius-confi… so ldap is configured in authorize section in default server and as authorize and authentication in inner-tunnel. I would like to use EAP-TTLS-PAP. The aim is to authorize via LDAP by binding anonymously and just looking up the uid, start an EAP-TTLS tunnel, tunnel the request to the inner-tunnel server and there use the clear password send by the supplicant in the following tunneled request to bind with the credentials against the LDAP server. If the bind is successfull the auth should be considered successfull. It works _if_ i provide a manager login to the ldap server so the ldap module can find the user and add a good password, **but if i delete those credentials it fails.** The whole process reaches the point where the authorize section in inner-tunnel is executed. It says: ..... [ldap] user pete authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. ...... So why is that? I set the set_auth_type in module/ldap to yes since what's described there is exactly the behaviour i'd like. Why it says that no authenticate method is set? What can i do that LDAP is doing the authentication at this point? Thanks in advance. I hope i delivered al Infrormation needed. JoVaRi

3 2

New in 3.0.5: Detail file reader tracking
by Alan DeKok 11 Oct '14

11 Oct '14

This is a feature which people have been asking about for a long time. It's finally here in 3.0.5. When configured with "track = yes", the detail file reader will track its progress through the detail file. When it has successfully read and processed an entry from the file, that entry is marked as "done". That means if the server is restarted, it will quickly scan through the detail file, and ignore the records marked "done". It will then continue processing the next (unfinished) entry. This change means that detail file entries will be processed once, and only once. It also means that the server will make progress through the detail files much more quickly when it's restarted. Alan DeKok.

2 2

Recommended Distro
by Patrick Gawthorne 10 Oct '14

10 Oct '14

Hi All, Planning to rebuild our radius server but I'm stuck on which distro to use. What is recommended for FR? Currently using CentOS 6.5. Thanks, Pat This email, together with any attachments, is intended for the named recipient(s) only and may contain privileged and confidential information. If received in error, please inform the sender as quickly as possible and delete this email and any copies from your computer network. If not an intended recipient of this email, you must not copy, distribute or rely on it, and any form of disclosure, modification, distribution and/or publication of this email is prohibited. Unless stated otherwise, this email represents only the views of the sender and not the views of Pacific Lutheran College.

5 4

is it possible to setup multiple user definitions with different privileges when using an ldap backend?
by Les Stott 10 Oct '14

10 Oct '14

Hi, I have freeradius 2.1.12 of rhel6 which uses freeipa as an ldap backend. All is working fine. The config I have setup is as follows: Ldap group sys_admins = contains users who get privileges to authenticate and login radius based devices (cisco routers/switches, ucs, f5, brocade). Radius config for ldap module checks group sys_admins for membership. (/etc/raddb/modules/ldap) groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn})))" groupmembership_attribute = sys_admins In /etc/raddb/users I have... DEFAULT Ldap-Group == "cn=sys_admins,cn=groups,cn=accounts,dc=mydomain,dc=com" Auth-Type :=Accept, Service-Type = "NAS-Prompt-User", Cisco-AVPair = "shell:roles*\"admin network-admin vdc-admin\"", Cisco-AVPair += "shell:priv-lvl=15", Fall-Through = No, F5-LTM-User-Role = 0, F5-LTM-User-Info-1 = administrator, F5-LTM-User-Partition = common, F5-LTM-User-Shell = tmsh, Brocade-Auth-Role+= "admin", Brocade-AVPairs1+= "HomeLF=0", Brocade-AVPairs2+= "LFRoleList=admin:0-255", Brocade-AVPairs3+= "ChassisRole=admin" DEFAULT Auth-Type := Reject Reply-Message="You do not have permission to access this device.", Fall-Through = Yes This is all working fine. My problem is that I need to have a user setup in ldap for monitoring purposes (using icinga), which should be a read only based user for the ucs and not have access to the brocade, f5 or other cisco devices. I've tried a lot of different configs and nothing has worked. Adding a specific user definition to /etc/raddb/users with appropriate privilege levels doesn't help as it seems to still require that the user belong to the ldap group sys_admins, which means they get access to all devices. Does anyone know of a way to have multiple user definitions in /etc/raddb/users with ldap backends with differing privilege levels? Could the ldap module be duplicated like the files module which allows a second users file? Is it even possible? Any alternatives? Thanks, Les

1 0

How to get a reply on this list?
by Uzee 09 Oct '14

09 Oct '14

Hi, I don't know what other info to provide but somewhat surprised that I didn't get any response. I think this is the active list for freeradius and I also subscribed to it. I see my post in the list archives but not sure if it went to all the members (it should have) Could someone please let me know if I need to provide any thing else? or any other suggestion... Here's my original post: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/07381… thanks

1 0

radiusclient
by Sushna C 09 Oct '14

09 Oct '14

hi, I am new in freeradius.. can anyone please tell me about radiusclient configurations and the command line options for running radiusclient.... is there any detailed documentation for radiusclient...? please help me.... thank you..!

1 0

strange regex question
by Xin 09 Oct '14

09 Oct '14

Hi Alan Dekok, I'm looking your reply on: http://lists.freeradius.org/pipermail/freeradius-users/2008-April/027737.htm l And I found you give an example as the following below: > e.g. for : DOMAIN\randy.hall > > if (User-Name =~ /^DOMAIN\\(.*)/) { > update request { > Stripped-User-Name := "%{1}" > } > } But it fails in my case: rad_recv: Access-Request packet from host my_ip port 56949, id=250, le ngth=175 User-Name = "Windows Phone\\test" NAS-Port-Type = Virtual .... # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/defau lt +group authorize { ++? if (User-Name =~ /Windows Phone\\(.*)/) ? Evaluating (User-Name =~ /Windows Phone\\(.*)/) -> FALSE ++? if (User-Name =~ /Windows Phone\\(.*)/) -> FALSE I really don't know why it fails. I have tested my case in RegexBuddy, and it worked in POSIX ERE, but POSIX BRE failed. My FreeRadius version is 2.2.5. Appreciate for your help.

3 4