- Freeradius-Users - lists.freeradius.org

using userPassword instead sambaNTPassword
by Nicolás Guerra 16 Sep '14

16 Sep '14

I have a PDC using SaMBa and openLDAP, I'm trying to make my openwrt router authenticate with openLDAP, I read that the way to do this is by configuring a RADIUS server. I configured freeradius and It works fine, but my problem is that I need to authenticate users using the userPassword attribute instead of sambaNTPassword, I can't get this work, I've read a lot, but I haven't found the answer (didn't read enough I guess). I installed and configured freeradius in openSuSE 13.1 # rpm -qa | grep freeradius freeradius-server-libs-2.2.0-7.4.1.x86_64 freeradius-server-doc-2.2.0-7.4.1.x86_64 freeradius-server-2.2.0-7.4.1.x86_64 I added in /etc/raddb/clients.conf client owrt.router { secret = secretPasswd ipaddr = 10.202.10.83 } I uncomment "ldap" and the "Auth-Type LDAP{....}" in the followin files: /etc/raddb/sites-enabled/default /etc/raddb/sites-enabled/inner-tunnel I set server and basedn info in the /etc/raddb/modules/ldap file I repeat, it works fine but with the openLDAP's sambaNTPassword entry instead of using the userPassword. any help will be wellcome, sorry my english, (I tried my best). saludos, Nicolás. **

1 0

Can't install freeradius-krb5-3.0.4-1.el6.x86_64.rpm for CentOS
by Sebastian Hagedorn 15 Sep '14

15 Sep '14

Hi, I'm trying to install RPMs from <https://packages.networkradius.com/centos/6.5/> on a CentOS 6.5 system. I have successfully installed the following: freeradius-3.0.4-1.el6.x86_64 freeradius-ldap-3.0.4-1.el6.x86_64 freeradius-debuginfo-3.0.4-1.el6.x86_64 freeradius-mysql-3.0.4-1.el6.x86_64 But the freeradius-krb5 RPM fails: # yum install freeradius-krb5-3.0.4-1.el6.x86_64.rpm ... Setting up Install Process Examining freeradius-krb5-3.0.4-1.el6.x86_64.rpm: freeradius-krb5-3.0.4-1.el6.x86_64 Marking freeradius-krb5-3.0.4-1.el6.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package freeradius-krb5.x86_64 0:3.0.4-1.el6 will be installed --> Processing Dependency: krb5 for package: freeradius-krb5-3.0.4-1.el6.x86_64 --> Finished Dependency Resolution Error: Package: freeradius-krb5-3.0.4-1.el6.x86_64 (/freeradius-krb5-3.0.4-1.el6.x86_64) Requires: krb5 You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest There is no package named "krb5" in the standard repos. Where does that dependency come from? Thanks Sebastian -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

4 4

Import datas on simtriplets file to mysql?
by rafa alfurqan 15 Sep '14

15 Sep '14

Hi, I want to ask what should i do if i want store datas in simtriplets.dat (imsi,rand,sres,kc) into phpmyadmin? actually the freeradius was installed with mysql and phpmyadmin and in phpmyadmin have database asterisk too. Thanks, Rafa

1 0

policy.d question
by BALSIANOK, Peter 14 Sep '14

14 Sep '14

Do you plan to use the same directory organization for policy.d (as in the case of mods-* site-*) ? Something like: policy-available (I can backup some file and freeradius won`t parse it) policy-enabled Thx

4 3

EAP-TLS and client certs issued with different CA's
by Bruncko Michal 14 Sep '14

14 Sep '14

Hello list, I am successfully using Freeradius in our Wifi environment using EAP-TLS in single-CA environment - i.e same CA was used to sign both server and clients SSL certificates. Now I have started to use new certificate PKI with new CA hierarchy - RootCA -> SubCA -> Wifi certificates, but I wanted to keep existing legacy CA in place. This means: - that I wanted to use client certificates issued by two different CA's for EAP-TLS authentication - and as I mentioned before, the new CA is a subCA of new rootCA. - and server certificate is signed still using legacy CA I looked over older posts and it looks that this scenario is supported by freeradius and can be achieved in two ways: - using CA_file (within tls section in eap.conf) pointing to file bundling all CA related certificates (i.e. legacy CA, new SubCA and RootCA), or - using CA_path pointing to directory with separate CA *.pem files (and running "c_rehash" over that directory). both subCA and rootCA in single pem file (but I tried to separate it as well) The problem is, that everytime I wanted to authenticate with client using certificate signed by subCA, I always get: [campuswifi] Request found, released from the list [campuswifi] EAP/tls [campuswifi] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03d6], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [campuswifi] Handler failed in EAP/tls [campuswifi] Failed in EAP select Questions: - what I am doing wrong? Miss I anything in order to get working EAP-TLS authentication over both legacy CA and new CA? recall: please note that new CA is not self signed, but signed by another rootCA authority (created also by me). thanks for any help -- Ing. Michal Bruncko, PhD., CCNP, RHCSA

2 3

how to store some data in freeradius users file into custom table?
by rafa alfurqan 13 Sep '14

13 Sep '14

Hi all, is it possible to store IMSI code (IMSI for eap-sim data in users file) from freeradius to a custom table that i made in phpmyadmin, if it's possible can someone show me if the examples of the implementation? what i want to achieve is that for freeradius to store IMSI data to asterisk's real time table or for asterisk to read from freeradius's table for sip.conf and extension.conf username in asterisk files. really need help. thank you

2 2

server type=detail and detail.work file
by Andrea Gabellini - SC 13 Sep '14

13 Sep '14

Hello, I'm starting to play with a virtual server of type = detail. I'm using FR 2.1.12 and the detail server writes to a MySQl DB. I have a stable configuration that just works! I noticed a strange behaviour. If I stop FR, the server leaves the detail.work file, and at the next start FR reloads this file and pushes duplicate records to the DB. Is it a normal behaviour or I'm doing something wrong? Thanks, Andrea

2 5

rlm_perl logging
by BALSIANOK, Peter 13 Sep '14

13 Sep '14

Hi, Is it possible to add request number (x) also for radius::radlog function (in rlm_perl module)? It would be very helpful (for debugging). Thx (0) perl : $RAD_CHECK{'Tmp-String-0'} = &control:Tmp-String-0 -> 'LNS1' (0) perl : $RAD_CONFIG{'Group-Name'} = &control:Group-Name -> 'MM1' (0) perl : $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'dummy' (0) perl : $RAD_CONFIG{'Tmp-String-0'} = &control:Tmp-String-0 -> 'LNS1' (x) rlm_perl: ### Authorize start (x) rlm_perl: RAD_REQUEST: Called-Station-Id=1.5895:50.405#188653810#RSP_BA_NSLO 5/1/5#speed:UBR#pppoe 00:24:c4:35:54:15#/ User-Password=dummy Framed-Protocol=PPP Event-Timestamp=Sep 13 2014 12:24:08 CEST NAS-Port=776 NAS-Port-Id=Uniq-Sess-ID776 Huntgroup-Name=LNS User-Name=dummy NAS-IP-Address=213.151.232.208 Calling-Station-Id=atm 10 NAS-Port-Type=Virtual Service-Type=Framed-User Connect-Info=155520000 (x) rlm_perl: ### Authorize end (0) perl : &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '1.5895:50.405#188653810#RSP_BA_NSLO 5/1/5#speed:UBR#pppoe 00:24:c4:35:54:15#/' (0) perl : &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'dummy' (0) perl : &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP'

1 0

Release of Version 3.0.4
by Alan DeKok 12 Sep '14

12 Sep '14

We've release version 3.0.4. It has a long changelong from 3.0.3: http://freeradius.org/version3.html But the wait has been worth it, I think. Lots of minor fixes, and many new features. The regex handling for strings has been fixed. This means that where it was hard / impossible to use regexes before, it's now simpler. The down-side is that you MAY have to update your regexes. Since the old ones didn't work in some situations, fixing them is preferable to leaving them broken. Alan DeKok.

7 19

Re: New repository - was Re: Release of Version 3.0.4 (Alan DeKok)
by Rui Ribeiro 12 Sep '14

12 Sep '14

Thanks, it is already working, and I have already installed it in my pre-production server for tests. Date: Thu, 11 Sep 2014 07:21:04 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: New repository - was Re: Release of Version 3.0.4 > Message-ID: <541185A0.8020108(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > Rui Ribeiro wrote: > > Err http://packages.networkradius.com wheezy/main amd64 Packages > > I've removed the redirect. The https site uses a self-signed key, so > that's why it doesn't work. > > Alan DeKok. > > > -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 1