- Freeradius-Users - lists.freeradius.org

NEW NAS Password Doesn't Authenticate
by mr. s 21 Aug '13

21 Aug '13

>From the logs I interpret, the error is incorrect password for the user. Is this correct interpretation? I believe we have added in the NAS correctly to the clients file. Also the username and password, we are testing, authenticates both locally and from another NAS, without issue. Here is an excerpt of our radius -X FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... client 192.168.1.239 { require_message_authenticator = no secret = "FreeRADIUS" shortname = "New_NAS" } rad_recv: Access-Request packet from host 192.168.1.239 port 1645, id=30, length=140 Framed-Protocol = PPP User-Name = "username(a)domain.com" User-Password = "password" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/1/2890" Cisco-AVPair = "client-mac-address=a820.6654.6a6f" Service-Type = Framed-User NAS-IP-Address = 192.168.1.239 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "domain.com" for User-Name = "username(a)domain.com" [suffix] Found realm "domain.com" [suffix] Adding Stripped-User-Name = "username" [suffix] Adding Realm = "domain.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++? if (control:Auth-Type == Reject) (Attribute control:Auth-Type was not found) ++- entering else else {...} [sql] expand: %{Stripped-User-Name} -> username [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> username [sql] sql_set_user escaped user --> 'username' rlm_sql (sql): Reserving sql socket id: 23 [sql] expand: SELECT '1' as id, userId as username, 'Cleartext-Password' as attribute, checkNASIPPassword( '%{NAS-IP-Address}','%{SQL-User-Name}') as value, ':=' as op FROM radiusUsers WHERE userId = '%{SQL-User-Name}' ORDER BY id -> SELECT '1' as id, userId as username, 'Cleartext-Password' as attribute, checkNASIPPassword( '192.168.1.239','username') as value, ':=' as op FROM radiusUsers WHERE userId = 'username' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT '1' as id, userId as username, 'Framed-IP-Address' as attribute, assignIPAddress('%{NAS-IP-Address}','%{SQL-User-Name}') as value, '==' as op FROM radiusUsers WHERE userId = '%{SQL-User-Name}' ORDER BY id -> SELECT '1' as id, userId as username, 'Framed-IP-Address' as attribute, assignIPAddress('192.168.1.239','username') as value, '==' as op FROM radiusUsers WHERE userId = 'username' ORDER BY id [sql] expand: SELECT userID as groupname FROM radiusUsers WHERE userId = '**-Not-Using-Groups-**' -> SELECT userID as groupname FROM radiusUsers WHERE userId = '**-Not-Using-Groups-**' rlm_sql (sql): Released sql socket id: 23 +++[sql] returns ok ++- else else returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "**-User-Not-Allowed-To-Use-This-NAS-**" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [ username(a)domain.com/password] (from client SHL-BRAS-01_239 port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> username(a)domain.com attr_filter: Matched entry DEFAULT attrt line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 30 to 192.168.1.239 port 1645 Finished request 70.

2 4

Re: User Account Configuration
by Alan Buxey 20 Aug '13

20 Aug '13

Think about the login time ... If you create an account for the future then if it has a start validity date. .. alan

1 0

User Account Configuration
by Patrick Meyer 20 Aug '13

20 Aug '13

Greetings! I am using Freeradius2 2.2.0 on a pfsense 2.1 RC1 firewall to support authentication for a captive portal. I see that it is possible to expire a user account in Freeradius. I am wondering if I can specify a date and time to make the account effective. For instance, I know I have a user starting in 30 days. Can I configure the account today to enable the user in 30 days? Regards, Patrick

1 0

FreeRADIUS + OpenLDAP + Daloradius
by Mantas Šiurkus 19 Aug '13

19 Aug '13

Hello, I am creating WIFI hotspot on Debian 7. I had configured FreeRADIUS to work with OpenLDAP for users authentication. How I can configure Daloradius for user control? All tutorials that I found, shows how to configure it with mysql, but my users are stored into LDAP (not mysql). Is it possible to configure Daloradius to work when users authenticate wia LDAP?

1 0

Policy to split domain and host
by nicolas.clo＠ricoh-industrie.fr 16 Aug '13

16 Aug '13

Hi list, I'm searching the best way to configure a policy to split the domain and the prefix ' /host' when it is a computer connection. The initial UserName is like this: host/computername.DOMAIN.LOCAL I can already easily split the /host by policy and realm configuration but I don't know how I can do when there is double delimiter in the same UserName ? Thanks for your reply. __________________________________________________________________________ Nicolas CLO Industrial and Network Technician ITS Section RICOH INDUSTRIE FRANCE SAS 144, route de Rouffach, 68920 WETTOLSHEIM Tel: +33 (0) 3 89 20 48 84 nicolas.clo(a)ricoh-industrie.fr | www.ricoh-thermal.com

2 2

FreeRADIUS basic setup for PEAP using example certificates
by Darlington, Andrew 15 Aug '13

15 Aug '13

Hi all I'm trying to setup a very basic test server using FreeRADIUS (running on Ubuntu 12.04) that uses PEAP with the example certificates generated by FreeRADIUS. I keep running into a variety of fairly basic problems. After running freeradius -X I get this error message. Couldn't open /etc/freeradius/acct_users for reading: Permission denied Errors reading /etc/freeradius/acct_users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. I was hoping someone could advise. Thanks PS I'm new to FreeRADIUS and Ubuntu. ________________________________ This e-mail message is confidential and for use by the addressee only. If you are not the intended recipient, you must not use, disclose, copy or forward this transmission. Please return the message to the sender by replying to it and then delete the message from your computer. Sagentia provides e-mail services for both itself and a number of its independent spin-out companies. Sagentia shall not be held liable to any person resulting from the use of any information contained in this e-mail and shall not be liable to any person who acts or omits to do anything in reliance upon it. Sagentia does not accept responsibility for changes made to this message after it was sent. Company Information: Name: Sagentia Limited. Registered Address: Harston Mill, Harston Cambridge CB22 7GG. Registered as a Company in England: 2081960 VAT Number: 432214202. Website hosted by: Sagentia Limited Harston Mill, Harston, Cambridge, UK. CB22 7GG info(a)sagentia.com -- Scanned by iCritical.

4 6

Rejecting realms based on calling client
by David Aldwinckle 15 Aug '13

15 Aug '13

Hello, I have two clients that proxy access requests to me. The realm varies, but the format is always userid(a)realm.whatever<mailto:userid@realm.whatever> Is there a way that I can deny a specific realm when an access request is received from a specific client? I tried adding something to policy.conf but I couldn't get the syntax right: #Prevent secretrealm from logging in off-campus remote_secret_reject if ("%{Realm}" == "secretrealm.ca") && ((Client-Shortname == "proxy-client1") || (Client-Shortname == "proxy-client2"))) { reject } Is there a different way that I should be doing this? Thanks, Dave Dave Aldwinckle Network Support Specialist Information Systems and Technology Phone: (519)-888-4567 ext. 31145 E-Mail: daldwinc(a)uwaterloo.ca<mailto:daldwinc@uwaterloo.ca>

3 5

How to accept RADIUS traffic on multiple interfaces?
by Kurt Hillig 15 Aug '13

15 Aug '13

We're running FreeRadius 2.2.0 on RHEL 6. The servers are working fine with a single active interface (eth0) on each one; but we need to activate a second interface (eth1) on each server - on a different IP subnet - to handle local traffic on that subnet. The interfaces look like this: eth0 Link encap:Ethernet HWaddr 18:03:73:EE:76:96 inet addr:10.10.0.189 Bcast:10.10.0.191 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 eth1 Link encap:Ethernet HWaddr 18:03:73:EE:76:98 inet addr:10.10.95.62 Bcast:10.10.95.127 Mask:255.255.255.128 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 and the routing is correct: Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.10.0.184 0.0.0.0 255.255.255.248 U 0 0 0 eth0 10.10.95.0 0.0.0.0 255.255.255.128 U 0 0 0 eth1 0.0.0.0 10.10.0.185 0.0.0.0 UG 0 0 0 eth0 Iptables is set up to accept incoming traffic from anywhere on UDP ports 1812 and 1813. radiusd.conf includes these "listen" sections (omitting comments): listen { type = auth ipaddr = * port = 1812 interface = eth0 } listen { type = auth ipaddr = * port = 1812 interface = eth1 } listen { type = acct ipaddr = * port = 1813 interface = eth0 } listen { type = acct ipaddr = * port = 1813 interface = eth1 } But radiusd isn't seeing any of the inbound RADIUS traffic on eth1 - tcpdump shows it coming in, but "radiusd -X" shows no indication of this traffic (but is reporting all of the traffic on eth0). Anyone know what I'm missing here? -- Dr. Kurt Hillig UMNet Administration I always tell the (734)647-8778 desk University of Michigan absolute truth, (734)323-2736 cell Ann Arbor, MI 48105-3640 as I see it. khillig(at)umich.edu > Computers were invented to help people waste more time faster <

3 3

Re: How to accept RADIUS traffic on multiple interfaces?
by Matteo Vocale 15 Aug '13

15 Aug '13

Before running radius in debug mode, try iptables -F with root privileges, it disables iptables default rules Phil Mayers <p.mayers(a)imperial.ac.uk> ha scritto: >On 14/08/13 15:07, Kurt Hillig wrote: > >> But radiusd isn't seeing any of the inbound RADIUS traffic on eth1 - >> tcpdump shows it coming in, but "radiusd -X" shows no indication of >> this traffic (but is reporting all of the traffic on eth0). > >If "radiusd -X" isn't reporting *anything*, then it's not reaching >FreeRADIUS, which means some part of the network stack is dropping it. > >If you're sure your iptables are correct, google "linux log martians" >and "linux rp filter". RHEL6 has different defaults to previous RHEL >versions in this regard. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Problem in freeradius 2.1.10, ldap and huntgroups
by ville＠leinonen.org 14 Aug '13

14 Aug '13

Hi, I have installed fr 2.1.10 w openldap and I can authenticate users against ldap. I have also added groups in ldap and allowed ldap module to search groups and it also works fine. Now the problem is that is huntgroups wont work. I need to restrict access to NAS for specific groups. I can see that groups match "rlm_ldap::ldap_groupcmp: User found in group xxxx", huntgroup match wont work. file huntgroups: xxxx NAS-IP-Address == 172.150.0.1 file users: DEFAULT Ldap-Group == "xxxx" Huntgroup-Name == "xxxx" I am very glad for any help and if someone have better solution for this i'm happy to hear it. There is about 600 NAS (sw's and routers) for different customers and we need to provide mgmt access to customers and our NOC staff, so i think we need to use huntgroups w groups and if someone have example for this one I'm very glad for that also. Best regards, Ville Leinonen

3 7