- Freeradius-Users - lists.freeradius.org

github & freeradius.org
by Dagia Dorjsuren 25 Jun '13

25 Jun '13

Hello, I am a bit confused. What is the difference between github-freeradius https://github.com/FreeRADIUS/freeradius-server AND freeradius.org? I think the number of difference between them such as radius database table structure and etc...

2 1

Username/Host authorization
by nicolas.clo＠ricoh-industrie.fr 25 Jun '13

25 Jun '13

Thanks for your help. We want two authorization in the same times, for example, to ensure that user not used his iPhone with his DOMAIN/UserName account. Mac Authorization is not a good way for us ( Too restrictive to keep up to date ) Authorization by certificat too because we have a lot of hosts which doesn't support that. Nicolas CLO. -----Original Message----- nicolas.clo(a)ricoh-industrie.fr wrote: > Is it possible to verify host with mschapv2 That question has a number of unstated assumptions. Those assumptions are wrong. Does the *host* provide mschapv2 authentication data? No. Therefore, the host can't be verified with mschapv2. > and if the module > return ok proceed to username verfication with the same module ? You're asking for mschapv2 to authenticate two different identities at the same time. It doesn't do that. What do you really want to do? Your question assumes a particular view of things. That view is wrong, so we can't help you. If you describe what you have and what you want to do, we may be able to come up with a different approach that meets your needs. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________________________________ Nicolas CLO Industrial and Network Technician ITS Section RICOH INDUSTRIE FRANCE SAS 144, route de Rouffach, 68920 WETTOLSHEIM Tel: +33 (0) 3 89 20 48 84 nicolas.clo(a)ricoh-industrie.fr | www.ricoh-thermal.com

4 5

Not able to build FreeRadius on Solaris 10
by Rama Krishna 25 Jun '13

25 Jun '13

Hi There, I am trying to build FreeRadius 2.2 on Solaris 10 by following the steps given in below link. http://coova.org/JRadius/FreeRADIUS In that process, make is giving the following errors. Can someone help fixing these? Is there a ready to execute binary for FreeRadius for Solari 10 that I could download? gambit-12 { zms_release_2.4_gambit_gvu } >ls freeradius-server-2.2.0 freeradius-server-2.2.0.tar pax_global_header gambit-9 { zms_release_2.4_gambit_gvu } >cd freeradius-server-2.2.0gambit-10 { zms_release_2.4_gambit_gvu } >lsCOPYRIGHT Makefile config.guess debian libtool.m4 redhatCREDITS README config.log dialup_admin ltmain.sh scriptsINSTALL VERSION config.status doc man shareLICENSE acinclude.m4 config.sub install-sh mibs srcMake.inc aclocal.m4 configure libltdl missing suseMake.inc.in autogen.sh configure.in libtool raddb todogambit-11 { zms_release_2.4_gambit_gvu } >makemake[1]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0'Making all in libltdl...make[2]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'/usr/local/bin/make all-ammake[3]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'/bin/bash ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -c -o ltdl.lo ltdl.c gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -c ltdl.c -fPIC -DPIC -o .libs/ltdl.oltdl.c: In function `tryall_dlopen':ltdl.c:2450: parse error before `data'ltdl.c:2452: `data' undeclared (first use in this function)ltdl.c:2452: (Each undeclared identifier is reported only onceltdl.c:2452: for each function it appears in.)make[3]: *** [ltdl.lo] Error 1make[3]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'make[2]: *** [all] Error 2make[2]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'make[1]: *** [libltdl] Error 2make[1]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0'make: *** [all] Error 2 Thanks, Rama

2 1

Re: ldap
by John Dennis 24 Jun '13

24 Jun '13

On 06/24/2013 03:15 PM, Julian Macassey wrote: > On 2013-06-24 at 14:32, John Dennis (jdennis(a)redhat.com) wrote: >> You need to configure radius to work with ldap, but you haven't done >> that. You have to uncomment the ldap module from >> /etc/raddb/sites-enabled/default in the authorize section and also >> configure your ldap values in /etc/raddb/modules/ldap. You haven't done >> either of those. > > Actually I have: If you had then there would have been rlm_ldap module configuration in the debug log you sent, but there isn't, you did try reading the debug right? > > ldap { > # > # Note that this needs to match the name in the LDAP > # server certificate, if you're using ldaps. > server = "plumgrid-ldap1" > #identity = "cn=admin,o=My Org,c=UA" > #password = mypass > basedn = "o=PLUMGRID,c=UA" > filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > #base_filter = "(objectclass=radiu > >> >> I'm afraid I can't help anymore, you need to start helping yourself >> first, pay attention to what you're doing, don't fail about, start with >> a vanilla configuration, put it under source control so you can revert, >> make only one change at a time, change only what you understand, and >> read the doc, most of it is inside the config files themselves. > Done all of what you suggest. No you haven't.

1 0

Re: ldap
by Alan Buxey 24 Jun '13

24 Jun '13

Hi Always start simple. Run radtest on the RADIUS server box using 127.0.0.1 ... THEN move to running against it from other systems once you've verified all authentication etc is working Note that it is port 1812 UDP alan

3 6

Re: Changed Attributes
by George Innocent 24 Jun '13

24 Jun '13

The configured user with the stated attributes: steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Alc-IPsec-Interface = private_ipsec, Alc-IPsec-SA-Lifetime = 1200, Alc-IPsec-SA-Encr-Algorithm = aes128, Alc-IPsec-SA-Auth-Algorithm = sha1, Error received on running radtest remains same. But when i comment the attributes the radtest is successful On 24 June 2013 19:55, <A.L.M.Buxey(a)lboro.ac.uk> wrote: > Hi, > > > I am creating attributes for the user using the scripts below but on > > running the radtest i get the failure attributes ; which seems to have > > changed. I am using Freeradius 2.1.0 . > > > > "user1test" Auth-Type := Local, User-Password == "testpassword" > > > > Framed-IP-Address = 172.162.3.33, > > > > Framed-IP-Netmask = 255.255.255.0, > > > > Alc-Primary-Dns = 4.4.2.2, > > > > Alc-Primary-Nbns = 8.8.4.4, > > > > Alc-IPsec-Serv-Id = 199920, > > > > Alc-IPsec-Interface = public_ipsec, > > > > Alc-IPsec-SA-Lifetime = 1200, > > > > Alc-IPsec-SA-Encr-Algorithm = aes128, > > > > Alc-IPsec-SA-Auth-Algorithm = sha1 > > 1) its Cleartext-Password := NOT User-Password == > > 2) formatting is VERY important...I hope you dont have blank lines between > each entry > > 3) ensure that these attributes that you are using are in a dictionary > file and that the dictionary file is being read by the server when it > starts > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Regards: George Innocent.

2 1

ldap
by Julian Macassey 24 Jun '13

24 Jun '13

I am tring to get freeradius working with ldap. The ldap server is on the same LAN as the RADIUS server. The local user test works. I have configured all files I can think are pertinent. In debug mode, I get: root#> freeradius -X .... .... } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ----- In another terminal window I enter: root#> radtest username(a)mydomain.com "PASSWORD" 192.168.10.14 0 sharedsecret ending Access-Request of id 231 to 192.168.10.14 port 1812 User-Name = "username(a)domain.com" User-Password = "PASSWORD" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Sending Access-Request of id 231 to 192.168.10.14 port 1812 User-Name = "username(a)domain.com" User-Password = "PASSWORD" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Sending Access-Request of id 231 to 192.168.10.14 port 1812 User-Name = "username(a)domain.com" User-Password = "PASSWORD" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 radclient: no response from server for ID 231 socket 3 ----- I get no output in the freeradius -X terminal window. I get no info in /var/log/freeradius. What am I missing? It won't complain and it won't work. --

5 14

Changed Attributes
by George Innocent 24 Jun '13

24 Jun '13

Hi Experts; I am creating attributes for the user using the scripts below but on running the radtest i get the failure attributes ; which seems to have changed. I am using Freeradius 2.1.0 . "user1test" Auth-Type := Local, User-Password == "testpassword" Framed-IP-Address = 172.162.3.33, Framed-IP-Netmask = 255.255.255.0, Alc-Primary-Dns = 4.4.2.2, Alc-Primary-Nbns = 8.8.4.4, Alc-IPsec-Serv-Id = 199920, Alc-IPsec-Interface = public_ipsec, Alc-IPsec-SA-Lifetime = 1200, Alc-IPsec-SA-Encr-Algorithm = aes128, Alc-IPsec-SA-Auth-Algorithm = sha1 Error on running radtest /usr/local/etc/raddb/users[7]: Parse error (check) for entry Alc-IPsec-SA-Lifetime: Unknown attribute "". Support and advice will be appreciated -- Regards: George Innocent.

2 1

Username/Host authorization
by nicolas.clo＠ricoh-industrie.fr 24 Jun '13

24 Jun '13

Hi list, I'm searching the best way to configure an authorization based on both Host + Username ( mschapv2 + /usr/bin/ntlm_auth) but not Host or Username. Is it possible to verify host with mschapv2 and if the module return ok proceed to username verfication with the same module ? Thanks for your reply. __________________________________________________________________________ Nicolas CLO Industrial and Network Technician ITS Section RICOH INDUSTRIE FRANCE SAS 144, route de Rouffach, 68920 WETTOLSHEIM Tel: +33 (0) 3 89 20 48 84 nicolas.clo(a)ricoh-industrie.fr | www.ricoh-thermal.com

3 2

Problems freeradius and samba4
by ricardobarbosams 23 Jun '13

23 Jun '13

Hi all. I trying deploy the environment beetween freeradius and samba4 for wireless network. The topology follow bellow. access point <----> freeradius server <-----> server samba4 I setting the access point for authenticate in freeradius server and freeradius using ldap e authenticate in samba4, but not work follow bellow log server freeradius: [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for user [ldap] expand: (&(objectClass=user)(sAMAccountName=%{User-Name})) -> (&(objectClass=user)(sAMAccountName=user)) [ldap] expand: dc=batlab,dc=corp -> dc=batlab,dc=corp [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] closing existing LDAP connection [ldap] (re)connect to 192.168.0.4:389, authentication 0 [ldap] bind as CN=freeradius,OU=noc,OU=batlab,DC=batlab,DC=corp/xxxx to 192.168.0.4:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=batlab,dc=corp, with filter (&(objectClass=user)(sAMAccountName=user)) [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [user/<no User-Password attribute>] (from client 192.168.0.200 port 0 cli 001f3a528f60) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated I note this ldapsearch executed successfull # ldapsearch -LLL -h 192.168.0.4 -b dc=batlab,dc=corp -D user2(a)batlab.corp -W '(&(objectClass=user)(sAMAccountName=user))' dn: CN=user test,OU=noc,OU=batlab,DC=batlab,DC=corp objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: user test instanceType: 4 whenCreated: 20130404161519.0Z displayName: user test uSNCreated: 3728 name: user test objectGUID:: x9uu1FOl70u8ovEwuZ72Rw== badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA2w3N/Xfij4HyH/nmUQQAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: user sAMAccountType: 805306368 userPrincipalName: user(a)batlab.corp objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=batlab,DC=corp pwdLastSet: 130095657200000000 userAccountControl: 66048 memberOf: CN=Administrators,CN=Builtin,DC=batlab,DC=corp memberOf: CN=Domain Admins,CN=Users,DC=batlab,DC=corp memberOf: CN=Enterprise Admins,CN=Users,DC=batlab,DC=corp memberOf: CN=g_noc,OU=noc,OU=batlab,DC=batlab,DC=corp mail: user(a)batlab.ufms.br whenChanged: 20130427195156.0Z uSNChanged: 4204 distinguishedName: CN=user test,OU=noc,OU=batlab,DC=batlab,DC=corp I noticed that the ldap Samba4 does not possess the attribute user-password, is this the cause? My settings: Ubuntu Linux 12.04.2 Access Point: Linksys Cisco wrtp54g Any ideas. Regards

5 11