- Freeradius-Users - lists.freeradius.org

Virtual server setup
by Vincent Rusilowicz 20 May '13

20 May '13

Hi, I am new to FreeRadius and am having some difficulty setting it up. My goal is to have requests from separate IP addresses authenticate to separate user files. I have read through documentation and see this is possible but I can not get it to work. Can anyone provide a lists of steps or example to guide me through this. I seem to be getting stuck at configuring the virtual server. Thanks in advance. Vincent Rusilowicz

2 1

Radius vs Tacacs+
by Roberto Carna 20 May '13

20 May '13

Dear, my chief ask me to choose between Tacacs+ and Radius for switches and Linux SSH user authentication. I see radius is universally supported for every device and OS, but I can't tell soo much about Tacacs+ because I don'y know very well. Can you give me your opinion about the best choice between radius and tacacs+??? Special thanks. Roberto

3 2

using unlang to call a stored procedure
by Alex Sharaz 20 May '13

20 May '13

Hi, I've written a mysql stored procedure that accepts 2 arguments, the nas-ip address of one of our (HP) switches and the calling station Id of a network client ( it's a MAC auth so the User-Name=Calling-Station-Id below). The procedure then queries various back end database tables to figure out which vlan to drop the client into based upon where it is on the network and the type of client it is. Once I've got the vlan back I can decide whether to use RFC 3580 or RFC 4675 when creating the attributes to pass back in the access-accept packet. Only problem is figuring out how to format the unlang statement. Elsewhere in my sites-enable/default file I've got if ( "%{sql:SELECT count(*) from banned_macs where mac_address=UPPER(TRIM('%{Calling-Station-Id}'))}" > "0" ) { update control { Auth-Type := Reject } update reply { Reply-Message := "quarantined, contact ITSO" } } which works just fine and I can block specific mac addresses from connecting to our wired network. In this case I've got Tmp-String-0 := "%{sql:call get_vlan_id('%{NAS-IP-Address}','%{User-Name}')}" get_vlan_id accepts two varchar arguments. Which, when I run radiusd -X -d /etc/freeradius gives me /etc/freeradius/sites-enabled/default[248]: Unknown action '%{sql:CALL get_vlan_id('%{NAS-IP-Address}','%{User-Name}')}'. I found a message on the list that says ………. call a stored procedure by using "%{<call the stored proc in here>}" Well, from a mysql cli I'd type call get_vlan_id(…….) to run the stored procedure. Rgds Alex

2 3

Authenticate SSH users against Freeradius
by Roberto Carna 20 May '13

20 May '13

Dear, I have: (A) One Freeradius server on Debian 6: freeradius installation and client.conf configuration (B) Another Debian 6 box with sshd:* *libpam-radius-auth installation (C) Several Windows and Linux ssh clients In (A) freeradius server, can I define the ssh users in client.conf file only ??? In (B) debian sshd box server, do I have to install a radius client in addition to libpam-radius-auth package ??? And do I have to define any ssh user here ??? Please, I need a good howto because I'm lost. Thanks a lot, Roberto

2 1

Unlang clarification
by David Peterson 20 May '13

20 May '13

I am fighting a buggy NAS and was told to add to the /sites-enabled/default file in the post-auth section this code: EAP-Message = "0x04040004" User-Name !* 0x00 Message-Authenticator = "%{Message-Authenticator}" Can someone clarify what this would actually do to the EAP response? David

4 5

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 20 May '13

20 May '13

Thanks Alan, It takes literary a second or so for a single client auth, but problems arise with multiple clients. I'll reset a card on the switch and capture the logs and see what's happening. Nothing as far as I remember pointed towards the ntlm_auth being the issue, it was the failure to complete the eap transaction that seemed to be the problem, but then I didn't scan each and every line to be honest. I'll post back. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 18 May 2013 13:37 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: > ... It worked brilliantly in testing, but come > production, when i reboot the switch or clear the authentication on the > ports it can take up to ten minutes for 10-15 clients to authenticate, That's bad. 10-15 clients should be done in a second or so. My guess is that the ntlm_auth process is taking a *long* time. Maybe your DNS settings are broken. Set up a test server. Run it in debugging mode and see. If the authentication takes more than a second or so (wtih debug messages), something is wrong. > - Synch the content of the AD OU I have the mac address "users" in to an > SQL database, maybe using vbscript/.net, including any state information > like whether the account is disabled or expired and test against these > custom fields during authentication. That will work for MS-CHAP. Not for CHAP. > The authorisation process I > currently have running against ldap doesn't pick up the account > information being expired, maybe I need to look into this. I want to be > able ideally to feed information back following a successful > authentication to a custom attribute in AD, which is quite possible with > an SQL database as an "intermediary", for example switch and port ID, > useful stuff to know. I can't think of any native linux apps that can > change AD attributes, excluding samba doing groups and passwords, maybe > there is one? A normal LDAP client should work. > - Use ldap as an authentication method? I know that AD will never give > me back a password, but since this is mac authentication I was wondering > if in the authorisation bit of the virtual server I could update the > cleartext-password attribute based on the username as the two details > are always identical in mac based auth, and then perform authentication > with a known password. Maybe this would pick up locked usernames > instead, again not sure about MS ldap in this area, never tried. If it's MAC authentication, then FreeRADIUS can do the CHAP checking itself. And there's no point in doing *more* authentication. The only reasonable thing to do is various checks in LDAP for the MAC address. > - use nps as a proxy for the authentication. I don't really want to do > this, but nps will (I think) allow chap / AD authentication. No, it won't. It's impossible. > Any ideas which of these / other would be the right direction to follow? > Need to do this in a hurry as the next switch is rolling out soon so > don't have time to look into all of them.. Step 1: find out what's wrong with the current system. If something is broken, fix it. Don't work around the problem. That makes it worse. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

reference to check items using unlang
by Nasser Heidari 20 May '13

20 May '13

Hi All, How can I reference to check items using unlang? When I use perl script , simply reference it by $RAD_CHECK. For example I want to check if there is a check item in sql user profile , then do some actions using unlang and if not then ignore it. By the way I know that I can do that by querying sql in unlang but I wondering if there is a better way for doing that. Could you please help me? Regards, Nasser

3 3

unlang equivalent of radlog
by Nasser Heidari 20 May '13

20 May '13

Hi, I have several Perl modules running on my Radius server, I'm going to remove them all and use unlang instead. I have two questions: 1- The reason that I'm going to change Perl modules with unlang is Performance ! I think unlang should have better performance in comparison to Perl (Note that I have some mysql queries in my perl modules), is this correct? 2- I have used &radius::radlog in my perl modules to log some cases on radius.log, is there any equivalent for it in unlang? Could you please kindly give an example? Regards, Nasser

3 3

Re: Using return-output from external script as reply-message
by S y s C o / developer 18 May '13

18 May '13

Hello Stephan, hello Alan, Have a look at the last beta version (http://www.1-2-3-4-5-6.net/multiotp/beta/) you can now set a prefix for the debug mode. for example to be able to handle response by the radius server ;-) To set this option : multiotp -config debug-prefix="Reply-Message := " Any feedback welcome Best regards, Andre Liechti Stefan Kuegler wrote: > exec multiotp { > wait = yes > input_pairs = request > output_pairs = reply > > That says the script output is a series of "Attribute = Value" lines. > > ...and activated this module in the authentication-section of the > default-configuration (and also in the inner-tunnel-configuration): > > authenticate { > [...] > Auth-Type MultiOTP { > update reply { > Reply-Message = "Hello, %{User-Name}" > } > multiotp > } Alan DeKok wrote: > Update sections should generally be in post-auth, but... whatever. > >> The external script gives me additional informations (like "OK: Token >> accepted", "INFO: Authentication failed" etc.) after authentication. > > Which isn't in "Attribute = Value" form, and is therefore ignored. > > Yes. Fix the script to send: > > Reply-Message := "... text ... "

1 0

Help with chap
by Franks Andy (RLZ) IT Systems Engineer 18 May '13

18 May '13

Hi, I seem to frequent this forum, hopefully one day I'll be answering some questions, not asking them. I've recently got into mac based auth on a procurve 5406. It does either chap or peap-mschap authentication, and i'm using ntlm_auth for the mschap2 when using peap. It worked brilliantly in testing, but come production, when i reboot the switch or clear the authentication on the ports it can take up to ten minutes for 10-15 clients to authenticate, simply because the nas (i guess) gets overwhelmed and consequently I see loads of "eap did not complete" messages. These don't happen for individual transactions - they always complete fine. I can't see a way around this - we have loads of these switches.. So the question is the best way to use chap. I can't do it with ntlm_auth - so I thought of a few, possibly ridiculous options : - Synch the content of the AD OU I have the mac address "users" in to an SQL database, maybe using vbscript/.net, including any state information like whether the account is disabled or expired and test against these custom fields during authentication. The authorisation process I currently have running against ldap doesn't pick up the account information being expired, maybe I need to look into this. I want to be able ideally to feed information back following a successful authentication to a custom attribute in AD, which is quite possible with an SQL database as an "intermediary", for example switch and port ID, useful stuff to know. I can't think of any native linux apps that can change AD attributes, excluding samba doing groups and passwords, maybe there is one? - Use ldap as an authentication method? I know that AD will never give me back a password, but since this is mac authentication I was wondering if in the authorisation bit of the virtual server I could update the cleartext-password attribute based on the username as the two details are always identical in mac based auth, and then perform authentication with a known password. Maybe this would pick up locked usernames instead, again not sure about MS ldap in this area, never tried. - use nps as a proxy for the authentication. I don't really want to do this, but nps will (I think) allow chap / AD authentication. Any ideas which of these / other would be the right direction to follow? Need to do this in a hurry as the next switch is rolling out soon so don't have time to look into all of them.. Thanks Andy

3 2