- Freeradius-Users - lists.freeradius.org

rlm_passwd help
by David Brodrick 17 Apr '13

17 Apr '13

Hi, We're experimenting with freeradius for authenticating users in a custom application. It was straightforward to get this authenticating against the OS: DEFAULT Auth-Type = System But what we want to do is maintain a list of usernames and crypt passwords in an external file, separate to the operating system users. The rlm_passwd module should do what we want but I'm having some trouble getting it to work. In the radiusd.conf modules section I have: passwd our_passwd { filename = /tmp/testpwd format = "*User-Name:Crypt-Password" hashsize = 100 ignorenislike = no allowmultiplekeys = no } In sites-enabled/default I added "our_passwd" to the authorize section. I think that part is essentially working and on my random walks running freeradius -X it looks like it is reading our passwd file okay. The thing I do not understand is what to put as the Auth-Type in the users file in order to authenticate against our file rather than against the OS? Any advice would be greatly appreciated. Thanks, Dave

2 3

Re: Setting different IDLE-TIMEOUTS based on IP Address
by Alan Buxey 17 Apr '13

17 Apr '13

If your NAS can take such a value then it can be assigned. Either via eg users file and huntgroup or via eg unlang if(%{NAS-Ip-Address} == "192.168.1.1") { update reply { Attribute = XYZ } } ..'man unlang' for more info alan

6 15

Re: Setting different IDLE-TIMEOUTS based on IP Address
by Alan Buxey 17 Apr '13

17 Apr '13

Use any one of the clients.conf methods that were mentioned yesterday with some unlang and this would be working already. I seem to recall that huntgroups might be going the way if the dodo(?) It doesn't do regex methods because its older... pre 1.0 code alan

1 0

FreeRADIUS using InnoDB.
by Antonio Fernández Pérez 17 Apr '13

17 Apr '13

Hi everybody, Are there any problem known about FreeRADIUS use with InnoDB as engine of MySQL? I know that FreeRADIUS has been developed for using MyISAM as engine but I think that could improve FreeRADIUS' performance. Any ideas? Thanks everybody. Best regards, Antonio Fernández.

3 2

Volume Control
by Russell Mike 17 Apr '13

17 Apr '13

Dear Alan D. What Freeraidus is using currently as to keep track. Is it 64bit or 32bit. Thanks / Regards

3 6

Trimming character of variables within configuration files
by P. Manton 17 Apr '13

17 Apr '13

Is there a way I could trim a variable (such as a password variable) within a configuration file. I saw a few examples manipulating variables using unlang here: http://freeradius.org/radiusd/man/unlang.html#lbAB but could not find anything about trimming variables. For example I have the following /etc/freeradius/ntlm_auth # # For testing ntlm_auth authentication with PAP. # # If you have problems with authentication failing, even when the # password is good, it may be a bug in Samba: # # https://bugzilla.samba.org/show_bug.cgi?id=6563 # exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=TEST.DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } The password variable input initially has an authentication code appended to the password and hence needs to be trimmed of the password variable so it authenticates with AD correctly. So e.g. the input password is: 'testing123456' - but needs to be trimmed to 'testing'

5 9

Setting different IDLE-TIMEOUTS based on IP Address
by John Giordano 16 Apr '13

16 Apr '13

Hi, So I have done a fair amount of RTFM'ing and search engining but am stumped. Perhaps someone on this list has successfully done what we are trying to do: Have our FreeRADIUS Server assign a different IDLE-TIMEOUT Value based on what IP Address is contacting the RADIUS server. OS: CentOS 5.8 FreeRADIUS Version: 2-2.1.12-4.el5_8 We have FreeRADIUS working fine (it has been a rock in fact and is running under Daniel Bernstein's daemontools). We just need to add this functionality as some of our network gear needs to have a different IDLE TIMEOUT than others. Is this possible? Thanks much, Jg

1 0

unsubscribe
by Julson, Jim 16 Apr '13

16 Apr '13

Jim C. Julson Sr. Network & Systems Administrator C 208.995.3297 jjulson(a)marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com/symposium-spring-2013.pdf> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.

1 0

Freeradius +LDAP + Samba integrates to Active Derectory
by John 15 Apr '13

15 Apr '13

Hi all, We deploy freeradius integrated to Active Directory, but the AD enabled "Require signing" option (see the attachement). net join is OK after we set "LDAP SASL wrapping" to 'sign'. But LDAP search failed. Is there a way to let LDAP search work? Can someone show me some reference or guide? Thanks, John

2 2

EAP-SIM simulation, how does Freeradius calculate MAC value in AT_MAC attribute
by Tabibel Sami 13 Apr '13

13 Apr '13

Hi, I am working on the implementation of an EAP-SIM supplicant, when i send to freeradius a EAP-Response/SIM/Start packet i receive as expected an EAP-Resquest/SIM/Challenge with AT_RAND (RAND value was specified in users file [2]) and AT_MAC, after this I should calculate MAC value and test if this value matches witch AT_MAC value sent by freeradius. my question is how freeradius calculate MAC value in AT_MAC atribute ? or from wich source freeradius fill MAC value in the AT_MAC attribute ? [2]: my eap-sim user is set in users file as below : 1262074920549791 Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x39900000000000000000000000000000, EAP-Sim-SRES1 = 0x30112233, EAP-Sim-KC1 = 0x445566778899AABB, EAP-Sim-Rand2 = 0x31000000000000000000000000000000, EAP-Sim-SRES2 = 0x31112233, EAP-Sim-KC2 = 0x445566778899AABB, EAP-Sim-Rand3 = 0x32000000000000000000000000000000, EAP-Sim-SRES3 = 0x32112233, EAP-Sim-KC3 = 0x445566778899AABB Thank you in advance, Best regards. -- Sami

1 0