- Freeradius-Users - lists.freeradius.org

mschap module vs ntlm_auth module
by Óscar Remírez de Ganuza Satrústegui 06 Mar '13

06 Mar '13

Good afternoon, As I said some days ago in this list, we have configured our freeradius server to use ntlm_auth for autentication following the document: http://deployingradius.com/documents/configuration/active_directory.html Everything is working as expected. Thanks! But I have some doubts about that documentation. In section "Configuring FreeRADIUS to use ntlm_auth" is said to "to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file." I have made some tests and it seems that is not needed to add it, as freeradius is using mschap module to autenticate. +- entering group MS-CHAP {...} [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> oscarrdg [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=oscarrdg [mschap] mschap1: b9 [mschap] expand: %{mschap:Challenge} -> b9415739df3a9c1b [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=b9415739df3a9c1b [mschap] expand: %{mschap:NT-Response} -> 2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 Exec-Program output: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program-Wait: plaintext: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program: returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok Is there anything else to take into account considering adding that section to the virtual servers configuration or not? Or is it just needed when Auth-Type is set to ntlm_auth manually in order to test the system? I usually prefer to let config files as similar to the default files as posible. Thank you so much for your help. Regards, * Oscar Remírez de Ganuza Satrústegui* Servicios Informáticos (Área de Infraestructuras) Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.es/SI/

3 3

design question
by Matt Zagrabelny 06 Mar '13

06 Mar '13

Greetings, I am configuring a general purpose RADIUS server that any number of clients can connect to for authn - it uses a PostgreSQL DB as the backend datastore. I would also like to setup a secondary RADIUS server listening on a different port (ie. 1814) and use the same Pg DB as a backend, but use a "restricted" view as the "users" table, then configure devices (certain network gear) that wish to only allow users in the "restricted" view to use that secondary RADIUS server and corresponding port. I am currently using Debian 6.0 with corresponding FR 2.1.10+dfsg-2+squeeze1. My questions are these: Has anyone here setup a second instance of FR running on the same system as their primary instance, but with different configs? Do you have any suggestions for layout or keeping configs/logs straight? Or said another way, how much confusion will there be in /etc/freeradius (default Debian config dir) due to the second instance? Is it worth it, just to have a single system have all of your RADIUS servers or should I just stand up another virtual server and use that instead? Thanks for any help or hints! -matt zagrabelny

3 7

Help
by Jed Gainer 06 Mar '13

06 Mar '13

Help

3 3

Thank You freeRADIUS!
by Thomas Simmons 06 Mar '13

06 Mar '13

Hello All, I have been working on a pretty major upgrade of the "core authentication system" at my company. The original system was designed and deployed by me nearly a decade ago, and was built around Samba3, OpenLDAP and freeRADIUS 1. Until I started the upgrade, I was unaware of the new capabilities of freeRADIUS 2, namely virtual servers. To be honest, when I started a few months back it was primarily for the functionality of Samba 4 (Active Directory). That said, when I became aware of the capabilities of freeRADIUS 2, it gave me some great ideas about authentication.Until now, we had a simple internal network where people could login with their Samba3 credentials and a external (connected to our DMZ) network that just used WPA2-PSK. I never liked this setup for two reasons: 1) anyone could bring their own device and connect to our internal network (it's gotten really bad since smartphones and tablets became the new craze) and 2) we have a large number of employees that are off-site, but come on-site regularly. These employees always want to connect to our main network with non-or-other-company systems since using their domain credentials is easier. In any event, I really started digging into freeRADIUS 2 over the last week and now have an internal network that does AD auth (user or computer) w/ MAC restrictions and an external network that does both AD auth and has a "guest" account in a file (I may change this to MySQL and create a small web interface so employees can create a temporary, self-expiring account for guests). The only hiccup I ran into along the way was Microsoft's client not liking wildcard certs, so I can say it was a very smooth process from a freeRADIUS perspective. Now I'm starting to think how can we push this out to a few other sites we have across the country. Pretty easily actually! Anyhow, I just wanted to give a big thank you to Mr. DeKok and anyone else who works on freeRADIUS or helps on the lists. As a lllloooonnngggg time user, your efforts are very much appreciated here! Thanks, Thomas

1 0

freeradius2.2.1 rpm build
by Fred MAISON 06 Mar '13

06 Mar '13

Hi all, I have make a build unsing Suse spec, I saw it is binded to SOURCES/freeradius-server-2.2.0.tar.bz2. Is there any way to create SOURCES/freeradius-server-2.2.1.tar.bz2 after following sequence : git clone git://git.freeradius.org/freeradius-server.git git fetch origin v2.x.x:v2.x.x git checkout v2.x.x ? Does a tar cvfj could be OK ? Best regards , Fred MAISON

1 0

Is updating RAD_CHECK attribute take effect on replay attribute
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

If in section of sites-enabled file ( such as : authorize - authenticate - preacct - accounting - checksimul - post_auth and ..) i update some RAD_CHECK control attribute such as Pool-Name it is take effect on Framed -ip address replay attribute ? Is it matter that in which section i update RAD_CHECK control attribute ?

1 0

overlapping cisco avpairs (UCS+IOS)
by Jimmy Stewpot 06 Mar '13

06 Mar '13

Hello, For some time we have been using freeradius to provide authentication to our networking estate. Recently we introduced the Cisco UCS. The problem that we now have is it appears that we have a conflict in the VSA attributes required to provide the right levels of access to end users. We have always had the Cisco-AVPAIR of "shell:priv-lvl=15" which has been working for some time. With the Cisco UCS platform we need to introduce an additional shell: variable which looks like this "shell:roles=admin". I have tried to add the variables to our users file with a += but the values are never accepted by the end Cisco device. It seems that only the first-to-be-received is actually activated on the Cisco device. I have bene playing around with various formats in the users file without any success. I am interested to know if anyone else has had such issues and if so what the solution is? I am currently running with Freeradius v2.1.12 provided as a part of the Redhat EL6 distro. We have our users in an Active Directory tree using the ldap plugin. our users file looks like this currently. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15" I've tried the following DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15, roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15,roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15", Cisco-AVPAIR+="shell:roles=admin" - Works with the switch/router estate but not with UCS. If i do a debug on the device it always matches the first entry in the returned attributes and discards the second. If I remove the priv-lvl=15 and only have shell:roles=admin and it works for UCS but the switch and router estate fails. Any assistance would be greatly appreciated. Regards, Jimmy.

3 2

Re: Freeradius 2.2.0 memory leak issue.
by Alan Buxey 06 Mar '13

06 Mar '13

Have you tried the latest 2.2 GIT release? Many code updates alan

3 2

Re: overlapping cisco avpairs (UCS+IOS)
by Alan Buxey 06 Mar '13

06 Mar '13

If request is from UCS then reply with the required UCS reply attribute, else send back your old reply attribute. This can be done by either using the client-identifier attribute and unlang, or by using a new virtual-server instance... well, it can actually be done by at least another 3 ways but they are the 2 methods I'd choose from Alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: schema.sql for postgresql >> problem in raduser group table
by Alan Buxey 06 Mar '13

06 Mar '13

Do YOU need a primary key? alan

1 0