- Freeradius-Users - lists.freeradius.org

Global User Blacklist
by David Aldwinckle 31 Jul '12

31 Jul '12

Hello folks, I am trying to devise the best way to configure a global blacklist in freeradius. In the current configuration, I am handling a number of different authentication types with various virtual servers. For PEAP, I have integrated active directory, and for the other services, I use LDAP. Since LDAP makes group checking very easy, I was hoping that I could leverage that for my blacklisting needs. So, my question is: Is it possible to do LDAP group checking in post-auth of the default server even if the request is EAP? Cheers, Dave

3 7

Re: Prompt for new password on mac 10.7 after change with 2.1.12 ?
by Jonathan Paul 31 Jul '12

31 Jul '12

I have allow_retry = yes in /etc/raddb/modules/mschap and send_error = yes in the mschapv2 section of /etc/raddb/eap.conf I am not seeing any change in behavior from the mac, it doesn't even prompt for a new username/password so I must be missing something else Jonathan >>> alan buxey 07/30/12 5:14 PM >>> Hi, > Allow EAP-MSCHAPv2 to send error message to client. This change allows > some clients to prompt the user for a new password. See raddb/eap.conf, > mschapv2 section, "send_error". you need to enable the function in the mschap module AND in the eap.conf I'm not sure whether there was another little bugette in that code that slipped by which recently got fixed in the 3.0 pre-release? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Acct-Status-Type
by Khapare Joshi 31 Jul '12

31 Jul '12

hi all, I see Acct-Status-Type = Interim-Update in my detail log. does it mean Acct-Status-Type = Alive ? K

3 4

OCSP
by Maja Wolniewicz 31 Jul '12

31 Jul '12

Hi, I'm getting a segmentation fault when a user certificate is verified, OCSP is switched on and OCSP responder does not set the next update. Then in src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c the OCSP_resp_find_status returns null for nextupd and ASN1_GENERALIZEDTIME_print(bio_out, nextupd) call fails causing this segmentation fault. Embedding this call with if (nextupd) {} helps. I checked that the same issue occurs with the git version. Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

2 1

Prompt for new password on mac 10.7 after change with 2.1.12 ?
by Jonathan Paul 30 Jul '12

30 Jul '12

Hi, We are running a freeradius 2.1.12 server for access to our wifi. The server is configured to authenticate users through ldap back to our Novell Edirectory. We are required to change our passwords every 6 months. The password change occurs, but users are not prompted for this new password on their mac when they try to get on the wifi the next time. We were previously running 2.1.10 and built a new server this summer as I was under the impression this was supposed to be fixed in this version. Is there a config change necessary to prompt for a new password when authentication fails ? Thanks Jonathan Paul Network Support Services

3 3

Invalid Authenticator... i.e. "munged" nt-key from Winbindd ...
by Robert Roll 30 Jul '12

30 Jul '12

Yes, I know this is really a Samba problem. I'm asking on this list because I really feel that a number of the users of ntlm_auth, winbindd are Radius admins. This is in regards to the "munged" nt-key bug in Winbindd. Most of the suggestions have been to simply upgrade Samba. From my reading, this all seems to go back to Samba 3.2.X'ish ? Well we are(were) running Samba 3.5.6. I figured that was relatively safe? Actually, I had noticed that the bug did still seem to exist, but would only occur after running Winbindd for a "while". I found other admins on the net reporting the same thing. We all seemed to adopt the same solution. Simply re-start Winbindd when the problem arose. This scheme worked very well for over a year. Then around 16:40 last Friday afternoon, something in our environment changed and this "bug" seemed to get tweaked all of the time. The radius servers just seemed to start to melt down. Actually, after a few hours 4 of 10 of our backend servers seemed to find a somewhat "stable" situation. In any case, I tried installing an older version of Samba 3.0.31 as there was some reference that nobody had seemed to see this problem with that version. However, that version did not do authentication at all against our win2008R2 directories. I found a bug report about that, and it basically said, "yes we know, we don't intend to fix it in 3.0.31 as that is an old version, upgrade". So, in any case, I did upgrade to the latest Samba 3.5.16 and things "seem" to be working now. After all said above, my real question is, has anybody seen anything somewhat definitive on this bug that would indicate the source of the problem has really been found and fixed ? Or, does it just seem that other changes to Winbindd have just "seemed" to make this bug go away (or hide better) ? The reason I ask, is that we use Freeradius here and we are a large R1 University with associated medical center. Our radius architecture is beginning to support not only the Campus, but the medical center as well. The plan is to really bring ALL of the medical center Wireless that requires authentication into our Freeradius architecture. Believe it or not, there are becoming more and more medical devices that are starting to have some wireless capabilities now. >From what I can tell, most of the use is to simply gather data about the device and ship it off to some master data gathering tool for analysis at a later time. However, I'm not sure, but some EKG devices in the future might start using this to actually ship the EKG results in real time to a doctor that is actually remotely located. This and other potential real time uses start to scare me a bit ??? I know that these devices should have some other backup capabilities for transmitting the data, but...... Thanks, Robert Robert Roll Computer Professional University of Utah (801) 581-7655

3 3

Abwesenheit (was: Freeradius Installation Challenges)
by tietjen 29 Jul '12

29 Jul '12

Vom 21. Juli bis einschl. 12. August bin ich nicht erreichbar (Urlaub). Bitte beachten Sie, daß von mir keine eingehenden E-Mails bearbeitet werden können. Vertretung: Hr. Brinkmann, Tel. 040-7410-56129, brinkmann(a)uke.de Hr. Werner, Tel. 040-7410-59630, k.werner(a)uke.de Vielen Dank für Ihr Verständnis. Diese Mail wird nicht weitergeleitet. Jan Tietjen

7 20

Session-Timeout
by Klaus Klein 28 Jul '12

28 Jul '12

Hi Folks, I'm in the process to setup a WPA(2)-Enterprise (IEEE 802.1X) protected WLAN. I choose FreeRADIUS (2.1.10) with a EAP-TLS to authenticate and control the access to the network. While everything works so far, I just can't get the Session-Timeout to work. If I start 'freeradius -X' I can see that FreeRADIUS sends the Session-Timeout information with the Access-Accept message. Also if I limit the Login-Time (e.g. Login-Time := "Wk0000-1500") and the remaining time is less then the Session-Timeout, the remaining time is send as a Session-Timeout. Nevertheless, after the session times out, no reauthentication takes place and the client stays connected to the network. As this behavior happens with all (two) APs I've got, I'm not sure where to locate the problem.(FreeRADIUS, AP or Client (Debian Squeeze with wpa_supplicant)) Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side? Thanks, Klaus

3 5

[Freeradius-Dialupadmin] "NAS Ports Number"
by Osvaldo T Crispim Filho 28 Jul '12

28 Jul '12

Greetings to all! I wonder if this is the correct list to talk about the Freeradius-Dialupadmin. If so, I wonder to what refers to the port number in registration of NAS (Radius Client). Is this for snmp communication? "NAS Ports Number" If not here the correct place ... Excuse me! Thank you.

2 1

Avoid locked Active Directory Account when using PAP/krb5 against active directory
by Thomas Glanzmann 28 Jul '12

28 Jul '12

Hello, I have Citrix Netscaler which authenticates user against active directory with PAP. First against Active Directory using krb5 and second against smsotp using a PAP Access challenge. If someone knows a username he can type in multiple times the right username with the wrong password and can so lock the account in active directory. Now I'm looking for solutions to avoid that. Is there a FreeRadius Module which accounts the login failures of another FreeRadius Module (krb5) within a given time range and stops prompting the underlying FreeRadius Module (krb5) if a user has authenticated itself for example 3 times within one hour, if not whatever practical solutions do you have in mind? Cheers, Thomas

2 2