October 2005 - Freeradius-Users - lists.freeradius.org

Re: clients.conf problem
by dev_null 15 Oct '05

15 Oct '05

Strange, I don't know why it won't work to me. Ok. Never mind. Thanks ----- Original Message Follows ----- > I've tested that config, and ones with 500K clients. They all work > for me. > > Alan DeKok. > -- Naručite svoj XXLadsl - instalacija i modem i dalje za samo 1 kn! Postanite i vi korisnik ultra brzog Interneta! http://www.iskon.biz/xxladsl

3 2

Rejecting auth requests
by Tim O'Donovan 15 Oct '05

15 Oct '05

Hi, Does anyone know of a simple way to invoke an Access-Reject for a user at the authenticate stage? Without changing the stored password. I have tried altering the 'op' to != and all manner of other combinations from within the rad_check table without success. We would just like to be able to ban/unban a user with a single SQL update statement. Kind regards, Tim O'Donovan

3 3

Login incorrect
by Andrea Bencini 15 Oct '05

15 Oct '05

I install FC4 with FreeRadius-1.0.4 and I have Colubris Network CN3000. My Colubris dasn't login (the messages, clients.conf and users configurations are below) In the Colubris I put "andreabencini" password. -------------------------------- MESSAGES . . . Sat Oct 15 17:10:10 2005 : Debug: Waking up in 31 seconds... Sat Oct 15 17:10:10 2005 : Debug: Thread 4 got semaphore Sat Oct 15 17:10:10 2005 : Debug: Thread 4 handling request 3, (1 handled so far) Acct-Session-Id = "67de5136" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "L005-00076" Calling-Station-Id = "00-02-2D-A6-01-E9" Called-Station-Id = "00-03-52-00-0D-E8" Framed-IP-Address = 10.100.0.37 EAP-Message = 0x02c1002004109013bf17eda858f4a4bcb624e2b5f09e4c3030352d3030303736 State = 0x3fc4e80ba3884fe8c338f3da57f4b36f NAS-Identifier = "L005-00076" NAS-IP-Address = 10.100.0.37 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Administrative-User Message-Authenticator = 0x92496a7f16273b8a17e589ca0527f580 Sat Oct 15 17:10:10 2005 : Debug: Processing the authorize section of radiusd.conf Sat Oct 15 17:10:10 2005 : Debug: modcall: entering group authorize for request 3 . . . Sat Oct 15 17:10:10 2005 : Debug: rad_check_password: Found Auth-Type EAP Sat Oct 15 17:10:10 2005 : Debug: auth: type "EAP" Sat Oct 15 17:10:10 2005 : Debug: Processing the authenticate section of radiusd.conf Sat Oct 15 17:10:10 2005 : Debug: modcall: entering group authenticate for request 3 Sat Oct 15 17:10:10 2005 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 3 Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: Request found, released from the list Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: EAP/md5 Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: processing type md5 Sat Oct 15 17:10:10 2005 : Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: Handler failed in EAP/md5 Sat Oct 15 17:10:10 2005 : Debug: rlm_eap: Failed in EAP select Sat Oct 15 17:10:10 2005 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 3 Sat Oct 15 17:10:10 2005 : Debug: modcall[authenticate]: module "eap" returns invalid for request 3 Sat Oct 15 17:10:10 2005 : Debug: modcall: group authenticate returns invalid for request 3 Sat Oct 15 17:10:10 2005 : Debug: auth: Failed to validate the user. Sat Oct 15 17:10:10 2005 : Auth: Login incorrect: [L005-00076/<no User-Password attribute>] (from client miarete-privata port 0 cli 00-02-2D-A6-01-E9) Sat Oct 15 17:10:10 2005 : Debug: Delaying request 3 for 1 seconds Sat Oct 15 17:10:10 2005 : Debug: Finished request 3 Sat Oct 15 17:10:10 2005 : Debug: Going to the next request CLIENTS.CONF client 10.100.0.37 { secret = andreabencini shortname = miarete-privata } USERS L005-0076 User-Password == "andreabencini" -------------------------------- Can you help me thank Andrea

2 1

auditing / biling users
by Infusino, Michael - ADP Dataphile 15 Oct '05

15 Oct '05

Hello, Would anyone have an idea on how to record the time the user logs in and more importantly the time the user logs off/disconnects from the system. I would prefer the information to be logged in the radius log file specified in the radiusd.conf. I am using the password/nis file for authentication. Thanks michael _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

FreeRadius/PEAP
by James Taylor 15 Oct '05

15 Oct '05

Hi, I am trying to secure my wireless connections using PEAP-TLS MSChapv2 to authenticate users against my Linux /etc/shadow; /etc/password/; and /etc/group files. I would like to use PAM but UNIX will work too. I do not want to use the USERS file as it stores passwords in clear text and that is what we are trying to avoid. All my tests conclude that this functionality will not work. I am able to Auth just fine using the USERS file with a username and password. Any info or direction would be greatly appreciated. Thank you James

6 9

rlm_exec for diferent users
by Miguel 14 Oct '05

14 Oct '05

Hi, how can i run diferent scripts depending on the usergroup of the username? According to the documentation: in radiusd.conf i can define diferent rlm_exec scripts: modules { exec tariff { program = "/path/to/program/tariff" wait = yes input_pairs = request output_pairs = reply } [...] exec billing { program = "/path/to/program/billing" wait = yes input_pairs = request output_pairs = reply } [...] } authorize { [...] exec [...] } So, _every_ user will execute both scripts, i want that user a from usergroup tariff execute the script tariff, user b from usergroup billing execute script billing, etc Right now im doing it with radgroupreply and exec-program-wait, but this is depreciated, isnt it? what options did you leave me?, to check this inside every script? thanks

1 0

Group checking - Radius AVP retrieval
by lenirsantiago＠yahoo.com 14 Oct '05

14 Oct '05

Hello list, Radius authentication works fine. The problem is after, when my radiusclient/application sends another radius Access-Request message but without the User-Password field and freeradius complains that it requires it since we are using Digest. What the radiusclient is trying to do is find out if a user (in this case 1000) belongs to a specific group. In /etc/raddb/users file I have the following at line 152: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Group-Check, Auth-Type := None DEFAULT Service-Type == SIP-Callee-AVPs, Auth-Type := None ----- These are mysql tables: +----+----------+-----------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------+ | 1 | Jhassell | Password | == | changeme | | 2 | Rneis | Password | == | changeme | | 3 | 1000 | Password | == | 1000 | | 4 | 2000 | Password | == | 2000 | | 5 | 3000 | Password | == | 3000 | | 8 | 1000 | Auth-Type | := | Digest | +----+----------+-----------+----+----------+ +----+-----------+-----------+----+--------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+--------+ | 6 | Dialin | Auth-Type | := | Accept | +----+-----------+-----------+----+--------+ +----+-----------+---------------+----+----------------------------------+-- ----+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+---------------+----+----------------------------------+-- ----+ | 1 | Dialin | Reply-Message | = | "Authenticated by group Dialin" | 0 | | 2 | Dialin2 | Reply-Message | = | "Authenticated by group Dialin2" | 0 | +----+-----------+---------------+----+----------------------------------+-- ----+ +----+----------+---------------+----+------------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+------------------+ | 1 | 1000 | Reply-Message | = | "Authenticated" | | 2 | 1000 | Sip-Group | = | Dialin | | 3 | 1000 | SIP-AVP | = | Sip-Group:Dialin | +----+----------+---------------+----+------------------+ +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 1 | Jhassell | Dialin | | 2 | Rneis | Staticdial | | 3 | 1000 | Dialin | | 4 | 2000 | Dialin | | 5 | 3000 | Dialin | | 6 | 3000 | Dialin2 | +----+----------+------------+ ------ This is the debug I get from freeradius for the group check: rad_recv: Access-Request packet from host xx.xx.xx.xx:33025, id=15, length=67 User-Name = "1000(a)xx.xx.xx.xx" Sip-Group = "Dialin2" Service-Type = Group-Check NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 74 modcall[authorize]: module "preprocess" returns ok for request 74 modcall[authorize]: module "chap" returns noop for request 74 modcall[authorize]: module "mschap" returns noop for request 74 modcall[authorize]: module "digest" returns noop for request 74 rlm_realm: Looking up realm "xx.xx.xx.xx" for User-Name = "1000(a)xx.xx.xx.xx" rlm_realm: Found realm "xx.xx.xx.xx" rlm_realm: Adding Stripped-User-Name = "1000" rlm_realm: Proxying request from user 1000 to realm xx.xx.xx.xx rlm_realm: Adding Realm = "xx.xx.xx.xx" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 74 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 74 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 158 modcall[authorize]: module "files" returns ok for request 74 radius_xlat: '1000' rlm_sql (sql): sql_set_user escaped user --> '1000' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 74 modcall: group authorize returns ok for request 74 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 74 ERROR: No Digest-Nonce: Cannot perform Digest authentication modcall[authenticate]: module "digest" returns invalid for request 74 modcall: group authenticate returns invalid for request 74 auth: Failed to validate the user. Delaying request 74 for 1 seconds Finished request 74 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to xx.xx.xx.xx:33025 Reply-Message = "Authenticated" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 74 ID 15 with timestamp 434f1121 Nothing to do. Sleeping until we see a request. Any help in this matter would be deeply appreciated, thanks Lenir

3 2

Simultaneous Use question
by Miguel 14 Oct '05

14 Oct '05

Hi, at what time is the user included in the radutmp file, in the authentication process or after a successful connection? I mean, if i agree with some friend and make at the same time (well, almost...., supose 30 seconds delay from one call to another) a connection attemp, both will be authenticated by the nas, or there is some way to know in advance that an authentication is in progress and deny any other for that user? I've verified im having this problem, i use freeradius + postgres for my voip solution, with the wonderful pgsql-voip scripts from Peter, if a pin has an active call, nobody can make another call, but in the seconds when the ivr is telling the user "please enter your card number blablabla....", you are allowed to call the access number and interact with the ivr too, and if both users enter the same valid pin, both calls are established. Am i confusing or missing something??? I can give you more details if you need it. thanks

1 0

Freeradius, Ldap, and static IPs for users.
by Terry J Fike Jr 14 Oct '05

14 Oct '05

Hello All, I'm trying to figure out how to get a static ip to only show up on a DSL login, and not a Dial-up. I'm using Freeradius 1.0.1 and OpenLdap 2.1.30. The only changes in the radiusd.conf is to bind to an ip and port and turn off radutmp and radwtmp I have a huntgroup for the dial-up that allows me to differentiate between the dial and dsl based on the radiusGroupName without any problems. But now i need to be able to let a DSL user with a static ip be able to log in via dial-up and pull a dynamic ip. Is this possible and how do i do it (or for that matter, what docs might even point me in the right direction) i'm not seeing much on this in my searches. my huntgroups.conf is like this: dialup NAS-IP-Address == ip of nas device in my users file i have this: DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Huntgroup-Name == dialup, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl128, User-Profile :="uid=dsl128,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl256, User-Profile :="uid=dsl256,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl512, User-Profile :="uid=dsl512,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl768, User-Profile :="uid=dsl768,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl4m, User-Profile :="uid=dsl4m,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl8m, User-Profile :="uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." the ldap user i'm testing this all with looks like this: dn: uid=tfike,ou=People,dc=mtaonline,dc=net cn: Terry gecos: Terry,,Fike gidNumber: 14 homeDirectory: /export/home/tfike loginShell: /bin/csh objectClass: posixAccount objectClass: top objectClass: radiusprofile objectClass: shadowAccount radiusFramedIPAddress: 216.152.176.25 radiusFramedIPNetmask: 255.255.255.255 radiusGroupName: dial radiusGroupName: dsl4m shadowLastChange: 13062 uid: tfike uidNumber: 130 userPassword: temppass thanks in advance. -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

crash, leaving PID file
by Tariq Rashid 14 Oct '05

14 Oct '05

i'm running a freeradius 1.0.2 as a proxy, with a very simple configuration - no ldap, no sql, only a users file, and some attribnute filters for pre- and post- proxying. strangely i'm finding that about once a day at random times the server is not running, but the PID is left - thus confusing any restart mechanisms. the main log file does not indicate any error. anyone suggest a good why to uncover the problem, short of running it in -X mode and waiting for it to fail. tariq

2 1