October 2005 - Freeradius-Users - lists.freeradius.org

Removing attributes from a reply
by Joe Maimon 11 Oct '05

11 Oct '05

I need to remove an A/V from the reply list, but only if another A/V is already there. For example: If I have the Framed-IP-Address attribute, I need to remove any attribute of Cisco-AVPair -~ "ip:addr-pool.*" (because my NAS's will choke on that and that means I have no way for a fall back pool to be defined by radius for my proxy users who may/are assigned IP addresses by my customer) This needs to be done post-proxy stage for my needs. I have been assuming I would need the new CVS head policy feature for this. Anything I am missing? Joe

3 4

RE: cannot return access accept from proxy to client
by Wilson Lie 10 Oct '05

10 Oct '05

Hi Alan, for Q2, doc/Post-Auth-type don't have information to support branching by realm ? -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, October 04, 2005 8:23 AM To: FreeRadius users mailing list Subject: Re: cannot return access accept from proxy to client "Wilson Lie" <wilson.lie(a)ithlgroup.com> wrote: > Q1. Any method such that host B won't goes into [post-auth] when it is receiving result from another server ? I'm not sure what you mean here. Perhaps you could try using complete sentences. I *think* the answer is "source code edits". > Q2. In case host B cannot bypass [post-auth] when receiving result from another server, how can I define multiple > sql section in [post-auth] ? As I cannot find any rule that I can set in [post-auth] such that it can go to [sql1] > for realm A and [sql2] for realm B doc/Post-Auth-Type. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________ (c) 2005 Interactive Technology Holdings Limited Group. All rights reserved. CONFIDENTIALITY: This communication and any attachment(s) is intended solely for the person or organisation to which it is addressed and it may be confidential. This communication may contain confidential or legally privileged material and may not be copied, redistributed or published (in whole or in part) without our prior written consent. This communication may have been intercepted, partially destroyed, arrive late, incomplete or contain viruses and no liability is accepted by any member of the Interactive Technology Holdings Limited Group as a result. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you must not copy, disclose, distribute or take any action in reliance on it. If you have received this communication in error, please immediately reply and highlight the error to the sender immediately and destroy the original from your computer.

2 1

802.1x client question
by Adam KOSA 10 Oct '05

10 Oct '05

Hi All, this question may be off-topic, but the windows list i was asking could not help. i set up a 802.1x wired authentication in an ethernet network, with all of the following: eap-tls, eap-md5, eap-peap, with freeradius. everything is working great except one thing: 2k and xp is not able to cache the authentication info. with the certificate, the most i could achieve that when logging on, the auth is automatic. but no network until i log on. this is not a radius problem, since the radius and the authentication process is working great. the reason i'm writing is maybe some of you have solved this problem and could help me please. how am i supposed to configure the client to remember the password? I'm open to any solution, even to forget eap-* and use something less secure. thanks Adam

4 3

RE: 802.1x client question
by Jonathan De Graeve 10 Oct '05

10 Oct '05

I'm using securew2 for that... J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Adam KOSA Verzonden: maandag 10 oktober 2005 22:09 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: 802.1x client question Hi All, this question may be off-topic, but the windows list i was asking could not help. i set up a 802.1x wired authentication in an ethernet network, with all of the following: eap-tls, eap-md5, eap-peap, with freeradius. everything is working great except one thing: 2k and xp is not able to cache the authentication info. with the certificate, the most i could achieve that when logging on, the auth is automatic. but no network until i log on. this is not a radius problem, since the radius and the authentication process is working great. the reason i'm writing is maybe some of you have solved this problem and could help me please. how am i supposed to configure the client to remember the password? I'm open to any solution, even to forget eap-* and use something less secure. thanks Adam - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Proxy when module_accounting rejects the request
by Nicolas Baradakis 10 Oct '05

10 Oct '05

I noticed that accounting requests are proxied anyway even if a module of the accounting section rejected the request. I don't know whether this is the expected behaviour or not. In other words: is this a bug or feature ? :-) Perhaps there are reasons to always proxy an accounting request, but I'm thinking the action might be: Return value Proxy Drop -------------------------------------- RLM_MODULE_REJECT X RLM_MODULE_FAIL X RLM_MODULE_OK X RLM_MODULE_HANDLED X RLM_MODULE_INVALID X RLM_MODULE_USERLOCK X RLM_MODULE_NOTFOUND X RLM_MODULE_NOOP X RLM_MODULE_UPDATED X -- Nicolas Baradakis

2 4

freeradius + peap + ldap
by Yuri Francalacci 10 Oct '05

10 Oct '05

Hi, I have this environment: WinXP PEAP wireless client + linksys AP + freeradius 1.0.5 + openldap (with kerberos password) and I would like to setup the 802.1x peap authentication. Everything works well if I use users file for authenticating wireless client, but if I use ldap users, clients are not authenticated. My password attribute is UserPassword The error is (I suppose) here: -------------- modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: Told to do MS-CHAPv2 for yuri with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 -------------- Does anyone has a working configuration that looks like (more or less) mine? --- radiusd.conf ------ > mschap section mschap { authtype = MS-CHAP use_mppe = no # require_encryption = yes # require_strong = yes with_ntdomain_hack = no } Thanks, Yuri

1 0

how group checks/replies work in rlm_sql
by Todd Williams 10 Oct '05

10 Oct '05

I'm working towards implementing freeradius-1.0.5 with rlm_sql/mysql for authorization and kerberos for authentication. I've managed to work out the basic configuration but have run into problem understanding exactly how rlm_sql is designed to handle authorization. According to the documentation in doc/rlm_sql it seems as though during the group check/reply stage of authorization the group membership for a user is looked up in the usergroup table, and then for each group the check AV pairs are pulled and if the checks are passed the group-relevant reply AV pairs are added to the packet. However, during my testing of this I was not getting the results that I expected under the assumptions I had based off of the rlm_sql documention. After further investigation (reading code and further testing) it appears that the way rlm_sql really works is to just pull all the check and reply AV pairs for all of the groups a user belongs to and create two big linked lists-- one check, one reply-- containing all of these AV pairs. At that point if all of the check items are met then all of the reply items are added without any granular sense of group membership. Is my understanding of this correct? If my understanding is correct then I come to a question of how to best approach the following problem. A single user might be entitled to consume VPN, dialup, and wireless service all of which are serviced by different NASs that are under the control of different departments. Each NAS will have a set of check and reply information that it expects when transacting with the RADIUS server, and it seems that simply putting users in the appropriate groups (in the usergroup table) will likely yield potentially conflicting check and reply AV pairs being pulled by rlm_sql and unnecessarily involved in the transaction. Am I still on the right track or am I missing a concept? Anyway, it seems like one solution to this problem would be to use some method of discriminating between NASs prior to entering the authorization phase (perhaps with huntgroups) and adding an Autz-Type attribute containing the name of a particular instance of rlm_sql that is configured with service-specific radgroupcheck/reply tables. Is this the way to go? Thanks in advance for the help. -- Todd C. Williams tcwill(a)ufl.edu The Open Systems Group

1 0

Re : Crypted Password Problem with DIGEST
by Philippe Sultan 10 Oct '05

10 Oct '05

Hi, Meltem. DIGEST mode does not work with encrypted passwords. However, one way to have an encrypted password storage is to store a hash value of the username:realm:password string in the User-Password field of your entry. digest module configuration must include this line : digest { enc_mode=yes } Auth-Type might be set to Digest, but it is not necessary since Freeradius will trigger the rlm_digest module when parsing the Access-Request. If you want to build the hash value, try this command : echo -n 'username:realm:password' | md5sum You might want to test this patch for that purpose : http://bugs.freeradius.org/show_bug.cgi?id=287 Please give some feedback if you ever test it, since I suspect some modifications are needed. The advice of Freeradius managers is also needed, since a configuration option to the rlm_digest module has been added. Best regards, Philippe --- Mon, 10 Oct 2005 01:25:09 -0700 Hello, I am using SIP Express Router(SER) version 0.9.3 and freeRADIUS version 1.0.4. SIP uses digest as authentication scheme. I am trying to keep the user passwords as encrypted in freeRadius DB which is mySql table radcheck. The system is working with plaintext password, but it does not work with encrypted passwords even I tried all type of configurations. My first question is "Does DIGEST work with ENCRYPTED PASSWORDS" ??? Since Digest is a must for SIP. If NOT, what authentication scheme can I use to make SIP work with freeRADIUS? If DIGEST works with encrypted passwords, what should be the configuration files: 1) in radiusd.conf ? 2) What should be the value of "Auth-Type" parameter in radcheck or radgroupchek tables ? 3) What should be the attribute for password in radcheck table ? Is it "User-Password" or "Chap-Password" or "Crypt-Password" ?? I'll appreciate very much if anyone can help. Regards, Meltem Kirisci

2 2

Reid Canavan/FortErie is on Vacation
by Reid Canavan 10 Oct '05

10 Oct '05

I will be out of the office starting 10/10/2005 and will not return until 10/21/2005. I will respond to your message when I return.

1 0

Re: rlm_perl hang server
by Abdul Lateef 10 Oct '05

10 Oct '05

Hi, i am not using sql.conf at all. i have only DB connection in example.pl file. But my example.pl file really it is very big. and i have lot of queries cous of i am using this file for Prepaid CallShop Diffrent rate for diffrent customers. I would like to paste my script here. but i am really sorry to post big script here. ================example.pl ================== use DBI; #use strict; use POSIX qw(ceil floor); use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remaping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ my $db_host = '192.168.1.65'; my $db_user = 'testdb'; my $db_pass = 'MoHaKa21'; my $db_name = 'radius'; sub dbh{ my $db = "dbi:mysql:dbname=${db_name};host=${db_host}"; my $dbv = DBI->connect($db, $db_user, $db_pass, { RaiseError => 1, AutoCommit => 0 } ) || die "Error connecting to the database"; } sub debugit{ #if(!$RAD_REQUEST{'User-Password'}){ #my $cn = $RAD_REQUEST{'Called-Station-Id'}; #my $up = $RAD_REQUEST{'User-Password'}; #}else{ #my $tt = $RAD_REQUEST{'Acct-Unique-Session-Id'}; #} my $debug_sql = "INSERT INTO nas (nasname) VALUES ($tt)"; my $dbg = dbh()->prepare($debug_sql); $dbg->execute(); } #debugit(); # Function to handle authorize sub authorize { # For debugging purposes only &log_request_attributes; #debugit(); my $UserP; my $uidf; my $pwws; my $uid; if(!$RAD_REQUEST{'User-Password'}){ $uidf = $RAD_REQUEST{'User-Name'}; @WordList = split(/_/, $uidf ) ; $pwws = @WordList[1]; $uid = @WordList[0]; }else{ $pwws = $RAD_REQUEST{'User-Password'}; $uid = $RAD_REQUEST{'User-Name'}; } my $sql_reg = "SELECT 1 FROM radcheck WHERE UserName = '$uid' and Value = '$pwws' ORDER BY id"; my $auth = dbh()->selectrow_array($sql_reg); if(!$auth){return RLM_MODULE_REJECT;} else {return RLM_MODULE_OK;} } # Function to handle authenticate sub authenticate { # For debugging purposes only &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute if(!$RAD_REQUEST{'Called-Station-Id'}){$skipp=0;} else{max_time();} &log_request_attributes; return RLM_MODULE_OK; } } #end of authenticate function ################ FUNCTION FOR LIVE CALL ################## sub max_time{ #debugit(); my $sessionID = $RAD_REQUEST{'Acct-Session-Id'}; my $sessionID =~ s/T/V/; my $CalledID = $RAD_REQUEST{'Called-Station-Id'}; my $DCode = r_code($CalledID); my $UserName = $RAD_REQUEST{'User-Name'}; if ($ARGV[1] == 800800) #for ivr call { $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=60"; exit; } #End if my $sql_rate = "Select If(RT.Rate Is Null,T.Rate*STC.Percentage,RT.Rate) As Sell_Rate From (Tariff As T JOIN Tariff_Classes As STC Inner Join Rate_Card As RC On STC.ID=RC.Groupn) Left Join Reseller_Tariff As RT On T.Co_Name=RT.Code And RC.AgentID=RT.AgentID And RC.Groupn=RT.Groupn Where RC.UserName='$UserName' And T.Co_Name='$DCode'"; my $sql_usr_balance = "SELECT Amount FROM balance WHERE op='r' and UserName = '$UserName' "; my $sql_port = "SELECT port FROM radcheck WHERE UserName = '$UserName' "; my $sql_status = "SELECT count(*) as RecNo FROM radacct WHERE UserName = '$UserName' and status ='1' and AcctSessionId = '$sessionID' "; my $sql_statuso = "SELECT count(*) as RecNo FROM radacct WHERE UserName = '$UserName' and status ='1'"; my $query_resel = "select R_update_balance.Amount from R_update_balance INNER join Device_auth on R_update_balance.AgentID = Device_auth.AgentID Where Device_auth.DeviceID = '$UserName' "; my $reseller_balance = dbh()->selectrow_array($query_resel); my $calling_rate = dbh()->selectrow_array($sql_rate); if($reseller_balance <= 0){ $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=0"; exit;} if ($calling_rate <= 0) { $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=0"; exit;} # Callshop # if(!$RAD_REQUEST{'Calling-Station-Id'}){ # my $don = 1; # }else{ # my $callingID = $RAD_REQUEST{'Calling-Station-Id'}; # my $booth_credit = "SELECT credit FROM booth_credit WHERE UserName = '$UserName' and port ='$callingID'"; # my $boCredit = dbh()->selectrow_array($booth_credit); # &log_request_attributes; # if($boCredit <=0) # { # my $t=0; # }else{ # $total_minute_duration = $boCredit/$calling_rate; # $return_h323_time = $total_minute_duration*60; # $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; # &log_request_attributes; # #exit; # return true; # } #end if for callshop # # } #End if # End call shop area if($RAD_REQUEST{'Calling-Station-Id'}){ my $callingID = $RAD_REQUEST{'Calling-Station-Id'}; my $booth_credit = "SELECT credit FROM booth_credit WHERE UserName = '$UserName' and port ='$callingID'"; my $boCredit = dbh()->selectrow_array($booth_credit); &log_request_attributes; if($boCredit <=0) { my $t=0; }else{ $total_minute_duration = $boCredit/$calling_rate; $return_h323_time = $total_minute_duration*60; $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; &log_request_attributes; #exit; return true; } #end if for callshop } #End if my $returnba = 0; my $total_balance = dbh()->selectrow_array($sql_usr_balance); my $port = dbh()->selectrow_array($sql_port); my $status = dbh()->selectrow_array($sql_status); my $statuso = dbh()->selectrow_array($sql_statuso); if($total_balance >=5 && $port >= 2){ my $d = $port-$status; $returnba = $total_balance/$d; }elsif($total_balance < 5 && $statuso >= 2){ $returnba = 0; }elsif($total_balance <= 0){ $returnba = 0; }else{ $returnba = $total_balance; } #End If for port devision $total_minute_duration = $returnba/$calling_rate; #$total_minute_duration = $calling_rate; my $return_h323_time = $total_minute_duration*60; $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; &log_request_attributes; } #end max_time sub r_code #from reseller table { $wh = $_[0]; $wh =~ s/^00//; $sql_code = "SELECT Max(Co_Name) As Code FROM `Tariff` WHERE '$wh' Like Concat(`Co_Name`,'%')"; return dbh()->selectrow_array($sql_code); } #End r_code ######################## END LIVE CALL FUNCTION ######### # Function to handle preacct sub preacct { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { # For debugging purposes only &log_request_attributes; my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime time; my $years = $year+1900; my $mons = $mon+1; my $fdatetime = "$years-$mons-$mday $hour:$min:$sec"; my $accounting_start; my $accounting_stop_query; $accounting_start = "INSERT IGNORE into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, status,Termination) values('$RAD_REQUEST{'Acct-Session-Id'}', '$RAD_REQUEST{'Acct-Unique-Session-Id'}', '$RAD_REQUEST{'User-Name'}', '$RAD_REQUEST{'Realm'}', '$RAD_REQUEST{'NAS-IP-Address'}', '$RAD_REQUEST{'NAS-Port'}', '$RAD_REQUEST{'NAS-Port-Type'}', '$fdatetime', '0', '0', '$RAD_REQUEST{'Acct-Authentic'}', '$RAD_REQUEST{'Connect-Info'}', '', '0', '0', '$RAD_REQUEST{'Called-Station-Id'}', '$RAD_REQUEST{'Calling-Station-Id'}', '', '$RAD_REQUEST{'Service-Type'}', '$RAD_REQUEST{'Framed-Protocol'}', '$RAD_REQUEST{'Framed-IP-Address'}', '$RAD_REQUEST{'Acct-Delay-Time'}', '0', '1','$RAD_REQUEST{'h323-remote-address'}')"; $accounting_stop_query = "UPDATE radacct SET AcctStopTime = '$fdatetime', AcctSessionTime = '$RAD_REQUEST{'Acct-Session-Time'}', AcctInputOctets = '$RAD_REQUEST{'Acct-Input-Octets'}', AcctOutputOctets = '$RAD_REQUEST{'Acct-Output-Octets'}', AcctTerminateCause = '$RAD_REQUEST{'Acct-Terminate-Cause'}', AcctStopDelay = '$RAD_REQUEST{'Acct-Delay-Time'}', status = '1', ConnectInfo_stop = '$RAD_REQUEST{'Connect-Info'}' WHERE AcctSessionId = '$RAD_REQUEST{'Acct-Session-Id'}' AND UserName = '$RAD_REQUEST{'User-Name'}' AND NASIPAddress = '$RAD_REQUEST{'NAS-IP-Address'}'"; my $dbg = dbh()->prepare($accounting_start); $dbg->execute(); if($RAD_REQUEST{'Acct-Input-Octets'}){ my $dbup = dbh()->prepare($accounting_stop_query); $dbup->execute(); } return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only # &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only # &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1