November 2005 - Freeradius-Users - lists.freeradius.org

assert request_list:1524 after running for some hours
by Joe Maimon 05 Nov '05

05 Nov '05

cvs 10/29 rad_assert(request->proxy->dst_ipaddr.af == AF_INET) Haven't done much troubleshooting on this one yet. (still getting assert in util.c:189 on sever shutdown)

2 1

Adding Attributes to a post proxy request
by Holger Steppke 05 Nov '05

05 Nov '05

Hi, i have read a couple of msg on this list about the same problem i actualy have but could not really find a nice solution for it. I have a case where I use Freeradius for proxy auth/acct to home servers. Lets assume I will be more then 20-40 different realms. Before the answer goes back to the Nas I need to add some attributes and now looking for the best way of doing this. In the past with Cistron or today with the switch in proxy.conf it is easy. I think this is maybe not the right way of doing it parsing the users files and everything else in authentication section twice. My Setup NAS ----- 1 -------> PROXY ------ 2 ---------> Home Radius <---- 4 -------- <----- 3 --------- So in 4 there should be e.g. different DNS servers for each realm. What is your view on this ? What's the best way doing this. Don't know if there is a way to add those Attributes to the Request Reply) attributes so that there still there when the Home Radius sends an answer ? Of course in a scalable way 20-40 realms. I´am already that far that I thought I need to patch the files module to have function for post-proxy which then I could use to parse another users file adding those Attributes Because that was easy Just defaults for each Realm and then adding them. BTW I found some parameter in the modules which do read the realm/proxy stuff which seams to be not used somewhere. It is trusted and hints. Or do you just allow them to be compatible with Cistron. ?? Bye Holger

3 2

Proxying based on AVPair (multiple SSIDs)
by Jason Carr 05 Nov '05

05 Nov '05

I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with. Our certificates don't include an @ sign in the username, nor do I know what authentication method the other groups will use. The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on. Anybody know if this is possible with freeradius or another software? If so, any configuration file contents I would need to set this up. Thanks, Jason

3 4

Attribute Value length using SQL
by Gunther 05 Nov '05

05 Nov '05

I am running FR 1.0.5 with MySQL 4.1.12. All data is stored in MySQL. My radgroupreply attribute values are SQL statements. It works very well. But it seems I have reached the limit for the Value column. My SQL output is setting the Session-Timeout. The length of Attribute Value can be found in the src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql CREATE TABLE radgroupreply ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', <== prio int unsigned NOT NULL default '0', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; I am trying to use a combination of the conditional syntax (e.g. %{Foo:-%{Bar}}) in connection with SQL statements. One sql statement is doing that and if false another sql statement is doing something else. e.g `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), ... and so on I was trying to change the AV lenght from 253 to 1024, but radius is simply cutting off after the limit, resulting in an error in the log file (MYSQL check_error: 1054). Log: radius_xlat: Running registered xlat function of module expr for string '%{sql:SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' radius_xlat: Running registered xlat function of module sql for string 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' rlm_sql (sql): - sql_xlat radius_xlat: 'gunther@demo' rlm_sql (sql): sql_set_user escaped user --> 'gunther@demo' radius_xlat: 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac rlm_sql_mysql: MYSQL check_error: 1054 received I then tried to shorten tablenames etc., but even with that I still have about 500+ bytes left. Is there any reason the limit must be at 253? Can the limit be changed ... in an easy way? My complete Sessiont-Timeout Value: `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user, phs_radacct WHERE user_username='%{User-Name}' AND radacct_username=user_username AND radacct_starttime >= user_starttime} :-%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(user_starttime, INTERVAL 24 HOUR) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(NOW(), INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user WHERE user_username='%{User-Name}'}}` Thanks! Gunther

2 3

RE: Attribute Value length using SQL
by Gunther 04 Nov '05

04 Nov '05

>I actually changed the MAX_STRING_LEN size from 254 to 762 in include/libradius.h and it seems to work. No, it doesn't work ...

1 0

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 04 Nov '05

04 Nov '05

>I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a >NetScreen5. I'm able to authenticate accounts just fine. Now I'd >like to begin pulling administrative privileges from the Radius >server, but I haven't figured out how to do that. I've referenced the >dictionary.netscreen file in my clients.conf file, nastype = >netscreen, but I'm embarrassed to say I can't figure out the format >for including the dictionary attributes for a user in my users file. > >I've tried various permutations like: > >markt Auth-Type := Local, User=Password == "testing" > NS-Admin-Privilege = "Read-Only-Admin" > >and: > >markt Auth-Type := Local, User=Password == "testing" > Netscreen-NS-Admin-Privilege = "Read-Only-Admin" > >Nothing's working. Can some one show me the correct syntax? > >Thank you, > >Mark >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Mark, I am having the same problems. I can authenticate fine, however, when I try and authorize via radius all logins fail (although RADIUS shows them to succeed. If I find the solution I will forward it along. Cheers, Chad

4 3

Newbie question re. dictionary files.
by Mark Tunnell 04 Nov '05

04 Nov '05

I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a NetScreen5. I'm able to authenticate accounts just fine. Now I'd like to begin pulling administrative privileges from the Radius server, but I haven't figured out how to do that. I've referenced the dictionary.netscreen file in my clients.conf file, nastype = netscreen, but I'm embarrassed to say I can't figure out the format for including the dictionary attributes for a user in my users file. I've tried various permutations like: markt Auth-Type := Local, User=Password == "testing" NS-Admin-Privilege = "Read-Only-Admin" and: markt Auth-Type := Local, User=Password == "testing" Netscreen-NS-Admin-Privilege = "Read-Only-Admin" Nothing's working. Can some one show me the correct syntax? Thank you, Mark

2 5

regexp and Group
by pepe lopez 04 Nov '05

04 Nov '05

Hi! I am using the 1.0.5 freeradius version. radiusd -v radiusd: FreeRADIUS Version 1.0.5, for host , built on Nov 1 2005 at 16:22:00 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I am trying to use regular expressions with the Group attribute, but its not working the way I expected. This is how my users file looks like: DEFAULT Auth-Type := Accept Fall-Through = Yes DEFAULT Group =~ "^test.*" Reply-Message = "%{0}", Fall-Through = No DEFAULT Huntgroup-Name == "as_totalcontrol" Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.255, Framed-IP-Address = 255.255.255.254, Framed-Routing = None, Framed-MTU = 1500, Reply-Message = "as_totalcontrol", Framed-Compression = Van-Jacobson-TCP-IP, Fall-Through = No First I tried a radtest with user test which belongs to group test groups test1 test1 : test_group_2 radtest -d /etc/raddb/ test1 test1 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 86 to 172.20.0.88:1812 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=86, length=27 Reply-Message = "test1" I ran freeradius in debug mode (radiusd X) This is the output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=86, length=63 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user test1 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 123 radius_xlat: 'test1' modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'test1' Sending Access-Accept of id 86 to 172.20.0.88:34613 Reply-Message = "test1" Finished request 1 Going to the next request Then I tried this: groups paraprueba paraprueba : test radtest -d /etc/raddb/ paraprueba parapeuba 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 98 to 172.20.0.88:1812 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=98, length=79 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP This is radiusd output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=98, length=68 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "paraprueba", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user paraprueba to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 147 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'as_totalcontrol' Sending Access-Accept of id 98 to 172.20.0.88:34613 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP Finished request 2 It seems as if the regular expression was matching the UserName attribute instead of the Group attribute. I also tried using regular expressions with the User-Name attribute and they worked as expected. Is it possible to use regular expressions with Group? And if it is so what am I doing wrong? Thanks in advance. Kind regards --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click. --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 1

how to use ntlm_auth
by mlopez＠uabc.mx 03 Nov '05

03 Nov '05

>> I have configured freeradius+ldap+802.1X for a wireless lan, but i >> can't get it to work because of mschap, and i dont have windows domain. > Then why the heck are you using ntlm_auth? It's only purpose is to >do MSCHAP authentication to a Windows domain controller. Because the configuration for 802.1X, using the 802.1X howto and http://vuksan.com/linux/dot1x/802-1x-LDAP.html, said that needs to configure peap and peap use mschap (....mmmm {thinking} but don't said nothing about ntlm) how the mschap module can perform authentication itself?? or how can i use 802.1X/peap and ldap ??? can i use it??? thank you in advance Manuel Lopez

3 2

Question about logging
by Lisa Casey 03 Nov '05

03 Nov '05

Hi Folks, You'll probably think this question is a bit nuts. With FreeRadius 1.01 on FreeBSD 5.3, is there any way of logging all authentication requests to radius.log EXCEPT requests from a particular username? Or alternatively, log all authentication requests EXCEPT those from a particular client (this would solve the same problem I have). I don't think this can be done, but you folks know a lot more about this than I do! Thanks, Lisa Casey -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.12.7/160 - Release Date: 11/3/2005

2 1