December 2005 - Freeradius-Users - lists.freeradius.org

Framed-Route ignored
by Arthur Sigel 13 Dec '05

13 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

2 2

accounting & lost trafic
by Andreas＠j8.com.ru 13 Dec '05

13 Dec '05

Hi, freeradius-users. TEll me please : when i use standart config - my accounting save ONLY AFTER SESSION CLOSE. If user have session 19 hours and server hang up or some thing else - i lost users trafic! I try use Acct-Interim-Interval like http://lists.cistron.nl/pipermail/freeradius-users/2005-April/042710.html but in to my sql table i do not see any changes. (i use freeradius-mysql) PLEASE HELP -- Best Regards, Andreas Wednesday, December 14, 2005 1:05:05 AM "Do not hesitate to ask me" ICQ UIN 177624 http://ServersLease.net - Offshore Dedicated Servers, Offshore Collocation http://HOST-LUX.RU - Offshore Virtual Hosting, Web Hosting, as low as 5$ per 1Gb HDD/month http://Reg-Master.net - Register`s Master of Domains http://Web-Media.Ru - Web Design studio. http://VEHICLE.RU - автомобили на заказ из США

2 1

Framed-Route ignored (repost in TXT)
by Arthur Sigel 13 Dec '05

13 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP radius=# select * from radreply; id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

1 0

parsing certificate fields ?
by Riccardo Veraldi 13 Dec '05

13 Dec '05

Hello, I am using freeradius with 802.11i, everything works fine qith certificate authentication but I Can only parse the CN of the certificate I would like to parse for Locality L field. the new version 1.0.5 support this ? thanks Rick

3 4

EAP-TTLS with LDAP authentication?
by Konne 13 Dec '05

13 Dec '05

hi is it possible to do EAP-TTLS with LDAP authentication or what is the best and secure way? i have an AP cisco aironet 1242, Debian with Freeradius and a W2k3 Server with the Active Directory. what do you suggest? thx

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

By the way, rlm_checkval meets in most cases losses ==8528== 200448 bytes in 783 blocks are definitely lost in loss record 178 of 190 ... ==8528== by 0x1BB83E41: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 60416 bytes in 59 blocks are possibly lost in loss record 162 of 190 ... ==8528== by 0x1BB88BF0: regexec (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FF4: do_checkval (rlm_checkval.c:281) ... ==8528== 55800 bytes in 15 blocks are possibly lost in loss record 159 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 22320 bytes in 6 blocks are possibly lost in loss record 151 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... etc.

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

Thanks, I have tried Valgrind. Valgrind have given out as a result of 20 losses and possible losses of memory. Basically from several bytes up to 200 kbytes for 30 seconds of work. The largest following. ... ... ... ==8528== 11032016 (72220 direct, 10959796 indirect) bytes in 785 blocks are definitely lost in loss record 166 of 190 ==8528== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==8528== by 0x1B906FFA: realloc (vg_replace_malloc.c:188) ==8528== by 0x1BB84194: (within /lib/tls/libc-2.3.2.so) ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ==8528== by 0x80579CF: call_modsingle (modcall.c:254) ==8528== by 0x8057F3E: modcall (modcall.c:590) ==8528== by 0x8057AB2: call_one (modcall.c:287) ==8528== by 0x8057B6D: call_modgroup (modcall.c:342) ==8528== by 0x8057FC7: modcall (modcall.c:575) ==8528== by 0x8057526: module_authorize (modules.c:936) ==8528== by 0x804D1ED: rad_authenticate (auth.c:548) ... ... ... ==8528== LEAK SUMMARY: ==8528== definitely lost: 275914 bytes in 1581 blocks. ==8528== indirectly lost: 10960904 bytes in 140534 blocks. ==8528== possibly lost: 236468 bytes in 234 blocks. ==8528== still reachable: 2190028 bytes in 32961 blocks. ==8528== suppressed: 0 bytes in 0 blocks. Also what with it is possible to do? To try me to correct rlm_checkval?

2 1

SQL authenticate & Proxying
by stu-tss1＠auxs.umn.edu 13 Dec '05

13 Dec '05

3 2

LDAP: disable filter setting?
by Derrick Woo 13 Dec '05

13 Dec '05

I tried searching for it, but haven't come up with any solution. Is there a way to disable the filter rule in the LDAP section freeRADIUS 1.0.1? If I comment out the filter setting in the radiusd.conf, it seems to default to (uid=%{User-Name}) according to the logs. I ask because the server I am trying to bind to has not implemented filters.

1 0

configuration question
by Norbert Wegener 13 Dec '05

13 Dec '05

At a switch we do 802.1x authentication with freeradius via EAP-TLS. We take the User-Name from the certificate and check against AD, whether a valid account belongs to that machine. If so, different data are returned from AD. Among others the primaryGroupID. This group id shall be assigned as vlan-id to the switch, if - and only if - this vlan-id is known by the switch, if not, a default vlan should be setup. I want to store the vlans a switch knows about, in a database and start a query, using the primaryGroupID from AD to get the information, whether the switch knows this vlan. If not, a default vlan id shall be assigned. As I did not yet succeed in the last part, my question is: Is this at all possible? How can I refer to the primaryGroupID, when querying the database? Is there a much better solution for that problem? Thanks Norbert Wegener

1 0