June 2005 - Freeradius-Users - lists.freeradius.org

Re: problem with freeradius and ldaps (Active Directory)
by Roberto S. G. 21 Jun '05

21 Jun '05

Hi, I'd like to thank you, Jose and Alan, for your information, and share my solution with u all: I've finally installed stunnel in order to provide SSL to the connection with LDAPS. freeradius is configured to connect with LDAP locally, and stunnel takes this local connection and makes the SSL to the LDAPS server. It runs smoothly!. I was unable to make freeradius 1.0.1 or 1.0.0 to run with LDAPS... no way... (it seemed that it didn't manage correctly LDAPS). thanks. >From: Jose Tomas Ochayta <Jose.Ochayta(a)tirea.es> >Subject: Re: problem with freeradius and ldaps (Active Directory) >I'm using freeradius 1.0.2 with ldaps. I had the same problem (freeradius crash) due, >I think, to a bug in openldap or openssl libraries. >Now I have it working with stunnel to add the ssl layer. >Jose T. >>> Hi, >>> >>> I'm trying to configure freeradius (1.0.1) to use an ldaps server >>> (without start_tls, it's an Active Directory). >>> But I'm not able to obtain any response. In fact, the freeradius >>> crashes with just a: >>> >>> rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1074, id=88, >>> length=29 >>> Discarding duplicate request from client localhost:1074 - ID: 88 >>> >>> (client is localhost because I was using radclient, but remote >>> attempts show the same behaviour). >>> >>> Normal ldap against the same server is correct. For the ldaps >>> configuration I've added just: >>> port = 636 >>> tls_require_cert = "never" >>> >>> though even with the server certificate: >>> tls_certfile = ./certs/xxxx_cacert.pem >>> >>> the result is the same. >>> I don't know which is the problem exactly... >>> >>> Has anyone sucessfully configured freeradius against an Active >>> Directory with LDAPS? >>> Any ideas are apreciated. >>> >>> thanks. >>> >>> >>> - List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>>

1 0

RE: Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 21 Jun '05

21 Jun '05

OK, got it working. I removed the "Proxy-To-Realm" attribute, and set Auth-Type = ldap. I assume because I'm actually going against the local RADIUS server that I don't need to proxy. Wood for trees scenario. On upgrading, I'd love to but I run a supported SLES8 server, and it's already got a custom 0.9.3 install, as base is only 0.5 !!! in fact even SLES9 only has 0.9.3. Maybe I need a chat with SuSE/Novell and ask them to release updates to freeRADIUS on a more regular basis...... Thanks for the help. :-) Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: 20 June 2005 19:02 > To: FreeRadius users mailing list > Subject: Re: Multiple Authentication REALMS - I hope in Plain Text > > "Shepherd, Dave" <Dave.Shepherd(a)compass-group.co.uk> wrote: > > As I've now got it working for my standard config. > > Good. > > > However, I still seem to be getting the request marked as complete > > after the authorize section:- > ... > > This only occurs when I match the following in my users file: > > > > # NexUS RAS > > DEFAULT Called-Station-Id == "********", Proxy-To-Realm := "sloxldap" > > Fall-Through = No > > > > If I match on my other statements, the user authenticates as expected. > > Do you have proxying turned off? > > > I'm on version 0.9.3. > > Bleah. You should really upgrade. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Expiration - my experiences and a partial solution
by Tomas 'tt' krag 21 Jun '05

21 Jun '05

Hi, I spent a few days working on a freeradius solution in which I want to be able to create users whose logins expire 24 hours after their first login. Since I noticed that many people have been asking for similar things on this list, I thought I'd explain the solution I have ended up using. NOTE: This solution is far from perfect. First of all, it is a hack, and not too elegant, secondly it does not do exactly what it is supposed to do, but it works well enough for my purposes, and perhaps other people can use this as inspiration for an improved solution. WARNING: I am far from proficient at freeradius, having spent only the past week trying to get an understanding of how it works. This solution was hacked together from various comments and ideas on this mailing-list. So anything I say and do should be considered risky :-) What I wanted was to be able to create a number of users, printed on cards, that I could hand out to users at an event to let them access the network for 24 hours after the first time they logged in. i.e. if they log in at 15:31 on tuesday their account should expire at 15:31 on wednesday no matter how much time they have spent on-line. I am using chillispot and freeradius with mysql, all on one central gateway server, as this is a small setup with a limited number of users. I had understood from comments by Kostas Kalevras and Alan DeKok (thanks) that the way to do this in freeradius/mysql was to use a post-auth query that executed whenever a user has successfully logged into the system. In that post-auth query I would set an Attribute/Value pair "Expiration := 25 May 2005 15:31" or equivalent in the radcheck table of the database. Since I didn't want this to apply to all users (I like to keep a permanent login for myself), I needed some way to distinguish users that should be timed out from other users. I came up with the following hack. When I generate the usernames (using a adapted version of phpMyPrepaid http://www.jabali.net/~carl/?link=2) I add an Attribute called Expiration with a value well in the future. In this case "Expiration:='1 Jan 2005'". When a user logs in I check if there is an Expiration attribute with that particular value, and if so, I change the Date to exactly 24 hours from Now. I do this in sql.conf by adding the following query: postauth_query = "UPDATE ${authcheck_table} SET Value=DATE_FORMAT(DATE_ADD(NOW(),INTERVAL ${expire} HOUR),'%%e %%b %%Y % %T') WHERE UserName='%{SQL-User-Name}' AND Attribute='Expiration' AND Value='${expiration_dummy}'" At the top of the file, I have defined the following # Added by tkrag (support for Expiration) # The dummy expiration value used when creating new # users expiration_dummy = "1 Jan 2099" # How many hours an account lasts from first login expire = 24 This has the effect of changing the Expiration date only the first time a user logs in. Unfortunately as Joachim Bloche pointed out in a mail "Session-Timeout not set with pending Expiration" on this list, it seems that Freeradius does NOT set the "Session-Timeout" based on an Expiration date in the future. I have confirmed this behaviour using freeradius 1.0.1 (from the ubuntu package, but recompiled to support the rlm_sqlcounter module). This effectively means that a user who logs in at 13:30 on tuesday and logs in again at 13:29 on wednesday can then stay on-line after the Expiration time, but cannot log back in again after that time. In my situation I have handled this by also using an sqlcounter with an Attribute "Max-All-Session := 86400" which then limits the user to a total of 24 hours on-line. i.e. a user could login at 13:30 on tuesday and immediately log out, after which she could relogin at 13:29 on wednesaday and stay connected for another 24 hours until 13:29 on thursday. In my case this is not a deal-breaker, as we are not selling access, but mostly trying to protect ourselves against ongoing abuse of bandwidth, but in other scenarios it might not work well. If I read the documentation correctly the current CVS version of freeradius contains a new module called rlm_expiration which apparently moves the Expiration support into a separate module, and will hopefully support returning the correct Session-Timeout attribute. I hope this helps someone out there. Regards /tomas wire.less.dk

3 2

FreeRADIUS 1.0.4 has been released.
by Alan DeKok 20 Jun '05

20 Jun '05

Sorry for the delay. Announcement is on the web: http://www.freeradius.org/ Alan DeKok.

5 12

disconnections
by John Fawcett 20 Jun '05

20 Jun '05

I'm using freeradius 1.0.0 on suse 9.2 to authenticate wireless users from a US Robotics USR5450 Access Point via eap-ttls (with eap-md5) Although the connection is established it is disconnected after 4 minutes (sometimes 2 minutes or 6 minutes). I get entries like the following repeated every four minutes in the radius.log Mon Jun 20 00:37:59 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:37:59 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Jun 20 00:38:00 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Jun 20 00:38:02 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:02 2005 : Info: (other): SSL negotiation finished successfully Mon Jun 20 00:38:02 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:02 2005 : Info: rlm_eap_md5: Issuing Challenge Mon Jun 20 00:38:03 2005 : Info: rlm_eap_tls: Length Included Mon Jun 20 00:38:03 2005 : Auth: Login OK: [steve/<no User-Password attribute>] (from client localhost port 0 cli 00-0e-35-c7-e3-fe) Mon Jun 20 00:38:03 2005 : Auth: Login OK: [steve/<no User-Password attribute>] (from client usrobotics port 0 cli 00-0e-35-c7-e3-fe) Just a couple of more points: I don't think the TLS_accept: error is serious. I cannot explain why there are two Auth Logins one from the NAS and one from localhost. Any help appreciated. I somehow get the impression that I'm probably not passing back the right attributes to the NAS: for testing I'm using the users file: steve User-Password == "testing" Framed-IP-Address = 192.168.1.67, Framed-IP-Netmask = 255.255.255.0, Service-Type = Framed-User Thanks John

2 2

rlm_sqlcounter problem
by Carlos Martínez-Troncoso Cera 20 Jun '05

20 Jun '05

2 6

Passing attributes from freeradius to Cisco VPN 3000
by Scott Stursa 20 Jun '05

20 Jun '05

Is anyone using freeradius to authenticate users of a Cisco 3000 series VPN concentrator? If so, are you successfully passing attributes (such as "Framed-IP-Address") from freeradius to the 3000? If so, please contact me off-list. Thanks, - SLS ------------------------------------------------------------------------ Scott L. Stursa 850/644-2591 Network Security Analyst stursa(a)mailer.fsu.edu OTI Enterprise Security Group Florida State University - No good deed goes unpunished -

1 0

Exec-Program-Wait: plaintext:
by Americatel Centroamerica 20 Jun '05

20 Jun '05

Hi, i have two servers with diferent versions of freeradius, one with 0.9 and another with 1.0.1. I have an Exec-Program-Wait perl script configured to add some attributes to the reply, all is working flawlessly on the 0.9, but the same script doesnt work on the 1.0 server, the output items of the script dont appear on the reply items, this is the debug output on the server with 1.0 radius_xlat: '/root/get_credit_time.pl' Exec-Program: /root/get_credit_time.pl Exec-Program output: h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Exec-Program-Wait: plaintext: h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Exec-Program: returned: 0 Login OK: [3212244132] (from client private-network port 0 cli 50322660124) Sending Access-Accept of id 179 to 192.168.10.112:21679 h323-credit-amount = "h323-credit-amount=3.00" h323-prompt-id = "h323-prompt-id=1350" Finished request 13 Look at the Exec-Program-Wait: plaintext:??? on the other server (with 0.9) the reply is as expected: Sending Access-Accept of id 179 to 192.168.10.112:21679 h323-credit-amount = "h323-credit-amount=3.00" h323-prompt-id = "h323-prompt-id=1350" h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Finished request 13 what is the configuration problem? thanks ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com

2 2

hints and PPTP/MPPE
by David Batterham 20 Jun '05

20 Jun '05

Hi All, I'm trying to get hints and huntgroups working with PPTP using MPPE MSCHAPv2. I want users to be able to login with uname or uname.suffix. When logging in with uname.suffix, the suffix is stripped and a hint is set using the hints file. They are also set in a huntgroup. The users file as a DEFAULT entry for that hint and huntgroup. This *works* when users connect a certain way (ipsec using clear text passwords), but fails on PPTP connections using MPPE. When connecting via PPTP, the DEFAULT entry does not get hit and it falls through to the DEFAULT entry with Auth-Type := Reject. The correct entry is hit when connecting via IPSEC. Despite this, it still sends an Access-Accept (albeit with the Reply-Message in the Reject). My suspicion is that MS Windows is generating MPPE keys based on the username with the suffix, and freeradius is correctly authenticating against the system (SMBPASSWD file) without the suffix, but generating MPPE responses also without the SUFFIX, therefore windows drops the connection. Version is 1.0.3. Any ideas? Regs, Dave -- ----------------------------------------------------------------------------- David Batterham Information Systems & Services Manager Department of Electrical & Electronic Engineering The University of Melbourne, Victoria 3010 Email: d.batterham(a)ee.mu.oz.au Phone: +61 3 8344 3366 Fax: +61 3 8344 6678

2 1

Adding a custom attribute
by Radoslav Kolev 20 Jun '05

20 Jun '05

Hi, all! I'm using FreeRADIUS 1.0.1 with the MySQL backend. I want to send out a reply attribute which is not in the standard dictionary file. What I did is edit /etc/raddb/dictionary and added a line like: ATTRIBUTE Some-Attribute 229 string Then inserted a row in the radreply table: insert into radreply values ('','user','Some-Attribute', ':=', "text"); When I chek with radtest or actual NAS, the new reply attribute is not sent in the Access Accept packet. If I delete the above line from the dictionary file and run the server in debug mode, I see a Unknown attribute error from the mysql module("Error: rlm_sql: unknown attribute Some-Attribute"), which is normal. When the attribute is in the dictionary no errors are given, and it is still not appended to the reply. Is there something else I need to to except adding the line to the dictionary file? I have added new attributes like that to FreeRADIUS 0.9.3 and it worked, has anything changed since then? Regards, Rado

2 5