June 2005 - Freeradius-Users - lists.freeradius.org

Qry:- How to assgin DNS server IP address to the client through RADIUS server
by romel dutta 13 Jun '05

13 Jun '05

Hai all Here i am using freeradius-1.0.2 using for AAA function...and pppoe-server as the client.... Here i need to assgin the DNS ip address to the pppoe-client through the radius..... server... pls tell me which attribute is there to assign DNS IP address.... Also tell me it is possible to assign ip address through the freeradius-1.0.2 (source code) in pppd we are using the patch version ppp-2.4.1b2-vanilla-radclient-v2.0.patch.gz .... With regards Romel

2 1

bogus session handling in radutmp?
by Stefan Winter 13 Jun '05

13 Jun '05

Hello, we are using a FR 1.0.1 server for accounting purposes. The server is configured to keep track of current sessions in radutmp. Occasionally, this file gets corrupted: it contains a _plain text_ copy of an accounting packet (exactly as you see them in the detail files) as opposed to the binary format this file is usually in. The result is that the parser radwho gets confused by these entries and fails to display the sessions that are located in the vicinity of the plain text part of the file. Strangely enough, there are no other problems. FR keeps working, no SEGVs, and radwho displays the other sessions as usual. Has anyone experienced this? Would upgrading to 1.0.3 help (this server is in heavy production use and I would like to avoid upgrading if possible)? Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473

2 1

RE: Class attribute questions
by Shawn K. O'Shea 13 Jun '05

13 Jun '05

> > I just wanted to make > > sure that I wasn't missing something, and that there isn't > an easier > > way to get at the ASCII inside the octet stream. > Edit the dictionary, and change "octets" to "string"? I saw discussion in a previous thread (Handling of the 'Class' attribute, this post in particular, http://lists.freeradius.org/mailman/htdig/freeradius-users/2003-July/021 267.html) that implied this was frowned upon, at least when interacting with other RADIUS servers (which is what I'm using FreeRADIUS for), but also because the RFC recommends that it should be treated as undistinguished octets. > > 2) The rfc's allow for more than one Class attribute (at least in > > Accounting-Request packets). How does FreeRADIUS treat > references to > > %{Class} when this happens? i.e. Is there a syntax to refer to each > > instance of the Class attr or get a count of how many are > in the packet? > The CVS snapshots allow this. 1.0.x doesn't. See doc/variables.txt I read through the current doc/variables.txt in CVS. Looks great. Is this a 1.1.x kind of feature or will it find it's way into a later 1.0.x? Thanks for the reply. -Shawn

2 1

Free RADIUS for WLAN - Problems?
by dat nguyen 13 Jun '05

13 Jun '05

I'm using freeRADIUS-1.02 as an Authentication Server for my Wireless LAN. I've read "802.1X Port-Based Authentication HOWTO" and I'm still wondering some thing: - What are differences between "unicast key" and "multicast/global key". If unicast key is used for encrypting per-client data and if I have 20 client, does that mean Access Point must hold all 20 per-client unicast key? And if multicast/global key is used for encrypting multicast/broadcast traffic, does that mean we have to pre-configure the key in Access Point? - Can someone explain me about "4-way handshake" and how a client derives 128-bits key for Encryption and 64-bits key for MIC. - I want to authenticate my clients with ComputerName\\UserName and i configured my radiusd.conf like below: realm ntdomain { format = prefix delimiter = "\\\\" ignore_default = no ignore_null = no } Is it right? Is it neccessary to care lowercase or upercase in ComputerName? - And I have a problem with my XP client: after the first successful authentication, when I disconnect and reconnect, Instead I must enter my username and password, It automatically connect without a login prompt. Thanks in advance! __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

Authenticate/Attributes based on NAS-IP-Address
by N White 13 Jun '05

13 Jun '05

Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server? Allow requests from NAS1 to authenticate and have certain attributes for users in that group and then allow requests from NAS2 to authenticate and have different attributes. Would there be anyway to allow a user to be a part of both groups? Thanks, Nick

6 16

Multiple logins Freeradius/Mysql
by Mark Elkins 13 Jun '05

13 Jun '05

We've set up Simultaneous-Use := 1 - and this seems fine. However, I have my first user - who is really off the net and 'radzap' seems to do nothing.... (radwho still gives the user as being there). What is the code... in sql.conf... simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" ...for???? In our previous Radius - we used to simply provide a valid AcctStopTime time - and the user could then login again. What do I need to do to change freeradius to do Simultaneous-Use control using mysql and not using radwho?? I've read doc/Simultaneous-Use - which doesn't use/mention [my]sql. I'm guessing (looking at where radutmp is mentioned)... radiusd.conf has... session { radutmp } Should this be changed to... session { sql } ??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

2 2

RE: restricting access for users
by alan walters 13 Jun '05

13 Jun '05

Dustin I get matchs in my users files. But the huntgroup seems to just be bypassed. Could you PM me with a users file and huntgroups file incase it is a syntax issue. thenks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Dustin Doris Sent: 13 June 2005 14:52 To: FreeRadius users mailing list Subject: RE: restricting access for users > > I have a second issue with this in that the users file has a defulat > reject if the group is not matched. This also is not being used > correctly by freeradius. The user defaults into that if there group does > not match but does not get rejected. > I have never noticed any problems like that myself. I suspect you have something else in your users file that it is matching on. Perhaps a DEFAULT Auth-Type = something? Please post your users file in its entirety (you can remove the # lines if you would like for easier reading) Then post your radiusd -X output showing this behavior. That way you can read the debug info and look for a line that says something like "matched users file at 1". Without seeing the users file and the actual debug here its hard to say. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005

1 0

Database connection failure and retry
by Ming-Ching Tiew 13 Jun '05

13 Jun '05

A little while ago I posted about in my configuration, using unixodbc/freetds, we noticed that database/network failure causes permanent disability in radius server to stop logging and I was given the reply that it is in the feature of radius server to retry upon failure. So there is a discrepancy between what I noticed verses the "supposed to be" behaviour. Upon further investigation I explored into the code, I found this in sql_mysql.c :- static int sql_fetch_row(SQLSOCK * sqlsocket, SQL_CONFIG *config) { rlm_sql_mysql_sock *mysql_sock = sqlsocket->conn; /* * Check pointer before de-referencing it. */ if (!mysql_sock->result) { return SQL_DOWN; } sqlsocket->row = mysql_fetch_row(mysql_sock->result); if (sqlsocket->row == NULL) { return sql_check_error(mysql_errno(mysql_sock->sock)); } return 0; } However the code in sql_unixodbc.c is like this :- static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; sqlsocket->row = NULL; if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) return 0; /* XXX Check if return suggests we should return error or SQL_DOWN */ sqlsocket->row = unixodbc_sock->row; return 0; } There is no checking whatsoever, so unixodbc driver is unable to reconnect upon failure.

2 5

RE: restricting access for users
by alan walters 13 Jun '05

13 Jun '05

I have a configuration similar to your no one option. >From readinr the huntgroups how to and the users how to, this seems to be the most correct method to use. I have a second issue with this in that the users file has a defulat reject if the group is not matched. This also is not being used correctly by freeradius. The user defaults into that if there group does not match but does not get rejected. Please can someone confirm these findings. Regards alan -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Martial VdB Sent: 13 June 2005 13:06 To: freeradius-users(a)lists.freeradius.org Subject: RE: restricting access for users Hi Alan, thank you for replying, this is how I tried this before, I will try to keep this as short as possible. 1) users: bob Password == "bob", Huntgroup-name == "diegem" Login-Service = 0, Vendor-Specific = 9, Reply-Message = "Hello, bob", Cisco-AVpair = "shell:priv-lvl=15", Service-Type = NAS-Prompt-User, huntgroups: diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x brussels NAS-IP-Address == 10.2.x.x I hoped that the nas ip addresses belonging to diegem where only accessable for users who had Huntgroup-name == "diegem" in their config. But this did not seem to make a difference. ************************************************************************ ** 2) users: DEFAULT Auth-Type = System Login-Service = 0, Vendor-Specific = 9, Service-Type = NAS-Prompt-User, Cisco-AVpair = "shell:priv-lvl=15", $enab15$ bob bobke huntgroups: diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x Group == NOC, brussels NAS-IP-Address == 10.2.x.x I made bob and bobke local users on my machine and added them to # groups. bob to NOC and bobke to brussels. bob:x:1005:1005::/home/bob: bobke:x:1006:1006::/home/bobke: NOC:x:1005: brussels:x:1006: If the user was not a member of group NOC he would be refused on the NAS servers belonging to huntgroup diegem.Because diegem is linked to group NOC (Group == NOC). This did not work either. In both cases every user was allowed access as soon as the username and passwords checked out. I also had problems with nas ip addresses belonging to more that 1 group. It looked like the groups are processed from top to bottom and as soon as it hits the first entry of that address freeradius allowes access. But for my problem to be solved it should cache information like Group = NOC or for example user_pool = diegem. And compare this information agains an entry in the users file like: user_pool=diegem or checking if on the system bob's primary group is NOC. I did several more combinations but I think one of these 2 should work. Perhaps I made a configuration error ? Big thank you in advance ony for reading and getting into this problem. If I was not clear enough please let me know. Martial >Yes this is my experience as well. Running v 1.0.2 there was nothing in the >change log for 1.0.3 >to say this was fixed either. >Just as a note when I posted these findings nothing came back. >I was using an ldap backend as well. It would be great to have a detailed >explaination of this one >and maybe confirmation that it is not working or >wheather is it syntax that causes the problem >Alan >>From: "Martial VdB" <mdbnoc(a)hotmail.com> >>Reply-To: FreeRadius users mailing list >><freeradius-users(a)lists.freeradius.org> >>To: freeradius-users(a)lists.freeradius.org >>Subject: restricting access for users >>Date: Mon, 13 Jun 2005 09:22:14 +0200 >> >>Hi there, >> >>I'm a newby here so forgive if I ask obvious questions. >> >>I'm trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on >>a Linux Debian machine and it is working fine :) >>But I need to achieve the following setup: >> >>We have # cisco routers and switches who are locally managed by on site >>engineers. So these local engineers have to be able to log in to their >>devices and not be allowed to log in to devices on other sites. Next to >>these different site engineers there is a group called NOC. The NOC >>engineers need to access all devices on all sites. >> >>I've tried several setups by using the huntgroups and using system as >>authentication method but I can't get the huntgroup validation to work. It >>looks like the huntgroups are just ignored. Everyone can just enter any >>device as soon as their usrname and password is matched on the system. >> >>Did someone do a similar setup where users where restricted and with a >>general group that needs access everywhere or can someone tell me how I >>should take this on. It should be fairly easy I thought... >> >> >>Thanks for your help, it is highly appreciated, >> >>Martial > >_________________________________________________________________ >Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be > >- List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee(r) Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

executing external program
by vicky 13 Jun '05

13 Jun '05

Hello guys and girls, While executing a script of mine in the radiusd.conf file I get a very strange error that worries me. /radius_xlat: '/home/vicky/finalprog/compAttrs Access-Request' Exec-Program: /home/vicky/finalprog/compAttrs Access-Request MASTER: Child PID 28050 failed to catch signal 11: killing all active servers./ The script it self is tested aside and it work. What seems to be the problem. I've never seen anything like this before... Thanks for all the suggestions! -- Vicky

1 0