July 2005 - Freeradius-Users - lists.freeradius.org

Dictionnary Permission - How to solve it ?
by Aime 14 Jul '05

14 Jul '05

Hello, I am calling "radclient" form a cgi perl script as follow : --- code fragment---------- $av_string = User-Name = fredf, User-Password = wilma, NAS-IP-Address = 192.168.89.1, NAS-Port = 0; my $response = `echo -E "$av_string | radclient -d /etc/freeradius -r $radretries -t $radtimeout $radiusip $radiustype $radiuspw 2>&1`; --- end code fragment------ and I am getting the following error: "radclient: dict_init: Couldn't open dictionary "/etc/freeradius/dictionary": Permission denied" I gave rwxrwxrwx to "/etc/freeradius/dictionary" but it does not help. Where can i look to solve this ? Using Freeradius 1.0.4 on Debian Sarge Testing --Aimé freeradius-users(a)lists.freeradius.org __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: Active Directory and FreeRadius
by Zawacki Jason D Ctr AFRL/IFOS 14 Jul '05

14 Jul '05

I'd recommend skipping PAM and using MIT's kerberized telnet. I don't believe PAM supports single signon, whereas you can have single sign-on with kerberized telnet. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Thursday, July 14, 2005 11:39 AM > To: FreeRadius users mailing list > Subject: Re: Active Directory and FreeRadius > > "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > > Well I can use pam_krb5, but what I am trying to accomplish > here is that I > > have quite a few Linux workstation on my network and I > thought if I can > > setup those Linux workstation to point to the radius server > where they login > > using there Active Directory credentials. > > You said that already. > > What you may not know is that AD implements Kerberos. You can use > pam_krb5 on the Linux boxes to do *exactly* the same thing, but > without using RADIUS at all. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Password == "bla%1" (shooting into my foot)
by Stefan Nehlsen 14 Jul '05

14 Jul '05

hello, trying to get freeradius working (again) I figured out a strange behaviour: Authentication with CHAP as my testaccount failed until I tried it with PAP first. After one (or more) successful authentifications with PAP CHAP works. It took some time until I figured out that my password contained a % and the daemon tried some variable substitution. don't do this! How do I escape special chars in the users file and what characters are special? Stefan -- Stefan Nehlsen | ParlaNet Administration | sn(a)parlanet.de | +49 431 988-1260

2 1

RE: Password == "bla%1" (shooting into my foot)
by Guy Davies 14 Jul '05

14 Jul '05

Hi Stefan, I also saw this. The escape character is \. Special characters I would think of are !, #, *, ?, ^, $, &, % and (obviously) \. There may well be others. Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Stefan Nehlsen > Sent: 14 July 2005 15:45 > To: freeradius-users(a)lists.freeradius.org > Subject: Password == "bla%1" (shooting into my foot) > > > hello, > > trying to get freeradius working (again) I figured out a > strange behaviour: > > Authentication with CHAP as my testaccount failed until I > tried it with PAP first. After one (or more) successful > authentifications with PAP CHAP works. > > It took some time until I figured out that my password > contained a % and the daemon tried some variable substitution. > > don't do this! > > How do I escape special chars in the users file and what > characters are special? > > Stefan > -- > Stefan Nehlsen | ParlaNet Administration | sn(a)parlanet.de | > +49 431 988-1260 > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Re: FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 14 Jul '05

14 Jul '05

You're right, sorry Here's what I get in my radius.log "Error: WARNING: Malformed RADIUS packet from host 172.17.xxxx: Vendor specific attributes do not exactly fill Vendor-Specific" That's the only error I get. "Alan DeKok" <aland(a)ox.org> Enviado por: freeradius-users-bounces(a)lists.freeradius.org 13/07/2005 10:34 p.m. Por favor, responda a FreeRadius users mailing list Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc: Asunto: Re: FreeRadius and PIX 520 accounting lmarante(a)aerolineas.com.ar wrote: > Last I checked, there was some kind of incompatibility between the packets > the firewall is sending and what FreeRadius is expecting to recieve. "some kind"? Can you say what, exactly? If you can't say what the incompatibility is, there's no way of knowing if the problem is fixed, or even can be fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 14 Jul '05

14 Jul '05

Thanks Dusty. I just implemented your suggestions and it's working very well. Once again I am pleasantly surprised by the flexibility of FreeRADIUS. Great job! Jason > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Dusty Doris > Sent: Wednesday, July 13, 2005 4:53 PM > To: FreeRadius users mailing list > Subject: RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > > > > > > You're using the LDAP-Group attribute, which is set to use svr1, > > > which is down. There's currently no fail-over for the LDAP-Group > > > attribute. > > > > > > > I dig, that's kind of what I thought (even if I didn't word > it correctly). > > Thanks for your help! > > > > You can simulate redundancy for the Ldap-Group attribute, by > doing this. > > Instantiate your ldap modules in radiusd.conf. > > instantiate { > srv1 > srv2 > srv3 > } > > In users file, add multiple lines of the same ldap-group > lookup, for each > srv. > > For example, say you must have ldap-group of dial if coming > from a dial > huntgroup. > > DEFAULT Huntgroup-Name == dial, srv1-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv2-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv3-Ldap-Group == dial > > What will happen is if the huntgroup matches, then the server > will lookup > on the srv1 instance if ldap-group = dial. If so, it matches and the > users file ends. If not, it continues down the file, where > it will then > try srv2. If that fails, it continues to srv3. > > So, if one and two are down, then this will require 3 > different lookups to > finally get to srv3, but it will provide you with some type > of redundancy. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 13 Jul '05

13 Jul '05

Hello everyone This subject was once asked but I've never seen a clear answer about it. I'm using FreeRadius 0.9.3 to authenticate our VPN users connecting through our PIX 520 with OS version 6.3. I'd like to enable accounting also so I can restrict only one connection per user simultaneously. Last I checked, there was some kind of incompatibility between the packets the firewall is sending and what FreeRadius is expecting to recieve. I wanted to know if this is somehow "patched" in 1.0.4 or if it will still not work. Also, if it's not fixed in freeradius, anyone knows if upgrading to the OS version 7 will fix it ? Thanks in advance. Lior Marantenboim.

2 1

eap id bug
by DALE REAMER 13 Jul '05

13 Jul '05

When using freeradius with wpa_supplicant I have noticed freeradius does not bump the EAP id when sending back the Access-Accept packet. wpa_supplicant notices this and has a work around. Will the WPA drop this packet (it is important because it has the keys in the attributes). Has anyone reported this bug? The reason I ask is because after receiving the accept packet, wpa_supplicant goes into AUTHENTICATED state but cannot connect to the network, or associate. Any ideas? the wpa_supplicant (last part) trace: WPA: Sending EAPOL-Key 2/4 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=119 EAPOL-Key type=254 WPA: RX message 3 of 4-Way Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: IE KeyData - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 01 WPA: No WPA/RSN IE for this AP known. Trying to get from scan results WPA: Found the current AP from updated scan results WPA: Sending EAPOL-Key 4/4 WPA: Installing PTK to the driver. WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=127 EAPOL-Key type=254 WPA: RX message 1 of Group Key Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: Group Key - hexdump(len=32): [REMOVED] WPA: Installing GTK to the driver (keyidx=1 tx=0). WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 WPA: Sending EAPOL-Key 2/2 WPA: Key negotiation completed with 00:0f:b5:7a:17:bc [PTK=TKIP GTK=TKIP] Cancelling authentication timeout Removed BSSID 00:0f:b5:7a:17:bc from blacklist EAPOL: External notification - portValid=1 EAPOL: SUPP_PAE entering state AUTHENTICATED Signal 2 received - terminating ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 wpa_driver_ndis_set_wpa: enabled=0 No keys have been configured - skip key clearing rmdir[ctrl_interface]: No such file or directory EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit the freeradius (last part trace): ending Access-Challenge of id 12 to 192.168.0.229:1075 EAP-Message = 0x010c00501900170301002028f83aa4e802c2965c29685e7521a11ea189ad707d72f340478950afc820a3dd1703010020c159819f4919952b824a4c2e7d71d92338cfeb7e35842ecca2590d0ec5e9a91f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25ce47ac6c8028e663a2f6f53414e7 rad_recv: Access-Request packet from host 192.168.0.229:1075, id=13, length=251 Message-Authenticator = 0x508b7cdf35912a2b07a9f6f461200076 Service-Type = Framed-User User-Name = "dreamer" Framed-MTU = 1488 State = 0xed25ce47ac6c8028e663a2f6f53414e7 Called-Station-Id = "000FB57A17BC:NETGEAR" Calling-Station-Id = "00070EB38E2D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020c005019001703010020d636529b1ced029a7bc635638d3d21e9e6eeff64ba0e2bbdae2f362655442a601703010020653e43e16142b6e7535d53a7306aad5bc40cf157a9fa7f38c067a870a649c184 NAS-IP-Address = 192.168.0.229 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Accept of id 13 to 192.168.0.229:1075 MS-MPPE-Recv-Key = 0x2ae009c01dc4c8af6bbf63b3a03eae0bf36d5f74277cd979e0aab0c7c0208b00 MS-MPPE-Send-Key = 0xed2e0e7f8242205404cecb7894a82d742f43a225b2f1ddae8231128e413f00ec EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "dreamer"

2 2

Re: MySQL Connection Failure
by Marcin Jessa 13 Jul '05

13 Jul '05

On Mon, 11 Jul 2005 17:18:00 -0500 "Thomas Tinsley" <ttinsley(a)everyones-wireless.com> wrote: > Marcin, > > > >> Hi my name is Tom and I am installing FreeRadius for the first time. > >> > >> Specifications: > >> OS: Fedora Core 4 > >> Linux Kernel 2.6.11smp > >> Freeradius version : 1.0.2 > > >1.0.2 has security holes. Use 1.0.4 > > Update complete. Problem still present. > > >> MySQL version : 4.1.11 > >> > >> DEBUG Info: > >> > >> Mon Jul 11 14:05:01 2005 : Error: rlm_sql (sql): Failed to connect DB > >> handle > >> #4 > >> Mon Jul 11 14:05:01 2005 : Info: rlm_sql (sql): There are no DB > >> handles to use! skipped 5, tried to connect 1 Mon Jul 11 14:05:10 2005 > >> : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. > >> Mon Jul 11 14:05:10 2005 : Info: rlm_sql_mysql: Starting connect to > >> MySQL server for #4 Mon Jul 11 14:05:10 2005 : Error: rlm_sql_mysql: > >> Couldn't connect socket to MySQL server root@localhost:radius Mon Jul > >> 11 14:05:10 2005 : Error: rlm_sql_mysql: Mysql error 'Can't connect to > >> local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' > > >Your MySQL is not running or you have wrong username and pass or no > database to connect to or wrong database name. > > MySQL is running. Username, Password, and Database have been confirmed > using Dialup-Admin to connect and administrate data records. > > >> Question? > >> > >> Does anyone have a method to trace the connection attempt? MySQL is > > >> not kicking out any log info that would help. > > >Read above. > I have been through the basic troubleshooting steps. Downloaded the newest > version (./configure, make, makeinstall) and still get an error. The error > points to a specific socket that does exist and is part of the MySQL > configuration. Ok, try to use this config: http://www.yazzy.org/configs/linux/my.cnf It's a standard config for gentoo but I am sure you can addapt it to RedHat. Pay attention to the socket variable. > >>I have confirmed the MySQL > >> server is running, and can connect to databases using PHP & PERL. > > >type mysql -u root -p > >You will be prompted to type in your pass if mysql is running ok. > > I do not have trouble using the mysql client to connect to the server and > select the radius database. I can even execute select statements against > tables to view the test data. > > Is there any chance that freeradius is not compatible with my current > version of MySQL? No. I run it on MySQL 5.x on FreeBSD. > > MyADMINPHP and Dialup-Admin are installed, configured, and tested > > successfully for the MySQL server. I just need to get Radius to do the > > same. Radius.conf & sql.conf are modified accordingly. > > > > Any help would be appreciated. Thank you. > > Cheers, > Marcin Jessa >

2 1

RE: sql counter clarification and issues
by Ross Tsolakidis 13 Jul '05

13 Jul '05

Thanks for clearing that up Marcin :) Does anyone else have any other suggestions on how to extract daily totals ? Regards, -- Ross -----Original Message----- From: Marcin Jessa [mailto:lists@yazzy.org] Sent: Wednesday, 13 July 2005 4:38 PM To: Ross Tsolakidis Cc: freeradius-users(a)lists.freeradius.org Subject: Re: sql counter clarification and issues On Wed, 13 Jul 2005 12:15:45 +1000 "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > Thanks for responding Marcin, just to double check: > > > I added those details into radgroupcheck: > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24Hours | Max-Daily-Session | := | 86400 | > | 2 | 24Hours | Max-Weekly-Session | := | 86400 | > | 3 | 24Hours | Max-Monthly-Session | := | 86400 | > | 4 | 24Hours | Max-All-Session | := | 86400 | > | 5 | 10Mins | Max-Daily-Session | := | 600 | > | 6 | 10Mins | Max-Weekly-Session | := | 600 | > | 7 | 10Mins | Max-Monthly-Session | := | 600 | > | 8 | 10Mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > mysql> > > == > > My sqlcounter.conf is exactly the same. > > I have added this: > $INCLUDE ${confdir}/sqlcounter.conf > Into the radiusd.conf > > == > > When I fire up radius in debug mode I get these messages for sqlcounter: > > Module: Loaded SQL Counter > sqlcounter: counter-name = "Daily-Session-Time" > sqlcounter: check-name = "Max-Daily-Session" > sqlcounter: key = "User-Name" > sqlcounter: sqlmod-inst = "sql" > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > sqlcounter: reset = "daily" > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Next > reset 1121263200 [2005-07-14 00:00:00] > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Prev > reset 1121176800 [2005-07-13 00:00:00] > Module: Instantiated sqlcounter (dailycounter) > > == > > I read the experimental.conf but I can't seem to understand where the > counters are reset, which table ? > Could you give me an example of the table so I can see what it should > look like ? (daily totals) I don't really have any need to disconnect > people after a certain period of time, just need daily and monthly > totals. Then sqlcounter is not for you. If you need stats, those are stored in radacct table and can be sorted with SQL queries + maybe some code. Take a look at dialupadmin, how it's done there. > Thanks again, greatly appreciated ! :) > > > Regards, > -- > Ross > > -----Original Message----- > From: Marcin Jessa [mailto:lists@yazzy.org] > Sent: Tuesday, 12 July 2005 6:03 PM > To: FreeRadius users mailing list > Cc: Ross Tsolakidis > Subject: Re: sql counter clarification and issues > > On Tue, 12 Jul 2005 15:21:52 +1000 > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > Ok, now I'm really confused :( > > > > Can someone please clarify exactly what does the sqlcounter module > > do > ? > > Basically I need to calculate the data on a daily basis for each user. > > sqlcounter works fine. > Your radgroupcheck or radcheck needs to have the same attributes you > have in your sqlcounter config. > Check out mine: > http://www.yazzy.org/configs/linux/freeradius/sqlcounter.conf > > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24hours | Max-Daily-Session | := | 86400 | > | 2 | 24hours | Max-Weekly-Session | := | 86400 | > | 3 | 24hours | Max-Monthly-Session | := | 86400 | > | 4 | 24hours | Max-All-Session | := | 86400 | > | 5 | 10mins | Max-Daily-Session | := | 600 | > | 6 | 10mins | Max-Weekly-Session | := | 600 | > | 7 | 10mins | Max-Monthly-Session | := | 600 | > | 8 | 10mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > Read experimental.conf, it describes the module. > It count's user's online time stored in the raddacct table and based > on that info allows user to log in if her allowed session time is not > exceeded. > This can be done on daily, weekly, monthly or total basis. > > > Thanks for your patience :) > > Read former postings to the list describing the behaviour and > functionality of the module. > People tend to be more patient if they know you did some work on your > own. > > Cheers, > Marcin Jessa > > > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Ross Tsolakidis > > Sent: Tuesday, 5 July 2005 2:14 PM > > To: FreeRadius users mailing list > > Subject: RE: sql counter clarification and issues > > > > Yes the server is receiving accounting packets. > > The SQL rows are updating every 5 mins, (I have the NAS set to send > > accounting packets every 5 mins). > > > > I run it in debug mode, I see: > > Module: Loaded SQL Counter > > sqlcounter: counter-name = "Daily-Session-Time" > > sqlcounter: check-name = "Max-Daily-Session" > > sqlcounter: key = "User-Name" > > sqlcounter: sqlmod-inst = "sqlcca3" > > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE > UserName='%{%k}' > > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > > sqlcounter: reset = "1h" > > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Next > > reset 1120536000 [2005-07-05 14:00:00] > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Prev > > reset 1120532400 [2005-07-05 13:00:00] > > Module: Instantiated sqlcounter (dailycounter) > > > > But no reset. > > > > Does anyone have this working, if so, what am I looking for, what am > > I > > > supposed to see ? > > > > Thanks :) > > > > Regards, > > -- > > Ross > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Alan DeKok > > Sent: Tuesday, 5 July 2005 2:05 AM > > To: FreeRadius users mailing list > > Subject: Re: sql counter clarification and issues > > > > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > At midnight every night will it begin a new row in SQL ? > > > > I don't know, I've never used the module. > > > > > Because at the moment there are no new rows being created, no > > > counters > > > > > being reset. > > > > Is the server receiving accounting packets? > > > > Run it in debug mode with "reset=hour", and spend some time > > looking at what it's doing. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0