August 2005 - Freeradius-Users - lists.freeradius.org

usage of exec to get LDAP value..
by haizam 29 Aug '05

29 Aug '05

Dear all, I've configured my radius to load value of timeout based on NAS-Port-Type.. Using LDAP for user's entry.. In LDAP.. user's entry will have additional 2 attributes TimeoutPSTN: 4000 TimeoutISDN: 1000 then in users file.. using exec to run small script to get correct value of sessiontimeout based on NAS-Port-Type DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U ISDN}` DEFAULT NAS-Port-Type == "Async", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U PSTN}` And its works... But my question is there any better way to do this?? Maybe directly get value from LDAP.... thanks.. --haizam

2 4

rlm_attr_filter for proxied accounting packets
by Thor Spruyt 27 Aug '05

27 Aug '05

Hi, I noticed that rlm_attr_filter.c contains the following in the attr_filter_preproxy function: if (request->packet->code != PW_AUTHENTICATION_REQUEST) { return (RLM_MODULE_NOOP); } This means that accounting packets are not handled by this function. Instead, the accounting packets are handled by the attr_filter_accounting function. I have a problem with this, because I'm rewriting attributes with the preproxy_users file. That module's function will change attributes in both proxied authentication requests and proxied accounting requests. Now, for authentication everything works fine: - I don't do any attribute changing in the "authenticate" stage, so everything stays the same here - then we go to the "pre-proxy" stage, where first I use rlm_files for some changing and then rlm_attr_filter to filter some attributes out For accounting however, the following happens: - in the "accounting" stage, rlm_attr_filter filters some attributes out because I don't want them to be sent to the home radius - in the "pre-proxy" stage, rlm_files wants to change some attribute based on another attribute which was filtered out already by rlm_attr_filter in the "accounting" stage - in the "pre-proxy" stage, rlm_attr_filter returns NOOP, since it's coded not to do anything here for accounting packets. To be clear: I think that the pre-proxy functions should always act on both Access-Request and Account-Request packets, the configuration in radiusd.conf should take care if you want to differentiate between the two. Obviously, for post-proxy this would apply too, but the need is not there, since Accounting-Reply packets generally do not contain any attributes, but even then it would be nice to be able to tell the server to filter them our or not. Since rlm_attr_filter should only be used for proxied packets, the attr_filter_accounting function is obsolete, just like the attr_filter_authenticate function was! If you want, I can supply a patch for rlm_attr_filter.c to also accept accounting packets in the attr_filter_preproxy function, just let me know. -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

1 0

more on server certificates
by Ben Thompson 27 Aug '05

27 Aug '05

Hi Has anybody got a digital certificate (with the extended key usage attributes required for PEAP) installed on their FreeRADIUS box that has been signed by a commercial trusted CA? I have come to suspect that this is impossible due to the fact that Verisign are the only company marketing such a product and it can only be installed on a Windows server (as the online purchase system only works if done from the target machine using Internet Explorer and Xenroll). Thanks Ben

2 2

PEAP issues
by allan.borman 26 Aug '05

26 Aug '05

Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end**********

2 1

Re: MySQL radacct not updated
by sean 26 Aug '05

26 Aug '05

Hi Thor, I'm just posting this to thank you for your help and let you know that it was appreciated and also to help anyone else with a similar problem to see the solution. In order to enable the accounting packets between Chilli and Radius I removed all of the pin holes in my ADSL modem and instead set up a NAT default server pointing to my Radius/WEB/Jabber/POP/SMTP/SMPP/Apache server. This allows all of the trafic arriving to the ADSL modem to pass through to the server and solved the problem. I not sure about the security of this fix so I'm setting up a firewall on the server. This will give me better control over the trafic than the ADSL modem did. Anyway once again thanks a million Thor you pointed me in the right direction and saved me another week with no sleep. Regards, Sean Bracken http://freetextworld.com http://topup.ie http://swarmhotspots.com

2 1

RE: PEAP issues
by Bill Carr 26 Aug '05

26 Aug '05

Remove the " Auth-Type Local" >From the guest account. Let freeradius figure out to do EAP on it's own. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of allan.borman Sent: Friday, August 26, 2005 12:32 PM To: FreeRadius users mailing list Subject: PEAP issues Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end********** - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

salt-encrypted VSAs?
by Bjørn Mork 26 Aug '05

26 Aug '05

Hello, I was hoping to send a few salt-encrypted VSAs to an ERX using FreeRADIUS Version 1.0.4, but I can't find any examples of how to do that. Is it possible, and if so, how? The format of the VSAs is documented on http://www.juniper.net/techpubs/software/erx/junose700/swconfig-broadband/h… My initial (far fetched) attempt was to modify dictionary.erx like this: VENDOR ERX 4874 BEGIN-VENDOR ERX ATTRIBUTE ERX-Virtual-Router-Name 1 string [..] ATTRIBUTE ERX-LI-Action 58 integer encrypt=1 ATTRIBUTE ERX-Med-Dev-Handle 59 string encrypt=1 ATTRIBUTE ERX-Med-Ip-Address 60 ipaddr encrypt=1 ATTRIBUTE ERX-Med-Port-Number 61 integer encrypt=1 END-VENDOR ERX [..] VALUE ERX-LI-Action off 0 VALUE ERX-LI-Action on 1 VALUE ERX-LI-Action noop 2 I also tried the other documented encrypt-values, with no success. As probably should be expected? The ERX seems to just ignore Access-Accept packets with any of these attributes. They are not even logged as received. Not much help there. Cisco has a bit better documentation with some examples (but not for FreeRADIUS) here: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/12… Does anyone have an idea of how to do this with FreeRADIUS? Bjørn

2 3

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 26 Aug '05

26 Aug '05

Thanks for the answert Alan, but what do you mean that it should be made more prominent in EAP-Conf? Could you give me detailed instructions how i can get this OID to my certificates? Armin FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 25.08.05 17:35:11: Ben Walding <ben.walding(a)gmail.com> wrote: > And then I stumbled on this > > http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html > > 1.3.6.1.4.1.311.17.2 > > After I started adding that OID to my machine certs, everything > started working wonderfully. That OID is added by the cert creation script in the "scripts" directory, but it should be made more prominent in eap.conf, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: FreeRadius-1.04 install seg faults after install (using EAP-TLS)
by Ben Dowling 25 Aug '05

25 Aug '05

I've loaded up radiusd into gdb and the bug looks the same as http://bugs.freeradius.org/show_bug.cgi?id=98. That page says the solution is to pass configure the --disable-shared flag, which I have done, yet the bug remains. Any help would be greatly appreciated, Ben Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 22174)] 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) (gdb) where #0 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 #1 0x08061404 in eaptype_load () #2 0x40489ad7 in eap_instantiate (cs=0x809f8d8, instance=0x814b0b8) at rlm_eap.c:134 #3 0x080575ff in find_module_instance () #4 0x0805874a in modcall () #5 0x080587b3 in compile_modsingle () #6 0x080579f4 in find_module_instance () #7 0x08057e75 in setup_modules () #8 0x0804ff76 in main () #9 0x40337e36 in __libc_start_main () from /lib/libc.so.6

2 4

lowercase before domain match in users file
by Tariq Rashid 25 Aug '05

25 Aug '05

hi - is it possible for freeradius to match the domains/realms for proxying purposes only (ie not rewrite the User-Name): in the users file: # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" can i enable a switch so that ABC.co.uk, aBc.Co.UK and so on are also matched? however, we don't want the User-Name to be rewritten as per to_lower in radiusd.conf tariq

2 1