August 2005 - Freeradius-Users - lists.freeradius.org

Acct-Session-Id too long
by Rohaizam Abu Bakar 24 Aug '05

24 Aug '05

Dear all, FreeRADIUS 1.0.4 I'm using mysql to store accounting...especially to check simultaneous-use.. but one case as below, i received a long "Acct-Session-Id" ... and cannot fit into mysql... and problem to update Stop record... should I change column size from char32 to reasonable value ? pls advise.. thanks.. Acct-Session-Id = "erx atm 2/3.10601218:60.1218:0165889995" +--------------+----------------------------------+------------------+---------------------+-------------+ | nasipaddress | AcctSessionId | AcctUniqueId | acctstoptime | nasporttype | +--------------+----------------------------------+------------------+---------------------+-------------+ | 61.6.191.247 | erx atm 2/3.10601218:60.1218:016 | ebe88dbb3457c826 | 2005-08-22 10:32:52 | xDSL |

4 3

matching accounting packets in the acct_users file
by Tariq Rashid 24 Aug '05

24 Aug '05

i would like to filter off interim accoutning packets from specific domains to a different proxy target - as follows... # interim/status/alive accounting records are actually sent to the processing domain DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Acct-Status-Type == Alive, Proxy-To-Realm := "filterradius" # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" however, the first rule is never matched when i send packets with the following attributes: Attributes: Acct-Status-Type = Alive, User-Name = "test(a)xyz.abc.co.uk" do i have the syntax wrong? tariq

1 0

Re: Windows Client Authentification bevore Domain logon
by Steven Atkinson 24 Aug '05

24 Aug '05

At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF

1 0

freeradius + MySQL not working after upgrade from 1.0.1
by marc-ml＠neoharmonix.net 24 Aug '05

24 Aug '05

Hello. I have encountered a problem upon upgrading from freeradius version 1.0.1. I'm using the sql module (rlm_sql_mysql) for authorization and accounting of dialup users (reselling dialup from several networks). After upgrading to 1.0.2 with the same configuration, it no longer works. >From the logs I see that authorization works: Login OK: [xxxx(a)xxxxx.com] (from client xxxxxxxx port 15) and it sends "Access-Accept" but the connecting dialup user can't connect. I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes which look something like this: WORKING VERSION 1.0.1: Sending Access-Accept of id 158 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Filter-Id = "data6330_1" Proxy-State = 0x3532 X-Ascend-Data-Filter += "ip in forward tcp est" X-Ascend-Data-Filter += "ip in forward dstip 200.100.100.10/32 0" X-Ascend-Data-Filter += "ip in forward dstip 66.55.44.0/24 0" X-Ascend-Data-Filter += "ip in forward dstip 66.44.55.0/24 0" X-Ascend-Data-Filter += "ip in drop tcp dstport = 25" X-Ascend-Data-Filter += "ip in forward 0" Finished request 0 Going to the next request NON-WORKING VERSION 1.0.4: Sending Access-Accept of id 154 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 X-Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 X-Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230392e3130322e3130372e37372f33322030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036342e32342e33352e302f32342030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036362e34352e3234332e302f32342030 X-Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 X-Ascend-Data-Filter += 0x697020696e20666f72776172642030 Filter-Id = "data6330_1" Proxy-State = 0x3234 Finished request 3 Going to the next request The working version proceeds to do accounting sometime after sending that while the other version stops there. I suspect those long strings are the culprit since everything else in the logs looks the same. The attributes come from the database and they look fine there. Any ideas how I can get the previous behavior or get the newer versions to work? Or maybe the problem is something else? Thanks, Marc

4 6

freeradius.net problem with reathentication
by Liaqat, Touseef 24 Aug '05

24 Aug '05

Hi All, I am using freeradius.net-1.0.2-r0.0.8.exe for windows which I downloaded from freeradius.net. I apologize if this distribution is not relevant to this mailing list. when testing I am getting some problem with authentication. Server authenticate the client but after one successful re-authentication it is denying next two re-authentications and then after those two , it is accepting two re-authentications and goes on with this pattern. I hope you understand what I am talking. This problem is very different then any other problem we faced related to radius server and we have never encountered this problem with freeradius with BSD. I have attached the debug log output of freeradius server for you comments. Please help me solving this problem. Thanks, Touseef Liaqat

1 0

Example of Mac OS X EAP-TLS process?
by Landon Cox 23 Aug '05

23 Aug '05

I've got a good, working FreeRadius running EAP-TLS on a SuSE 9.2 box. I've had good luck with WPA supplicants for XP SP2 and several vendor PCMCIA card supplicants - all on XP SP2. I've been trying to get an OS X (Tiger) machine up with the same type of setup, but each time I set the 802.1x "TLS" check box, I always get an error stating that there is no valid certificate available on the machine. I've imported both the client and root CA certs into the Mac OS X Keychain (the root CA imported into X509 anchors category and the client cert into 'logins'.) I've generated the Mac client cert in the same way as I do the XP client cert except without the xpextensions ASN.1 options on openSSL. I realize this isn't a FreeRadius question per-se but was hoping that someone else in FR land has done an 802.1x EAP-TLS setup on OS X w/FR and had success. Thank you, Landon

1 0

Mobile phone authentification
by Marc.Schlueter＠comneon.com 23 Aug '05

23 Aug '05

Hi all, I'd like to use FREERADIUS as an authentification method for mobile phones, but I'm not sure A) if this is possible and B) how to configure as I'm a newbie. Please find following scenario: A mobile phone user would like to access my server behind the proxy/gateway by using a gprs connection of an official provider (e.g. vodafone). Currently the mobile phone builds up a gprs connection to the providers network and send a get.request to the server through the proxy/gateway. My proxy/gateway simply forwards the request to the server but can not authentificate it. Especially authentification gets important for the application called "MMS-Multimedia Messaging Service". In this case the client POSTs a message, but leaves the sender-header in the message empty (=asks the network to insert the proper information). Then my proxy/gateway can not insert the proper information, but the server which has to process this request requires the sender-header to perform billing actions for example. Now I was told that RADIUS is the solution. RADIUS is able to detect the actual sender information and delivers this information to the proxy/gateway which is then able to insert the missing value into the sender-header and everybody's happy ;) Someone was able to follow my thoughts? What's currently available? A proxy/gateway, mobile-phones, GPRS-connectivity and a RedHat machine for freeradius. What's needed? Some support in configurating freeradius. Comments are really welcome, Rgds. Marc

2 1

ldap_connections_number
by Benedikt Panzer 23 Aug '05

23 Aug '05

Hello, it seems to me the FR doesn't open as many connections as in ldap_connections_number specified. Even tough there are many RADIUS requests in the queue (they have to be) and I allowed 50 connections to the ldap server FR opens justs 1 or 2. Why? That wouldn't bother me usually. But my ldap server delays responses when the password was wrong. And because FR uses only so few parallel connections also those requests with correct passwords are affected and delayed. That's why I'd really apreciate if FR used more connections. Is there a chance? Thanks a lot, Benedikt -- Benedikt Panzer Rechenzentrum Universität Stuttgart

2 1

RE: best place for logic - users file or custom module?
by Tariq Rashid 23 Aug '05

23 Aug '05

is python more stable than the support for perl? i have much more experience in python than perl. also is the "perl/python" stuff persistent - or is the interpreter invoked for every request? i am asking as i think this is the main reason for Radiator's performance issues - in theory even a big interpreter loaded into RAM should run fine ... but I suspect something inefficent is happening with Radiator. tariq rashid -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 23 August 2005 16:54 To: FreeRadius users mailing list Subject: Re: best place for logic - users file or custom module? Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > hi, i'm planning a significant migration from a different radius server > (Radiator, perl based). That's good to hear! > our tests with freeradius show a much lighter server - its faster, and > easier on memory and cpu. however the downside is that applying custom logic > to the radius process is a bit more difficult. Yes, there are trade-offs. > i'd like some advide on the best place to implement this logic. for example > - a common scenario is for a request to come from A, and the reply to A > contains instructions to extend a tunnel to a second device B. A second > query from B is then received. > > this case is handled easily in perl using "if()" constructs. My suggestion is to use Perl. :) rlm_perl is in 1.0.4, but it's not stable. The CVS head is in transition, too. I would suggest grabbing revision 1.19 of rlm_perl from CVS, and building it into 1.0.4. It should work, and it will get you the custom logic you need. And, it will be multi-threaded, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

MySQL radacct not updated
by sean 23 Aug '05

23 Aug '05

Hi, I have a strange problem with MySQL and FreeRadius. The system had been performing perfectly but it is no longer updating radacct. The result is that when users login the counter on their login page counts down their remaining time. But when they logout and then login again the counter is reset back to its origional value. This means that user names and passwords last forever. The sql log file used to show Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('42e4494400000000', '3f1c519e5a66e2fe', 'bebbik6', '', '0.0.0.0', '0', 'Wireless-802.11', '2005-07-26 06:04:07', '0', '0', '', '', '', '0', '0', '00-12-17-B7- A1-70', '00-C0-49-5C-40-48', '', '', '', '192.168.182.2', '', '0'); UPDATE radacct SET AcctStopTime = '2005-07-26 06:04:13', AcctSessionTime = '6', AcctInputOctets = '1403', AcctOutputOctets = '5179', AcctTerminateCause = 'User-Request', AcctStopDelay = '', ConnectInfo_stop = '' WHERE AcctSessionId = '42e4494400000000' AND UserName = 'bebbik6' AND NASIPAddress = '0.0.0.0'; But now it only shows Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; I'd really appreciate any help to solve this problem. Regards from Ireland. Sean Bracken

2 1