September 2005 - Freeradius-Users - lists.freeradius.org

Weird huntgroup issue
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Hello, I have a weird huntgroup issue. I have users in a group 'artsen' with HuntgroupName => == ^(vpn|ras)$ I have users in group 'stagiars' with HuntgroupName => == hotspot On the radiussystem itself I can successfully authenticate users from group artsen but not from group stagiairs. But I can login with a user from group stagiars from a nas with ip 194.8.52.37 My NASclients from SQL: 17 | localhost | localhost | other | 0 |... Huntgroup file: # VPN infrastructure vpn NAS-IP-Address == 10.2.254.1 vpn NAS-IP-Address == 10.2.254.2 vpn NAS-IP-Address == localhost # ras NAS-IP-Address == 10.2.254.81 ras NAS-IP-Address == 10.2.254.82 ras NAS-IP-Address == localhost # hotspot NAS-IP-Address == x.y.z.37 hotspot NAS-IP-Address == x.y.z.38 hotspot NAS-IP-Address == localhost This comes in the logging when I do a check on the radiusystem itself with following arguments: radtest lvanhoey0 password localhost:1812 0 passwordhere radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [lvanhoey0] rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "volumelimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "prepaidcounter" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [lvanhoey0/jo0clni3] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- And logging when login in from nas-ipadress modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 modcall[authorize]: module "digest" returns noop for request 12 rlm_realm: No '@' in User-Name = "lvanhoey0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 12 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 12 rlm_sqlcounter: Entering module authorize code Any idea's??? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

Nortel Networks Passport 8600 + Radius AAA
by Inci Gedik 20 Sep '05

20 Sep '05

Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik -------------------------------------------------------------------------- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

1 0

RE: Walled Garden for Users Without Realms.
by Alexander C. Fossa 19 Sep '05

19 Sep '05

Hi James, Exactly what I have been trying to do for about 6 months, but keep getting distracted by doing something else. What software do you use for the wildcard DNS? Any example configs? Regards, Alexander Fossa -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of McCain, Al Sent: 19 September 2005 14:26 To: FreeRadius users mailing list Subject: RE: Walled Garden for Users Without Realms. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of James Wakefield (Sunet Sysadmin) Sent: Sunday, September 18, 2005 6:27 PM To: FreeRadius users mailing list Subject: Re: Walled Garden for Users Without Realms. G'day Al, We're doing the same thing here changing a dial-up number and migrating off of the NASes that serve that number. My approach is: * Match customers who need to be placed in the walled garden, this is easy enough for our situation, as they're in the huntgroup comprised of the old NASes. I could also match Called-Station-Id if I wanted. * Send specific attributes for those users, giving them a short session timeout (say 5, 10 minutes) which, if they fail to see or heed our message, will motivate them to call helpdesk and get sorted out, and also setting their primary DNS server to one which resolves every hostname to one of your IP addresses using a wildcard zone or some such. If this DNS server is already providing other services, you'll want to use a view for walled garden users, which you may need to facilitate by putting them into a specific subnet. What attribtues you use, exactly, will depend on your NAS gear. * On that IP address that you're resolving * to, is a webserver which displays the message you wish the walled garden users to read. If this webserver already serves other pages, you'll need to do some URL rewriting to send them to the appropriate page eg: using Apache's mod_rewrite. This way, any request for a web page will display your message. Personally, I find the easiest approach is to just dust off a box that's not being used and put the wildcard DNS and webserver on it - it's only got a couple of very simple functions to perform and it's not a critical service. You may also want to consider applying packet filtering to walled garden users as they'll still be able to reach the entire Internet by IP address, though the session timeouts make that only a moderate concern in our situation. You could also do a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. McCain, Al wrote: >Hi. > >I was wondering if there was a way to place users in a Walled Garden if >they try to Auth without a Realm. >We are currently running FreeRADIUS Version 0.9.3. Our users are stored >in MySQL. > >Company: >I work for an ISP. We seem to aquire new properties every few months. > >Current structure : > >We have multiple instances of RADIUS running: one for each domain. (I >have NO clue who set it up this way). > >I would like to consolidate these intances into one, and force our >users to use realms. > >Problem: > >We can't just force the customers to use realms. We would need to >notify them of the changes. (This can prove tricky). > >What I would like to see: > >Aside from contacting the customer about changes, I would like to send >the users to a web page after they log in without a realm. The page >would tell them that they need to log in with realms. I believe this >is called hURL'ing, however I cannot seem to find any documentation. > >Has anyone ever done this, or know if it can be done ? > >Any help is greatly appreciated. > >Thanks, >Al > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Very good idea James. I will test that out. -Al - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

PAM, Postgres, Freeradius
by Mark Olliver 19 Sep '05

19 Sep '05

Hi All, I am looking at using a postgres database as the backend storage system for freeradius and I think I have this part configured correctly. Does anyone have any scripts for creating simple user a/c's into the database? The second more important thing is that I want to use PAM to authenticate against the freeradius server. This is because I have many different servers and need to keep a consistent list of users on all systems. This I can do by replicating the postgres database, however I can not directly (safely to my knowledge) do this with out going via pam. Can anybody who has this working please give me an example of how they did this and what there pam.d files look like now. Thanks Mark Mark Olliver BSc (Hons) MBCS Thermeon Europe Ltd e-Card www.thermeoneurope.com/e-Card/mpo Email mpo(a)thermeoneurope.com Web www.thermeoneurope.com Support 0906 515 0908 Int. Support +44 1293 864 341 Support Email support(a)thermeoneurope.com Support Site www.thermeoneurope.com/rt Sales +44 1293 864 334 Sales Email sales(a)thermeoneurope.com

2 1

Re: PAP and clear text
by Stefan.Neis＠t-online.de 19 Sep '05

19 Sep '05

Hi, > You must have missed the information in RFC 2865 (RADIUS), which is also > a Fine Manual. The PAP password is XOR'd with the MD5 hash of the > shared secret and the authenticator. Yes, that's a bit clearer than saying "the password is hashed", since it also shows that the process is reversible and you can easily obtain the cleartext password from the "obfuscated" password. > You've been reading about the protocol prior to the RADIUS client's > involvment. The same thing applies to CHAP, just to head you off. No, not quite. Here, the password is (essentially) used as a key to compute the hash value of a challenge. Most notably, this means you (or the server) have no way whatsoever to get back to the clear text password from what is transmitted to the server. Regards, Stefan

2 1

NAS Specific Attributes
by Jonathan De Graeve 19 Sep '05

19 Sep '05

Hello, I'm searching a way to sent specific attributes to certain nas devices. I'm already using huntgroups in combination with an mysql backend for user and accounting storage and accept or deny user access based on the SQL group the user is in and which Huntgroup the calling nas matches. Group IT has HuntgroupName ~= ^(vpn|ras)$ I want to give VPN Nasses extra attributes like CES-Group and Session-Timeout Any idea's on how to do this? J. --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

1 0

RE: Walled Garden for Users Without Realms.
by McCain, Al 19 Sep '05

19 Sep '05

-----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of James Wakefield (Sunet Sysadmin) Sent: Sunday, September 18, 2005 6:27 PM To: FreeRadius users mailing list Subject: Re: Walled Garden for Users Without Realms. G'day Al, We're doing the same thing here changing a dial-up number and migrating off of the NASes that serve that number. My approach is: * Match customers who need to be placed in the walled garden, this is easy enough for our situation, as they're in the huntgroup comprised of the old NASes. I could also match Called-Station-Id if I wanted. * Send specific attributes for those users, giving them a short session timeout (say 5, 10 minutes) which, if they fail to see or heed our message, will motivate them to call helpdesk and get sorted out, and also setting their primary DNS server to one which resolves every hostname to one of your IP addresses using a wildcard zone or some such. If this DNS server is already providing other services, you'll want to use a view for walled garden users, which you may need to facilitate by putting them into a specific subnet. What attribtues you use, exactly, will depend on your NAS gear. * On that IP address that you're resolving * to, is a webserver which displays the message you wish the walled garden users to read. If this webserver already serves other pages, you'll need to do some URL rewriting to send them to the appropriate page eg: using Apache's mod_rewrite. This way, any request for a web page will display your message. Personally, I find the easiest approach is to just dust off a box that's not being used and put the wildcard DNS and webserver on it - it's only got a couple of very simple functions to perform and it's not a critical service. You may also want to consider applying packet filtering to walled garden users as they'll still be able to reach the entire Internet by IP address, though the session timeouts make that only a moderate concern in our situation. You could also do a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. McCain, Al wrote: >Hi. > >I was wondering if there was a way to place users in a Walled Garden if >they try to Auth without a Realm. >We are currently running FreeRADIUS Version 0.9.3. Our users are stored >in MySQL. > >Company: >I work for an ISP. We seem to aquire new properties every few months. > >Current structure : > >We have multiple instances of RADIUS running: one for each domain. (I >have NO clue who set it up this way). > >I would like to consolidate these intances into one, and force our >users to use realms. > >Problem: > >We can't just force the customers to use realms. We would need to >notify them of the changes. (This can prove tricky). > >What I would like to see: > >Aside from contacting the customer about changes, I would like to send >the users to a web page after they log in without a realm. The page >would tell them that they need to log in with realms. I believe this >is called hURL'ing, however I cannot seem to find any documentation. > >Has anyone ever done this, or know if it can be done ? > >Any help is greatly appreciated. > >Thanks, >Al > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Very good idea James. I will test that out. -Al

1 0

Re: FreeRadius Proxying and Message-Authenticator
by Paolo Rotela 19 Sep '05

19 Sep '05

I wonder if it is correct to discard a packet based on the presence of an attribute witch use is not defined by any standard. I've read the "aboba-radext-fixes" and I see that FR is calculating Message-Authenticator in Accounting packets this way. But there is no RFC about it... RFC2869 describes how to handle incorrect or missing Message-Authenticator in Access-* packets, it doesn't say that you must discard an Accounting packet with invalid Message Authenticator, because as you say there is no standard about how to calculate it. I suggest at least a configuration option that can help to avoid this compatibility issue, giving the user the option of accepting or not "incorrect" MAs in Accounting. I'll try to find out the algorithm used by Cisco... If I happen to be successful, I'll post it. Thanks Date: Tue, 13 Sep 2005 17:57:05 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FreeRadius Proxying and Message-Authenticator To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050913215705.0B8CA170D2(a)mail.nitros9.org> "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> wrote: > Hi. I've downloaded FR 1.0.5 whch is supposed to have a bugfix for > Message-Authenticator handling in Accounting-* messages. The issue is that the suggested method of calculatin Message-Authenticator MAY NOT be the same as what Cisco's using. Because there's no standard, Cisco may be doing almost *anything*. > I'am missing something? If you can find out the algorithm used by Cisco, we may be able to update FreeRADIUS to handle it. Until then, there isn't much we can do. Ing. Paolo Rotela Jefe Técnico Blue Telecom

3 9

Re: Problems with oracle
by chabral - 19 Sep '05

19 Sep '05

Ilia, No, I were'nt doing that! That seems to have solved the problem. I'd not found that tip on the doucmentation. Now I'm having an invalid user oracle error, but I'll see it with the DBA. Thanks a lot, -- chabral Message: 8 Date: Sat, 17 Sep 2005 11:47:45 +0600 (YEKST) From: Ilia Chipitsine <ilia(a)paramon.ru> Subject: Re: Problems with oracle To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050917114703.M40140(a)office.paramon.ru> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed using oracle require setting enviroment variable ORACLE_HOME before you start radiusd, did You do that ? Cheers, Ilia Chipitsine >Hi, >I'm trying to use freeradius 1.0.1 with oracle 9i. I successfully (i think) >compiled freeradius with oracle support. I've the files: > >/usr/local/etc/raddb/oraclesql.conf >/usr/local/lib/rlm_sql_oracle-1.0.1.so >/usr/local/lib/rlm_sql_oracle.so >/usr/local/lib/rlm_sql_oracle.la >/usr/local/lib/rlm_sql_oracle.a > >The problem is when I start "radiusd -X" I see the lines: > >rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and >linked >rlm_sql (sql): Attempting to connect to > TR_RADIUS@oracle:1521/(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=oracle)(PORT=1521)))(CONNECT_DATA=(SID=TESTSID)(SERVER=DEDICATED))) >rlm_sql (sql): starting 0 >rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 >rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) >rlm_sql (sql): Failed to connect DB handle #0 >rlm_sql (sql): starting 1 >rlm_sql (sql): starting 2 >rlm_sql (sql): starting 3 >rlm_sql (sql): starting 4 >rlm_sql (sql): Failed to connect to any SQL server. >Module: Instantiated sql (sql) > >Any help? > >-- >chabral > > >- List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html >

1 0

Intel PEAP client "Roaming Identity"
by Ben Thompson 19 Sep '05

19 Sep '05

Hi We have a 802.1x/PEAP wireless network using freeRADIUS 1.0.1 on RedHat AS 4. It is important for us to know who is using the network at any given time so the accounting logs are very useful to us. The other day someone came along with a laptop using an Intel wireless adapter and client software. In the configuration settings for this program there was a place to enter a username and password for PEAP authentication and there was also a field named "Roaming Identity" which as default was set to "anonymous(a)myabc.com". The client conected up fine, but when I checked the RADIUS accounting logs I noticed that the username for that client was listed as anonymous(a)myabc.com instead of the one I expected. After a bit of googling in found this link on the Dell website which describes that the roaming identity is only required for MS RADIUS servers :- http://support.dell.com/support/edocs/network/P72721/en/UtilAdv.htm Could anyone advise me whether it is possible to configure my server so that the actual username used get's logged in the accounting records instead of this roaming identity string? Many Thanks Ben Thompson

3 3