January 2006 - Freeradius-Users - lists.freeradius.org

EAP-TLS and accounting are incompatible
by Marcos González 10 Jan '06

10 Jan '06

Hello, my name is Marcos, I wrote to this list some weeks ago. My problem was the freeradius accounting was working only for "session time" but "input-octets" and "output-octets" attributes weren't being sent by the NAS to the freeradius server. I was using EAP-TLS authentication. The NAS is a Cisco Aironet 1200, it's a WiFi network. Freeradius runs on a Fedora Core4, and it's version 1.0.4. Trying everything, I finally deactivated authentication. Let the network open... and then "input-octets" and "output-octets" started to come included in the accounting packages from the NAS! Now I'll try other EAP methods, but don't think EAP-TLS preventing the packet tracking from working to be normal. I'm doing something worng? It's a Cisco IOS bug? Thanks in advance.

1 0

Cisco to FreeRadius to AD-LDAP authentication
by Dickson, John 09 Jan '06

09 Jan '06

I have tried and nearly completely succeeded in authentication and authorization. The user is identified in LDAP just not provided access (rad_recv: Access-Reject packet from host 10.1.1.27:1812, id=121, length=20). Another issue I have is with the user login. In Windowz, a new user is created by providing the First name, middle initial and last name which is not their "User logon name". These credentials are distributed within AD-LDAP in the "CN=" fields using spaces to break the name. If this is not exactly how the "User logon name" is installed then radius request rejects authentication. An example would be: User Tom Thumb Logon tthumb CN=Tom Thumb sAMAccountName=radtest So when a request of the database occurrs using ldap lookup with "cn=tthumb" it fails and I do not know if there is another way around this but using sAMAccountName doesn't work either. I am hopeful that I am missing something. My question is, how do I get an "Accept" from the request and is there a way around the basedn naming conventions that will alllow FreeRadius to work with Windowz? Below is user "testing" with a logon of "testing". rlm_ldap: - authorize rlm_ldap: performing user authorization for testing radius_xlat: '(cn=testing)' radius_xlat: 'ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication 0 rlm_ldap: bind as superuser(a)xxxx1.xxxx2.edu/password <mailto:superuser@xxxx1.xxxx2.edu/password> to xxxx1.xxxx2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=testing) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32803, id=121, length=59 Sending Access-Reject of id 121 to 10.1.1.27:32803 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 121 with timestamp 43c2d99f Nothing to do. Sleeping until we see a request.

2 1

What is this "group authentication"?
by Gary Algier 09 Jan '06

09 Jan '06

Hi: I am trying to use the WinXP supplied supplicant and I am getting: modcall: group authenticate returns invalid for request 41 Can someone give me a hint as to what this means? When I use the WinXP bulitin supplicant in "Automatically use my Windows login..." mode, Freeradius fails with the group authentication message. If I uncheck that and type a login and password (but not a domain), it works fine. It never does any sort of group check. If I supply a domain, it does the group check (and fails). When does it check groups? What is it checking? I am using Freeradius 1.0.5, Sun's DS (with Samba attributes loaded), and WinXP SP2. BTW: I am stripping the hostname when doing the user lookups in LDAP using this: filter = "(&(objectclass=person)(uid=%{exec:/etc/ulcmit/raddb/nodomain %{User-Name}}))" where "nodomain" strips the domain portion. My LDAP lookups work fine. -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

2 4

router dies, takes radius with it
by RH Lists 09 Jan '06

09 Jan '06

Hi all, Has anyone experienced this? I have a Cisco router which is being used to terminate pppovpdn sessions over l2tp tunnels. It crashed and rebooted the other day, and took my radius servers down too! I have identified the problem with the router and will be upgrading it first chance I get, but I'm concerned that the router would cause radiusd to crash. Any thoughts? I'm using radiusd: FreeRADIUS Version 1.0.1, for host , built on Nov 2 2004 at 19:55:49 and will be upgrading that shortly. Thanks Rob --- Checked for viruses by Transact Bermuda

1 0

Exec-Program-Wait multiple reply items
by wrath＠geo.net.ge 09 Jan '06

09 Jan '06

Hello, I have recently migrated to freeradius (latest stable on debian sarge - 1.0.2-4) and faced with the following problem: I use Exec-Program-Wait attribute as a reply item in users file. It returns 3 attributes: NAS-Identifier, Framed-IP-Address and Framed-Route. These attributes are printed on stdout with trailing "\n". However they are not returned to the NAS as are not comma separated. Is there any known workaround for this problem? Thanks in advance. Best Regards, George

4 3

Freeradius as Proxy
by Nicola Iotti 09 Jan '06

09 Jan '06

Hi, I'm using freeradius 1.0.5 just as proxy to do a realm based messages redirection... I want freeradius does not change any attribute in communication messages from home server and nas, so I've commented all lines of attrs file, default realm attributes too....Is it correct ? And what about other particular configurations or suggestions Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

RE: MS LDAP connect OK users not found
by Dickson, John 09 Jan '06

09 Jan '06

In fact it is. My review of the debug shows that the radiusd.conf ldap connects (binds) yet the testing user is not located. -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Dennis Skinner Sent: Friday, January 06, 2006 4:33 PM To: FreeRadius users mailing list Subject: Re: MS LDAP connect OK users not found Dickson, John wrote: > rlm_ldap: performing search in ou=Users,dc=XXXX1,dc=XXXX2,dc=edu, with > filter (uid=testing) > rlm_ldap: object not found or got ambiguous search result > rlm_ldap: search failed I read that as... uid=testing is not in the ldap database. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

User accounts that expire and timeout
by Jon Pipitone 09 Jan '06

09 Jan '06

Hey all, I'm working to set up a wireless hotspot using mikrotik, freeradius, and mysql. Actually the initial setup went pretty smoothly, so a big thank you to everyone that contributed to the documentation and mailing lists. Right now I'm looking to set up user accounts that are only valid for a certain date range (for instance, from today at noon until tomorrow at noon). In essence I want to set some sort of expiry date on the user account. But, as well, I'd like the session time limit for the user to be set so that the user can't stay logged in after the expire date (i.e. log in just before the expiry time and stay logged in for a few more hours.). During the time when the account is valid (i.e. hasn't expired) the user should be able to log in and out as much as the'd like, or stay logged in for the entire time. In other words, the Session-Timeout ought to be exactly the difference in time from when they log in to when the account expires. I've done a bit of reading through the mailing list archives and the documentation. I wasn't able to get the Expiration attribute to work (i can elaborate if need be), but then even if it did it isn't fine-grained enough (only down to the day) and I still wasn't sure how to automatically adjust the Session-Timeout. I was toying with using a sqlcounter somehow, but I thought it best to ask for ideas before I dive in again. Thanks in advance, Regards, jon

2 2

GPRS
by alfonso 09 Jan '06

09 Jan '06

Hello to all. This is a theorically question Im working to validate GPRS users with freeradius( WIFI users goes ok). I want to know the state of this machines, when they are logged. For that Im using nagios, to check the state. I must join both solutions. The AAA solution and the check Solution. I should write a custom script for the authorization section, retrieve the parameters of the Access-Request. User-Name, ip is passed as an arguments, or passed as additional arguments or another posibilitie is to make a sql query to insert all the values needed to a nagios database, so nagios can check it periodically I haven't clear wich is the way. Another question is how can I run scripts after the user is validated Thank you for your opinion Alfonso Guerendiain oliver

2 1

SQL Authentication (mainly @Alan!)
by florian broder 09 Jan '06

09 Jan '06

Hi. Some weeks ago I was asking for this, but didn't receive an answer. Subject is MySQL Authentication based on a Calling-Station-ID. The problem is, that the cisco Switch doesn't send a user-name&user-password in his access-request, and mysql doesn't like! --> *Error: rlm_sql *>* (sql): zero length username not permitted" I tried to comment out this part in the sql-module source-code, and recompile freeradius. To my surprise, this actually DOES work. --> rad_recv: Access-Request packet from host 127.0.0.1:1046, id=134, length=52 User-Name = "" User-Password = "michael" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'michael' rlm_sql (sql): sql_set_user escaped user --> 'michael' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck ? WHERE Username = 'michael' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'michael' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 134 to 127.0.0.1:1046 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 134 with timestamp 43bc1274 Nothing to do. Sleeping until we see a request. Sql.conf was told, to check for the password, not username. It works! So, my question is, like in the subject, mainly directed to alan, or some other developper of the sql-module. WHY was it done like that, i.e. that you HAVE to use a username in sql? Thanks for your help, I really appreciate it! Bye. *

2 4