October 2006 - Freeradius-Users - lists.freeradius.org

authenicate internet access through MACs
by Ali Jawad 22 Oct '06

22 Oct '06

Hi Ive got a debian router and a switch through which I provide internet access to some of the residents of my building...I want to implement a mechanism so that only the computers I specify can access the Internet...I could do it through squid but if I do so it would allow me only to restrict traffic going through port 80 what about Internet applications that use other ports such as ftp, smtp, yahoo and msn. I want to use a mechanism that allows me to authenicate PCs based on mac address and only those computers are allowed to access the internet. One particular solution could be blocking all access to the router unless the request have the source mac from an authorised PC..but I would prefer another approach if available...since Iam not going to operate the router..and the firewall script was written using VIM and the oprerator needs a web interface to operate the router. I ve got a freeradius server setup and running on the router with the dialup admin interface..I have done this setup previoulsy with pppoe and freeradius. I can not use pppoe this time..so I would like to know if there is a mechanism that allows me to redirect all the requests coming to the router through radius and access is granted upon the authenication info found in the radius database. I use to do that by loading radius.so each time a request to the pppoe server is made by including radius.so in the pppoe.options file..but I have no clue on how to do it this time. Any suggestions are welcome -- With Regards Ali Jawad

1 0

SQLcounter patch - Addition of reply-attribute
by Jonathan De Graeve 22 Oct '06

22 Oct '06

I just made a patch against 1.1.3 for the SQLcounter module. This patch allows to set the reply-name variable in the sqlcounter.conf file per instance. In this way the default behaviour of Session-Timeout can be overridden by your own reply-attribute. The system will set the session-timeout attribute if you omit the reply-name var in your config for backwards compatibility. I'm planning the following additions: The ability to override the reject behaviour with an accept but adding attributes. For example: if the user has reached his volume limit, accept the user but add speed-limitation attributes. <BEGIN OF PATCH> --- rlm_sqlcounter.c.orig 2006-10-21 23:18:04.147404980 +0200 +++ rlm_sqlcounter.c 2006-10-21 23:01:30.190552948 +0200 @@ -65,17 +65,19 @@ * be used as the instance handle. */ typedef struct rlm_sqlcounter_t { - char *counter_name; /* Daily-Session-Time */ - char *check_name; /* Max-Daily-Session */ - char *key_name; /* User-Name */ + char *counter_name; /* Daily-Session-Time */ + char *check_name; /* Max-Daily-Session */ + char *key_name; /* User-Name */ + char *reply_name; /* Authorized Reply, defaults to Session-Timeout */ char *sqlmod_inst; /* instance of SQL module to use, usually just 'sql' */ char *query; /* SQL query to retrieve current session time */ - char *reset; /* daily, weekly, monthly, never or user defined */ + char *reset; /* daily, weekly, monthly, never or user defined */ char *allowed_chars; /* safe characters list for SQL queries */ time_t reset_time; time_t last_reset; int key_attr; /* attribute number for key field */ int dict_attr; /* attribute number for the counter. */ + int reply_attr; /* attribute number for the authorized OK reply, defaults to Session-Timeout */ } rlm_sqlcounter_t; /* @@ -91,6 +93,7 @@ { "counter-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,counter_name), NULL, NULL }, { "check-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,check_name), NULL, NULL }, { "key", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,key_name), NULL, NULL }, + { "reply-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reply_name), NULL, NULL }, { "sqlmod-inst", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,sqlmod_inst), NULL, NULL }, { "query", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,query), NULL, NULL }, { "reset", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reset), NULL, NULL }, @@ -480,6 +483,27 @@ data->key_attr = dattr->attr; /* + * Discover the attribute number of the reply. + * If not set, set it to Session-Timeout + * for backward compatibility + */ + if (data->reply_name == NULL) { + DEBUG2("rlm_sqlcounter: 'reply' set to Session-Timeout for counter name %s",data->counter_name); + data->reply_attr = PW_SESSION_TIMEOUT; + } + else { + dattr = dict_attrbyname(data->reply_name); + if (dattr == NULL) { + radlog(L_ERR, "rlm_sqlcounter: No such attribute %s", + data->reply_name); + return -1; + } + data->reply_attr = dattr->attr; + DEBUG2("rlm_sqlcounter: Reply attribute %s is number %d", + data->reply_name, dattr->attr); + } + + /* * Check the "sqlmod-inst" option. */ if (data->sqlmod_inst == NULL) { @@ -666,11 +690,12 @@ res += check_vp->lvalue; } - if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { + /* if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { */ + if ((reply_item = pairfind(request->reply->vps, data->reply_attr)) != NULL) { if (reply_item->lvalue > res) reply_item->lvalue = res; } else { - if ((reply_item = paircreate(PW_SESSION_TIMEOUT, PW_TYPE_INTEGER)) == NULL) { + if ((reply_item = paircreate(data->reply_attr, PW_TYPE_INTEGER)) == NULL) { radlog(L_ERR|L_CONS, "no memory"); return RLM_MODULE_NOOP; } @@ -682,8 +707,8 @@ DEBUG2("rlm_sqlcounter: Authorized user %s, check_item=%d, counter=%d", key_vp->strvalue,check_vp->lvalue,counter); - DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=Session-Timeout, value=%d", - key_vp->strvalue,reply_item->lvalue); + DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=%d, value=%d", + key_vp->strvalue,data->reply_attr,reply_item->lvalue); } else{ char module_fmsg[MAX_STRING_LEN]; @@ -722,6 +778,7 @@ free(data->sqlmod_inst); free(data->counter_name); free(data->allowed_chars); + free(data->reply_name); allowed_chars = NULL; free(instance); </END OF PATCH> Enjoy this patch, J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

2 1

Decreasing connection time (Session-Timeout)
by micobros 22 Oct '06

22 Oct '06

Hello, I have a wisp solution working with mysql+freeradius and chillispot (ver 1.1) working pretty well together (bandwdth limit, user/password, connection time, etc.). But. there's one more thing I need. Lets say a user has 1 hour of connection time (Session-Timeout := 3600) and stays on the network for 20 minutes than disconnects. Chillispot is informed of this and sends freeradius an "Accounting-Request" message with "Acct-Status-Type=stop" attribute and "Acct-Session-Time=1200" attribute. Now, how could I subtract the elapsed time from the original Session-Timeout time? So that the user will, at the next login, only have 40minutes left. Cheers, mico "The only way to get rid of a temptation is to yield to it." (Oscar Wilde)

1 0

radutmp and/or SQL Accounting
by Matt Harlum 22 Oct '06

22 Oct '06

Hey guys, I've got my radiusd setup to work from an SQL Database for WPA Enterprise encryption, However i cannot get radutmp or SQL accounting to work, i'm running it on OSX 10.4.8 My Radiusd.conf is attached

2 3

EAP-TTLS problem at phase 1
by Rafiqul Ahsan 21 Oct '06

21 Oct '06

Hi all, I have been trying to figure this out for couple days, but could not get any clue. My test is about authentication with EAP-TTLS/MSCHAPV2. I am using freeradius v - 1.1.3, on Solaris 10. No matter what I do, I get "rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request" at the server. Anybody can help me what went wrong ? Here is my configs..and logs (truncated) Awaits some solution... Rafi Here is my eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 2 pem_file_type = yes private_key_password = "wimax i2 test certs" private_key_file = /etc/freeradius/etc/certs/key2.pem certificate_file = /etc/freeradius/etc/certs/cert2.pem CA_file = /etc/freeradius/etc/certs/cacert.pem dh_file = /etc/freeradius/etc/certs/dh random_file = /etc/freeradius/etc/certs/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } ttls { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no } peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } Here is my users file : "testuser" Auth-Type := EAP, User-Password := "testuser" DEFAULT Auth-Type := EAP Here is my supplicant config : # cat supplicant.conf ctrl_interface=/var/tmp/supplicant.ctl eap_trace=1 enableWiMAXauth=1 validateFNECerts=1 checkCRL=1 ignoreTimeOfDay=0 update_config=0 data_interface=/var/tmp/supplicant_data.ctl ap_scan=0 fast_reauth=1 load_dynamic=/usr/lib/wpa_supplicant/eap_ttls.so network={ eap=TTLS eap_workaround=1 anonymous_identity="anonymous_identity" ca_path="/var/tmp/truststore" ca_cert="/var/tmp/root.crt" client_cert="/var/tmp/cpe.crt" private_key="/var/tmp/key" private_key_passwd="wimax i2 test certs" phase2="auth=MSCHAPV2" } Here is the radius log (only shown the failed part) rlm_fastusers: checking defaults^M fastusers: Matched DEFAULT at 6^M modcall[authorize]: module "fastusers" returns updated for request 1^M modcall: leaving group authorize (returns updated) for request 1^M rad_check_password: Found Auth-Type EAP^M auth: type "EAP"^M Processing the authenticate section of radiusd.conf^M modcall: entering group authenticate for request 1^M rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request^M rlm_eap: Failed in handler^M modcall[authenticate]: module "eap" returns invalid for request 1^M modcall: leaving group authenticate (returns invalid) for request 1^M

2 4

how to force "Accept" and override default and null proxy realms?
by Mike 21 Oct '06

21 Oct '06

I would like to always send an Accept unconditionally if the User-Name is test[0-9], but proxy request to default or null realm for all other user names. I tried a configuration with authorize { files suffix } the "suffix" will match on default and null realms. I currently have a line in users file that looks like this: DEFAULT User-Name =~ "test[0-9]", Auth-Type: Accept however regardless of which user makes the request, even the "test" user (which does match), the request is still proxied. If I change "Auth-Type: Reject", then the test user is always rejected, but I am looking for the opposite behavior. Thanks in advance for any help or pointers.

2 1

CVS make error
by Jan Mulders 20 Oct '06

20 Oct '06

Hello all, After much trouble I've managed to get CVS to download the right version of freeradius (not radiusd-cistron...doh), and now I'm having some problems with making it. >From what I can see, there's some problems with EAP (which I happen to not need). Is it possible (or even recommended) to remove EAP from the compilation process? If so, how do I go about doing this? Failing that, if somebody is feeling really nice they could code a fix for CVS :) Regards, Jan /root/installs/radiusd-cvs/radiusd/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -fPIC -DPIC -o .libs/radeapclient.o radeapclient.c: In function `radlog': radeapclient.c:111: warning: implicit declaration of function `va_start' radeapclient.c:111: warning: nested extern declaration of `va_start' radeapclient.c:113: warning: implicit declaration of function `va_end' radeapclient.c:113: warning: nested extern declaration of `va_end' radeapclient.c: In function `log_debug': radeapclient.c:124: warning: nested extern declaration of `va_start' radeapclient.c:111: warning: redundant redeclaration of 'va_start' radeapclient.c:111: warning: previous implicit declaration of 'va_start' was here radeapclient.c:126: warning: nested extern declaration of `va_end' radeapclient.c:113: warning: redundant redeclaration of 'va_end' radeapclient.c:113: warning: previous implicit declaration of 'va_end' was here radeapclient.c: In function `radlog': radeapclient.c:106: warning: 'ap' might be used uninitialized in this function radeapclient.c: In function `log_debug': radeapclient.c:121: warning: 'ap' might be used uninitialized in this function gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -o radeapclient.o >/dev/null 2>&1 /root/installs/radiusd-cvs/radiusd/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libeap.la -lnsl -lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libeap.so -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,--rpath -Wl,/usr/local/lib .libs/radeapclient.o(.text+0x13b): In function `radlog': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:111: undefined reference to `va_start' .libs/radeapclient.o(.text+0x15a):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:113: undefined reference to `va_end' .libs/radeapclient.o(.text+0x193): In function `log_debug': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:124: undefined reference to `va_start' .libs/radeapclient.o(.text+0x1b2):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:126: undefined reference to `va_end' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/installs/radiusd-cvs/radiusd' make: *** [all] Error 2

2 1

freeradius-snapshot-20061020 make error
by Velikanov 20 Oct '06

20 Oct '06

Good Day. Such error in freeradius-snapshot-20061020 during "make" What to do? Making all in rlm_acct_unique... gmake[6]: Entering directory `/u01/data/freeradius-snapshot-20061020/src/modules/rlm_acct_unique' /u01/data/freeradius-snapshot-20061020/libtool --mode=compile gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c mkdir .libs gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c -fPIC -DPIC -o .libs/rlm_acct_unique.o In file included from rlm_acct_unique.c:28: /u01/data/freeradius-snapshot-20061020/src/freeradius-devel/radiusd.h:390: error: syntax error before "va_list" Thanks

3 2

Dialupadmin and PHP Question
by Darcy Parker 20 Oct '06

20 Oct '06

Good day all, I am running ubuntu 6.06, I have apache2, PHP5, and MySql installed. I ran the following command to install freeradius: root@postoffice:~# apt-get install freeradius freeradius-ldap freeradius-mysql freeradius-krb5 libperl5.8 I then ran the following command to get dialupadmin root@postoffice:~# apt-get install freeradius-dialupadmin Reading package lists... Done Building dependency tree... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. Since you only requested a single operation it is extremely likely that the package is simply not installable and a bug report against that package should be filed. The following information may help to resolve the situation: The following packages have unmet dependencies: freeradius-dialupadmin: Depends: php4 but it is not going to be installed E: Broken packages How do I make this work or is there something else I can use? (Webmin?????) Darcy

2 2

pppd/pptp + freeradius + static IP FYI
by Michael Gale 20 Oct '06

20 Oct '06

Hello, FYI - Requirements for me to give out static IP address to users using the following: pptpd-1.3.3-1.fc4 ppp-2.4.3-5.fc4 freeradius-mysql-1.1.3-1 freeradius-debuginfo-1.1.3-1 freeradius-1.1.3-1 freeradius-unixODBC-1.1.3-1 freeradius-postgresql-1.1.3-1 I have a rlm_perl module that I use to authenticate users and provide static IP addresses. I came across the following info / issues when setting this up: 1. /etc/raddb/users file This file contained a default entry for "Framed-IP-Address" which was overriding the value set by the rlm_perl module. The "DEFAULT" options needed to be changed to remove the setting of the IP address. 2. /etc/pptpd.conf file In this file I uncommented the "delegate" option to allow the IP address to be set by the radius or chap-secrets. So PPTP will NOT pass an IP address to pppd. So disables the localip and remoteip options at the bottom. * With this option commented out, the IP address returned by freeradius was still being taken and given to the client, however the pptpd documentation says to enable the "delegate" option if you are going to do that. 3. /etc/ppp/options.pptpd file Once the "delegate" option was enabled, pppd would fail with the error "Could not determine local IP address". Since this address is no longer being set. Simple added the same IP address used in pptpd.conf localip to the options.pptpd file in the format: ipaddress: According to the man page: OPTIONS <local_IP_address>:<remote_IP_address> Set the local and/or remote interface IP addresses. Either one may be omitted. The IP addresses can be specified with a host name or in decimal dot notation (e.g. 150.234.56.78). The default local address is the (first) IP address of the system (unless the noipdefault option is given). The remote address will be obtained from the peer if not specified in any option. Thus, in simple cases, this option is not required. If a local and/or remote IP address is specified with this option, pppd will not accept a different value from the peer in the IPCP negotiation, unless the ipcp-accept-local and/or ipcp-accept-remote options are given, respectively. I added the system's IP address with the colon, with allowed pppd to determine it's localip and radius to set the client's IP address. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

1 0