October 2006 - Freeradius-Users - lists.freeradius.org

RE: static IP's with rlm_perl
by Garber, Neal 20 Oct '06

20 Oct '06

> $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; See if the following helps: use Socket; . . . $RAD_REPLY{'Framed-IP-Address'} = inet_aton('192.168.77.200');

3 2

Re: SNMP with Freeradius - Again
by Velikanov 20 Oct '06

20 Oct '06

Good Day. I use Oracle with Freeradius. The situation with SNMP is as follows now: 1. When i have sql in radiusd.conf and such string: snmp = no then i have working radiusd with Oracle 2. When i have no sql , but have snmp = yes then i have working radiusd with SNMP 3. When i have sql in radiusd.conf and snmp = yes i have not working radiusd, debug does not contain any strings with SMUX and it is finished with: Module: Instantiated sql (sql) Segmentation fault In all cases the configurations was the same, except pointed above I post you the radiusd -X of last case (3) with sql and snmp = yes Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/oraclesql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/etc/raddb/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = yes preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "Acct-Session-Id, NAS-IP-Address, Login-IP-Host, Login-TCP-Port" Module: Instantiated acct_unique (acct_PIX) exec: wait = yes exec: program = "/usr/local/etc/raddb/radius.auth" exec: input_pairs = "request" exec: output_pairs = "request" exec: packet_type = "(null)" Module: Instantiated exec (echo) Module: Loaded SQL sql: driver = "rlm_sql_oracle" sql: server = "192.168.98.100" sql: port = "1521" sql: login = "inter1_odessa" sql: password = "inter1_odessa" sql: radius_db = "(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = apusold)(PORT = 1521))(CONNECT_DATA = (SERVICE_NAME = APUSOLD)))" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT * FROM TABLE(CAST(INTERNET_SECURITY.CHECK_USER ?('%{SQL-User-Name}', ?'%{NAS-IP-Address}','%{NAS-Port-T sql: authorize_reply_query = "SELECT * FROM ?TABLE(CAST(INTERNET_SECURITY.REPLY_USER('%{SQL-User-Name}','%{NAS-IP-Addres s}','%{Framed-Protoc sql: authorize_group_check_query = "" sql: authorize_group_reply_query = "" sql: accounting_onoff_query = "UPDATE radacct ?SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), ?AcctSessionTime=((TO_DATE('%S','yyyy sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', ''), AcctStatusType = '%{Acct-St sql: accounting_update_query_alt = "INSERT into radacct ?(RadAcctId, AcctSessionId, AcctUniqueId, UserName, ?NASIPAddress, NASPort, NASPortT sql: accounting_start_query = "INSERT into radacct (UserName, NASIPAddress, NASPort, NASPortType, ServiceType, AcctStatusTy sql: accounting_start_query_alt = "UPDATE radacct SET ?AcctStartTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'),AcctStartDelay = '%{Acct-Delay- sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctStatusType = '%{Acct-Status-Type} sql: accounting_stop_query_alt = "INSERT into radacct ?(UserName, NASIPAddress, NASPort, NASPortType, ServiceType, ?AcctStatusType, ?AcctSe sql: group_membership_query = "SELECT SERVICE_NAME FROM usergroup ?WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct ?WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL ??AND NASIPAddress = '%{N sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, ?NASIPAddress, NASPort, FramedIPAddress, CallingStationId, ?FramedProt sql: postauth_query = "INSERT into radpostauth ?(id, username, user_password, sql_password, Packet_Type, ?AUTH_START_TIME, reply_message,ses sql: safe-characters = "$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to inter1_odessa@192.168.98.100:1521/(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = apusold)(PORT = 1 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_oracle #1 rlm_sql (sql): Attempting to connect rlm_sql_oracle #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_oracle #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_oracle #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.168.10.111,shortname=192.168.10.111,secret=test123 rlm_sql (sql): Adding client 192.168.10.111 (192.168.10.111) to clients list rlm_sql (sql): Read entry nasname=pix.asu.farlep.net,shortname=PIX,secret=pixfirewall rlm_sql (sql): Adding client 192.168.98.1 (PIX) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Instantiated sql (sql) Segmentation fault Thanks for your attention.

2 1

static IP's with rlm_perl
by Michael Gale 20 Oct '06

20 Oct '06

Hello, I am trying to set static IP addresses for clients I have authenticated via radius with my rlm_perl module. I am trying the following as a test but it is not working: --snip-- $RAD_CHECK{'NT-Password'} = $pass; $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; $RAD_REPLY{'Framed-Netmask'}= '255.255.255.255'; $RAD_REPLY{'Framed-Protocol'} = 'PPP'; $RAD_REPLY{'Service-Type'} = 'Framed-User'; --snip-- Any help would be great full. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 6

RE: static IP's with rlm_perl
by Garber, Neal 20 Oct '06

20 Oct '06

> $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; Perhaps the problem is that your are assigning a string to an attribute of type ipaddr (look in /usr/local/share/freeradius/dictionary.rfc2865)?

1 0

rlm_perl and checking request status in post-proxy
by Pshem Kowalczyk 20 Oct '06

20 Oct '06

Hi, I have a simple question - is it possible to check the status of request (Accept/Reject) in a post-proxy phase using rlm_perl? And if so - how? kind regards pshemko

2 1

Re: Pam radius authentication
by danieldinu＠rdslink.ro 20 Oct '06

20 Oct '06

Isn't there anyone who tried this implementation? > >Hi! >if you are reffering to this line: >"account required pam_radius_auth.so debug" >than here is the explanation: > "The pam configuration can be: >... >auth sufficient /lib/security/pam_radius_auth.so [options] >... >account sufficient /lib/security/pam_radius_auth.so" > (this is taken from http://www.freeradius.org/pam_radius_auth/USAGE) > >On the other hand, I don't care if I don't use this module for accounting. As a matter of fact, I tried in many configurations, even without using it for accounting. >The main concern is to succed in authetincating the users!!! if anyone can help me accomplish that, I would be happy and I will not mind about accounting... > > > > >> >>Hi, >> >>> I don't understand why you are saying that "you are invoking pam_radius_auth in the wrong place and for the wrong reason"...please, be more specific and if you know the right configuration, enlight me! >>> >>> >> >#%PAM-1.0 >>> >> >auth required pam_securetty.so >>> >> >auth sufficient pam_radius_auth.so debug >>> >> >auth required /lib/security/pam_unix_auth.so >>> >> >account required pam_radius_auth.so debug >> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> >>explain >> >>alan >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Rewrite Attribute when proxy the specific realm
by Rio Yang 19 Oct '06

19 Oct '06

Hi, I have tried attr_rewrite function to rewrite attribute value on specific attribute successfully. But now, I want to rewrite to attribute that proxy to specific realm. For example, When the AUTH proxy the realm "abc.com". I wanna to rewrite the attribute "NAS-Identifier" value into new one. Could somebody know to how configure it? Thanks. Rio

2 3

Difference between radiusd-cistron and freeradius?
by Jan Mulders 19 Oct '06

19 Oct '06

Hello, I'm currently trying to get hold of a CVS snapshot of the latest FreeRADIUS build - but I'm having some real trouble. I've tried looking in the cvs-snapshots subfolder, and found: radiusd-cistron-1.6-snapshot-20061019.tar.gz Is this freeradius? I would like the new functionality that allows me to write to the RAD_CHECK hash from rlm_perl, that's the only reason I want to use CVS. When I attempt to connect to CVS, I get the following: root@betabitch [~/installs/radiusd-cvs]# cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: root@betabitch [~/installs/radiusd-cvs]# cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd ....upon which point it sits there doing nothing for about 20 minutes. I presume this is not normal CVS behaviour? Where do I get the correct CVS snapshot for freeradius? I apologise, this is probably very obvious but I've been trying all day to figure out why the snapshot I had downloaded (see top of email) doesn't read from config files, or accept the radiusd -X switch... Regards, Jan

2 2

Inserting and/or replacing reply attributes on a proxy request
by Jarrod Sayers 19 Oct '06

19 Oct '06

Hi, I have a FreeRADIUS 1.1.2 box which its only job in life is to proxy requests based on realms, i.e., no local authentication is done. One of the realms is internal to the organisation (lets call that internal.org.com.au) and I trust the variables being returned, however I have no control over one external realm (lets call that some.other.org.net.au) and the default realm. The FreeRADIUS box is used to proxy wireless requests which relies on the following variables to dump users into their particular tunnel groups: Tunnel-Type:1 => VLAN Tunnel-Medium-Type:1 => IEEE-802 Tunnel-Private-Group-Id:1 => 1234 What I am trying to accomplish is to have replies from a certain realm forced to be returned with set values either adding them in if they are missing, or replacing them is they are not the same. So, if the request is proxied to a trusted source then don't alter the reply, though if its proxied to an external realm, force the Tunnel- Private-Group-Id:1 attribute to be 1234, yet if its proxied to the default realm, use 4321 instead. I had a go at this using the exec clause and had some success in adding variables if they didn't exist in the reply, but it wouldn't replace existing ones: modules { ... exec vlan_assignment { wait = yes program = ${confdir}/vlan.sh input_pairs = proxy-request output_pairs = proxy-reply packet_type = Access-Accept } } post-proxy { vlan_assignment ... } The associated script that it ran: fruitbox# cat vlan.sh #!/bin/sh # Set defaults. TunnelType="VLAN" TunnelMediumType="IEEE-802" TunnelPrivateGroupId="200" # Only alter Wireless-802.11 requests. if [ "${NAS_PORT_TYPE}" = "Wireless-802.11" -a "${REALM}" != "internal.org.com.au" ]; then # Determine VLAN to be used. if [ "${REALM}" = "some.other.org.net.au" ]; then # Force user into specific tunnel group. TunnelPrivateGroupId="1234" elif [ "${REALM}" = "DEFAULT" ]; then # Force user into specific tunnel group. TunnelPrivateGroupId="4321" fi # Return actual VLAN assignment. echo "Tunnel-Type:1 = ${TunnelType}" echo "Tunnel-Medium-Type:1 = ${TunnelMediumType}" echo "Tunnel-Private-Group-Id:1 = \"${TunnelPrivateGroupId}\"" fi exit 0 fruitbox# Allowing these variables to pass though from untrusted sources may allow a user to be placed in another organisations tunnel group which I cannot allow. Any help or ideas appreciated :) Jarrod.

6 11

Privelege Level with Different Manufacturers
by Maestro_Ba 19 Oct '06

19 Oct '06

Hi, I've been using freeradius for a while, for authentication in a network of cisco devices. All my users follow this pattern: </etc/raddb/users> user1 Auth-Type := System Service-Type = Shell-User, cisco-avpair = "shell:priv-lvl=15" However, now I have other manufacturers' devices in my network, namely Alcatel, Enterasys and Nortel. I want this user to be able to authenticate in any device, and with high privilege levels, if possible. As it is right now, an error occurs in non-cisco equipment (because of "cisco-avpair"). Can anyone tell me: 1 - How to configure </etc/raddb/users> file? 2 - How to configure the different devices? Thanks a lot, any information will be very helpful! Maestro_Ba -- View this message in context: http://www.nabble.com/Privelege-Level-with-Different-Manufacturers-tf247300… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1