October 2006 - Freeradius-Users - lists.freeradius.org

syslog - 1.1.2
by Michael Messner 11 Oct '06

11 Oct '06

hey freeRADIUS users, I'm trying to syslog the radius-messages with freeradius 1.1.2! Now I've added the line log_destination = files to the radiusd.conf, and I also tried to start the radius with the parameter -lsyslog but nothing goes to syslog! Any ideas?!? thanks mIke

4 8

rlm_sql_mysql: safe characters
by Stefan Winter 11 Oct '06

11 Oct '06

Hi, is it a problem to add the equal sign (=) to the list of safe characters for SQL databases? I imagine it might be because it is used to escape MIME-encoded special chars and that might confuse the FR server... I don't want to just try it on our production server; maybe someone has experience with this? As a side-note, I wonder why the safe_characters list is so small. I know it is to prevent SQL injections, but the default queries are all encoded in single quotes ('...'), so there are more safe characters IMO. In particular, how about # ! $ & * + none of these should make problems within single quotes, or am I wrong here? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Decisionmaking in FreeRADIUS & Check/Reply Items
by Jan Mulders 11 Oct '06

11 Oct '06

Hello list, I am trying to use the 'files' module of Freeradius to do decisionmaking, based on information pulled in from the sql module, and the sqlcounter thing. First off, is this the right way of doing this? I want to assign users a different Pool-Name for each assigned speed, and send Max-Download-Speed and Max-Upload-Speed vendor-specific variables to the client on each request. My actual problem relates to the following errors, pulled from radiusd -X: ............ Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" [/etc/raddb/users]:214 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items Module: Instantiated files (files) radiusd.conf: "files" modules aren't allowed in 'post-auth' sections -- they have no such method. radiusd.conf[327] Failed to parse post-auth section. root@betabitch [/etc/raddb]# The offending rules are in users: DEFAULT User-Bytes-Used < 21474836480 , Group == "512k" # user gets high speed service if under 20gb Pool-Name := "512k_high", Max-Download-Rate := 524288, Max-Upload-Rate := 262144 DEFAULT User-Bytes-Used > 21474836480 , Group == "512k" # user gets low speed service if under 20gb Pool-Name := "512k_low", Max-Download-Rate := 262144, Max-Upload-Rate := 131072 DEFAULT User-Bytes-Used < 53687091200 , Group == "10m" # user gets high speed service if under 50gb Pool-Name := "10m_high", Max-Download-Rate := 10485760, Max-Upload-Rate := 10485760 DEFAULT User-Bytes-Used > 53687091200 , Group == "10m" # user gets low speed service if over 50gb Pool-Name := "10m_low", Max-Download-Rate := 1048576, Max-Upload-Rate := 1048576 But... but... the bottom 3 attributes *aren't* check attributes! I want to *set* them! Or am I getting entirely the wrong end of the stick here? Can somebody point out how these rules are meant to be arranged, and perhaps how I could do this in sql? It's all quite confusing. ##### radiusd.conf - important bits ###### sqlcounter monthlybytecounter { counter-name = User-Bytes-Used check-name = Max-User-Bytes sqlmod-inst = sql key = User-Name reset = monthly # this query is awesome in every way. # it selects the traffic used by the user since they last paid for their subscription # and adds up the input and output bytes together to get a composite usage figure. query = "SELECT SUM(AcctInputOcte.......................... } instantiate { monthlybytecounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess # acct_unique } accounting { #acct_unique #detail radutmp # ? 512k_high 512k_low 10m_high 10m_low sql } session { #radutmp # ? sql } post-auth { sql files 512k_high 512k_low 10m_high 10m_low } Thank you everyone :) Jan

3 3

Switch dies
by Jack Daniels 11 Oct '06

11 Oct '06

Hello everyone, just a dumb question. My switch is configured for vmps and freeradius and I'm playing with dynamic assignation of vlans. Vmps, when instructs the switch to place a client in a determined vlan, if that vlan doesn't exist in the switch, the switch just blocks access and continues with its normal operation. But, if I try the same with FreeRadius, when FreeRadius gives the vlan back (this vlan doesn't exist in the switch either), the switch freezes and I can't use it anymore until I restart it. Why is this behaviour? Thanks _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 2

Accounting-Response Log ??
by Rio Yang 10 Oct '06

10 Oct '06

Hi, I have two radius servers. (Freeradius and Juniper SBR). Freeradius server be a radius proxy to proxy all auth/acct requests to Juniper SBR. Then I sometimes found there are some accounting-stop request don't arrival to Juniper SBR. Because Freeradius server and Juniper SBR is in the different subnet and through firewall. I think this problem may cause by firewall. In the radius accounting communication model there should have request and response. Is freeradius log the accounting-response result ? How to enable it ? I want to this log to identify the problem. Thanks. Rio Yang

1 0

mac auth help please
by Marwan Sultan 10 Oct '06

10 Oct '06

Hello guys, Im on FreeBSD6.1-R, freeradius, mysql4.1, and using chillispot to authentication users. its wired network not a wireless. The problem is some users are using "phone adapters" such like motorola or cisco on my network so instead of plugin the cat5 (ethernet) cable to thier laptop they are plugin the cable to the phone adapter. the adapter is not working ofcourse because its expecting an internet.. in the time that chillispot will expect the adapter to "authenticate" which adapter will not So I have been advised to add the MAC adress to some allow list.. Is there a any way, that I can make 1 MAC adress only to not authenticate ? and keep the rest of the network authenticate using chillispot? Thank you. Marwan Sultan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Adding proxying to our EAP setup
by Dave Mussulman 10 Oct '06

10 Oct '06

Hello, I've been using FreeRADIUS for years to do PEAP/MSCHAP2 WPA authentications, and it's worked well enough to be a set-it-and-forget-it solution. I'm currently running 1.0.4, but would upgrade if it would help me accomplish the goals in this message. However, changing environments bring me back into the config, and I'm not sure how to do what I want. We've been using ntlm_auth against the AD for our primary authentication, with a fallback to sql and plaintext passwords for local accounts. I'd like to change from maintaining my own sql copy/user database to RADIUS proxying to someone else's server. >From a few trial/error tests, I have two questions about proxying and EAP. What's the recommended way to configure failover proxying/realms when there's no realm-ish identifier? When "user" logs in, I want them to check against ntlm_auth, and if that fails, resort back to a proxied realm as "user". Right now, I'm doing that via the default config realm suffix {} module, and a realm NULL section in proxy.conf. Is there a better way? Hints or something? Does this involve the configurable_failover documentation? Second question involves proxies and EAP. Since my upstream RADIUS server I'm proxying to doesn't seem to support EAP, is it even possible for my RADIUS server (in its PEAP/MSCHAPv2 decoding,) to create a 'normal' RADIUS packet to relay? Or do I have to get the upstream server to support EAP? It seems like if suffix (realm) module is anywhere in the authorize section, it proxies the entire EAP packet. Can I tell it only to do that at a certain stage in the process? How would you recommend I configure this? Dave

3 4

RE: EAP-TLS Certificate problems.
by Jason-Wittlin-Cohen 10 Oct '06

10 Oct '06

> Date: Mon, 9 Oct 2006 11:26:51 -0400 > From: "Brian vb" <nova5radius(a)gmail.com> > Subject: RE: EAP-TLS Certificate problems. > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <000f01c6ebb7$59118220$be01010a@lightwave> > Content-Type: text/plain; charset="us-ascii" > > Recreated certs, same issue came with the Issuer field. XPExtensions are > used. Password is the same in this file an what Freeradius has just changed > to protect it. > > > Here is the batch file I'm using to create the certs. I don't see anything > amiss between it and the page you sent.. any ideas? > > > PATH=C:\openssl\bin;C:\ssl1;%path% > export LD_LIBRARY_PATH=C:\openssl\lib > > > CD\SSL1 > > REM CA Creation > C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -export -in newreq.pem -out root.p12 -cacerts > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in root.p12 -out root.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in root.pem -out > root.der I'm not sure what you're doing here. First, "> C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved" You're outputting the private key and public key to the same file. I'm not sure if this will include both in the same file, or only create one. Regardless, it's not what you want to do. Give the files unique names. The clients and server need the public key and only the certificate signing machine needs the private key. You don't want to combine the keys. To create a CA: openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf Also, why are you creating a p12 file for the CA? You certainly don't want to hand out the private key to clients, and for certificate signing, you only need the private key which can be stored in cakey.pem for example. Clients should be given cacert.pem or cacert.der depending on the format you use. The p12 format should only be used for client certs because those need to combine private key + certificate (at least for the MS supplicant). > > REM Client cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, -keyout is used to creaate the private key, and -out to create the certificate signing request which is then passed on to the CA later. You're using the same filename, so I have no idea what's happening. Either you have a certificate signing request and no key, or a key without a signing request. Either way, it won't work. You need to do something like this: openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf Notice that the key and the signing request are given different names. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpclient_ext -extfile > xpexts -infiles newreq.pem > > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-clt.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-clt.pem -out > cert-clt.der So, you convert from a PEM certificate and PEM key, to a P12 cert+key, to a PEM cert+key to DER cert+key. Why? The P12 cert+key will work fine. > > REM Server Cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, the key and certificate signing request must be given different names or else your setup will fail. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpserver_ext -extfile > xpexts -infiles newreq.pem > Do you need these steps? Freeradius will use a seperate certificate and key in PEM format. It works fine for me. It seems like your setup is overly complex. Keep it simple, and see if it works. Then you can change file formats- etc. For now, just make the changes I recommended and see if it gives you a working CA and client/server certificates. > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-srv.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-srv.pem -out > cert-srv.der > Jason Wittlin-Cohen

2 1

AD Group based ldap auth
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

I'm trying to get group based authentication working using LDAP against AD. Right now I'm getting a failure related to the group search filter. What filter should I be using? groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniq uemember=%{Ldap-UserDn})))" Looking at the howto here http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048536. html got me part of the way. Anyone out there doing group based auth against AD mind sharing their config? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

1 0

RHEL4 and Oracle Instant Client
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

Has anyone gotten the source RPM's from RHEL4 to build with the oracle module using the Oracle instant client? It keeps giving me the following error no matter what I try: checking for oci.h... yes checking for oracle_init in -loracleclient... no configure: warning: oracle libraries not found. Use --with-oracle-lib-dir=<path>. configure: warning: sql submodule 'oracle' disabled Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

2 1