November 2006 - Freeradius-Users - lists.freeradius.org

how to allow login only from specified access point?
by Norbert Grochal 18 Nov '06

18 Nov '06

I have freeradius serwer with PEAP auth. secrets of nasnames and user passwords are in mysql. Is it possible to set freeradius to send Access-Accept only where user try to connect to specified access point? I try to check it by sql query modified by me. sql: authorize_check_query = "SELECT r.id, r.UserName, r.Attribute, r.Value, r.op FROM radcheck r WHERE r.Username = '%{SQL-User-Name}' and ('%{NAS-IP-Address}' = 'aaaaaaaaaa')" When sql gets the password from sql where is no desired value of NAS-IP-Address attribute, so I don't know how to check it by sql. Example, this is ONE packet of Access-Request: rad_recv: Access-Request packet from host 10.10.10.123:2048, id=247, length=261 User-Name = "Adam Nowak" NAS-IP-Address = 10.10.10.123 (...) rlm_sql (sql): sql_set_user escaped user --> 'Adam Nowak' radius_xlat: 'SELECT r.id, r.UserName, r.Attribute, r.Value, r.op FROM radcheck r WHERE r.Username = 'Adam Nowak' and ('10.10.10.123' = 'aaaaaaaaaa') // YOU CAN SEE NAS-IP-Address here, but Adam Nowak is not the eap-peap login... (...) rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - wlxtbp - // THIS IS THE CORRECT LOGIN... rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of wlxtbp PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to wlxtbp (...) rlm_sql (sql): sql_set_user escaped user --> 'wlxtbp' radius_xlat: 'SELECT r.id, r.UserName, r.Attribute, r.Value, r.op FROM radcheck r WHERE r.Username = 'wlxtbp' and ('127.0.0.1' = 'aaaaaaaaaa' ) // YOU SEE 127.0.0.1 instead of desired NAS-IP-Address here, so I can't check here from which access point the user try to connect This is the place, where freeradius gets password from mysql and if the password is ok we can see: rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success My question is as I have written: Is it possible to set freeradius to send Access-Accept only where user try to connect to specified access point? And how to do it ? :-). Norboro

1 0

FW: how to force NAS-port info in accounting-start, for radutmp to work ok
by Radu IONESCU 18 Nov '06

18 Nov '06

as I had no answers on this thread, I'm just updating it: with an arbitrary NAS-port attribute entry in hints, radutmp is ok, radwho is working and Simultaneous-Use attribute has an effect; however the setup should be refined by implying checkrad, which does not work for NAS type 'other'; ri -----Original Message----- Sent: 15 noiembrie 2006 16:15 To: 'freeradius-users(a)lists.freeradius.org' Subject: how to force NAS-port info in accounting-start, for radutmp to work ok I have installed freeradius-1.0.5-1.2 on FC-5, and I intend to use Freeradius with only one NAS - ZyXEL VSG-1200 - a subscriber gateway for wire/wireless campus access zone. The NAS is defined in clients.conf file as "nastype = other". The VSAs are working ok. It seems that the NAS, doesn't include the NAS-Port attribute (Integer) in the accounting packets, so RADIUS accounting process doesn't write into radwtm/radutmp files (radwho outputs no data), and Simultaneous-Use check is not effective: rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! Is there a workaround for this, I mean on the RADIUS host? Thank you for any help! ri Following is a radiusd -X output for a current accounting request: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rad_recv: Accounting-Request packet from host 192.168.19.226:10661, id=7, length=136 User-Name = "pcrist" Acct-Status-Type = Alive Acct-Delay-Time = 0 Acct-Session-Id = "0050fce8552031000000" NAS-IP-Address = 192.168.19.226 NAS-Identifier = "vsg" Framed-IP-Address = 10.59.1.2 Calling-Station-Id = "00-50-FC-E8-55-20" Called-Station-Id = "00-13-49-6F-EE-C4" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 21 modcall[preacct]: module "preprocess" returns noop for request 21 rlm_acct_unique: Hashing 'Client-IP-Address = 192.168.19.226,NAS-IP-Address = 192.168.19.226,Acct-Session-Id = "0050fce8552031000000",User-Name = "pcrist"' rlm_acct_unique: Acct-Unique-Session-ID = "c425325ee3d8e6fc". modcall[preacct]: module "acct_unique" returns ok for request 21 modcall[preacct]: module "files" returns noop for request 21 modcall: group preacct returns ok for request 21 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 21 radius_xlat: '/var/log/radius/radacct/192.168.19.226/detail-20061115' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.19.226/detail-20061115 modcall[accounting]: module "detail" returns ok for request 21 modcall[accounting]: module "unix" returns noop for request 21 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'pcrist' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 21 modcall: group accounting returns ok for request 21 Sending Accounting-Response of id 7 to 192.168.19.226:10661 Finished request 21 Going to the next request ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and this is a radiusd -X output when I simulate an accounting packet with NTRadPing, forcing an attribute of NAS-port=1: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rad_recv: Accounting-Request packet from host 192.168.19.11:3828, id=4, length=43 User-Name = "dani" Acct-Status-Type = Start Acct-Session-Id = "460" NAS-Port = 1 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 22 modcall[preacct]: module "preprocess" returns noop for request 22 rlm_acct_unique: Hashing 'Client-IP-Address = 192.168.19.11,NAS-IP-Address = 192.168.19.11,Acct-Session-Id = "460",User-Name = "dani"' rlm_acct_unique: Acct-Unique-Session-ID = "45e816fe4586d71f". modcall[preacct]: module "acct_unique" returns ok for request 22 modcall[preacct]: module "files" returns noop for request 22 modcall: group preacct returns ok for request 22 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 22 radius_xlat: '/var/log/radius/radacct/192.168.19.11/detail-20061115' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.19.11/detail-20061115 modcall[accounting]: module "detail" returns ok for request 22 modcall[accounting]: module "unix" returns ok for request 22 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'dani' modcall[accounting]: module "radutmp" returns ok for request 22 modcall: group accounting returns ok for request 22 Sending Accounting-Response of id 4 to 192.168.19.11:3828 Finished request 22 Going to the next request --- Walking the entire request list --- Cleaning up request 22 ID 4 with timestamp 455b108c Nothing to do. Sleeping until we see a request. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ the above seems ok, as I have now an entry in radutmp: # radwho Login Name What TTY When From Location dani dani shell S1 Wed 15:05 193.254.2 and an authentication packet sent with NTRadPing with the same user-name 'dani' gets an 'Access-Reject' response: 'You are already logged in - access denied' So, Simultaneous-Use works ok for me if NAS includes NAS-port attribute in accounting start packet. I wrote to ZyXEL with no much hope for an answer, so I am looking for a FreeRADIUS workaround on the host installation. --- / Universitatea TRANSILVANIA Brasov / -- virus checked - cciu unitbv

1 0

problems with ldap
by Marilene Lima 18 Nov '06

18 Nov '06

Hi, I am again. It's work with my mysql users. But, I have two databases and I will have more. The first, mysql it's ok. But, after I installed every softwares again, I can't authenticate now with my ldap users. It is the error: rlm_unix: [ldapuser]: invalid shell []... I don't know where I configure this. It is the radiusd.conf? freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8116868 Module: Instantiated ldap (ldap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.164.67:32782, id=149, length=60 User-Name = "ldapuser" User-Password = "789" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User ldapuser not found in radcheck rlm_sql (sql): User ldapuser not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_unix: [ldapuser]: invalid shell [] rad_recv: Access-Request packet from host 10.0.164.67:32782, id=149, length=60 Sending Access-Reject of id 149 to 10.0.164.67:32782 wireless6e:~#

2 1

EAP anonymous and inner User-name
by Florian Prester 17 Nov '06

17 Nov '06

Hi, I want to provide the possibility of anonymouse EAP, with inner User-name and password. So I think I have to add the user "annonymous" to the users-file with Auth-type = EAP, but how do I access the inner User-name, which I need for authentication/authorization? Thanks Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

4 12

Its work!!!!
by Marilene Lima 17 Nov '06

17 Nov '06

Hi! I need to be thankful all that had helped me. My problem was decided when I reinstalled all the packages. Probably I was with some problem in my installations because I did not obtain to get no reply when I had started freeradius - x or radiusd - x. Now it's work. Thanks a lot, Marilene

1 0

failed query & postgresql driver
by freeradius＠list.coretech.ro 17 Nov '06

17 Nov '06

hello, I am trying to use the redundant feature of freeradius and I do not understand why the sql module (postgresql driver) returns ok when a query fails. from radiusd -X rlm_sql (sql): Reserving sql socket id: 61 rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error column "aaa" does not exist rlm_sql_postgresql: Postgresql Fatal Error: [42703] Accured!! rlm_sql_postgresql: Postgresql Fatal Error: [UNDEFINED COLUMN] Occured!! radius_xlat: '' rlm_sql (sql): Released sql socket id: 61 modcall[accounting]: module "sql" returns ok for request 1 modcall: group returns ok for request 1 modcall: group accounting returns ok for request 1 in file sql_postgresql.c function sql_check_error I see that for non "SQL_DOWN" errors it returns 0 (OK) is this ok ? also in the compile stage I get: In file included from sql_postgresql.c:56: sql_postgresql.h:21: warning: missing braces around initializer sql_postgresql.h:21: warning: (near initialization for `errorcodes[0]') sql_postgresql.c: In function `sql_query': sql_postgresql.c:300: warning: enumeration value `PGRES_EMPTY_QUERY' not handled in switch sql_postgresql.c:300: warning: enumeration value `PGRES_COPY_OUT' not handled in switch sql_postgresql.c:300: warning: enumeration value `PGRES_COPY_IN' not handled in switch sql_postgresql.c:319: warning: control reaches end of non-void function sql_postgresql.c: At top level: sql_postgresql.c:68: warning: 'sql_num_fields' declared `static' but never defined sql_postgresql.c:75: warning: 'status_is_ok' defined but not used my gcc is: gcc (GCC) 3.4.4 20050721 (Red Hat 3.4.4-2) is it to old ? the rest of freeradius compiles ok thanks, razvan radu

1 0

problem with radrelay
by Riccardo Roasio 17 Nov '06

17 Nov '06

Hi, first of all hello to everybody! I have a problem with my freeradius installation. I'm using it to pass data from a softswitch to another radius server. The radiusd daemon receive data and put it into a file called "details". The radrelay should read from this file and send data away. The problem is that it seems not to read from file ... If i run it with -f -xxx options it read few data from the file and nothing else, while in the detail file there are a lot of data ... Anyone have an idea of which can be the problem? > Thanks,Riccardo > > >

2 3

Logging EAP conversation Access-Challenges
by Stefan Winter 17 Nov '06

17 Nov '06

Hello, is it possible to log an EAP conversation's Access-Challenge packets that leave the FR server? I mean, other than dumping the output of -X but with a detail { } instance. During looking that up, I took a look at Post-Auth-Type and the dictionary only knows about the value "Local" = 0, but since REJECT exists and is also used I suspect that there might be more values available. Having something like Post-Auth-Type EAP-CHALLENGE { detail } would probably do the trick - if it exists. If more values are available, updating doc/Post-Auth-Type would enlighten people for sure. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

caching mechanisms and clean disconnect
by Josh Shamir 17 Nov '06

17 Nov '06

Hi, I've a problem regarding the clean disconnect of a client and some caching mechanisms. I briefly illustrate my problem : My system is composed by freeradius and chillispot with WPA enterprise (LDAP as backend). When i connect a client 1 to my system all works fine, except for the time taked by authentication process, i'm using WinXP SP2 build-in supplicant. (How I can speed up this procedure?Could you suggest me some opensource supplicant?) The problem is that when I disconnect client 1 from my system (just connecting my client to another network) and then i reconnect client1 to the system the WPA authentication failed for about 10 minutes.After this time authentication of client 1 works fine. So I think that this fact is caused by some cache mechanism used by freeradius. How can I make sure that a Client is disconnected in clean way and remove his session after it has disconnected inside Freeradius? Thanks for attention Regards, Josh

2 3

Is this hack possible?
by Erling Paulsen 17 Nov '06

17 Nov '06

Hi. I'm using FreeRADIUS to authenticate Wireless users (WPA) to an LDAP backend. FreeRADIUS also rewrites attributes for dynamic Vlan assignments. Works like a charm. Is it possible to make FreeRADIUS rewrite/force an "Access Denied" reply into an "Access Accept" reply? Why on earth would I want this? Well, I would like to i.e. give a guest-net Vlan back to users that actually fail authentication, so that when they try to access the web they will instead get connected to a redirected guest-information webpage. - or does anyone have an idea of how such a functionality can be achieved through some kindof magic? We're using lightweight AP's connected to Cisco WISM controllers. - Erling Paulsen

5 5