November 2006 - Freeradius-Users - lists.freeradius.org

Problem with 3Com-User-Access-Level and rlm_perl
by Krzysztof Olędzki 27 Nov '06

27 Nov '06

Hello, It seems there is something wrong with RAD_REPLY handling. With 3Com-User-Access-Level set to 3Com-Manager/3Com-Monitor freeradius finally sends 3Com-Administrator: My code looks like thos: $RAD_CHECK{'Auth-Type'} = 'Accept'; $RAD_REPLY{'3Com-User-Access-Level'} = '3Com-Manager'; # radiusd -X (...) rlm_perl: Added pair 3Com-User-Access-Level = 3Com-Manager rlm_perl: Added pair Auth-Type = Accept (...) Sending Access-Accept of id 68 to 192.168.139.254 port 2048 3Com-User-Access-Level = 3Com-Administrator (...) But if I set it to 2: $RAD_REPLY{'3Com-User-Access-Level'} = 2; then: # radiusd -X (...) rlm_perl: Added pair 3Com-User-Access-Level = 2 rlm_perl: Added pair Auth-Type = Accept (...) Sending Access-Accept of id 69 to 192.168.139.254 port 2048 3Com-User-Access-Level = 3Com-Manager BTW, there is no problem with other attributes like for example: $RAD_REPLY{'Tunnel-Medium-Type'} = 'IEEE-802'; Tested with freeradius-1.1.2 and 1.1.3. Best regards, Krzysztof Olędzki

2 8

New "look and feel" for the web site.
by Alan DeKok 27 Nov '06

27 Nov '06

After almost 5 years with the previous look & feel, we've updated the web site with a new style, and slightly re-arranged content. It now looks a lot flashier, and should still load quickly for most people. Users with text-based browsers or Internet Explorer may still have issues (lots of links or no transparent PNG's), but we should have most of those straightened out in the next week. We've also changed the slogan on the main page, from "Building the perfect RADIUS server", to "The worlds most popular RADIUS server". The link in the menu bar on the right gives some detailed survey results, and explains why we think it's the worlds #1 RADIUS server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Re: FreeRadius working as proxy Radius for RSA ACE Server
by David Mitton 26 Nov '06

26 Nov '06

On 11/23/2006 11:34 AM, Alan DeKok wrote: >Luis wrote: > > Hi there, > > > > Is there anyone with experience with FreeRadius working as proxy for the > > RSA ACE Server? > > Yes. RSA ACE is just a re-branded Funk server. > > Alan DeKok. Careful here. The RSA SecurID Server, (aka the ACE Server or more properly the Authentication Manager) that holds the SecurID user and token database, and authenticates the token codes, proper doesn't speak RADIUS but a proprietary secured protocol. The API to this protocol's client module is documented. Versions 5.6 and 6.0 of the ACE Server include an optional RADIUS server that accepts PAP requests with a SecurID passcode (PIN + tokencode) and proxies them to the ACE Server. This server is based on the original Livingston RADIUS server code. This server did not support EAP protocols. The Windows version of the server includes a Windows EAP module that supports our SecurID EAP method. This module works directly with the Windows RAS and VPN servers, or via the Microsoft IAS RADIUS Server. Version 6.1 of the Auth Manager Server includes an custom version of SBR that accepts RADIUS requests and only proxies them to the Auth Manager. It supports PAP/SecurID, EAP-GTC, EAP-SecurID, and EAP-Protected OTP. And with TTLS, PEAPv0, and PEAPv1 support. It's supported on Windows and several UNIX platforms. It does not support any other form of authentication. The Windows EAP DLL is still provided and now supports EAP-POTP as well. Any of these RADIUS requests could be proxied by any reasonable RADIUS proxy. There's nothing special about the RADIUS aspects of these requests, just the authentication content. Dave.

3 2

Simultaneous login
by HSS-NOC 26 Nov '06

26 Nov '06

In the radcheck table, Fill Username, attribute, op & value as your_uasername, Simultaneous-Use, :=, 1 respectively. This will not allow more than one simultaneous use for this user. You need to configure session as follows to enable simultaneous query. Session { radtump sql } Regards Muhammed Ali NOC -----Original Message----- Message: 1 Date: Fri, 24 Nov 2006 13:15:42 +0100 From: "Nicolas Viers - Univ. Limoges" <nicolas.viers(a)unilim.fr> Subject: Simultaneous login To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4566E26E.4020105(a)unilim.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello, how to deny simultaneous login with same username on freeradius ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mil: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

1 0

FreeRadius and MySQL boot problem
by HSS-NOC 26 Nov '06

26 Nov '06

Change the line RADIUSD=/usr/src/sbin/radiusd & CONFIG=/path/to/your/radiusd.conf in your rc.radiusd Regards Muhammed Ali NOC -----Original Message----- Message: 3 Date: Sat, 25 Nov 2006 22:09:54 -0800 (PST) From: olisa <rinab01(a)yahoo.com> Subject: Re: FreeRadius and MySQL boot problem To: freeradius-users(a)lists.freeradius.org Message-ID: <7545147.post(a)talk.nabble.com> Content-Type: text/plain; charset=us-ascii I check it freeradius scripts rc.radiusd .it is same as /usr/local/sbin/rc.radiusd. I am using operating system fedora core 4 and chillispot is chillispot-1.0.i386.rpm and freeradius is freeradius-1.1.0.tar.gz . and whenever i reboot the radiusd server there is the error in radiusd log file like Sun Nov 26 11:00:51 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 26 11:00:51 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[10] Failed to link to module 'rlm_eap': /usr/local/lib/rlm_eap-1.1.0.so: cannot restore segment prot after reloc: Permission denied Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[1749] Unknown module "eap". Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[1696] Failed to parse authenticate section. and when i start the radiusd by typing /usr/src/sbin/radiusd , radiusd server run and it has radiusd log file like Sun Nov 26 11:46:10 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 26 11:46:10 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 26 11:46:10 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Nov 26 11:46:10 2006 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/mypaid Sun Nov 26 11:46:10 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 26 11:46:11 2006 : Info: Ready to process requests. so , how to run this radiusd server at boot time not by manully starting everytime when server is restart. regards rina Hernan Antolini wrote: > > Check the scripts dir that came with the freeradius source; there is a > rc.radiusd file to do that. > regards > Hernan Antolini > > freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on > 11/24/2006 03:52:53 AM: > >> >> hello >> i configure chillispot and freeradius and it is working. But >> whenever i reboot this radiusd server i have to run manually all the > time. >> So how to run this radiusd server at boot time. >> chillispot ,apche and mysql all run at boot time but radiusd > is >> not.i try it by writing script in /etc/rc.local and also directly copy >> /usr/local/sbin/radiusd file to /etc/rc.d/init.d but it don't work . So >> please give me any ideas to start radiusd server at boot time. >> >> regards >> rina >> >> >> >> Diniz Da Rocha wrote: >> > >> > HI, >> > >> > I have currently setup FreeRadius 1.0.4 with ldap authentication and >> > authorization as well as mysql authorization and its all working fine. > My >> > only problem is that when I boot the server (Fedora Core 4) and > radiusd >> > starts up there is a rlm_sql_mysql error: >> > >> > Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect >> > unconnected handle 4.. >> > Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to > MySQL >> > server for #4 >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect > socket >> > to >> > MySQL server radius_client@myip:radius >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't >> > connect >> > to MySQL server on 'myip' (13)' >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB >> > handle >> > #4 >> > >> > >> > The MySQL server is on another server with ip "myip" I initially > thought >> > it >> > was a firewall block but even with no firewall I get this error. But > once >> > the server has started and I run "service radiusd restart" from a > terminal >> > the connect to the MySQL server works fine and has no problems. I even >> > tried >> > running the service from rc.local but it still fails did anyone have > this >> > problem??? is anyone running the MySQL server on another machine???? > Is >> > there a fix for this??? >> > >> > thanks >> > >> > diniz >> > >> > - >> > List info/subscribe/unsubscribe? See >> > http://www.freeradius.org/list/users.html >> > >> >> -- >> View this message in context: http://www.nabble.com/FreeRadius-and- >> MySQL-boot-problem-tf1191658.html#a7518565 >> Sent from the FreeRadius - User mailing list archive at Nabble.com. >> >> - >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- View this message in context: http://www.nabble.com/FreeRadius-and-MySQL-boot-problem-tf1191658.html#a7545 147 Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 19, Issue 88 ************************************************

1 0

FreeRadius and MySQL boot problem
by Diniz Da Rocha 26 Nov '06

26 Nov '06

HI, I have currently setup FreeRadius 1.0.4 with ldap authentication and authorization as well as mysql authorization and its all working fine. My only problem is that when I boot the server (Fedora Core 4) and radiusd starts up there is a rlm_sql_mysql error: Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius_client@myip:radius Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on 'myip' (13)' Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB handle #4 The MySQL server is on another server with ip "myip" I initially thought it was a firewall block but even with no firewall I get this error. But once the server has started and I run "service radiusd restart" from a terminal the connect to the MySQL server works fine and has no problems. I even tried running the service from rc.local but it still fails did anyone have this problem??? is anyone running the MySQL server on another machine???? Is there a fix for this??? thanks diniz

5 8

WPA Guest support
by Josh Shamir 24 Nov '06

24 Nov '06

Hi, I am interested in the fact that also the users who are not registered can visit a few sites. I would to know if the last stable version of freeradius support the "WPA Guest" feature for 802.1x captive portal implemented by Coova chilli. And if so what kinds of modifications I must do in the Freeradius configuration? I am already using Freeradius with WPA (PEAP) and all works fine. Thanks Best Regards,Josh

1 0

EAP abort in the middle of conversation
by Stefan Winter 24 Nov '06

24 Nov '06

Hello, today I stumbled over a very peculiar problem: an EAP exchange goes like this: (eapol_test) -> FR 1.1.3 Access-Request (initial) ---------> (2 proxies) ---------> FR 1.1.3 (eapol_test) <- FR 1.1.3 <--------- (2 proxies) <--------- FR 1.1.3 Access-Challenge (eapol_test) -> FR 1.1.3 Access-Request ---------> (2 proxies) ---------> FR 1.1.3 (eapol_test) <- FR 1.1.3 <--------- (2 proxies) <--------- FR 1.1.3 Access-Reject I.e. there is no networking issue, packet exchange works, but as soon as the second Access-Request comes in, the request is rejected. The -X log of the packet exchange in question gives a hint: rad_recv: Access-Request packet from host 158.64....:1814, id=14, length=184 User-Name = "someuser(a)restena.lu" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x0200001e0174657374757365722e616c6c6f774072657374656e612e6c75 Message-Authenticator = 0xa701151b3e81f0317f3ffa1444b0fd06 RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313934 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 54 hints: Matched DEFAULT at 109 modcall[authorize]: module "preprocess" returns ok for request 54 radius_xlat: '/var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail modcall[authorize]: module "nas_auth_log" returns ok for request 54 rlm_realm: Looking up realm "restena.lu" for User-Name = "someuser(a)restena.lu" rlm_realm: Found realm "restena.lu" rlm_realm: Proxying request from user someuser to realm restena.lu rlm_realm: Adding Realm = "restena.lu" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 54 modcall[authorize]: module "mschap" returns noop for request 54 modcall[authorize]: module "files" returns notfound for request 54 rlm_eap: EAP packet type response id 0 length 30 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 54 radius_xlat: 'testuser.allow(a)restena.lu' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'someuser(a)restena.lu' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'someuser(a)restena.lu' ORDER BY id' rlm_sql (sql-normal-vpn): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'someuser(a)restena.lu' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql-normal-vpn): Released sql socket id: 2 rlm_sql (sql-normal-vpn): No matching entry in the database for request from user [someuser(a)restena.lu] modcall[authorize]: module "sql-normal-vpn" returns notfound for request 54 modcall: leaving group authorize (returns updated) for request 54 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 54 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 54 modcall: leaving group authenticate (returns handled) for request 54 Sending Access-Challenge of id 14 to 158.64... port 1814 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb6a7e30b6348a332f14e7da16cc90197 Proxy-State = 0x313934 Finished request 54 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 158.64...:1814, id=15, length=160 User-Name = "someuser(a)restena.lu" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x020100060315 Message-Authenticator = 0x4109008e4025ee5df4b62db3e8feaa9d RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313935 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 55 hints: Matched DEFAULT at 109 modcall[authorize]: module "preprocess" returns ok for request 55 radius_xlat: '/var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail modcall[authorize]: module "nas_auth_log" returns ok for request 55 rlm_realm: Looking up realm "restena.lu" for User-Name = "someuser(a)restena.lu" rlm_realm: Found realm "restena.lu" rlm_realm: Proxying request from user someuser to realm restena.lu rlm_realm: Adding Realm = "restena.lu" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 55 modcall[authorize]: module "mschap" returns noop for request 55 modcall[authorize]: module "files" returns notfound for request 55 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 55 radius_xlat: 'someuser(a)restena.lu' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'someuser(a)restena.lu' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'someuser(a)restena.lu' ORDER BY id' rlm_sql (sql-normal-vpn): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'someuser(a)restena.lu' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql-normal-vpn): Released sql socket id: 1 rlm_sql (sql-normal-vpn): No matching entry in the database for request from user [someuser(a)restena.lu] modcall[authorize]: module "sql-normal-vpn" returns notfound for request 55 modcall: leaving group authorize (returns updated) for request 55 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 55 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 55 modcall: leaving group authenticate (returns invalid) for request 55 auth: Failed to validate the user. Login incorrect: [someuser(a)restena.lu] (from client ... port 0 cli 70-6F-6C-69-73-68) Now, the message "rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request" seems definitive, but it is definitely not a timeout (all happens within a few seconds, and eap.conf timeout is set to 60), and the EAP request really should be known, it's a conversation that started only a few millis ago. I would guess that eapol_test might be broken, but strangely enough it works perfectly when initiating an EAP exchange to another server that ends up at the same home server. So, the only thing that's different is the first-in-line FR 1.1.3 server. I'm perfectly clueless here :-( Why would the EAP conversation be unknown? All FR servers in the chain are 1.1.3, there is one Radiator server in the proxy chain. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 5

Simultaneous login
by Nicolas Viers - Univ. Limoges 24 Nov '06

24 Nov '06

Hello, how to deny simultaneous login with same username on freeradius ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mél: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

2 1

Ippool howto questions..
by Collen Blijenberg 24 Nov '06

24 Nov '06

Hello, just some basic questions about the Ippool. if i'm right, the ippool option, is for handing out IP's to clients ?! (right ??) you could call it DHCP (right??) how can i setup the dns gateway and proxy options in a ippool... Cheers.. Collen..

2 2