December 2006 - Freeradius-Users - lists.freeradius.org

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

Alan, Could you perhaps give me a hint about how one would go about allowing any user from any system (_unless_ that system is listed for the specific purpose of not allowing anyone to authenticate from it) to authenticate? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 11:47:47 AM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > Users are authenticating from systems that they should not be > authenticating from - we need to block authentication on a per system > (IP address) basis, not a per user basis. You can do this in FreeRADIUS. Put users into different groups, and block the group from accessing particular systems. > Users should be allowed to authenticate from any system that they are > using _except_ a certain, specific list of IP addresses which would > basically be banned/blocked from authenticating. This can be done, too. > Is this something that FreeRADIUS can do? Yes. > I just started reading about it - and if nothing else it looks like > exec-program-wait might be used to test the IP address and return an > authentication failure? That will work, too, but will be less efficient. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

I thought that the user system only talked to the firewall/nas and that it talked to the RADIUS server? I mean, I thought that using IPTables on the RADIUS server would not work because only the firewalls ever communicated with it directly - am I worng about this? ----- Original Message ---- From: Jan Mulders <lastchancehotel(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 11:46:44 AM Subject: Re: Questions from a totally ignorant n00b Freeradius can do this, I believe (please correct me if I'm wrong, List). However, you might want to consider firewalling those certain addresses on your radius server so authentication/accounting packets never reach your existing radius server daemon. Look into iptables, it should be fairly easy to do. It'd also save what is probably an unnecassary change of software for your purposes! Hope this helps, Jan On 21/12/06, Gene Mosley <freeradius(a)mosleyfamily.org> wrote: I am currently running RADIUS under AIX (the AIX version of RADIUS) and having a problem. It appears that the AIX RADIUS cannot be configured to work around this problem. I was wondering if switching to FreeRADIUS would help? The problem is this: Users are authenticating from systems that they should not be authenticating from - we need to block authentication on a per system (IP address) basis, not a per user basis. Users should be allowed to authenticate from any system that they are using _except_ a certain, specific list of IP addresses which would basically be banned/blocked from authenticating. Is this something that FreeRADIUS can do? I just started reading about it - and if nothing else it looks like exec-program-wait might be used to test the IP address and return an authentication failure? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

I am currently running RADIUS under AIX (the AIX version of RADIUS) and having a problem. It appears that the AIX RADIUS cannot be configured to work around this problem. I was wondering if switching to FreeRADIUS would help? The problem is this: Users are authenticating from systems that they should not be authenticating from - we need to block authentication on a per system (IP address) basis, not a per user basis. Users should be allowed to authenticate from any system that they are using _except_ a certain, specific list of IP addresses which would basically be banned/blocked from authenticating. Is this something that FreeRADIUS can do? I just started reading about it - and if nothing else it looks like exec-program-wait might be used to test the IP address and return an authentication failure?

3 2

Multiple ISPs and big user database
by Felipe Neuwald 21 Dec '06

21 Dec '06

Hi Folks, My MySQL database is working ok, thank you all of you guys. More one problem: I have two ISPs here, each one with 3 NAS IP addresses: ISP1: NAS 1: 10.1.1.1 NAS 2: 10.1.1.2 NAS 3: 10.1.1.3 ISP2: NAS 1: 10.2.2.1 NAS 2: 10.2.2.2 NAS 3: 10.2.2.3 And my radcheck table is like this: id: (incremental) username: the user name attribute: (always Password) op: (always ==) value: the password isp: (can be 1 or 2) A simple example: id: 33934 username: john attribute: Password op: == value: smith isp: 1 The question is. When a user come from ISP1, can I pass one SQL paramether, and whan a user come from ISP2, can I pass other SQL paramether? Thanks, Felipe Neuwald.

2 2

problem with mysql accounting
by basile 21 Dec '06

21 Dec '06

hi i try to account with mysql here are the mysql start stop and update definition accounting_start_query = "INSERT into radaact SET\ `User-Name` = '%{User-Name}',\ `Calling-Station-Id` = '%{Calling-Station-Id}',\ `Called-Station-Id` = '%{Called-Station-Id}',\ `NAS-IP-Address` = '%{NAS-IP-Address}',\ `NAS-Port` = %{NAS-Port},\ `Timestamp Start` = NOW(),\ `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}' " accounting_update_query = "UPDATE radaact SET\ `Acct-Session-Time` = '%{Acct-Session-Time}',\ `Acct-Input-Octets` = '%{Acct-Input-Octets}',\ `Acct-Output-Octets` = '%{Acct-Output-Octets}',\ `Acct-Input-Packets` = '%{Acct-Input-Packets}',\ `Acct-Output-Packets` = '%{Acct-Output-Packets}'\ WHERE `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}'\ LIMIT 1 " accounting_stop_query = "UPDATE radaact SET\ `Timestamp Stop` = NOW(),\ `Acct-Session-Time` = '%{Acct-Session-Time}',\ `Acct-Input-Octets` = '%{Acct-Input-Octets}',\ `Acct-Output-Octets` = '%{Acct-Output-Octets}',\ `Acct-Input-Packets` = '%{Acct-Input-Packets}',\ `Acct-Output-Packets` = '%{Acct-Output-Packets}',\ `Acct-Terminate-Cause` = '%{Acct-Terminate-Cause}'\ WHERE `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}'\ LIMIT 1 " update works fine rlm_sql (sql): sql_set_user escaped user --> 'xxxx' radius_xlat: 'UPDATE radaact SET??`Acct-Session-Time` = '292',??`Acct-Input-Octets` = '94237',??`Acct-Output-Octets` = '937628',??`Acct-Input-Packets` = '597',??`Acct-Output-Packets` = '816'?WHERE `Acct-Unique-Session-Id` = '814b38bc0e9c60f4'?LIMIT 1 ' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sql" returns ok for request 61 modcall: leaving group accounting (returns ok) for request 61 but start and stop not rlm_sql (sql): sql_set_user escaped user --> 'yyyy' radius_xlat: 'INSERT into radaact SET ' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't insert SQL accounting START record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 59 modcall: leaving group accounting (returns ok) for request 59 rlm_sql (sql): sql_set_user escaped user --> 'yyyy' radius_xlat: 'UPDATE radaact SET ' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't update SQL accounting STOP record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 3 modcall[accounting]: module "sql" returns fail for request 60 modcall: leaving group accounting (returns fail) for request 60 i use mysql 4.1 , freeradius 1.1 thanks for help basile

3 2

Re: Huntgroups, Users and Proxy
by Walt Reynolds 21 Dec '06

21 Dec '06

Just checking back to see if anyone can let me know if I am on the right track. Thanks. -------- Original Message -------- Subject: Re: Huntgroups, Users and Proxy Date: Wed, 13 Dec 2006 15:17:44 -0500 From: Walt Reynolds <waltr(a)umich.edu> To: freeradius-users(a)lists.freeradius.org > Date: Wed, 13 Dec 2006 08:05:32 +0000 > From: B Thompson <bt4(a)york.ac.uk> > Subject: Re: Huntgroups, Users and Proxy > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20061213080532.GA2261(a)grande.york.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Tue, Dec 12, 2006 at 04:23:43PM -0500, Walt Reynolds wrote: >> I am going in circles here and not getting anywhere. I will try to >> describe what I want to do starting with huntgroups. >> >> huntgroup: >> All NAS-IP-Address == 10.213.226.1 >> All NAS-IP-Address == 10.213.226.2 >> All NAS-IP-Address == 10.213.226.3 >> All NAS-IP-Address == 192.168.224.5 >> All NAS-IP-Address == 192.168.224.36 >> All NAS-IP-Address == 172.213.226.46 >> >> Bldg1 NAS-IP-Address == 10.213.226.1 >> Bldg1 NAS-IP-Address == 10.213.226.2 >> Bldg1 NAS-IP-Address == 10.213.226.3 >> Bldg1 NAS-IP-Address == 192.168.224.5 >> Bldg1 NAS-IP-Address == 192.168.224.36 >> >> Bldg2 NAS-IP-Address == 172.213.226.46 > > You can't have the same IP address in more than one huntgroup - See bug > #233. > > http://bugs.freeradius.org/show_bug.cgi?id=233 > > The solution is to use rlm_passwd instead. Ok, Thanks for that info. Now lets say I put each NAS in one huntgroup (I added the extra groups for possibilities. So lets say I have the following: UnitA NAS-IP-Address == 10.213.226.1 UnitA NAS-IP-Address == 10.213.226.2 UnitA NAS-IP-Address == 10.213.226.3 UnitB NAS-IP-Address == 192.168.224.5 UnitAB NAS-IP-Address == 172.213.226.46 TypeVPN NAS-IP-Address == 192.168.224.5 TypeGW NAS-IP-Address == 192.168.224.36 So this sets each NAS into a single group. The rest of my question I am still confused about. "UnitA" Authenticate with user(a)unita.generic.edu or Authenticate with Null Realm or Authenticate user(a)generic.edu But NOT user(a)unitb.generic.edu "UnitB" Authenticate with user(a)unitb.generic.edu or Authenticate with Null Realm or Authenticate user(a)generic.edu but NOT user(a)unita.generic.edu "UnitAB" Authenticate with user(a)unita.generic.edu or Authenticate with user(a)unitb.generic.edu or user(a)generic.edu or Null realm "TypeVPN" Authenticate ONLY with Null Realm "TypeGW" authenticate with Null realm or generic.edu So would I add the following to the users file: (Not sure about UnitAB and TypeVPN with Fall-Through = No. I think the rest is right though) DEFAULT Huntgroup-Name == UnitAB, User-Name =~ *(a)unita.generic.edu", Proxy-To-Realm := unita.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitAB, User-Name =~ *(a)unitb.generic.edu", Proxy-To-Realm := unitb.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitA, Proxy-To-Realm := unita.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitB, Proxy-To-Realm := unitb.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == TypeGW, Proxy-To-Realm := generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == TypeVPN, Proxy-To-Realm := NULL Fall-Through = No Then in the proxy.conf proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } realm unita.generic.edu { type = radius authhost = radius.unita.generic.edu:1812 accthost = radius.unita.generic.edu:1813 nostrip } realm unitb.generic.edu { type = radius authhost = radius.unita.generic.edu:1812 accthost = radius.unita.generic.edu:1813 nostrip } realm generic.edu { type = radius authhost = LOCAL accthost = LOCAL strip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = radius.highered.edu:1812 accthost = radius.highered.edu:1812 secret = XXXX nostrip } Thanks. There are so many things our there that I got a little lost. I guess that is a problem with so many options and ways to do things. Sorry for the resend, but wanted the same subject for threading > -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438 -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

1 0

sql and password
by jerrrry＠voila.fr 21 Dec '06

21 Dec '06

Hi, i'd like to athenticate user in ldap and put them in groups using sql. so i don't want to check their password in the radcheck table. my issue is that i don't see how not to check the password using the web GUI dialup admin ? thanks for your help regards jerrrry > Message du 21/12/06 à 08h56 > De : "Kostas Kalevras" > A : "FreeRadius users mailing list" > Copie à : > Objet : Re: Dialup admin Display users online (suggestion) > > Cory Robson wrote: > > >I am slowly getting around this interface and notice many things that could > >be improved upon but I'm lacking in the coding department. > > > >For example the user_finger.php page, this does a nice job once you have > >manually entered all of the pops into the separate naslist file but can > >become a royal pain to maintain. > > > >If someone could rewrite the code to extract the users online from the > >raddact table and simply group them by the independent nas's this would be a > >far simpler method. As you added additional pops to your range nothing to > >add/remove in the code, it simply regenerates as people log in from that > >pool. > > > > > If you are using sql to keep radius client info then you don't need to > do any extra work, since you already have your clients added in the > table for freeradius to function correctly. What you are suggesting > isn't a lot of work. The idea was to have more information than just the > ip of the nas server though (like description, ports available). In any > case it could be added as a configuration option > > >I have done a very similar thing with the failed logins page. Have the sql > >query dumping failed logins into the postauth table from the radius process > >and then have dialup admin failed logins script running an sql query against > >that table instead. Alas my coding is not that good so I'm not getting all > >records just the last one. Again help would be needed for me to finish this. > > > > > It's a nice thought. > > >Anyone up to the task to assist in this matter > > > > > > > >Regards > > > >Cory Robson > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

huntgroups, sql and dialup admin
by jerrrry＠voila.fr 21 Dec '06

21 Dec '06

hi, i configured freeradius using configuration files( user, huntgroups, clients, ...). it works great. now i 'd like to be able to manage my radius server with the web GUI dailup admin. my issue is that i don't see how i can put a nas ip in a huntgroup with this GUI. Can i have my nasip list / huntgroup in an sql DB to be able to manage it with dialup admin or can i only use the huntroups file ? with more than 400 nas it it could be usefull. thank you for your help, regards, jerrrry

1 0

Dialup admin Display users online (suggestion)
by Cory Robson 21 Dec '06

21 Dec '06

I am slowly getting around this interface and notice many things that could be improved upon but I'm lacking in the coding department. For example the user_finger.php page, this does a nice job once you have manually entered all of the pops into the separate naslist file but can become a royal pain to maintain. If someone could rewrite the code to extract the users online from the raddact table and simply group them by the independent nas's this would be a far simpler method. As you added additional pops to your range nothing to add/remove in the code, it simply regenerates as people log in from that pool. I have done a very similar thing with the failed logins page. Have the sql query dumping failed logins into the postauth table from the radius process and then have dialup admin failed logins script running an sql query against that table instead. Alas my coding is not that good so I'm not getting all records just the last one. Again help would be needed for me to finish this. Anyone up to the task to assist in this matter Regards Cory Robson

3 2

Re: Send atributes to the client
by fjlagos＠vtr.net 20 Dec '06

20 Dec '06

James: Can you send an example. Saludos y Gracias Francisco

2 1