August 2006 - Freeradius-Users - lists.freeradius.org

PEAP LDAP confusion
by Rob Shepherd 23 Aug '06

23 Aug '06

Dear FreeRADIUS users, Firstly, I am attempting to get XP/OSX clients to connect to a 802.1x WLAN provided by a cisco wlan controller. This is currently backed by ACS and works, but i'd like to use FreeRADIUS is possible, with half my users in LDAP and half in MySQL. The setup uses PEAP, however am I correct in thinking that the RADIUS server never touches any TLS components. The TLS tunnel is between the WLAN controller and the client right? Furthermore, I know I cannot use ldap authentication (binding) as a result of the eap conversation, however can I store an NT-Hash in LDAP/MySQL for the mschapv2 module to pick up and use? I'd prefer not to store clear text at all if possible... I have everything I need compiled and installed, but I'd like to know whether or not I can achieve my goal before wasting a lot of my time. Any pointers are thus greatly appreciated. thanks Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

7 10

BUG! Variables and MySQL queries
by Chris Knipe 23 Aug '06

23 Aug '06

radiusd: FreeRADIUS Version 1.1.1, for host , built on May 18 2006 at 13:16:06 Copyright (C) 2000-2006 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. sql query: authorize_check_query = "SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `User` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID LEFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes`.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `GroupTimes`.StopTime > DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `Realm`.Realmname=LOWER(SUBSTRING('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') +1))) AND `User`.Username=LOWER(LEFT('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute" Escaped query sent to the database: SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `Use r` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID L EFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y ' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes `.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `GroupTimes`.StopTime > D ATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `Realm`.Realmname=LOWER(SUBSTRING('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') +1))) AND `User`.Username=LOWER(LEFT('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute The mySQL variables %H:%i:%S is over written by FreeRadius' variables... I have filed in BugZilla as well. Any possibility to get this fixed??? Regards, Chris.

2 2

More SQL
by Chris Knipe 23 Aug '06

23 Aug '06

1 1

Re: Re: openser and AD
by Artur Hayne 23 Aug '06

23 Aug '06

Active Directory does not supply clear-text passwords to FreeRADIUS. In many cases, Active Directory doesn't *have* the clear-text passwords. Digest authentication is impossible when the passwords are in Active Directory. Sorry. > I see in some tutorials show how authenticate in a domain to use one > tool called ntlm_auth, but it seams that only work with the mschap > protocol, and the openser uses the digest. Yes. ntlm_auth will not help you. > What to do? Any ideia? Use another database, like OpenLDAP or MySQL. Active Directory is responsible for making Digest authentication impossible. > Its necessarily to do some configuration in the users or another files? No. There is NOTHING you can do except use another database. The Openser , Active Directory and FreeRadius support TLS. Can I use it for solve my problem? Or is this a bad ideia? --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora!

1 0

bill payment using RADIUS
by Asiful Mustafa 23 Aug '06

23 Aug '06

Hi, Is there any ways that post-paid users can pay their bill using RADIUS packet? Is there any RADIUS attribute which updates a user account by specifed amount? Thanks, Asif

3 4

Infor required to use the exec_program
by Shankar Ganesh C 23 Aug '06

23 Aug '06

Hi , I am trying to use the mod exec command to pass the request list parameters to an external program when there is a accounting request start is recived. The below steps i have followed. 1) in the Acct_users files below statement are given. DEFAULT Acct-Status-Type == Start Exec-Program = "/usr/bin/exec-program-wait" 2) In the radiusd.conf file exec exec-program-wait { wait = yes program = "exec-program-wait %{WaterCove-Bearer-Type}" input_pairs = request output_pairs = reply } 3) in the instantiate section called the below module instantiate { exec exec-program-wait 4) Ensured the script is available in /usr/bin/exec-program-wait 5) Below is the script definition # For 'acct_users': # DEFAULT Acct-Status-Type == Start Exec-Program="/home/shankarganesh/freeradius-1.1.2/scripts/exec-prog ram-wait" DEFAULT Acct-Status-Type == Stop Exec-Program="/home/shankarganesh/freeradius-1.1.2/scripts/exec-prog ram-wait" printenv > /tmp/exec-program-wait echo "Reply-Message += \"Hello, %u\"," echo "Reply-Message += \"PATH=$PATH\"," echo Framed-IP-Address = 255.255.255.255 echo "The prameter list of $* " WaterCove-Bearer-Type = WATERCOVE_BEARER_TYPE exit 0 6) When i try to run the server below error message is logged in the server , which could not find the environment variables . Ready to process requests. rad_recv: Accounting-Request packet from host 10.45.2.42:1230, id=0, length=223 User-Name = "steve" Acct-Status-Type = Start Acct-Session-Id = "0" NAS-IP-Address = 10.45.2.34 Framed-IP-Address = 10.45.2.33 Called-Station-Id = "1234" Calling-Station-Id = "4546" 3GPP-IMSI = "12345" 3GPP-NSAPI = "asdfgh" 3GPP-Charging-ID = 123 3GPP-GPRS-Negotiated-QoS-profile = "wdefefr" 3GPP-GGSN-Address = 255.255.255.255 3GPP-SGSN-Address = 255.255.255.255 WaterCove-Bearer-Type = WLAN WaterCove-HTTP-URL = "qewweqqwe" WaterCove-FlowTemplate-Name = "23453255" WaterCove-ServiceClass-Name = "sgdfsfgd" WaterCove-FlowTemplate-ID = 325454 WaterCove-ServiceClass-ID = 32534254 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 10.45.2.42,NAS-IP-Address = 10.45.2.34,Acct-Session-Id = "0",User-Name = "steve"' rlm_acct_unique: Acct-Unique-Session-ID = "a488c9e5208ecdb9". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 acct_users: Matched entry DEFAULT at line 7 modcall[preacct]: module "files" returns ok for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radacct/10.45.2.42/detail-20060823' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/10.45.2.42/detail-20060823 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns noop for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radutmp' radius_xlat: 'steve' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 radius_xlat: '/usr/bin/exec-program-wait' Exec-Program: /usr/bin/exec-program-wait /usr/bin/exec-program-wait: printenv: not found Sending Accounting-Response of id 0 to 10.45.2.42 port 1230 Finished request 0 Going to the next request Pls let me know where i am doing wrong. Thanks and rgds Shankar ganesh

2 1

Simultaneous-Use and checkrad with Cisco Router
by Faisal Butt 23 Aug '06

23 Aug '06

Dear Sir, I want to know the setup for the simultaneous logins and checkrad script with Cisco Router SNMP enabled. The settings are configured but checkrad is not returning any results from cisco snmp. Also, how can I know whether radius will block MPP attempts? I am looking for configuration and any additional documents that can help me understand it more. Best Regards, M. Faisal Butt

1 0

variables.txt
by Chris Knipe 23 Aug '06

23 Aug '06

states: %S request timestamp in SQL format %T request timestamp in database format What is SQL format? What is 'database format' A database can hold times in MANY different formats. Can someone just shed some clarity as to the format for the variables, might be a good idea to update that in the documentation as well, it's really not being helpful. Regards, Chris.

4 4

(no subject)
by Гудыно Андрей 23 Aug '06

23 Aug '06

unsubscribe privet -- --------------------------------------- Гудыно Андрей Сергеевич Могилевский филиал РО Белтелеком +375 0222 228534 +375 0222 312007 PGP http://www.mogilev.by/ash.asc ---------------------------------------

1 0

rlm_perl and proxy
by Pshem Kowalczyk 22 Aug '06

22 Aug '06

Hi, I'm trying to implement proxy using rlm_perl, I've applied the patch that should allow me to modify the attributes, but it doesn't seem to work. (freeradius 1.1.2) Perl code: # Function to handle pre_proxy sub pre_proxy { &radiusd::radlog(1, "entering pre-proxy"); my %hash = (); $hash{'User-Name'} = "testuser"; $hash{'Operator'} = ":="; $RAD_REPLY{'User-Name'} = \%hash; return RLM_MODULE_UPDATED; } # Function to handle post_proxy sub post_proxy { &radiusd::radlog(1, "entering post-proxy"); my %hash = (); $hash{'Framed-IP-Address'} = "10.10.1.1"; $hash{'Operator'} = ":="; $RAD_REPLY{'Framed-IP-Address'} = \%hash; return RLM_MODULE_UPDATED; } and then debug from radius: rad_recv: Access-Request packet from host 127.0.0.1:32777, id=31, length=219 User-Password = "password" User-Name = "test1(a)somwhere.com" Acct-Session-Id = "erx atm 8/0.16901030:169.1030:0239293057" Service-Type = Framed-User Framed-Protocol = PPP Connect-Info = "speed:UBR" NAS-Port-Type = xDSL NAS-Port = 1084818438 NAS-Port-Id = "atm 8/0.16901030:169.1030" NAS-IP-Address = 10.10.1.2 NAS-Identifier = "CH_RAN_11" ERX-Qos-Profile-Name = "qos-3584k_shape" ERX-Ingress-Policy-Name = "128k_rate" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: Looking up realm "somwhere.com" for User-Name = "test1(a)somwhere.com" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "test1" rlm_realm: Proxying request from user test1 to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 perl_pool: item 0x81fc008 asigned new request. Handled so far: 2 found interpetator at address 0x81fc008 rlm_perl: Added pair REALM = somwhere.com rlm_perl: Added pair Proxy-To-Realm = quik rlm_perl: Added pair Stripped-User-Name = test1 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x81fc008 modcall[authorize]: module "perl" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 1 perl_pool: item 0x85ea2a8 asigned new request. Handled so far: 2 found interpetator at address 0x85ea2a8 rlm_perl: entering pre-proxy rlm_perl: Added pair User-Name = testuser rlm_perl: Added pair Realm = somwhere.com rlm_perl: Added pair Stripped-User-Name = test1 rlm_perl: Added pair Proxy-To-Realm = quik perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x85ea2a8 modcall[pre-proxy]: module "perl" returns updated for request 1 modcall: leaving group pre-proxy (returns updated) for request 1 As you can see it modified the User-Name attribute (at least it claims it did), but: Sending Access-Request of id 1 to 10.10.12.103 port 1812 User-Password = "password" User-Name = "test1" Acct-Session-Id = "erx atm 8/0.16901030:169.1030:0239293057" Service-Type = Framed-User Framed-Protocol = PPP Connect-Info = "speed:UBR" NAS-Port-Type = xDSL NAS-Port = 1084818438 NAS-Port-Id = "atm 8/0.16901030:169.1030" NAS-IP-Address = 10.10.1.2 NAS-Identifier = "CH_RAN_11" ERX-Qos-Profile-Name = "qos-3584k_shape" ERX-Ingress-Policy-Name = "128k_rate" Proxy-State = 0x3331 It doesn't send it, what's more: rad_recv: Access-Accept packet from host 10.10.12.103:1812, id=1, length=30 Framed-IP-Address = 192.168.1.65 Proxy-State = 0x3331 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 1 perl_pool: item 0x89bb2e0 asigned new request. Handled so far: 2 found interpetator at address 0x89bb2e0 rlm_perl: entering post-proxy rlm_perl: Added pair Framed-IP-Address = 10.10.1.1 rlm_perl: Added pair Realm = somwhere.com rlm_perl: Added pair Stripped-User-Name = test1 rlm_perl: Added pair Proxy-To-Realm = quik rlm_perl: Added pair Proxy-State = 0x3331 rlm_perl: Added pair Framed-IP-Address = 192.168.1.65 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x89bb2e0 modcall[post-proxy]: module "perl" returns updated for request 1 modcall: leaving group post-proxy (returns updated) for request 1 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 31 to 127.0.0.1 port 32777 Framed-IP-Address := 10.10.1.1 Framed-IP-Address = 192.168.1.65 Finished request 1 So in both cases it retaind original values of the attributes. How do i fix this? regards pshemko

1 0