September 2006 - Freeradius-Users - lists.freeradius.org

radcheck vs radreply
by Graham Beneke 20 Sep '06

20 Sep '06

I seem to have a conceptual misunderstanding of the radcheck and radreply tables - and all my googling has given me nothing solid to correct myself on. Can someone explain the difference of the 2 and what their purpose in the system is. My understanding it the radcheck is used to decide whether a user should have access to the NAS and values are then sent back from the results of these checks... The radreply is then simply a list of properties/configuration attributes that are returned to the NAS is that specific user is authorised. My confusion comes - though - due to the fact that when running a radtest on my server none of the radcheck attributes are being returned and the users are being allowed to do more than they should be as a result.

1 0

Authenticating users on cisco 3750 switch
by Jean-Francois Fortin 20 Sep '06

20 Sep '06

Hi, We are trying to use freeradius as authentication system to allow users to connect to our cisco switch (3750) for management. The radius server is running ok, we can authenticate Cisco ASA, BigIP LB against it. But when trying with the 3750, we see that the radius server accept the user and return an answer to the switch, but it doesn't work. Anyone has sample config using freeradius with cisco switch? Thanks JF Jean-Francois Fortin | Deployment Prime | OZ T: 514.390.1333 x4004 | F: 514.390.0033 | M: 514.260.6334 | jean-francois.fortin(a)oz.com

3 5

users fil vs sql
by Keith Woodworth 19 Sep '06

19 Sep '06

Ive got things working using 1.1.3, username in radcheck with crypt-password, using auth-type = Local in radgroupcheck. I'm using the flat Users file with a simple 6 line Default entry to make it all work. On my test bed this has been working quite well for the last 3 days. While this is ok, how does radius get configured to use the sql table to send the replies, not the users file? Ive tried commenting out all the files entries in radiusd.conf but radius sends back a access-accept but the client side gets rejected. Thanks, Keith

2 4

New to FreeRadius (not to Radius) and need to know about capabilities.
by Dan Geist 19 Sep '06

19 Sep '06

Greetings, all. I'm a new user that's looking at FreeRadius because of some of it's features, but I'd like to figure out if it can replicate what I'm currently doing before I start looking into a migration. My current setup does the following (with openradius, mysql, perl, and a PAM-securID module) on each packet arrival: 1) check an SQL db for the encryption key and tokenize everything (if so, continue, else exit) 2) check to see if it's an accounting packet and log it (if so, then do it then exit) 3) if it's anything else, check the SQL db to see if the username is valid. (if so, continue, else exit) 4) execute a PAM check on the valid user with the credentials just provided (which could be unix auth, securID, mysql, LDAP, whatever PAM supports) (if authenticated, continue, else exit) 5) check to see if it's one of a short list of auth-only NASs (if so, authenticate that user and exit, else continue) 6) do another SQL lookup to get the combination of VSA option values for that unique username/nas pair and return the appropriate RAD-access option along with the VSA options for that user/device combination (return packet/VSAs and exit) Now, I know that's a lot of info, but does FreeRadius have the flexibility to be able to do something like this? The big things are that it be able to do PAM auth on users and that it be able to return VSAs based on a one-to-one relationship that's stored in a MySQL db. Thanks. Dan -- Dan Geist | dan.geist(a)cox.com | (404) 269-6822 Cox Communications - Engineering Security

3 2

Banking Time
by Prabhdeep Singh 19 Sep '06

19 Sep '06

Hi, I am trying to figure out how can i support two sets of users on same DB (radius/MySQL), where one set of users are able to bank the time, and others not. For example. User A buys a plan that is good for 2 hour.... he/she logs in and after 1 hour logs out. One day after User A is again able to log in and use the remaining 1 hour. User B buys a plan that is also good for 2 hours.... he/she logs in and after 1 hour logs out. But One day after User B is not able to log in as the time was calculated from the time, when user first logged in. Thanks. With Regards, Prabh -- Get your news at www.DailyHeadlines.NET

1 0

Re: sqlippool not working
by Peter Nixon 19 Sep '06

19 Sep '06

It turns out that sqlippool.conf was in the Makefile for 1.1.x but not for CVS head. It didnt affect us because we use an rpm. Guilherme can you please test a new cvs checkout? Also, because sqlippool is still experimental you need to explicitly enable it with ./configure --with-modules="rlm_sqlippool" Cheers Peter On Tue 19 Sep 2006 17:44, Tuyan Ozipek wrote: > Hi Peter, > > When i installed (compiled from source) the > freeradius-snapshot-20060918 tarball, the only missing thing was > the sqlippool.conf file (which i copied from some other test > environment). Since sqlippool module is not(yeah, we run it on > production happily for sometime..) considered stable yet, we do not > build it by default.(Lets check sqlippool.conf file installation in the > makefiles tho.) > > I am running it now on my development machine with no problems. > > The only thing possible is there is some type of typo in the config file > that Guilherme Franco is using. > > also, trace shows that there is no allocate-clear statement set for > sqlippool to use. > > > here is the allocate-clear statement that i used for my test.. > > allocate-clear = "UPDATE radippool \ > SET nasipaddress = '', pool_key = 0, callingstationid = '', \ > expiry_time = 'now'::timestamp(0) - '1 second'::interval \ > WHERE pool_key = '${pool-key}'" > > > > Regards > > On Tue, 2006-09-19 at 00:27 +0300, Peter Nixon wrote: > > ---------- Forwarded Message ---------- > > > > Subject: sqlippool not working > > Date: Mon 18 Sep 2006 23:40 > > From: "Guilherme Franco" <guilhermefranco(a)gmail.com> > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > > > Hi Peter, > > > > Like you told me before, you did some cleanups in the sqlippool.conf. > > > > Well, I've tried to install todays freeradius CVS, and it installed > > without the sqlippool module, don't know why. > > > > So, I've compiled it manually from > > freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ > > > > OK, but when I run radiusd -X, I got this in the end, regardless of my > > configuration in sqlippool.conf and radiusd.conf: > > > > Module: Loaded SQL IP Pool > > sqlippool: sql-instance-name = "sql" > > sqlippool: lease-duration = 86400 > > sqlippool: pool-name = "" > > sqlippool: allocate-begin = "BEGIN" > > sqlippool: allocate-clear = "" > > sqlippool: allocate-find = "" > > sqlippool: allocate-update = "" > > sqlippool: allocate-commit = "COMMIT" > > sqlippool: allocate-rollback = "ROLLBACK" > > sqlippool: start-begin = "BEGIN" > > sqlippool: start-update = "" > > sqlippool: start-commit = "COMMIT" > > sqlippool: start-rollback = "ROLLBACK" > > sqlippool: alive-begin = "BEGIN" > > sqlippool: alive-update = "" > > sqlippool: alive-commit = "COMMIT" > > sqlippool: alive-rollback = "ROLLBACK" > > sqlippool: stop-begin = "BEGIN" > > sqlippool: stop-clear = "" > > sqlippool: stop-commit = "COMMIT" > > sqlippool: stop-rollback = "ROLLBACK" > > sqlippool: on-begin = "BEGIN" > > sqlippool: on-clear = "" > > sqlippool: on-commit = "COMMIT" > > sqlippool: on-rollback = "ROLLBACK" > > sqlippool: off-begin = "BEGIN" > > sqlippool: off-clear = "" > > sqlippool: off-commit = "COMMIT" > > sqlippool: off-rollback = "ROLLBACK" > > rlm_sqlippool: the 'allocate-clear' statement must be set. > > > > It's not even trying to access the Oracle server. > > > > What can it be? > > > > Thanks! > > > > ------------------------------------------------------- -- Peter Nixon mailto:peter@suntel.com.tr Chief Technologist Suntel Communications http://www.suntel.com.tr TR tel:+902123369299 US tel:+13103177825 UK tel:+448700685002 VoIP sip:pbx@suntel.com.tr IM jabber:peter@suntel.com.tr Absolutum obsoletum. (If it works, it's out of date.) -- Stafford Beer -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 5

Matter of Life and Death - SQL and Proxy
by Guilherme Franco 19 Sep '06

19 Sep '06

Hello, I work in a Carrier and have an important question regarding SQL query check: I need to check a value in authorize_check_query (oracle-dialup.conf) to see if the user has paid his ADSL service. If he did paid the service, the request would be proxied to the ISP radius to authenticate the user, otherwise, the access needs to be rejected. So , the query would be checked like that: authorize_check_query = "SELECT id,UserName,Attribute,Value,op,PAID FROM ${authcheck_table} WHERE Username = '%{SQL-User-Name}' AND PAID = 'YES' ORDER BY id" The problem is, If PAID != YES, the user is not found by the SELECT (correctly) but the request is still proxied to the ISP (normal proxy behaviour). What can I do to reject the request and not proxy it? Please help! Thank you.

3 3

Authenticate users against the passwd module?
by Scott Lambert 19 Sep '06

19 Sep '06

I am trying to get the ability to authenticate users from a few different password databases on the same server. To that end, I have users in the FreeBSD system password database as well as in a Linux style shadow passwd file. >From a stock FreeRADIUS 1.1.2 radius.conf file have have done: modules { ... + passwd myshadow { + filename = /home/lambert/shadow.txt + format = "*User-Name:Crypt-Password::Group:::::" + # have also tried: + format = "*User-Name:User-Password::Group:::::" + # and supplied the crypted password as the users password + hashsize = 100 + authtype = PAP # have tried with and without + # ignorenislike = no + # allowmultiplekeys = no + } ... } authorization { ... # Read the 'users' file files + myshadow # # Look in an SQL database. The schema of the database ... } authentication { ... + Auth-Type any_is_ok { + myshadow { + reject = 1 + notfound = 2 + ok = return + } + unix + } - unix ... } I've tried to make simpler changes to the authentication section such as just adding "myshadow" on the line above the original "unix" entry. But the above is where I think I want to be. I got the above format from a suggestion which used multiple LDAP instances. The FreeBSD system users are able to authenticate. If I try to list my linux style shadow passwd file module "myshadow" in the authenticate{} section of radius.conf, radiusd -X bombs out with: ... Module: Instantiated mschap (mschap) Module: Loaded passwd passwd: filename = "/home/lambert/shadow.txt" passwd: format = "*User-Name:Crypt-Password::Group:::::" passwd: authtype = "PAP" passwd: delimiter = ":" passwd: ignorenislike = yes passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 9 keyfield 0(User-Name) listable: no Module: Instantiated passwd (myshadow) radiusd.conf: "passwd" modules aren't allowed in 'authenticate' sections -- they have no such method. radiusd.conf[1919] Failed to parse "myshadow" subsection. Maybe that's a bug in 1.1.2? I haven't tried 1.1.3 just yet. I'm trying to make the version in the FreeBSD ports collection work before I venture out on my own. If I have to go to 1.1.3, it won't break my heart. If I remove the "myshadow" reference from the authenticate{} section, the "myshadow" users are denied: modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_passwd: Added User-Password: 'sFE*/CZQF8saE' to config_items rlm_passwd: Added Group: '0' to config_items rlm_passwd: Adding "Auth-Type = PAP" modcall[authorize]: module "myshadow" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. I get the feeling that I don't understand how the rlm_passwd module is supposed to be used. I've read docs/rlm_passwd and most, if not all of the other stuff in the docs directory. I'm just missing something. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

2 3

FW: Proxy.conf
by Cliff Hayes 19 Sep '06

19 Sep '06

No reponse. Allow me to restate the question. There in instructions in radiusd.conf that say # To disable proxying, change the "yes" to "no", and comment the # $INCLUDE line. But, it appears that the $INCLUDE for proxy.conf is mandatory regardless of whether proxying is done because it contains the realms. If so, that is an error in the instructions. If not, then I'm missing something and would like to know because I am not proxying. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Cliff Hayes Sent: Monday, September 18, 2006 3:49 PM To: FreeRadius users mailing list Subject: RE: Proxy.conf Ok. Thanks. I'm trying to learn. The instructions in radiusd.conf say the following: # To disable proxying, change the "yes" to "no", and comment the # $INCLUDE line. Here's the issue -- how can I comment out the include line if that is what causes my problem. I want to disable proxying. I thought, since that was in the instructions, there must be some other place to put realm info. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Alan DeKok Sent: Monday, September 18, 2006 1:20 PM To: FreeRadius users mailing list Subject: Re: Proxy.conf "Cliff Hayes" <chayes(a)afo.net> wrote: > When I comment out the include line for proxy.conf, my users can no longer > authenticate. The logs show their entire username + realm instead of just > the username. I figure it is because it can't strip the realm anymore > because it doesn't know what the realm is. Exactly. > There are REALM sections in the proxy.conf, with type, authhost, and > accthost statements. I have entries there for each of my realms. I have > not found an equivalent to the REALMS section of proxy.conf in MySQL. Do I > use the radgroupcheck table? If so, do I add the authost and accthost > lines? You can't put the REALMS into SQL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Conditionally adding reply pair
by Garber, Neal 19 Sep '06

19 Sep '06

I need to conditionally add a reply pair based upon Huntgroup-Name and a custom attribute. Pseudocode follows for what I'm trying to accomplish: If Huntgroup-Name == NetSensory then if LDAP-Group-Requirement == "NP-Admin" then pairadd(reply, NetSensory-Permission, "npadmin") Elsif LDAP-Group-Requirement == "NP-Read" then pairadd(reply, NetSensory-Permission, "npread") Elsif LDAP-Group-Requirement == "NP-Insight" pairadd(reply, NetSensory-Permission, "insight") Endif Endif I thought about using an external program (e.g., Perl module) in post-auth to accomplish this. Is this reasonable or is there a better way?

2 1