January 2007 - Freeradius-Users - lists.freeradius.org

Daily Accounting - 3 days account?
by liran tal 14 Jan '07

14 Jan '07

Hey everyone, I've seen that there's a Max-All-Session, Daily, Weekly and Monthly even. I need to limit the user for a 3days period. How do I accomplish that? Thank you. Liran.

2 3

My Dictionaries seem corrupted
by Evan Vittitow 14 Jan '07

14 Jan '07

Working Dictionaries requested. Anyone with known working dictioniaries?

4 4

Radius Server refusing to MS-CHAP
by Evan Vittitow 14 Jan '07

14 Jan '07

This is the configuration producing the MS-CHAP issue. No matter what I do, it wants to use CHAP instead of MS-CHAP radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = /var/log/radius raddbdir = /etc/raddb radacctdir = /var/log/radius/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radius group = radius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = no require_strong = no } ldap { server = "kurama.pukey" identity = "cn=Manager,dc=pukey" password = password basedn = "dc=pukey" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.101.1 range-stop = 192.168.101.99 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess ldap mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql } session { radutmp } post-auth { sql } pre-proxy { } post-proxy { eap } users DEFAULT Auth-Type := MS-CHAP Fall-Through = 1 ldap.attrmap # # Mapping of RADIUS dictionary attributes to LDAP directory attributes # to be used by LDAP authentication and authorization module (rlm_ldap) # # Format: # ItemType RADIUS-Attribute-Name ldapAttributeName # # Where: # ItemType = checkItem or replyItem # RADIUS-Attribute-Name = attribute name in RADIUS dictionary # ldapAttributeName = attribute name in LDAP schema # # If $GENERIC$ is specified as RADIUS-Attribute-Name, the line specifies # a LDAP attribute which can be used to store any RADIUS # attribute/value-pair in LDAP directory. # # You should edit this file to suit it to your needs. # checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem SMB-Account-CTRL-TEXT sambaAcctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } clients.conf #client some.host.org { # secret = # shortname = localhost #} # # You can now specify one secret for a network of clients. # When a client request comes in, the BEST match is chosen. # i.e. The entry from the smallest possible network. # #client 192.168.0.0/24 { # secret = testing-1 # shortname = private-network-1 #} # #client 192.168.0.0/16 { # secret = testing-2 # shortname = private-network-2 #} #client 10.10.10.10 { # # secret and password are mapped through the "secrets" file. # secret = testing # shortname = liv1 # # the following three fields are optional, but may be used by # # checkrad.pl for simultaneous usage checks # nastype = livingston # login = !root # password = someadminpas #} I've removed passwords. /etc/ppp/opions.pptpd lock nobsdcomp nodeflate mtu 1000 mru 1000 debug auth -chap -mschap +mschap-v2 plugin radius.so plugin radattr.so

4 12

RE: FreeRadius IRC...
by Thibault Le Meur 13 Jan '07

13 Jan '07

> The issue is, I've done everything, a semi-competent Linux user with > Critical thinking skills should do, I've been methodical. asnd > disciplined and persistent. Yet still, I cannot succeed at this. This > will make my University Career look bad. I just think I could use > another pair of eyes, maybe I missed something. > > I feel like Edward Elric searching for the Philosopher's stone. I posted an idea and you decided not to reply to my questions ! I suspect that your VPN server doesn't know Microsoft Radius attributes and refuses to send them to the radius server. I've tested a bad setup (lack of Microsoft radius dictionary), and I get the same radiusd -X debug log: no MS-CHAP Challenge in the request... I asked "have you checked possible error messages in /var/log/messages " on the vpn server ? To be more specific, look for the following lines in you log file: " rc_avpair_new: unknown attribute" If you see such lines it might be that your radiusclient library (used by the PPPd plugin on your VPN server) doesn't understand the Microsoft attributes (for instance the MS-CHAP Challenge). Thus, the PPPd radius plugin doesn't send these attributes that are required for Freeradius to do MS-CHAP authentication. Could you really check that your dictionnary file on the VPN server side contains a line like: INCLUDE /usr/share/radiusclient-ng/dictionary.microsoft and check the content of this file... HTH, Thibault

2 2

MySQL authentication problem
by Ian Truelsen 13 Jan '07

13 Jan '07

radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Dec 26 2006 at 01:46:55 mysql Ver 14.12 Distrib 5.0.30, for pc-linux-gnu (i686) using readline 5.2 I thought that I had everything configured properly for MySQL authentication, but when I try to do a test with radtest, the test user is not authenticated and there is no log of activity to the MySQL database. Anyway, here is the output of radiusd -X and, at the end, the population of my database: rad_recv: Access-Request packet from host 192.168.182.1:2053, id=7, length=55 User-Name = "ian" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ian", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ian' rlm_sql (sql): sql_set_user escaped user --> 'ian' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ian' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ian' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect: [ian/test] (from client brentwood port 1812) Delaying request 0 for 1 seconds Finished request 0 mysql> select * from radcheck -> ; +----+----------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-------+ | 1 | Password | == | te | | | 2 | ian | Password | == | test | +----+----------+-----------+----+-------+ 2 rows in set (0.01 sec) Any thoughts on why this is not working would be greatly appreciated. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

4 14

lookingfor some information to test a dictonary rules
by Cameron Cowie 13 Jan '07

13 Jan '07

Hi all: I am running freeradius on ubuntu I was looking for a way to limit bandwith, I thought I found it buy createing a dictionary rule set for the wireless kit I am use. heres is a snip of what I am doing I created the proxim.dictionary in /usr/share/freeradius # Proxim dictionary # VENDOR Proxim 841 BEGIN-VENDOR Proxim ATTRIBUTE Proxim-Input-Limit 1 integer ATTRIBUTE Proxim-Uplink-Limit 1 integer ATTRIBUTE Proxim-Output-Limit 2 integer ATTRIBUTE Proxim-Downlink-Limit 2 integer END-VENDOR Proxim and put the limits in with the user files. --------------------------------------------------------------------------------- 0012cf-016942 Auth-Type := Accept Proxim-Input-Limit = 128, Proxim-Output-Limit = 64 --------------------------------------------------------------------------------- for what I can tell it all works. when running tests from a proxim subsubscriber unit it looks like the bandwidth restrictions don't take place. Now do I have to tell it 128k instead of just useing 128? Both types work. Or do I have to use the uplink and downlink instead or with the input/output? Or are my setting right and I need to look elsewhere for an answer? Any help would be greatly appreciated. Cameron

3 2

FreeRadius IRC...
by Evan Vittitow 13 Jan '07

13 Jan '07

Do you folks ever show up on Freenode's #FreeRadius channel?

3 3

CHAP with crypt
by Evan Vittitow 13 Jan '07

13 Jan '07

When using OpenLDAP, is there a way to make CHAP work without storing passwords as clear text/

2 1

Re: freeradius-1.1.3 + snmp...
by adreas Polyxronopoulos 12 Jan '07

12 Jan '07

Hi Kevin and thanks for your time, - "In your snmpd.conf file, do you have a line that looks like the following? smuxpeer .1.3.6.1.4.1.3317.1.3.1 public " + No i hadn't in my snmpd.conf a line like the follwing : smuxpeer .1.3.6.1.4.1.3317.1.3.1 public However when i add the line in my snmpd.conf at a random place in the file i got the same output. Do i have to write it in a specific place in the snmpd.conf ? - "Are there any errors in your log files that might indicate a problem with your snmpd config? " + I checked the radiusd.log but nothing useful. - "Does freeradius exit without error or do you press Ctrl-C to kill it? " + No my freeradius exits without error and i don't press Ctrl-C to kill it. Adreas Polyxronopoulos ----- Original Message ---- From: Kevin Bonner <keb(a)pa.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, 12 January, 2007 6:43:04 PM Subject: Re: freeradius-1.1.3 + snmp... On Friday 12 January 2007 11:13, adreas Polyxronopoulos wrote: > I have configured the radiusd.conf to support snmp > and in snmp.conf i have set the community string to public as it is in > snmpd.conf. In your snmpd.conf file, do you have a line that looks like the following? smuxpeer .1.3.6.1.4.1.3317.1.3.1 public Are there any errors in your log files that might indicate a problem with your snmpd config? > However when i am running freeradius in debugging mode : > radiusd -X , i get the following output and the freeradius does not start. > Why is that happening ? When i configured the radiusd.conf without snmp > everything works perfect. Does freeradius exit without error or do you press Ctrl-C to kill it? Kevin Bonner - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________ New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

2 1

RE: MySql and calling-station-id help please
by Ackbar Joolia 12 Jan '07

12 Jan '07

Kevin, Password is working fine. I have tried almost all the operators and none is doing the job for me. I wonder whether the logic I am using is good or not? Al -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalmetering.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalmetering.com@lists.freeradius.org] On Behalf Of Kevin Bonner Sent: 12 January 2007 16:29 To: FreeRadius users mailing list Subject: Re: MySql and calling-station-id help please On Friday 12 January 2007 10:19, Ackbar Joolia wrote: > > See the FAQ about "it doesn't work". > > > > Also, try posting pieces of your current config. What you want isn't > > hard to do, but we have no idea what your configuration is, so it's > > impossible to say what is going wrong. > > > > Alan DeKok > > Alan, > > Where is the “it doesn’t work” faq? http://wiki.freeradius.org/FAQ#It_still_doesn.27t_work.21 > Radcheck table > -------------------------- > UserName | Attribute | op | Value > User1 | Password | == | pass1 Operator should be :=. Attribute should be User-Password (or Cleartext-Password depending on your freeradius version), but Password should be fine for your tests. > Radgroupcheck > -------------------------------- > GroupName | Attribute | op | Value > Group1 | Calling-Station-Id | := | 123456 > Group2 | Calling-Station-Id | := | 345677 The operator is incorrect. := sets the attribute to that value. See the Operators page in the wiki or "man 5 users" for more info on operator behavior. Kevin Bonner *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

1 0