January 2007 - Freeradius-Users - lists.freeradius.org

call for help
by Andrew Long 08 Jan '07

08 Jan '07

I may need some consulting if someone is willing. We have freeradius 0.9.3 running on RHE 6, and need to move the server to a new ip address. I have been trying to get things rolling on a second server running 1.3, but cannot get it right so far (NAS's authenticate but our wireless clients do not authenticate to the nas). I would prefer to build a new 1.4 server. System is chap, using mysql. I have all the 0.9.3 configs and tables. I will say up front that I would prefer to do this myself but seem to need a little more help than is possible or efficient via the list. If someone would consider making themselves available via telephone or chat for a tutelage, great; If $ is required, we can discuss that. Please email off-list if you would consider. -- Regards, Andrew Long Network Support Specialist EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 ****** CONFIDENTIALITY NOTICE ****** NOTICE: This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system. Thank you.

1 0

Can't access Internet?
by Tim Tyler 08 Jan '07

08 Jan '07

FreeRadius experts, We are trying to run FreeRadius on a RedHat AS 2.1 system. We use an external password file for authentication defined in the unix system (password = filename) section of radius.conf. This seems to work fine. Modem users can authenticate to our old 3com Total Control modem pool, but users can not access the Internet. They can access all local domain servers on campus, but they can't get off campus. This really should not be a firewall issue as the same ip addresses are still associated with the modem pool. Note: if we go back to our old Lucent Technology radius server running on AIX, everybody is fine and can access the Internet again. I am trying to find out what might cause a modem pool to only work locally (access servers on our campus) after switching to FreeRadius particularly since it seems that the authentication part is working? I know that the 3com Total Control modem pool is rather old but I don't know why it would behave differently from one radius server to another as long as authentication works. I read in one of the FreeRadius archives that some users have experienced a similar problem of either very slow or won't work at all for some customers accessing the Internet via Freeradius authentication until they modified the MTU setting. This is curious to me. Is there a place in FreeRadius that I might change the mtu setting given that I am using an external unix password crypt file for all authentication? If so, what mtu setting might be recommended? Is there another possible explanation that might relate to Freeradius? any thoughts are much appreciated? Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

3 2

MySql and calling-station-id help please
by Ackbar Joolia 08 Jan '07

08 Jan '07

Dear all, I want to do authentication based on calling-station-id and then to assign a static IP from my database to that requester. SO basically, all the requests coming in will have the same username and password, and I will only identify each of them through their calling-station-id, and then assign a Framed-IP-Address to them. I cannot get the above to work at all, can anyone please give me an idea of how to do the above? Thanks Al -- Internal Virus Database is out-of-date. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.15.29/607 - Release Date: 28/12/2006 12:31

3 2

Authomated Access Accept/Deny
by Tamba Ben-Jusu 08 Jan '07

08 Jan '07

Hi All, I am running the freeradius server on an ubuntu server platform and it is running fine. However, I want to include a time factor in the operations: Users to be set in the following groups 1. Grant Access-Accept only between 8am to 6pm every day 2. Grant Access-Accept only between 6pm to 8am every day 3. Grant Access-Accept only weekends etc Please help me with information on how to set it up in the users file, other means of achieving this. Thanks Tamba -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.7/619 - Release Date: 07/01/2007 18:29

3 2

overwriting ldap radiusprofile according to realms?
by Markus Krause 08 Jan '07

08 Jan '07

Hi list, we are storing our user data in openLDAP with a radiusProfileDN attribute, which is sent back by the freeradius server (v.1.1.3, on SLES10) as expected. The profile contains information for the vlan of user. We now would like to have the possibility to let the user login in a special vlan (the "internetcafe") and thought of doing this with realms, which means the user has to login with "username" or "username@ic", setting the following in the users file: ---- /etc/raddb/users DEFAULT User-Name =~ "@ic$", User-Profile := "cn=InternetCafe,ou=Netconfig,o=Test" ---- This works if the users has no radiusprofileDN stored in LDAP, but if he has such an attribute the profile data from the user is used, not the "cn=InternetCafe". How can I overwrite the value for radiusprofiledn if the user appends "@ic" to this username? Or is there a better way to achieve this (changing the profile data / vlan according to login)? Thanks in advance for any help! Reagards Markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0

Strip @domain.com before auth.
by Shaun Medvec 07 Jan '07

07 Jan '07

Hi, Currently, I am accepting users with and without a realm name. I am satisfied with the acceptance of users without a realm name, but not with users that do have the realm name. I do have set up in my proxy.conf to accept the realm as so: realm domainexample.com { type = radius authhost = LOCAL accthost = LOCAL } This lets me authenticate against the same user base as users that dont include the @domain.com in their user name. My problem is this. I would to strip the @domain from the username before the authentication takes place? how and where is this done? Thank you in advance.

2 2

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 07 Jan '07

07 Jan '07

Hi everyone Merry Christmas and a Happy new year , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install). My wireless supplicant is on windows xp SP2. I use users file for authentication . I will show you the radiusd -X output and the freeradius behavior when the supplicant tries to connect to the wlan: root@apolyxrono2:~# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.0.15:1812 Listening on accounting 10.0.0.15:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.10:3794, id=160, length=132 NAS-IP-Address = 10.0.0.10 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "someone" Calling-Station-Id = "00166f122595" Called-Station-Id = "000d545c4190" NAS-Identifier = "3Com Access Point" EAP-Message = 0x0201000c01736f6d656f6e65 Message-Authenticator = 0x160e121c6c28afb7f18ee9f0862390d0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry someone at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 160 to 10.0.0.10 port 3794 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 160 with timestamp 4596dbfe Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 10.0.0.10:3791, id=45, length=166 Acct-Status-Type = Start Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9" NAS-IP-Address = 10.0.0.10 Acct-Input-Octets = 198 Acct-Output-Octets = 122 Acct-Input-Packets = 3 Acct-Output-Packets = 3 User-Name = "not available" Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x4553534944203d206d794170 Vendor-Specific = 0x45415020547970652069733a206e6f7420617661696c61626c65 Acct-Session-Time = 26 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 10.0.0.10,NAS-IP-Address = 10.0.0.10,Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9",User-Name = "not available"' rlm_acct_unique: Acct-Unique-Session-ID = "11a74fb405c72016". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "not available", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns noop for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'not available' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 45 to 10.0.0.10 port 3791 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 45 with timestamp 4596dc07 Nothing to do. Sleeping until we see a request. .............................. Why the authentication of "someone" user failed ? What does it means : module "mschap" returns noop for request 0 ? Is it important debug info ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: 0.9.3 > 1.1.0 sql errors
by Long 06 Jan '07

06 Jan '07

3 "invalid operator" messages from debug mode... 3 lines in the hints file with the Suffix attribute. I think we have a winner. See 'man 5 users' or the Wiki Operators page to see why that is invalid. I think the hints file in the latest release (1.1.4) has correct defaults. -Kevin Sure 'nuf, things are changed here. >From the 1.1.4 hints file... 37:DEFAULT Suffix == ".ppp", Strip-User-Name = Yes 42:DEFAULT Suffix == ".slip", Strip-User-Name = Yes 47:DEFAULT Suffix == ".cslip", Strip-User-Name = Yes why doesn't 0.9.3 yield errors when the operator is wrong? - Andrew

2 1

How to proxy to multiple accounting hosts not using load balancing
by Rene 05 Jan '07

05 Jan '07

Hello all, I am trying to proxy/relay accounting records I receive on my Radius server to two remote Radius servers. I don't want to use load balancing, so both remote Radius servers should get the proxied/forwarded records. Questions: how can this be done? I checked the proxy.conf file, but it looks that you can do only load balancing and that's not what I want. I use FreeRadius version 1.0.2 Thanks, Rene

3 2

how to log Disconnects/Stop (Acct-Status-Type)
by Adrian 05 Jan '07

05 Jan '07

Hello Everyone, We recently moved from Merit Radius to Freeradius (1.0.4). Everything works great however we want to log Stop/Alive packets (the Acct-Status-Type request) to the radius.log as we did before. Right now this information is only logged to the detail file. With Merit Radius we were able to see when a client disconnected in the regular log file and with Freeradius we only see the Auth Login OK messages but no disconnects. Is there an easy way to log the Acct-Status-Type to the radius.log file also? Much appreciated, Adrian

3 4