January 2007 - Freeradius-Users - lists.freeradius.org

0.9.3 > 1.1.0 sql errors
by Andrew Long 04 Jan '07

04 Jan '07

I am trying to get a second server (ver. 1.1.0) running mostly on the configs from an older (0.9.3). The sql tables are identical (except for some ip changes) and the radiusd.conf, sql.conf, etc are identical except for small details particular to system (I hope). When I point an NAS (Colubris CN3000) to the new server, it authenticates, but we get error: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'hawth_cn3000' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql: Failed to create the pair: Unknown value Administrative for attribute Service-Type rlm_sql (sql): Error getting data from database And... only one A-V pair is sent along... Sending Access-Accept of id 187 to 204.95.127.xxx port 2048 Colubris-AVPair = "login-url=http://64.69.121.xxx/hotspots/hawthorn/login.html?loginurl=%l" with this in the colubris log... At least one required internal page was not retrieved - Keeping previous set of internal pages. I have run the query on the old server and the results are the identical set. When authenticating to the old server, no errors result and all A-V pairs are sent along... Any hints? Andrew -- Regards, Andrew Long Network Support Specialist EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 ****** CONFIDENTIALITY NOTICE ****** NOTICE: This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system. Thank you.

2 1

RE: How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 04 Jan '07

04 Jan '07

Thanks. Got it working. Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Wednesday, January 03, 2007 9:58 AM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > Well here is where I am. > > I am using PAM. Yes, you've said that lots. And it has nothing to do with user names, grouping, or RADIUS client devices. It's completely irrelevant to the problem at habd. > All I need to pull all the pieces together is one simple example of > what has to be done to do the following: user1 and user2 can access > devices 10.1.1.1, 10.1.1.2, and user3 can access only 10.1.1.3. > ************* > > Here is where I am. To turn on rlm_passwd, I think, you have to goto > radiusd.conf and create a passwd entry say passwd My_group { > filename = ${raddbdir}/My.group > format "=Group-Name:*,User-Name" No, the Group and Group-Name attributes are for Unix groups. The documentation for rlm_passwd says specifically that you need to create a different attribute. > authtype = PAM (I hope I can auth via PAM since that is how my > security is tailored) You don't need that line. Delete it. > Next, you have to add it to the dictionary ... My_group? No. > Then, I was thinking I could use the huntgroups and add a entry called > admin and ops. The huntgroup would include multiple entries If you're going to use huntgroups, then you don't need to use rlm_passwd, but you do need extra entries in the "users" file... as documented in the "huntgroups" file itself. > huntgroups > > admin NAS-IP-Address = 10.1.1.1 > admin NAS-IP-Address = 10.1.1.2 > User-Name = user1, > User-Name = user2 > ops NAS-IP-Address = 10.1.1.3 > User-Name = user3 You should use the same huntgroup name for them all. > Finally, if I am at least close, I am not entirely clear how to setup > the USERS file for > user1 and user2 and user3. You don't. As per the documentation in the "huntgroups" file, you can match a huntgroup by doing: DEFAULT Huntgroup-Name == "admin" If you read the FAQ, there is an example of rejecting a user based on certain criteria. With a little bit of putting the pieces together, the following should work: DEFAULT Huntgroup-Name != "admin", Auth-Type := Reject Which will reject everyone who doesn't match the criteria in the huntgroups file. If you want something more complicated, you will need a more complicated configuration. Part of the issue is that there is no one place which will give you the exact configuration you need to solve the problem. Instead, the documentation describes how to solve problems, and it's up to you to put the pieces together. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 03 Jan '07

03 Jan '07

Well here is where I am. I am using PAM. All I need to pull all the pieces together is one simple example of what has to be done to do the following: user1 and user2 can access devices 10.1.1.1, 10.1.1.2, and user3 can access only 10.1.1.3. ************* Here is where I am. To turn on rlm_passwd, I think, you have to goto radiusd.conf and create a passwd entry say passwd My_group { filename = ${raddbdir}/My.group format "=Group-Name:*,User-Name" authtype = PAM (I hope I can auth via PAM since that is how my security is tailored) delimiter = ":" Next, you have to add it to the dictionary ... My_group? Then, I was thinking I could use the huntgroups and add a entry called admin and ops. The huntgroup would include multiple entries huntgroups admin NAS-IP-Address = 10.1.1.1 admin NAS-IP-Address = 10.1.1.2 User-Name = user1, User-Name = user2 ops NAS-IP-Address = 10.1.1.3 User-Name = user3 Next, in the My.group file I would put "admin:user1,user2" and on the next line "ops:user3" Finally, if I am at least close, I am not entirely clear how to setup the USERS file for user1 and user2 and user3. Can I use the following: user1 My_group == "admin" ??? (this would add admin to my custom group for user1??) Then, how do I map user1 with My_group "admin" to the admin huntgroup? Or do I just insert a DEFAULT entry at the bottom and include huntgroup-name == admin ??? Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Tuesday, January 02, 2007 4:12 PM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > I have looked it over, but I am still not clear. What *exactly* about the documentation is not clear? You can use rlm_passwd to make a group of anything you want. > I was thinking that I > could use huntgroups to map devices to specific groups, but then I am > not clear on how to restrict users ('users' file) to those groups. The FAQ has an example of limiting users to groups. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

My AP does accountig but radwho doesn't work..
by adreas Polyxronopoulos 03 Jan '07

03 Jan '07

Hi list, I am trying to work the radwho command but i get this error : radwho: Error reading /usr/local/var/log/radius/radutmp: No such file or directory My AccessPoint (3com 7250) has the accounting option i have set it enable and i have detail files in /usr/local/var/log/radius/radacct/10.0.0.10 . In my radiusd.conf : radutmp { filename = ${LOGDIR}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = yes } accounting { detail radutmp } session { radutmp } ----- and when running radiusd -X : .............. Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes .... Module: Instantiated radutmp (radutmp) thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

RE: How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 02 Jan '07

02 Jan '07

I have looked it over, but I am still not clear. I was thinking that I could use huntgroups to map devices to specific groups, but then I am not clear on how to restrict users ('users' file) to those groups. I know this has probably been done most everywhere in one form or another. Any examples that show the actual entries in the approp. files? Thanks, Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Tuesday, January 02, 2007 9:43 AM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > I am using PAM for Auth-Type. > I want to be able to either 1) restrict the devices the user has > access to (admins,operators, etc) by username and/or 2) preferably > carve into groups my network gear/NAS devices and then assign users to groups. See "man rlm_passwd". It's documentation describes how to create groups like this. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Status of my book
by Alan DeKok 02 Jan '07

02 Jan '07

It's January, so the book obviously hasn't met my target of being finished by December. The good news is that I have over 100 pages of content, and I recently entered an agreement with a partner that will give me access to additional networking equipment, which should help expand the content to include configuration for many common clients. However, I'm in the middle of moving 6000 km, so I'm a little busy. I expect to be able to start working on the book again in a month or so. Thanks to everyone who's emailed to inquire about the book, or offer help. That has given me incentive to push hard to finish it ASAP. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 1

radiusd command line parameters?
by Eduardo Costa Lisboa 02 Jan '07

02 Jan '07

Hi all. I would like to know where can I find a list of the parameters used by radiusd. I looked all over the wiki FAQ and the documentation under /usr/share/doc/freeradius-1.0.1 and couldn't find any mention to it. Attentiously, -- Eduardo Costa Lisboa

2 2

How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 02 Jan '07

02 Jan '07

I am using PAM for Auth-Type. I want to be able to either 1) restrict the devices the user has access to (admins,operators, etc) by username and/or 2) preferably carve into groups my network gear/NAS devices and then assign users to groups. Simply put, I would like to know what I have to do for user1 and user2 that auth via PAM to limit the NAS/Network gear they are allowed to access/authenticate against....I am looking for one straight for example. I would like user1 to be able to access device 10.1.1.1 and user2 to be able to access 10.1.1.2 and 10.1.1.3 and 10.1.1.4..... Thanks, Scott

2 1

Radrelay: Zero Session length packets
by Etienne Pretorius 02 Jan '07

02 Jan '07

Hello everyone. I've been going a bit mad on this subject for a while. I am receiving proxied requests from my upstream provider and I am also doing authentication locally. The issue I've been experiencing has to do with this error handed to me from my upstream provider : Tue Jan 2 09:47:05 2007 : Error: rlm_sql: Stop packet with zero session length. (user 'celliott@<snip>', nas 'XXX.XXX.XXX.XXX') It seems that this is always the second ISDN connection that has its session time set to zero. Thu Dec 21 23:08:02 2006 Acct-Session-Id = "00009F8B" Framed-Protocol = PPP Acct-Authentic = RADIUS X-Ascend-Connect-Progress = Call-Up X-Ascend-PreSession-Time = 1 X-Ascend-Xmit-Rate = 64000 X-Ascend-Data-Rate = 64000 Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 X-Ascend-Pre-Input-Octets = 233 X-Ascend-Pre-Output-Octets = 102 Acct-Input-Packets = 0 Acct-Output-Packets = 0 X-Ascend-Pre-Input-Packets = 6 X-Ascend-Pre-Output-Packets = 4 Acct-Terminate-Cause = Port-Unneeded X-Ascend-Disconnect-Cause = No-Reason Acct-Status-Type = Stop User-Name = "celliott@<cut>" Acct-Multi-Session-Id = "00005D0F" X-Ascend-Multilink-ID = 23823 Acct-Link-Count = 2 X-Ascend-Num-In-Multilink = 2 Framed-IP-Address = XXX.XXX.XXX.XXX NAS-Port = 20423 NAS-Port-Id = "Serial7/4:23" NAS-Port-Type = ISDN Calling-Station-Id = "0217624546" Connect-Info = "64000 HDLC" Called-Station-Id = "0000" Service-Type = Framed-User NAS-IP-Address = XXX.XXX.XXX.XXX Acct-Delay-Time = 30 Vendor-1431-Attr-1 = 0x4449414c Proxy-State = 0x3936 Client-IP-Address = QQQ.QQQ.QQQ.QQQ Hint = "KING" Acct-Unique-Session-Id = "2b29fa83d47585d9" Timestamp = 1166735282 What I would like, is to avoid radrelay for those packets as it only jams up the radrelay queue when this happens while the logging to sql works. The config below is insuffiecient as this is what leads me up to a radrelay jam. [root@CCCCC:/var/log/freeradius/radacct] ls -hal total 6.4M drwxr-xr-x 2 freerad freerad 120 2006-12-21 23:08 . drwxr-xr-x 3 freerad freerad 872 2006-12-31 06:30 .. -rw------- 1 freerad freerad 6.3M 2007-01-02 08:45 detail-radrelay -rw------- 1 freerad freerad 1.2K 2006-12-21 23:08 detail-radrelay.work BTW is there a way to specify an OR / AND operator below for acct_users? So that I can say something like DEFAULT [ Client-IP-Address == "XXX.XXX.XXX.XXX" || Client-IP-Address == "YYY.YYY.YYY.YYY" || Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ" && Acct-Session-Time == "0" ] , Acct-type := "REMOTE-AUTH" *acct_users* # Do not radrelay these packets: DEFAULT Acct-Session-Time == "0", Acct-type := "REMOTE-AUTH" # This Configuration prevents Accouting loops of a two-way radrelay sync # [o] Radrelay must be sending accounting info from IP(s) below # on the other Radius server(s) DEFAULT Client-IP-Address == "XXX.XXX.XXX.XXX", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "YYY.YYY.YYY.YYY", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ", Acct-type := "REMOTE-AUTH" # Everyone else must still be radrelay'ed DEFAULT Acct-type := "LOCAL-AUTH" *radiusd.conf* accounting { # 2006-09-27: EPP # If Acct-Type is LOCAL-AUTH then log to sql module AND to detail file # for radrelay - accounting sync daemon Acct-Type LOCAL-AUTH { radrelay sql } # 2006-11-24: EPP # If accounting packet is from one of our other radius servers, then # just log it to sql...otherwise we will end up with an Accouting packet # storm/loop. Acct-Type REMOTE-AUTH { sql } [snip...] -- Kind Regards Etienne

2 1

RE: problem with NT-Password and LDAP
by Ana Gallardo Gómez 02 Jan '07

02 Jan '07

---------------------------------------- > Date: Thu, 28 Dec 2006 08:44:22 -0800 > From: aland(a)deployingradius.com > To: freeradius-users(a)lists.freeradius.org > Subject: Re: problem with NT-Password and LDAP > > Ana Gallardo Gómez wrote: > > > Well, I can not modify the LDAP server, I only can use it, > > so, while I ask the LDAP administrator to modify this atribute, > > I would like to modify in Freeradius server. > > OK, use the "perl" module to re-write the attribute. There is an > "example.pl" distributed with the server that should be a good start. > > Alan DeKok. > -- I'm goint to use the "perl" module, but first, and while I learn to use it, I probed the attr_rewrite module: attr_rewrite quitar_espacios { attribute = NT-Password # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = config searchfor = " " replacewith = "" ignore_case = no new_attribute = no max_matches = 220 ## If set to yes then the replace string will be appended to the original string append = no } I don't know if I can use regular expressions in "searcfor" field, and, in this case, what is the regular expressions grammar; or if is better with "max_matches = 220 and searchfor = " ""... I use this module in authorize section: authorize { preprocess suffix files Autz-Type LDAP_LOCAL{ ldap_local } Autz-Type LDAP_UNEX_ES{ ldap_unex_es quitar_espacios } mschap eap } and I can authenticate users: rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_unex_es" returns ok for request 7 radius_xlat: ' ' rlm_attr_rewrite: Changed value for attribute NT-Password from '06B11E3D941021E1A5C51C6868F2F0E6 ' to '06B11E3D941021E1A5C51C6868F2F0E6' modcall[authorize]: module "quitar_espacios" returns ok for request 7 modcall: leaving group LDAP_UNEX_ES (returns ok) for request 7 Thank you _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

1 0