January 2007 - Freeradius-Users - lists.freeradius.org

Splitting the password field in freeRADIUS
by Drumm, Daniel 24 Jan '07

24 Jan '07

As some of you may know, RSA SecurID servers now support RADIUS. The Auth Manager comes with the Funk RADIUS sever embedded into it, and supports a number of auth types, including EAP-OTP as well as the usual types such as CHAP. Is it possible to front end this type of server with FreeRADIUS, so that NAS-Clients can send a tokencode prepended to, say, a Kerberos password - and have the FreeRADIUS server forward the first 6 digits of the field to the RSA server for tokencode validation - and the remaining charcters to another RADIUS server, one that front-ends a Kerberos system? Only when both fields return true is the authentication true. Is this possible? I was looking at the various scripting options in radius.conf, and don't know of anyone who has done this. Or if it can be done. Thank you. Dan. # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files }

4 3

post-proxy section and local proxy
by Markus Krause 24 Jan '07

24 Jan '07

Hi List, i am still stuck in the problem on how to overwrite replies from freeradius to a nas depending on realms (see http://marc.theaimsgroup.com/?l=freeradius-users&m=116824114228037&w=2 and http://marc.theaimsgroup.com/?l=freeradius-users&m=116903668505574&w=2) and trying different things to solve this (i got no repsonses so far which, of course, is not a complaint! maybe i am asking the wrong or a too dump question ...) i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf) the section "post-proxy", which contains "attr_filter", is _not_ processed. If i am using a "real" proxy (authhost = anotherradius:1812) "attr_filter" does what i want it to do, it replaces some reply-attributes (for VLAN in my case). Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?) Or does someone know a better solution for my problem? Thanks in advance for any help! Regards markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4

log failed logins
by Cory Robson 24 Jan '07

24 Jan '07

I have the following sql in my sql conf file and this is working. My only gripe is if there is no info provided then what gets placed in the log. It appears in the case of User-Password that a default of Chap-Password is entered as per below. Does anyone have a list of attributes I can log on failed attempts and the structure for the SQL statement. Eg %{reply:Reply-Message} quite often gives me "=5Cr=5CnYou are already logged in - access denied=5Cr=5Cn=5Cn" whereas I obviously only need the statement you are already logged in. I assume that an attribute followed by :- means to place what follows in the event of no data provided. Looking for lots of clarification here. postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date, callingid) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Reply-Message}', NOW(), '%{Calling-Station-Id}')" Thanks Cory

3 3

RE: a freeradious/wireless solution for a school
by Josh Howlett 24 Jan '07

24 Jan '07

(I'll bite to save Alan the déjà vu) An attacker sets up a captive portal system that looks exactly the same as yours (spoof). Users can't distinguish between the two captive portals, and so some users inevitably enter their credentials into the spoof portal. These credentials can be used by the attacker to gain network access through the authorised portal, or whatever else they're authorised for. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Tas Dionisakos > Sent: 23 January 2007 21:55 > To: FreeRadius users mailing list > Subject: Re: a freeradious/wireless solution for a school > > Please elaborate on how the system can be circumvented? > > Tas. > > A.L.M.Buxey(a)lboro.ac.uk wrote: > > Hi, > > > > > >> * Apache > >> * Freeradius > >> * Chillispot > >> * Mysql > >> > > > > though note that captive portals are easy to mitigate/spoof and > > circumvent > > > > alan > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > -- > ************************************* > Tas Dionisakos > IT Manager > St Mary's College and Newman College > The University of Melbourne > T: 03 9342 1708 > M: 0439 655 565 > E: tas(a)newman.unimelb.edu.au > C: (0o (||||)(||||) o0) > ************************************* > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Can't start FreeRadius after 1st installation
by Tek Bahadur Limbu 23 Jan '07

23 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, I am very new to FreeRadius. Just today, I have installed FreeRadius 1.13 from FreeBSD 6.0 (i386) ports. I am following this material from: http://www.onlamp.com/pub/a/onlamp/excerpt/radius_5/index1.html However when I try to start it using: radiusd -X, I get the following errors: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Segmentation fault: 11 (core dumped) Can somebody shed some light on this issue? - -- With best regards and good wishes, Yours sincerely, Tek Bahadur Limbu (TAG/TDG Group) Jwl Systems Department Worldlink Communications Pvt. Ltd. Jawalakhel, Nepal -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQFFoMAnVrOl+eVhOvYRAkQZAJ4mnkYZj5EzStO36Yl07vCrp+KjGwCgoY0U eptcoO+IV9DavLvJDl/LXow= =rnIv -----END PGP SIGNATURE-----

5 10

Freeradius + DHCP server ?
by Rafał Kamiński 23 Jan '07

23 Jan '07

Hi, Is it works ? If yes, can somebody tell me how i can do that ? My users is auth. and i want get him some address IP. BR -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

5 9

RE: Access-Accept ONLY on every second try
by Miguel Reategui 23 Jan '07

23 Jan '07

Thanks for your reply Alan, I believe I found the problem and I will describe it here as it might help others Looks like for some reason the only access-request that was issued, was being resent endlessly: The block below would be repeated 192 times (I don't know why) each time adding one more Proxy-State line <log> modcall[authorize]: module "sql" returns ok for request {/*1 to 192* ) modcall: leaving group authorize (returns updated) for request (/*1 to 192*/) Sending Access-Request of id (/*1 to 192*/ to xx.xx.xx.xx8 port 1812 User-Name = "18xxxxxxxx" User-Password = "xeexxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Proxy-State = 0x313230 Proxy-State = 0x30 Proxy-State = 0x31 Proxy-State = 0x32 Proxy-State = 0x33 </log> Finally the authentication realm would be marked as DEAD for each request <log> marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 2. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 3. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 4. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 5. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 6. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 7. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead {go on until all requests would be dead} </log> As this realm was marked dead, the next request (the second one) would go through another (default?) realm and this time, it would work normally. So, I took the proxy.conf file and commented out the offending realm information, forcing the "first request" to go to the next realm (default?) and it worked!!! I still need to see what I might be affecting as this is probably a Hack I hope this makes sense to someone....actually I got the idea from checking an old mailing list archived message about missing proxies Thanks to everyone, Mig

2 1

Rewrite accounting request/Proxy-To-Realm
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

i) How rewrite accounting request to insert certain attribute in order for billing engine to process futher.?? ii) Tried to set Proxy-To-Realm to force proxy accounting using rlm_perl.. But failed... $RAD_REPLY{'Proxy-To-Realm'} = "infranet2"; --haizam

1 0

Proxy accounting after query LDAP
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

FR: freeradius-1.1.2 OD: FreeBSD 6.0 trying to query LDAP for certain attribute.. if found, then proxy accounting to other server if not store accounting locally. trying using rlm_perl as below:- i) radiusd.conf perl y5perl { module = /usr/local/etc/raddb/y5perl.pl } accounting { ...... y5perl } ii) y5perl.pl sub accounting { # For debugging purposes only &log_request_attributes; # You can call another subroutine from here &test_call; &wifi_infranet; return RLM_MODULE_OK; } sub wifi_infranet { ## some code to query ldap for attribute A if (A) { ## What should i put here to force proxy accounting to other server?? } Any other method?? TQ.. --haizam

1 2

match client's shortname in huntgroups file
by Jakob Hirsch 22 Jan '07

22 Jan '07

Hi, is there an easy/good way to determine the huntgroup depending on the the shortname from clients.conf? We have more than 100 clients configured (with a "ProviderLocationCounter" pattern), so the information is duplicated in the huntgroups file (multiple times, as the huntgroup is also determined by Called-Station-Id). So it would really simplify things to have the shortname available for matching in the huntgroups file. I could extend one of our custom modules to put the name into a VSA and use that like 'Client-Shortname == "blub"' (already did it in a test environment and it works fine), but that seems a little clumsy to me, so I wondered if there's an easier way. unrelated side note: As I see, client_find() walks linearly through the client list. Shouldn't we keep this in a more appropriate data structure, like a btree or a trie, and/or save the once found RADCLIENT* pointer in the REQUEST struct? I understand that it doesn't matter for most installations (and we don't have any performance problems, either), it just does not feel right to waste so many cpu cycles :) regards, J

3 2