October 2007 - Freeradius-Users - lists.freeradius.org

Terminate EAP in FreeRADIUS and do authentication in other RADIUS server.
by Ruijgrok, Ronald 28 Oct '07

28 Oct '07

Hi I want to do 802.1x PEAP authentication on FreeRADIUS. Authentication (username/password checking) needs to be done on another RADIUS server (Safeword server), which is uncapable to handle EAP requests. What I do have working: * PEAP with users in a local MySQL database on the FreeRADIUS server * proxy simple authentication requests to Safeword server I have configured all kinds of options suggested in this list to try to terminate the EAP tunnel in FreeRADIUS, but still EAP messages are sent to the Safeword server: An RADIUS Access-Request is sent, with these attribute value pairs: EAP-Message User-Name NAS-IP-Address Message-Authenticator Proxy-State I should expect a RADIUS Access-Request with these attribute value pairs: User-Name User-Password NAS-IP-Address NAS-Port Proxy-State What am I doing wrong? I have this in my users file: NULL Proxy-To-Realm := LOCAL DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := Safeword I have this in proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm Safeword { type = radius authhost = <ip>:1645 accthost = <ip>:1646 secret = <secret> } Ronald

3 2

A question about rlm modules
by Ali Majdzadeh 27 Oct '07

27 Oct '07

Hello all I have written an rlm_module. It works fine. Here, we have clients which should be authenticated using CHAP passwords. In the radiusd.conf, I have mentioned my module before the CHAP module in the authentication section. Also, I have found that my module should populate the request->config_items field of the request with the clear text password so that the CHAP module can process the request. I have added the required code to do so, but the CHAP module complains about the size of the password. I want to know, is there something that I have missed? By the way, is the concept right at all? Thanks in advance. Regards Ali Majdzadeh

2 5

limited hours per user
by hadi golestani 26 Oct '07

26 Oct '07

Hi, I'm using freeRadius with poptop and it's logging all accounting issues well, but how can I add some rules to restrict people , e.g. how to restrict a group of users to only connect 2 hours per day? tnx

2 1

Re: Access-Reject in a php script
by manIP 26 Oct '07

26 Oct '07

Hi all, Thanks again! I've tried to put return(2) and it does not work because my client receives an Access-Accept. If I let exit(2), the server does not send anything so the client fall in time out. The user will not have access but he will make many attempts as long as he does not receive an Access-Reject packet. Furthermore, he needs to know what is going on... BTW, I'm using the "NTRadPing Test Utility" client. hereunder is the output debug: Module: Instantiated realm (suffix) exec: wait = yes exec: program = "/home/authentication.php" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "Access-Request" Module: Instantiated exec (myauth) Module: Instantiated files (files) exec: wait = yes exec: program = "/home/accounting.php" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "Accounting-Request" Module: Instantiated exec (myacct) rad_recv: Access-Request packet from host x.x.x.x:2658, id=49, length=58 User-Name = "xxx" User-Password = "xxx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "xxx" for User-Name = "xxx" rlm_realm: No such realm "xxxx" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 Exec-Program output: Exec-Program: returned: 2 rlm_exec (myauth): External script failed modcall[authorize]: module "myauth" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host xxxxx, id=49, length=58 Discarding duplicate request from client xxxx - ID: 49 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 49 with timestamp 4721d900 Nothing to do. Sleeping until we see a request. Thank you very much anyway! Patric wrote: > > Something just occurred to me that I dont think I tried before. > > What happens if instead of doing an > > > > exit(2); > > > > you do a > > > > return(2); > > > > This way your script will still exit clean, so freeradius wont pick it > > up as a script failure, but hopefully will still get the result? > > No. If the script succeeds, the output is either a text message, or > RADIUS attributes that go into an Access-Accept. > > If the script fails, the server sends an Access-Reject. > > Stop playing games with PHP and post the output of "radiusd -X". I'll > bet money that the solution is right there in the debug output. > > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 30, Issue 97 > ************************************************ >

2 1

How to triger an application after a authentication done
by ram 26 Oct '07

26 Oct '07

Hi iam trying to make some iptables rules to trigger after authentication done with Radius Server here is my setup user--------BRAS------Freeradius---Gateway Router(Linux+iptables)--Internet when the user intiate pppoe with BRAS, bras send the request to Radius Radius checks the authentication and send to the user for the authorisation. when use authenticated and authorised. and same time i want to trigger the script to open a Iptable rules and his bandwidth with TC can some one give me suggestion how can i achieve this ? ram

2 2

Re: Access-Reject in a php script (manIP)
by Sean Bracken 26 Oct '07

26 Oct '07

Hi, I have a working PHP script that may help. You can load it from http://swarmhotspots.com/bb.php.txt The sript is designed to reply to Chillispot authentication requests but should be easy to modify for other NAS's. Hope it helps. Regards, Sean Bracken http://swarmhotspots.com

1 0

Re: Access-Reject in a php script
by manIP 26 Oct '07

26 Oct '07

Hi everyone! Thank your for your answers... Alan, Patric has totally right. I've set the reject_delay to "0" and the result was the same. I really don't want to touch to the source code and I am sure we can find another way 1) if there is a server timeout, is it assumed as an Access-reject (or does the user will be given access ?) 2) for instance, executing a script from another language which exit 2 from PHP...I tried it with a sh script and it does not work 3) If I reply with a Session-Timeout := 0...may be it will be the same effect (I know it is not clean but I have no other choice 4) If the previous solutions do not work, I will probably have to change the code...so Patric, I think the name of the file has changed: it is rlm_exec.c instead of exec.c. Also, After compiling it, could you give some hints to uninstall the previous version and to install the new version properly. Thank you for your comprehension. Khalid ps:Sorry, I sent that email twice but the "Subject" of the previous one was wrong. > manIP wrote: > > Hi, > > > > I have put exit(2) but as Patric said, freeradius thinks that the script > > failed and does not respond to the access-request. In the client side, > > there is a server time out...I don't know if that server time out is > > assumed as an Access-Reject? > > No it does not assume an access-reject - it registers it as no response, > which is undesirable. > > As Alan said : "It delays the Access-Reject. See the debug output." > I tried setting "reject_delay = 0" in the radius.conf but that did not > help. > > > May be the problem comes from PHP and I could use the UNIX system() > > function send back the code 2. > > I believe that this specific scenario only occurs with PHP as I said > before, because of the way it sends its status codes (in the exit call). > I don't know how else to do it, which is why I changed the code for my > use... > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. > >

3 5

Cisco NAS Password problem
by John Morris 26 Oct '07

26 Oct '07

Hello: I am new to using Freeradius, and I am using Freeradius 1.1.6 that comes with Ubuntu Server 7.10 I have set up Freeradius with MySQL as the backend database. I set up one of my Cisco 3550 switches to use Radius as the login method. This worked fine, authentication was running through freeradius. All of my Cisco switches are running the same IOS version, and all configured similarly (only port information is different). I then added a second switch to the freeradius client configuration (nas table), and encountered a problem. The password was being rejected. So I ran Freeradius -X so I could see what was going on. On the good password attempt (first switch added) I see something like this: rad_recv: Access-Request packet from host 192.168.x.x:1645, id=9, length=80 NAS-IP-Address = 192.168.x.x NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "192.168.x.y" User-Password = "decodedpassword" On the failed password attempt (second and now third switch in the list) I see something like this: rad_recv: Access-Request packet from host 192.168.x.z:1645, id=1, length=80 NAS-IP-Address = 192.168.x.z NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "192.168.x.y" User-Password = "r\306\324\333M\014\247\022\363\216K\257`\315#]" The password doesnt appear to get decoded before processing of the auth packet occurs. All of the entries in the nas table include the same NAS type. I've gone thru my configs several times, and I'm not sure what I am missing. Does anyone out there have any ideas? Regards John

4 6

Re: Freeradius-Users Digest, Vol 30, Issue 94
by manIP 26 Oct '07

26 Oct '07

Hi everyone! Thank your for your answers... Alan, Patric has totally right. I've set the reject_delay to "0" and the result was the same. I really don't want to touch to the source code and I am sure we can find another way 1) if there is a server timeout, is it assumed as an Access-reject (or does the user will be given access ?) 2) for instance, executing a script from another language which exit 2 from PHP...I tried it with a sh script and it does not work 3) If I reply with a Session-Timeout := 0...may be it will be the same effect (I know it is not clean but I have no other choice 4) If the previous solutions do not work, I will probably have to change the code...so Patric, I think the name of the file has changed: it is rlm_exec.c instead of exec.c. Also, After compiling it, could you give some hints to uninstall the previous version and to install the new version properly. Thank you for your comprehension. Khalid > > Hi, > > > > I have put exit(2) but as Patric said, freeradius thinks that the script > > failed and does not respond to the access-request. In the client side, > > there is a server time out...I don't know if that server time out is > > assumed as an Access-Reject? > > No it does not assume an access-reject - it registers it as no response, > which is undesirable. > > As Alan said : "It delays the Access-Reject. See the debug output." > I tried setting "reject_delay = 0" in the radius.conf but that did not > help. > > > May be the problem comes from PHP and I could use the UNIX system() > > function send back the code 2. > > I believe that this specific scenario only occurs with PHP as I said > before, because of the way it sends its status codes (in the exit call). > I don't know how else to do it, which is why I changed the code for my > use... > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. >

1 0

RE: How to triger an application after a authentication done
by Josh Howlett 26 Oct '07

26 Oct '07

rlm_exec See radiusd.conf for examples. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of ram > Sent: 26 October 2007 07:50 > To: FreeRadius users mailing list > Subject: How to triger an application after a authentication done > > Hi > > iam trying to make some iptables rules to trigger after > authentication done with Radius Server > > here is my setup > > user--------BRAS------Freeradius---Gateway > Router(Linux+iptables)--Internet > > when the user intiate pppoe with BRAS, bras send the request to Radius > > Radius checks the authentication and send to the user for the > authorisation. > when use authenticated and authorised. and same time i want > to trigger the script to open a Iptable rules and his > bandwidth with TC > > can some one give me suggestion > > how can i achieve this ? > > ram > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

1 0