December 2007 - Freeradius-Users - lists.freeradius.org

Newbie question
by Monah Baki 07 Dec '07

07 Dec '07

Hi all, I am new to freeradius and I want to know if it's possible to perform the following. I provide for multiple people access to the internet via a proxy server with authentication (htpasswd), server is FreeBSD. I want to deny them access after 1 month. I was wandering if freeradius can work with the htpasswd password file, and then deny them access after 1 month. Thank you

2 1

rlm_sql_log. accounting and locking
by Phil Mayers 07 Dec '07

07 Dec '07

All, The rlm_sql_log module only logs a single query; unlike the main sql module which (for accounting) will do an update or insert if not found. How, if at all, are people merging the rows? Triggers? Post-processing? Also, I doubt it will be an issue, but just wanted to check; is the flock() of the file likely to cause any contention issues? Is there an easy way of hashing the NAS-IP-Address to writing to 26 files named "sql-log-[a-z]" and asking radsqlrelay to replay them all? Thoughts welcome. Regards, Phil

3 2

Fall-Through Syntax
by Reynolds, Walter 07 Dec '07

07 Dec '07

In looking at the list and several examples from various places I noticed that Fall-Through = xxx has been listed in different ways. I have seen "Yes" "yes" and "1" What are the options and where would I have been able to find the logic in the src so I could have looked myself? Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

attr_rewrite
by Дмитрий 07 Dec '07

07 Dec '07

Good afternoon! I have a problem. The user will be authorized with a login in the form of 123456@realm1, it is necessary, that freeradius transformed its login 123456@realm2... And so for all users. How to make? TRIED: radiusd.conf: attr_rewrite User-Name { attribute = User-Name searchin = packet searchfor = "realm1" replacewith = "realm2" ignore_case = yes new_attribute = yes max_matches = 1 append = yes } authorize { Autz-Type unknown { files } User-Name preprocess chap mschap suffix files sqlauth } in radiusd -X: User-Name = "123456@realm1" User-Password = "EBLAImXtaUidLnSa" NAS-IP-Address = 10.173.65.200 rad_lowerpair: User-Name now '123456@realm1' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: 'realm2' rlm_attr_rewrite: Added attribute User-Name with value 'realm2' modcall[authorize]: module "User-Name" returns ok for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "realm1" for User-Name = "123456@realm <mailto:123456@realm2> 1" rlm_realm: Found realm "realm1" rlm_realm: Proxying request from user 123456 to realm realm1 rlm_realm: Adding Realm = "123456" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '123456@realm1' rlm_sql (sqlauth): sql_set_user escaped user --> '123456@realm1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '123456@realm1' ORDER BY id' Сысоев Дмитрий Александрович Сетевой администратор Отдел информационных технологий ЗАО ''Ульяновская Сотовая Связь'' Тел.: +7 (901) 947 17 31 Моб.: +7 (901) 947 02 71 Факс: +7 (8422) 43 51 99

2 2

Feature requests
by Fabio Pedretti 06 Dec '07

06 Dec '07

Hi, is there a plan on adding these features, already discussed some time ago on the lists? * SSL support on MySQL connections: http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-March/04213… * OpenSSL exceptions or GNUTLS support, so SSL support can be legally distributed in distribution packages: http://lists.freeradius.org/pipermail/freeradius-devel/2006-July/010008.html Thanks

2 1

IP Pool
by Marcelus Trojahn 06 Dec '07

06 Dec '07

Hi folks, I have a PPPoE server which authenticates the user on freeradius... Right now, the PPPoE server is in charge of assigning the IPs to the users but I want to do that via radius because I'm adding another PPPoE server on the network and OSPF routing... Problem is, I had a look on radiusd.conf and what I could understand is that I can only have pools on a same network (like 192.168.0.0/23, for instance)... But I need 1 big pool with IPs in different networks because my users receive valid public IP addresses... So, I need all users on the same pool and the pool has to have a bunch of differente IP ranges, not in order, like 200.200.200.0/24, 201.10.20.0/24 and so on... Is that even possible? -- Marcelus Trojahn

2 2

Re: Using nas-ip address for user authorization
by Reynolds, Walter 06 Dec '07

06 Dec '07

You can also use the huntgroups file For example: LimitedAccess NAS-IP-Address == 191.168.1.53 User-Name == firstuser, User-Name == aaa, User-Name == bbb, User-Name == lastuser This will limit only those users listed from being able to log into the particular NAS. > Yes it is. Read instructions in users file and: > > http://wiki.freeradius.org/Operators > > Ivan Kalik > Kalik Informatika ISP > > > Dana 6/12/2007, "ajay raut" <rautajays(a)yahoo.com> pi?e: > > >Hi, > > > > I want to use nas-ip address of the radius-request to be checked in > users.conf file for the users authorization to access that NAS server. > > Is it possible in FreeRadius and i need to know the configuration to > do it.. > > > > > > Thanks, > > > > Ajay Raut > > > > > >--------------------------------- > >Be a better friend, newshound, and know-it-all with Yahoo! Mobile. > Try it now. > > > > > --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

Using nas-ip address for user authorization
by ajay raut 06 Dec '07

06 Dec '07

Hi, I want to use nas-ip address of the radius-request to be checked in users.conf file for the users authorization to access that NAS server. Is it possible in FreeRadius and i need to know the configuration to do it... Thanks, Ajay Raut --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

3 2

RE: free radius with radauth discarding packet?
by satyanarayanam 06 Dec '07

06 Dec '07

Hi ti all, Thanks you valuable sugestions, Now my setup is freeradius server<--->radauthfreeradius client client sending packet to server, server accepting only when USERNAME-root PASSWD-root123 othher than this server rejecting and sendinf access denied packet to client. i am trying to change clients.conf file in server as below client 10.50.41.43 { # secret and password are mapped through the "secrets" file. secret = testing123 shortname = liv1 # the following three fields are optional, but may be used by # checkrad.pl for simultaneous usage checks nastype = livingston login = root password = root123 } if i am changing this login and passwd then also it is not acepting.. anybody help to work this .. thnak you in advance -----Original Message----- From: Sridhar Bandi [mailto:sridhar.bandi@hp.com] Sent: Thursday, December 06, 2007 12:29 PM To: satyanarayanam(a)tataelxsi.co.in Subject: Re: free radius with radauth discarding packet? Hi Satyanarayana, The problem is with the radius client that is sending packets that are more than 4096 bytes. As per the standard (http://www.ietf.org/rfc/rfc2865.txt?number=2865) you cannot send packets more than 4096. In case, packets are more than 4096 the RADIUS servers will discarded those. We are not sure why you need to send packets which are more than 4096. What is the setup that you are working on? What is the platform that you are using? What is the customer base that you are looking at? If you provide the information on the configurations then the community will be able to help you out better. Best Regards, Bandi satyanarayanam wrote: > Hi, > > I am running sucessfully freeraduis with raduth-freeradius know it is > working fine but > only taking > USERNAME-root > PASSWD-root123 > > why not others i am changing this in clients.conf file also > > but working with only this ... > Please tell me what to do.. > > Thank you inadvance > > Thank you, > Satyanarayna reddy mendaddula, > Tata Elxsi Ltd,White field ,Hoody-1, > Emp no--6185, Mb no - 9341311577 > Email:- satyanarayanam(a)tataelxsi.co.in > > Help ever ,,,, Hurt never.... > > > > The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. > > Contact your Administrator for further information. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. Contact your Administrator for further information.

3 2

Login rejected. Error 691.
by pungki arianto 06 Dec '07

06 Dec '07

I installed FreeRadius 1.1.2 on FreeBSD 6.0. I followed the HOWTO from http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html to configure the server. When I ran radtest, it show the message like this: Sending Access-Request of id 153 to 10.1.1.3 port 1645 User-Name = "user@sisni" User-Password = "sni" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 10.1.1.3:1645, id=153, length=20 or Sending Access-Request of id 153 to 10.1.1.3 port 1645 User-Name = "user" User-Password = "sni" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 10.1.1.3:1645, id=153, length=20 The user 'user' already registered inside /etc/password: user:*:1006:1006:user_radius_sisni:/home/user:/usr/sbin/nologin In radius.conf , proxy_request is set to No. And the $INCLUDE ${confdir}/proxy.conf is already commented. But I still got this message: rlm_realm: Proxy reply, or no User-Name. Ignoring. This is the content from huntgroup file: LNS-KPU-SM2 NAS-IP-Address == 10.1.1.0 This is the content from hints file DEFAULT Suffix == "@sisni", Strip-User-Name = Yes Hint = "sisni", If I tried to dial the Radius from Windows terminal, it always give me an error like this: *Error 691*: Access was denied because the user name and/or password was invalid on the domain Please help me to fix the error. Thank you. -Pungki Here is the last message in /var/log/radacct/10.1.1.0/detail-20071203 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 957324 Client-IP-Address = 10.1.1.0 Timestamp = 1196662186 Here is the message that show after radiusd -X command. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5 eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Accounting-Request packet from host 10.1.1.0:50016, id=223, length=80 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 952314 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 0 modcall: leaving group preacct (returns noop) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/radacct/10.1.1.0/detail-20071203' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.1.1.0/detail-20071203 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns noop for request 0 radius_xlat: '/var/log/radutmp' rlm_radutmp: NAS callback restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 223 to 10.1.1.0 port 50016 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.1.1.0:50016, id=224, length=80 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 952317 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 1 modcall: leaving group preacct (returns noop) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/radacct/10.1.1.0/detail-20071203' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.1.1.0/detail-20071203 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns noop for request 1 radius_xlat: '/var/log/radutmp' rlm_radutmp: NAS callback restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 224 to 10.1.1.0 port 50016 Finished request 1 Going to the next request --- Walking the entire request list ---

5 12