February 2007 - Freeradius-Users - lists.freeradius.org

specify ip range in huntgroups (or similar functionality).
by Jason Murray 28 Feb '07

28 Feb '07

Is it possible to specify a range of IP addresses in a huntgroups file? What I am trying to accomplish is: 1) AAA authentication to our Cisco devices using radius 2) Only allow people in a specific group to access the devices 3) Reject everyone else. I am using the following: huntgroups: ------------------- netgear NAS-IP-Address == 172.20.120.75 users: ---------- test1@net Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "netgear" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject, Huntgroup-Name == "netgear" Reply-Message = "Not Authorized to access this gear" This works just fine, but we have well over 600 devices. If at all possible I would like to specify network ranges instead of individual IP addresses in the huntgroups file (similar to what I can do in the clients.conf file). Is this possible? If it is not possible in the huntgroups is there a better way to do what I want to accomplish? Thanks in advance! -- Jason E. Murray jemurray(a)zweck.net http://unixhosts.us/

2 1

alternating authentication LDAP/mini Token
by Jochen Schäfer 28 Feb '07

28 Feb '07

Hi List, I want to accomplish following task with freeradius: Users have two possibilities to authenticate 1. Authentication via username ldap password 2. Authentication via username mini Token What would be a possible solution? Do the normal authentication with username and password against ldap. If it succeeds everythink is fine. This was a ldap auth. If not there has to be a second check via an external script (e.g. perl Net::Simple::RADIUS) which hands over the User-Name, User-Password to the Token Server to check if the possible token is valid. If both attempts fail either the ldap username/password pair or the username/token pair were wrong. I'm wondering which could be the right way to call the script when the first auth failed. I'm looking for a way of reauthentication. Is this possible at all. Can I call the external script somehow in the REJECT sub-section to recall the authentication process? Is there another or a recommended solution to accomplish the above task? Thanks, Jochen

1 0

FreeRadius 1.1.4 and rlm_krb5 and Active Directory
by Kozlov Artem 28 Feb '07

28 Feb '07

Hi! I'm trying to configure freeradius with rlm_krb5 using mini howto from Enrik Berkhan http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html , but i have some troubles. when i type radtest user(a)office.ru userpass localhost 10 testing123 i got: Sending Access-Request of id 145 to 127.0.0.1 port 1812 User-Name = "user(a)office.ru" User-Password = "userpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=145, length=20 and radius log: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:53441, id=145, length=105 User-Name = "user(a)office.ru" User-Password = "userpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "office.ru" for User-Name = "user(a)office.ru" rlm_realm: No such realm "office.ru" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type krb auth: type "krb" Processing the authenticate section of radiusd.conf modcall: entering group krb for request 3 rlm_krb5: Parsed name is: user(a)office.ru rlm_krb5: failed verify_user: Unknown error -1765328343 (user(a)office.ru ) modcall[authenticate]: module "krb5" returns reject for request 3 modcall: leaving group krb (returns reject) for request 3 auth: Failed to validate the user. Login incorrect: [user(a)office.ru/userpass] (from client localhost port 10) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 145 to 127.0.0.1 port 53441 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 145 with timestamp 45e576ce Somebody has experience of such adjustment?

1 0

sql set up - Fall-Through agains read_groups in sql.conf
by tzieleniewski 28 Feb '07

28 Feb '07

Hi! How can I configure radius to always check the group table for a user without utilizing the Fall-Through parameter in the radreply table for a particular user?? I tried to use read_groups=yes in the sql.conf but it didn't help. Thanks in advanced -tomasz

1 0

Radius says client is unknown.
by M. Onur ERGiN 28 Feb '07

28 Feb '07

Hello, I have configured freeRadius server and a Cisco AP350. When I run the server in debug mode, it prints 'unknown client', although the client is explicitely defined in clients.conf. Output is: rad_recv: Access-Request packet from host 10.2.8.150:1058, id=31, length=143 Ignoring request from unknown client 10.2.8.150:1058 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. clients.conf entity is: client 10.2.8.150 { secret = testing123 shortname = tnl2-network } Any idea on what's wrong? Regards, Onur. --------------------------------- Cheap Talk? Check out Yahoo! Messenger's low PC-to-Phone call rates.

7 11

On IEEE 802.1x roaming
by Josh Shamir 28 Feb '07

28 Feb '07

Hello, I'm using FreeRADIUS with Coova Chilli in proxy mode with IEEE 802.1Xauthentication (PEAP auth. method to be more specific). In my network there are 6 Access Point that use TKIP as security protocol. Now I need that the Supplicants can do "roaming" between the Access Points. The IEEE 802.1X asserts that can be used two mechanisms to obtain roaming : - PMK Caching - Pre Authentication I would to know how I could implement this mechanisms in my system. Are requested special configuration of FreeRADIUS or to implement roaming I must only configure the Access Point (If so, how I can do this)? Note that Access Point are all on the same subnet. Thanks for all Josh

2 1

Add+cnadge attributes to proxy-reply with condition
by Victor 28 Feb '07

28 Feb '07

Hello, I need to modify proxy-reply auth packet with condition. All i need - if proxy user enter UserName like 'username#554466' send UserName like 'username' to proxy (its already work) and check proxy-reply - if it consist av-pair Ascend-CBCP-Mode=CBCP-Any-Or-No changer this pair value to CBCP-Profile-Callback and add new attribute - Ascend-Dial-Number with value after # in original UserName and send modified packet to NAS. Now it work unconditional and stupid Lucent MAX trying dial-out to users who dont have permition for it. My current settings: preproxy_users: DEFAULT User-Name =~ "^([a-z0-9_\-]+)#([0-9]+)$" User-Name := "%{1}" proxy.conf: post_proxy_authorize = yes users: DEFAULT Stripped-User-Name =~ "#([0-9]+)$" Ascend-Dial-Number = "%{1}", Ascend-CBCP-Mode := CBCP-Profile-Callback I need something like in users: DEFAULT Stripped-User-Name =~ "#([0-9]+)$", %{proxy-reply:Ascend-CBCP-Mode} == CBCP-Any-Or-No Ascend-Dial-Number = "%{1}", Ascend-CBCP-Mode := CBCP-Profile-Callback Thanx! -- Best regards, Victor mailto:kha0s@ukr.net

2 1

group question
by Matt Ashfield 28 Feb '07

28 Feb '07

Hi, I'm trying to set up a restricted users group to deny access to users so I don't have to create an entry for each one in the users file. Based on the WIKI FAQ, I found: The following entry denies access to a group of users. The same restrictions as above on location in the raddb/users file also apply: DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled" But where do I specify that group disabled? Is that a group on my linux system or is that group defined within Radius, and if so, where? Thanks Matt mda(a)unb.ca

2 1

Custom queries
by Dariusz Dwornikowski 28 Feb '07

28 Feb '07

Hi, I am using freeradius 1.0.2 on debian and i want to integrate it with openser. What is my question is how to use my own sql queries in authentication and authorization. I do not want/I can't use the database schema provided with freeradius. -- Pozdrowienia, Dariusz Dwornikowski tel. 0601596474

3 2

sql and interim update packets
by Andrew D 28 Feb '07

28 Feb '07

Hi there, We're running freeradius 1.1.4 on freebsd 5.5, using unixodbc and freetds to talk to mssql. According to the default mssql file file the _alt queries are only supposed to run if there is an error when doing the first sql query. # accounting_update_query - query for Accounting update packets # accounting_update_query_alt - query for Accounting update packets # (alternate in case first query fails) However this isn't the case. User-Name = "aliencroc" NAS-Port-Type = ADSL-DMT Attr-103 = 0x45e50bfe rad_lowerpair: User-Name now 'aliencroc' rad_rmspace_pair: User-Name now 'aliencroc' Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 1851,Client-IP-Address = 203.132.224.35,NAS-IP-Address = 203.220.236.246,Acct-Session-Id = "00152C4F",User-Name = "aliencroc"' rlm_acct_unique: Acct-Unique-Session-ID = "b577760b95764125". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "aliencroc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/radacct/203.132.224.35/detail-20070228' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/203.132.224.35/detail-20070228 modcall[accounting]: module "detail" returns ok for request 0 radius_xlat: '/var/log/radutmp' radius_xlat: 'aliencroc' modcall[accounting]: module "radutmp" returns ok for request 0 radius_xlat: 'aliencroc' rlm_sql (sql): sql_set_user escaped user --> 'aliencroc' radius_xlat: 'UPDATE CallsOnline SET DataIn = '262653',DataOut = '354385', LastHit = getdate() WHERE AcctSessionId = '00152C4F' AND UserName = 'aliencroc' AND NASIdentifier= '203.220.236.246'' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'INSERT into accounting (LogTime, LogDate, UserName, NasIPAddress, NasPortID, ServiceType, FramedProtocol, FramedAddress, CallingStation ID, NasIdentifier,AcctStatusType, NasPortType, ConnectInfo, ConnectInfo2, AcctUniqueID, CalledStationID, Connection_ID) values (getdate(),getdate(),' aliencroc','203.220.236.246','1851','Framed-User', 'PPP', '125.168.108.242','sfy211300202027','LNS02-WAYM-ADL.comindico.com.au','Start','ADSL-DMT','15 5520000','155520000','b577760b95764125','','00152C4F') ' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 67 to 203.132.224.35 port 35240 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... The first update query didn't fail. Any ideas or would this be a bug? Cheers cya Andrew

1 0