March 2007 - Freeradius-Users - lists.freeradius.org

Reject authentication attempts based on "cli" value?
by markcapelle＠pcmc.com 15 Mar '07

15 Mar '07

It is a Cisco WLAN 4402. For reference, here is a log entry from a user connecting from the Guest network: Thu Mar 15 07:10:52 2007 : Auth: Login OK: [guestuser] (from client PCMCWLANCTRLR1 port 0 cli 192.168.100.101) And here is a log entry from someone connecting via 802.1x on another network: Thu Mar 15 07:26:36 2007 : Auth: Login OK: [DOMAIN\\guestuser] (from client PCMCWLANCTRLR1 port 1 cli 00-12-F0-19-6E-B3) As you can see the only way I have to differentiate these two auth attempts is via the "cli" value. 192.168.100.x is the subnet range of my Guest network. I want all auth attempts from 192.168.100.x to be rejected. Hope someone can help me out with this. Thanks. >Date: Thu, 15 Mar 2007 10:55:55 -0400 >From: "King, Michael" <MKing(a)bridgew.edu> >Subject: RE: >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: > <6641F169E241EA40B29DE7BFAD24674DA7A43B(a)EXCH2.campus.bridgew.edu> >Content-Type: text/plain; charset="iso-8859-1" > >What manufacturer makes the NAS (the wireless controller?) > >I would look to the Called-Station field. Usually (Based on Cisco AP's) this is the MAC of the AP, followed by the SSID they connected to. > >> -----Original Message----- >> From: >> freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or >> g >> [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer >> adius.org] On Behalf Of markcapelle(a)pcmc.com >> Sent: Thursday, March 15, 2007 10:48 AM >> To: freeradius-users(a)lists.freeradius.org >> Subject: >> >> I have a situation where I have a wireless controller that services >> multiple wireless networks (vlans).? When the controller contacts the >> RADIUS server with an authentication request, it does so with the IP >> address of the controller as the client address.? The problem is I >> have a guest network that has lower security than my other wireless >> networks.? The guest network has it's own user/password database >> stored in the controller, but the way authentication occurs is that it >> checks RADIUS for the user first and assumes it will fail, then will >> use the internal database.? The issue with this is that if one of my >> users jumps on the guest network, they are authenticated which is not >> what I want to happen.? Looking at the logs, I noticed that all the >> guest network users have the IP address of the client in the "cli" >> field.? My guest network is a totally different VLAN and IP subnet. >> >> Is there a way to key off of the "cli" field and then make it so that >> all requests from clients with a specific subnet in this field are not >> authenticated?? This would stop my internal users from connecting, but >> allow the correct users (those in the internal DB) to still get >> connected. >> >> Thanks. >> CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or >> privileged, undisclosed or otherwise confidential information. If you >> have received this e-mail in error, you are hereby notified that any >> review, copying or distribution of this message in whole or in part is >> strictly prohibited. >> Please inform the sender immediately and destroy the original >> transmittal. Thank you for your cooperation. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

2 1

Accounting Request Message Authenticator setting to 0x00
by Archna Mittal 15 Mar '07

15 Mar '07

Hi, I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working. Please let me know if there is a way to do it? Thanks & Regards, Regards, -Archna

5 9

Programming request
by Cory Robson 15 Mar '07

15 Mar '07

I require a php script to be written that I can run from cron. The purpose of the script is to basically remove stale/locked accounting records in the sql database. Script will need to have variables defined at top of script for easy changes. (I.E. mysql database,username,password and time variables) SQL statement will need to filter on open sessions (acctstoptime = null) my NAS's are set to send acct update packets every fifteen minutes. Script will need to first look at records with acctsessiontime=0 and if elapsed time from acctstarttime is greater than 30 mins then remove or close the session. If acctsessiontime > 0 then look at last session time and look at current time and again if more than 45 minute variation close the session based on last known session update (starttime+sessiontime = acctstoptime) I'm open to tendors and can pay by paypal but looking at figures around $20 as this shouldn't be a hard task for a programmer. Cory

1 0

Problem with Digest/OpenSER/Radius
by Dariusz Dwornikowski 15 Mar '07

15 Mar '07

Hi. My problem is such, that we store our passwords in Md5 in database, when authorization request comes from ser, i get digest attributes. I issue: authorize_check_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" And in Database I have: id = 1 UserName = test001 Attribute=User-Password Value = test Now, my real database stores passwords as md5 hashes and the radius compares the clear text passwords, how can i force it to compate md5 hashes of passwords? -- Dariusz Dwornikowski tdi(a)vercom.pl

3 5

Re: Reject authentication attempts based on "cli" value?
by Sam Schultz 15 Mar '07

15 Mar '07

An entry like this in your 'users' file should work: DEFAULT NASIPAddress =~ "192.168.100.*" Auth-Type := Reject I'm not sure '*' is the appropriate regular expression character for freeradius, but you should be able to verify that pretty quickly from the documentation. Operator information itself can be found on: http://wiki.freeradius.org/Operators On Thu, 15 Mar 2007 11:23:23 -0500 markcapelle(a)pcmc.com wrote: >It is a Cisco WLAN 4402. For reference, here is a log entry from >a user >connecting from the Guest network: > > Thu Mar 15 07:10:52 2007 : Auth: Login OK: [guestuser] (from >client >PCMCWLANCTRLR1 port 0 cli 192.168.100.101) > >And here is a log entry from someone connecting via 802.1x on >another >network: > > Thu Mar 15 07:26:36 2007 : Auth: Login OK: [DOMAIN\\guestuser] >(from >client PCMCWLANCTRLR1 port 1 cli 00-12-F0-19-6E-B3) > >As you can see the only way I have to differentiate these two auth >attempts >is via the "cli" value. 192.168.100.x is the subnet range of my >Guest >network. I want all auth attempts from 192.168.100.x to be >rejected. > >Hope someone can help me out with this. > >Thanks. > >>Date: Thu, 15 Mar 2007 10:55:55 -0400 >>From: "King, Michael" <MKing(a)bridgew.edu> >>Subject: RE: >>To: "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >>Message-ID: >> ><6641F169E241EA40B29DE7BFAD24674DA7A43B(a)EXCH2.campus.bridgew.edu> >>Content-Type: text/plain; charset="iso-8859-1" >> >>What manufacturer makes the NAS (the wireless controller?) >> >>I would look to the Called-Station field. Usually (Based on >Cisco AP's) >this is the MAC of the AP, followed by the SSID they connected to. >> >>> -----Original Message----- >>> From: >>> freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or >>> g >>> [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer >>> adius.org] On Behalf Of markcapelle(a)pcmc.com >>> Sent: Thursday, March 15, 2007 10:48 AM >>> To: freeradius-users(a)lists.freeradius.org >>> Subject: >>> >>> I have a situation where I have a wireless controller that >services >>> multiple wireless networks (vlans).? When the controller >contacts the >>> RADIUS server with an authentication request, it does so with >the IP >>> address of the controller as the client address.? The problem >is I >>> have a guest network that has lower security than my other >wireless >>> networks.? The guest network has it's own user/password >database >>> stored in the controller, but the way authentication occurs is >that it >>> checks RADIUS for the user first and assumes it will fail, then >will >>> use the internal database.? The issue with this is that if one >of my >>> users jumps on the guest network, they are authenticated which >is not >>> what I want to happen.? Looking at the logs, I noticed that all >the >>> guest network users have the IP address of the client in the >"cli" >>> field.? My guest network is a totally different VLAN and IP >subnet. >>> >>> Is there a way to key off of the "cli" field and then make it >so that >>> all requests from clients with a specific subnet in this field >are not >>> authenticated?? This would stop my internal users from >connecting, but >>> allow the correct users (those in the internal DB) to still get >>> connected. >>> >>> Thanks. >>> CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets >or >>> privileged, undisclosed or otherwise confidential information. >If you >>> have received this e-mail in error, you are hereby notified >that any >>> review, copying or distribution of this message in whole or in >part is >>> strictly prohibited. >>> Please inform the sender immediately and destroy the original >>> transmittal. Thank you for your cooperation. >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> > CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or >privileged, undisclosed or otherwise confidential information. If >you have >received this e-mail in error, you are hereby notified that any >review, >copying or distribution of this message in whole or in part is >strictly >prohibited. Please inform the sender immediately and destroy the >original >transmittal. Thank you for your cooperation. > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S7Yc87BTvBoSylfnjF0laDKyZ/

2 1

Question about SQL authentication.
by Kelly Hamlin 15 Mar '07

15 Mar '07

I haven't yet downloaded Free Radius, but looks to be the solutions I'm in search of. My question is this. We already have a db developed and running that maintains all customers, usersnames, passwords, static wan IP, ect. I would love to be able to have FreeRadius query my db for those fields to authenticate the user. I don't care about any of the accounting stuff since it isn't and hasn't been used in a long time. Any insight to this would be great! Kelly

2 1

RE: Reject authentication attempts based on "cli" value?
by Sam Schultz 15 Mar '07

15 Mar '07

I'm not sure what that "cli" value is. Have you checked the radius attributes page to see if it is standard? If you have any way to pull that information to the radius server external of freeradius, I suppose you could use the exec module. I doubt it would be efficient at all, though. Looks like your best bet is to pour through your radius debugging logs, and see if you can find a radius attribute that has what you need in it. If you do happen to find one, my previous suggestion would be easy enough to modify to accommodate. On Thu, 15 Mar 2007 13:09:06 -0500 "Capelle, Mark (PCMC-GB)" <Mark.Capelle(a)pcmc.com> wrote: >Actually, I don't think this will help since the wireless >controller IP >that freeradius "sees" is *not* in the 192.168.100.* range. This >controller uses LWAPP, so the IP ranges that the wireless networks >use >are totally contained within the wireless infrastructure, which >means >that the NAS IP is actually the LAN IP address of the controller. > >Again, it appears the only way for my to determine that the client >request is coming from the wrong subnet is via the "cli" value. >If >Cisco would just fix the guest wireless implementation to only >look at >the internal database or give you an option to specify this, all >would >be well. But... since they don't, I have to figure out how to >break >RADIUS for one subnet and yet allow it to function for the rest. > >-----Original Message----- >From: Sam Schultz [mailto:segfault90@hushmail.com] >Sent: Thursday, March 15, 2007 12:46 PM >To: freeradius-users(a)lists.freeradius.org; Capelle, Mark (PCMC-GB) >Subject: Re: Reject authentication attempts based on "cli" value? > >An entry like this in your 'users' file should work: > >DEFAULT NASIPAddress =~ "192.168.100.*" > Auth-Type := Reject > >I'm not sure '*' is the appropriate regular expression character >for freeradius, but you should be able to verify that pretty >quickly >from the documentation. Operator information itself can be found >on: > >http://wiki.freeradius.org/Operators > >On Thu, 15 Mar 2007 11:23:23 -0500 markcapelle(a)pcmc.com wrote: >>It is a Cisco WLAN 4402. For reference, here is a log entry from > >>a user >>connecting from the Guest network: >> >> Thu Mar 15 07:10:52 2007 : Auth: Login OK: [guestuser] (from >>client >>PCMCWLANCTRLR1 port 0 cli 192.168.100.101) >> >>And here is a log entry from someone connecting via 802.1x on >>another >>network: >> >> Thu Mar 15 07:26:36 2007 : Auth: Login OK: [DOMAIN\\guestuser] > >>(from >>client PCMCWLANCTRLR1 port 1 cli 00-12-F0-19-6E-B3) >> >>As you can see the only way I have to differentiate these two >auth >>attempts >>is via the "cli" value. 192.168.100.x is the subnet range of my >>Guest >>network. I want all auth attempts from 192.168.100.x to be >>rejected. >> >>Hope someone can help me out with this. >> >>Thanks. >> >>>Date: Thu, 15 Mar 2007 10:55:55 -0400 >>>From: "King, Michael" <MKing(a)bridgew.edu> >>>Subject: RE: >>>To: "FreeRadius users mailing list" >>> <freeradius-users(a)lists.freeradius.org> >>>Message-ID: >>> >><6641F169E241EA40B29DE7BFAD24674DA7A43B(a)EXCH2.campus.bridgew.edu> >>>Content-Type: text/plain; charset="iso-8859-1" >>> >>>What manufacturer makes the NAS (the wireless controller?) >>> >>>I would look to the Called-Station field. Usually (Based on >>Cisco AP's) >>this is the MAC of the AP, followed by the SSID they connected >to. >>> >>>> -----Original Message----- >>>> From: >>>> freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or >>>> g >>>> [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer >>>> adius.org] On Behalf Of markcapelle(a)pcmc.com >>>> Sent: Thursday, March 15, 2007 10:48 AM >>>> To: freeradius-users(a)lists.freeradius.org >>>> Subject: >>>> >>>> I have a situation where I have a wireless controller that >>services >>>> multiple wireless networks (vlans).? When the controller >>contacts the >>>> RADIUS server with an authentication request, it does so with >>the IP >>>> address of the controller as the client address.? The problem >>is I >>>> have a guest network that has lower security than my other >>wireless >>>> networks.? The guest network has it's own user/password >>database >>>> stored in the controller, but the way authentication occurs is > >>that it >>>> checks RADIUS for the user first and assumes it will fail, >then >>will >>>> use the internal database.? The issue with this is that if one > >>of my >>>> users jumps on the guest network, they are authenticated which > >>is not >>>> what I want to happen.? Looking at the logs, I noticed that >all >>the >>>> guest network users have the IP address of the client in the >>"cli" >>>> field.? My guest network is a totally different VLAN and IP >>subnet. >>>> >>>> Is there a way to key off of the "cli" field and then make it >>so that >>>> all requests from clients with a specific subnet in this field > >>are not >>>> authenticated?? This would stop my internal users from >>connecting, but >>>> allow the correct users (those in the internal DB) to still >get >>>> connected. >>>> >>>> Thanks. >>>> CONFIDENTIALITY NOTICE: This e-mail may contain trade >secrets >>or >>>> privileged, undisclosed or otherwise confidential information. > >>If you >>>> have received this e-mail in error, you are hereby notified >>that any >>>> review, copying or distribution of this message in whole or in > >>part is >>>> strictly prohibited. >>>> Please inform the sender immediately and destroy the original >>>> transmittal. Thank you for your cooperation. >>>> >>>> - >>>> List info/subscribe/unsubscribe? See >>>> http://www.freeradius.org/list/users.html >>>> >> CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets >or >>privileged, undisclosed or otherwise confidential information. If > >>you have >>received this e-mail in error, you are hereby notified that any >>review, >>copying or distribution of this message in whole or in part is >>strictly >>prohibited. Please inform the sender immediately and destroy the >>original >>transmittal. Thank you for your cooperation. >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html > >-- >Click here for free information on nursing jobs, up to $150/hour >http://tagline.hushmail.com/fc/CAaCXv1Rz1rlcvSEadQx6HQWGb8Bu3X2/ -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74n6Yp0DOeHM036F5MyaEXtW/

2 1

Opertors Problems
by Internet-Wifi Operador 15 Mar '07

15 Mar '07

I have in radgroupcheck GroupName Attribute op Value 14 days Session-Terminate := 1209600 (Time for 14 days from first connection) in usergroup GroupName UserName 14 days aaa in radcheck UserName Attribute op Value aaa UserPassword == pepe aaa Session-Terminate += 86400 (Time for 1 day to Add to Session-Terminate) @radiusd.conf modules { ............ sqlcounter sessionterminate { counter-name = Session-Limit-Time check-name = Session-Terminate reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = "SELECT IF (UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='%{%k}'))>0, UNIX_TIMESTAMP() - UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='%{%k}'))),0)" } ........... } instantiate { ..... sessionterminate ...... } authorize { .......... sql sessionterminate ......... } Ok, when send the authentication request, everything work fine but in reply Session-Timeout = 86400 so the radius overwrite the value not add. rad_recv: Access-Request packet from host 172.16.0.3:2353, id=115, length=44 User-Name = "aaa1" User-Password = "pepe" rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'aaa1' ORDER BY id rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'aaa1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'aaa1' ORDER BY id rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'aaa1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 radius_xlat: Running registered xlat function of module sql for string 'SELECT IF(UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='aaa1'))>0,(UNIX_TIMESTAMP()-UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='aaa1'))),0)' rlm_sql (sql): - sql_xlat rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT IF(UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='aaa1'))>0,(UNIX_TIMESTAMP()-UNIX_TIMESTAMP((SELECT MIN(AcctStartTime) FROM radacct WHERE UserName='aaa1'))),0) rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT COUNT(*) FROM radacct WHERE UserName='aaa1' AND AcctStopTime = 0 rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'aaa1', 'pepe', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 1 Sending Access-Accept of id 115 to 172.16.0.3 port 2353 Reply-Message += "Hola aaa1\\r\\n" WISPr-Bandwidth-Max-Down := 200000 WISPr-Bandwidth-Max-Up := 20000 Acct-Interim-Interval := 120 Idle-Timeout := 390 Session-Timeout = 86400 I did that before with freeradius 1.0.2 but stop to work and I don't know why. I install the new freeradius 1.1.5, Wow is to better and more easy, but my problem continue, I guess I forget something, please if someone have any idea why the operators doesn't work. Can help me? Thanks. Fabián Franzotti _________________________________________________________________ With tax season right around the corner, make sure to follow these few simple tips. http://articles.moneycentral.msn.com/Taxes/PreparationTips/PreparationTips.…

2 2

Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

>reference the initial thread where i said i was authenticating off >of >active directories, using eap-peap. which i had previously >working just >fine. >Since i didn't specify an instance name in my eap.conf, it is >referenced >as 'eap' (which i did read, but was following your advice). Once you configure the eap module, it tends to take care of itself. Setting Auth-Type & Autz-Type are for when you want to force a user (or all users, as with DEFAULT entries) to be authorized & authenticated by the respective modules. If you're purely using ldap for authorization & authentications, you wouldn't shouldn't need to set either one. I know in my case I had to set access_attr_used_for_allow to 'no' because I wasn't using the ldap schema extension packaged with freeradius. > >Joe > > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on accredited degrees with 150K/ year potential http://tagline.hushmail.com/fc/CAaCXv1JCgCkZNt7KGojkRoJHjx8XdRL/

1 0

RE: Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

>> DEFAULT <check_items (ex: Realm == 'your_domain')> >> Autz-Type := <your_ldap_instance (ex: ldap)>, >> Auth-Type := <module_instance_for_authentication> >so i did what you recommended, which makes sense to do... i have >Autz-type := eap, and in debug mode i get this clearly an access- reject >follows. > >auth: No authenticate method (Auth-Type) configuration found for the >request: Rejecting the user >auth: Failed to validate the user. First off, eap shouldn't be used this way. The top line of eap.conf clearly states: "Whatever you do, do NOT set 'Auth-Type := EAP'. The server is smart enough to figure this out on its own" Typical modules that would be used here are things like 'files', 'ldap', or 'sql'. There are also special types like 'Local' & 'System', which you'd have to use one of if you were using an sql table to store user credentials. The second thing you have to understand is the difference between modules & instances. An instance is a specific configuration of a module. The instance itself has a name that is user-specified. I suggest you read through the configurable_failover document, which is usually in /usr/share/doc/freeradius-<version>, it isn't long and offers pretty good insight into how freeradius' configuration gets processed. Also, if you need to use a seperate back-end for authentication, maybe you should tell us what you need to use so we can give you more specific answers. -- Click for free info on online degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1WBTC2SZD08y4Fk4U6rprEfbhG/

2 1