April 2007 - Freeradius-Users - lists.freeradius.org

Size Limitations on clients.conf
by Alexander Papenburg 22 Apr '07

22 Apr '07

Hi, iam just wondering if there are any "size" limitations on the clients.conf file. Background is: The current file consist of many /24 net-ranges and is currently 22k big ;) For the past days I recognised some strange activities but unfortunately only saw the following in the log: ..... Auth: Login incorrect (Home Server says so): [aaliyah] (from client INET-X.X.X.X/16 port 2 cli A.B.C.D) ..... Obviously A.B.C.D tries a Word-List-Attack on one device in the range but I can't figure out on which one without going into debugging mode. So I hacked a quick and dirty perl script which generate a clients.conf with single ip's which is about 17M big ^^ Is there a better way? Thanks, Alex

3 3

Blocking Interim-Update Accounting-Requests
by Jakob Hirsch 22 Apr '07

22 Apr '07

Hi, is it possible to filter out accounting requests with an Acct-Status-Type of Interim-Update? rlm_attr_filter works obviously only when we are a proxy, and rlm_files with this acct_users changed nothing: DEFAULT Acct-Status-Type == Interim-Update, Auth-Type := Reject DEFAULT Acct-Status-Type == Start, Auth-Type := Accept DEFAULT Acct-Status-Type == Stop, Auth-Type := Accept I guess it's just not possible to handle acct-requests that way... Anybody with an idea? Otherwise I'll have to add that to our logging module. TIA.

2 2

dictionary question
by Jackson Jerry-NPC637 21 Apr '07

21 Apr '07

I'm a freeradius newbie so bear with me. Two questions/issues: 1. I've installed version 1.1.6, but have some dictionary files that are/were setup for Freeradius 1.1.3. I've seen from the README/faq that the dictionary files have changed post 1.1.3 & am wondering what I need to do/change to incooperate my 1.1.3 dictionary files to work with Freeradius 1.1.6? It looks like most of the 1.1.3 dict. files are duplicated in 1.1.6, but notice I have a couple (company specific) dictionary files that I need to use with freeradius 1.1.6? 2. Probably not a big deal (just curious), but was wondering what exactly changed with the dictionary files between freeradius 1.1.3 & 1.1.6. I see an error like "values can only be Interger types", but am not sure what this means. Hopefully this is just a quick/short answer. Thanks, Jerry

2 1

restricting users access to clients?
by Matt Ashfield 20 Apr '07

20 Apr '07

Hi, We're using FreeRadius to authenticating our wireless users (who's credentials are stored in LDAP). But we'd also like to use it to authenticate a select few users who need access to our networking gear. Our networking gear is setup to do this, but I'm not sure how to set this up in FreeRadius. I would assume that you'd specify in the clients.conf section which users are allowed access to that device, but in looking at the documentation for clients.conf, that doesn't seem to be the case. Any links/advice is appreciated. Thanks Matt mda(a)unb.ca

3 5

How to use FreeRADIUS proxy to set an attribute value only if not provided by end RADIUS server ?
by John Butala 20 Apr '07

20 Apr '07

We would like to use FreeRADIUS (acting as a proxy server) to set the Primary-DNS-Server and Secondary-DNS-server attributes in the auth response to the RADIUS client only if these attributes are not provied by the end RADIUS server (which we don't control). Is there anyway to do this without making a FreeRADIUS source code change ? Thanks much, John Butala Senior Staff Engineer Qwest

2 1

rlm_sql: %{sql:<long query>} - length limit
by Milan Holub 20 Apr '07

20 Apr '07

Hi Alan and others, using cvs head from yesterday... I have some query in radgroupcheck for some custom attribute defined in dictionary: dictionary: # test_query ATTRIBUTE test_query 3014 string select * from radgroupcheck where id=67; +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 67 | hotzone | test_query | := | `%{sql:select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='%{NAS-IP-Address}' and nas.ports='%{NAS-Port}') or nasid is null) and batchid=(select batchid from card where username='%{SQL-User-Name}') and charge_planid=charge_plan.id and zoneid=zone.id order by nasid desc limit 1}` | +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ I wanted to use the value of test_query attribute later in rlm_perl module(as I do it for my other attributes configured from DB). My approach is to fetch all neccesary data into "custom" attributes and in rlm_perl I'm doing just simple "decissions" based on custom attributes. I do not want to connect from within perl to database to fetch those values(new DB connections, using other perl modules, performance hit...) My problem: - it looks like Value field in radgroupcheck is limited by 253 characters ==> I did: mysql> alter table radgroupcheck modify column Value varchar(1024); but still the possible length of string to be xlated is limited by MAX_STRING_LEN rather than by MAX_QUERY_LEN... rlm_sql (sql): User found in group hotzone radius_xlat: 'SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'hotzone' ORDER BY id' radius_xlat: Running registered xlat function of module sql for string 'select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='%{NAS-IP-Address}' and nas.ports='%{NAS-Port}') or nasid is null) and batchid=(sel' rlm_sql (sql): - sql_xlat radius_xlat: 'pexcmp' rlm_sql (sql): sql_set_user escaped user --> 'pexcmp' radius_xlat: 'select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='193.247.122.178' and nas.ports='5280') or nasid is null) and batchid=(sel' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='193.247.122.178' and nas.ports='5280') or nasid is null) and batchid=(sel: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 2 I did not test yet but I think the string length limit is common for all %{sql:} dynamic strings(not only for those in [rad|group][check|reply] tables.). Is there a way how to specify more complex(longer) sql queries in freeradius configuration? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

RE: Grouping after Kerberos 5 authentication accepted?
by Jason Chan 20 Apr '07

20 Apr '07

Thank you Alan. I read the documentations and now I'm able to use Kerberos and MySQL along with FreeRadius. Thank you for your help. However, I'm stuck in the last part of the project which is to reply the accept request along with assigned attributes. For example, Kerberos successfully authenticate admin/admin (yes I don't use MySQL for authentication), and FreeRadius knows this user has permission to access. Now, in the postauth part, FreeRadius searches the radreply table in its MySQL database for the proper attributes that this particular user has, say Service-Type = Administrative-User. I store these attribute information in radreply table and leave other tables empty. So, I edited the postauth_query in sql.conf: postauth_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" I can't get the 'Service-Type = Administrative-User' in the accept-reply package. Am I missing something here? Any help would be appreciated. Regards, Jason -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Thursday, April 19, 2007 10:27 AM To: jchan2(a)utm.utoronto.ca Subject: Re: Grouping after Kerberos 5 authentication accepted? Jason Chan wrote: > You are correct, the grouping isn't come from Kerberos. I'm going to > build a mysql database in the FreeRadius server to handle all the > grouping/permissions. What fields do I need for the database? I > searched on the FreeRadius website and I can't find any information > related to SQL See the "doc" directory. There are schemas and examples. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.446 / Virus Database: 269.5.4/768 - Release Date: 4/19/2007 5:32 AM

2 2

rlm_perl: perl 5.6 & segmentation fault when reloaded
by Milan Holub 20 Apr '07

20 Apr '07

Hi all, I'm using cvs head on debian woody(historical reasons). I'm using rlm_perl module with perl 5.6: `dpkg -l '*perl*'` ... ii libperl-dev 5.6.1-8.9 ii libperl5.6 5.6.1-8.9 ii libsnmp-perl 4.2.3-2 ... This version of perl is without ithreads and does not support multiplicity. I experienced following behaviour when sending HUP to radius process: Program received signal SIGSEGV, Segmentation fault. 0x404525dd in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.6 (gdb) bt #0 0x404525dd in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.6 #1 0x4044d347 in perl_get_cv () from /usr/lib/libperl.so.5.6 #2 0x4044d4b6 in perl_call_pv () from /usr/lib/libperl.so.5.6 #3 0x4042a030 in _init () from /usr/lib/freeradius/rlm_perl-2.0.0-pre0.so #4 0x08055e12 in free_mainconfig () #5 0x0804eec5 in cf_pair_free () #6 0x0804f1fc in cf_section_free () #7 0x0804f21b in cf_section_free () #8 0x0804f21b in cf_section_free () #9 0x080558c4 in read_mainconfig () #10 0x08058ee2 in main () #11 0x4024714f in __libc_start_main () from /lib/libc.so.6 Problem was localized to detach section of perl module and here is a dummy patch(do not call custom detach function as I do not need it...) Index: src/modules/rlm_perl/rlm_perl.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_perl/rlm_perl.c,v retrieving revision 1.51 diff -u -r1.51 rlm_perl.c --- src/modules/rlm_perl/rlm_perl.c 17 Apr 2007 16:08:00 -0000 1.51 +++ src/modules/rlm_perl/rlm_perl.c 19 Apr 2007 07:47:51 -0000 @@ -1258,6 +1258,7 @@ { dTHXa(inst->perl); #endif /* USE_ITHREADS */ +#if 0 PERL_SET_CONTEXT(inst->perl); { dSP; ENTER; SAVETMPS; @@ -1276,6 +1277,7 @@ FREETMPS; LEAVE; } +#endif #ifdef USE_ITHREADS } #endif Hope this can help someone... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

Questions regarding authentication systems and protocols to password types compatibility
by Reimer Karlsen-Masur, DFN-CERT 20 Apr '07

20 Apr '07

Hi Alan, hi list, I appreciate the tables explaining the compatibility of authentication systems / protocols to password type compatibility from: [table 1] http://deployingradius.com/documents/protocols/compatibility.html and [table 2] http://deployingradius.com/documents/protocols/oracles.html But I am still confused about the relationship of these two tables to each other and how to use them. Is the following considered correct? 1. If I am using the back end DB (e.g. ldap or users file, etc.) as a simple *password store*, only [table 1] if of interest. And freeradius is able to connect to the back end (if there is a rlm_<back-end-db> module available), authenticate itself with a special radius server account/user credential and to retrieve the password plus optionally some other attribute values if the radius server *itself* authenticates successfully with the back end DB. The radius server itself is then performing the user name/password check to accept or reject the authentication request of the user trying to connect. 2. If I am using the back end DB (e.g. ldap etc.) as an *authentication oracle*, [table 2] tells me which authentication oracle system I can use (depending on the authentication protocol that the supplicant/client/user is using) and [table 1] tells me in which format the passwords need to be stored in the authentication oracle. And freeradius is able to connect to the back end (if there is a rlm_<back-end-db> module available), to authenticate *with the user provided* credentials (username/password) and to optionally retrieve some attribute values if the *user* authenticated successfully against the authN oracle. Confirmation or further clarification is welcome. Thanks Reimer ps: There is probably a small typo in the column heading of [table 1]: 'SSHA1 hash' should be 'SHA1 hash' and 'Salted SSHA1 hash' should be 'Salted SHA1 hash (SSHA1)' -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737

2 3

re: configuration
by parfait kouassi nda 20 Apr '07

20 Apr '07

my last coonfiguration of these files is: radiusd.conf proxy_request = yes proxy.conf realm gie.local { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = araignee.gie.local:1812 accthost = araignee.gie.local:1813 secret = parfait nostrip } Clients.conf client 192.168.0.2 { secret = parfait shortname = araignee.gie.local } when i do configuration in all flies my freeradius reject my packets! this is the show of radiusd -X! Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 0 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.1:1812, id=19, length=130 NAS-IP-Address = 192.168.3.1 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "picasso(a)gie.local" Calling-Station-Id = "00-A0-C9-DE-7A-FE" Service-Type = Framed-User Framed-MTU = 1000 EAP-Message = 0x02020016017069636173736f406769652e6c6f63616c Message-Authenticator = 0x5aa9378c210f3cc9896ff7a4742bce77 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "gie.local" for User-Name = "picasso(a)gie.local" rlm_realm: Found realm "gie.local" rlm_realm: Proxying request from user picasso to realm gie.local rlm_realm: Adding Realm = "gie.local" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 19 to 192.168.3.1 port 1812 EAP-Message = 0x01030016041014292e9e4d0f780980b96f3ad2459504 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x020f058ccb95cbc717c1bb0f624b681b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.3.1:1812, id=20, length=165 NAS-IP-Address = 192.168.3.1 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "picasso(a)gie.local" Calling-Station-Id = "00-A0-C9-DE-7A-FE" Service-Type = Framed-User Framed-MTU = 1000 State = 0x020f058ccb95cbc717c1bb0f624b681b EAP-Message = 0x020300270410e10ab8e5381c81c7806d8dbe102936fa7069636173736f406769652e6c6f63616c Message-Authenticator = 0xd4268d3dbb7397a0ff40d4c74b040f9d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_realm: Looking up realm "gie.local" for User-Name = "picasso(a)gie.local" rlm_realm: Found realm "gie.local" rlm_realm: Proxying request from user picasso to realm gie.local rlm_realm: Adding Realm = "gie.local" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 39 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [picasso(a)gie.local/<no User-Password attribute>] (from client Switch port 50001 cli 00-A0-C9-DE-7A-FE) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.3.1:1812, id=20, length=165 Sending Access-Reject of id 20 to 192.168.3.1 port 1812 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 19 with timestamp 46288d79 Cleaning up request 1 ID 20 with timestamp 46288d79 Nothing to do. Sleeping until we see a request. _________________________________________________________________ MSN Hotmail : créez votre adresse e-mail gratuite & à vie ! http://www.msn.fr/newhotmail/Default.asp?Ath=f

3 2