April 2007 - Freeradius-Users - lists.freeradius.org

Very Newbie question
by Antuan Avdioukhine 10 Apr '07

10 Apr '07

Greetings! I'm very newbie in FreeRadius software. Now I have to setup FreeRadius server for dialup users billing. We have three categories of dialup users: 1. Traditional users, who authenticates itselves with login and password; some of them must have fixed IP. 2. Internal telephony network users, who have no registered login name (may authenticate with any login/password pairs); server must check caller-id of such users (which is subsituted to fixed one usind our phone station magic) as a part of authorization procedure. Accounting will be performed as an payed telephone call, no radius accounting will be performed. 3. Small group of users (about 10 ones) which passes by accounting schemes (admninistrators). For authentication, authorization and accounting of first category users custlom rlm by billing software vendor will be used. For third category users I'm planning to use users.conf. Now -- two questions. 1. Which authorization method should I use for second category users? Obviously I should use rlm_perl, but it seems to me quite unpractical to use perl for just compare one attribute with single string constant. 2. Second category users call most frequently, while third category users call very rarelly (about 2-3 calls per week). Is it significant during FR setup? -- Antuan Avdioukhine (DEKA-RIPE). Convey Plus Telecommunications St.Petersburg, Russia.

3 3

Can i do that?
by apolyxrono 10 Apr '07

10 Apr '07

Hi list, I have freeradius-1.1.3 doing accounting with mysql. I am thinking to create 2 or 3 new tables in the radius db for my purposes and write in them the info i want every time freeradius writes data to the other tables (nas ,radcheck ,radacct etc.). Is it possible to do that ? If yes how ? If yes is it possible to do it using php scripts and not perl (for example to call a php script to update my tables every time freeradius writting accounting data in the radius db) Thanks a lot

3 3

Accounting question
by Ian Truelsen 09 Apr '07

09 Apr '07

When I connect to my AP, authenticated by freeradius using EAP-TLS, I get an entry into radpostauth, entries in /var/log/radius/radacct/192.168.3.115/detail-auth and detail-reply files, but I am not getting any entries into radacct. I don't know whether this is because the NAS is not sending any accounting packets or my setup is not correct. However, since I am getting the entries into radpostauth, I think I must have the setup correct. In what circumstances are accounting packets sent from the NAS? How can I test to see whether the packets are being sent? What sort of information is supposed to be stored in radacct? -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

3 2

Mac OS 10.4 & Radius
by John Warf 09 Apr '07

09 Apr '07

I am looking to see if anyone has a install of FreeRadius running on a Mac OS 10.4 server binding to an LDAP server. We are looking at doing this and I was wanting to see if anyone has already got a binary out there or some words of advise for it. I currently have FreeRadius running on a Linux box as a stand alone and has been for sometime now but need a new install on a Macintosh to try some new things. Thanks John ****This Message was sent through the Chatham County Schools E-Mail Server**** All e-mail correspondence to and from this address is subject to the North Carolina Public Records Law, which may result in monitoring and disclosure to third parties, including law enforcement.

2 1

Reject user without realm
by Marcos Roberto Greiner 09 Apr '07

09 Apr '07

Hi, I'm trying to use FreeRadius with Realms (using the form user@realm). Basically, if a user uses user(a)provider1.com, I want Radius to authenticate locally. If it's @provider2.com, 3.com, etc, on other servers listed in proxy.conf. The problem I'm having is that if a user adds no realm, only the user, the server is autenticating locally. I wanted it to deny the authentication. How should I proceed? Thank you very much, Roberto My current setup and radius -X follows. I'm using MySQL as database (both for users and accounting) hints file. Added only the following entry: # The following entry is to be authenticated locally DEFAULT Suffix == "@domain1.com", Strip-User-Name = Yes Hint = "PPP", Service-Type = Framed-User, Framed-Protocol = PPP Users file. Commented the entry referencing to Auth-Type = System. No other changes. Nothing added to huntgroups The radius -X output: rad_recv: Access-Request packet from host a.b.c.d:3793, id=0, length=58 User-Name = "user(a)provider1.com" User-Password = "user" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 36 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'user' rlm_sql (sql): sql_set_user escaped user --> 'user' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "pap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password user rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Login OK: [user] (from client dsu24 port 0) Sending Access-Accept of id 0 to a.b.c.d port 3793 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Session-Timeout := 7200 Finished request 0 Going to the next request -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

4 4

Problem with freeradius and mysql
by José Christian Rodríguez 09 Apr '07

09 Apr '07

Hello all When i try to run in debug mode, show and error messages # /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "_freeradius" main: group = "_freeradius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) ERROR: Cannot find a configuration entry for module "sql". radiusd.conf[1801] Unknown module "sql". radiusd.conf[1730] Failed to parse authorize section. I'm running openbsd 4.0 and these programs: mysql-client-5.0.22 multithreaded SQL database (client) mysql-server-5.0.22 multithreaded SQL database (server) freeradius-1.1.1p1 RADIUS server implementation freeradius-mysql-1.1.1 freeradius mysql rlm addon I don't know which is the problem Can you help me? christian

3 3

Freeradius+OpenLDAP+SAMBA+Windows Domain Logon.
by Sérgio Kojima 09 Apr '07

09 Apr '07

Hello all. My freeradius1.1.5 is configured to work with openldap and samba PDC, resume, it works fine when i login with username/password/domain, but this user already logon one time on domain, that is, the user is on cache in this windows machine (XP and W2kPRO). When i try with a username/password/the same domain that never logon in this machine, or do not have cache in windows, return a message error that do not have controler domain. What can i do to resolve? The windows XP and 2k can`t logon this way with switchs-802.1x ? []`s Kojima. -------------------------------------------------------

3 5

RE: [m0n0wall] Captive Portal and Radius
by Alex M 09 Apr '07

09 Apr '07

Are we talking about M0n0 as a NAS here? If yes, why not to mod the boxy to do internal counting of the section and then "talk" to the radius with final data? -----Original Message----- From: YvesDM [mailto:ydmlog@gmail.com] Sent: Monday, April 09, 2007 11:37 AM To: Peter Boosten Cc: m0n0wall(a)lists.m0n0.ch Subject: Re: [m0n0wall] Captive Portal and Radius On 4/9/07, Peter Boosten <peter(a)boosten.org> wrote: > > YvesDM wrote: > > When you use radius you can specify max-daily-session through > sqlcounter. > > Yves, thanks for your answer, although it doesn't answer my question. > > Again: I defined a max-daily-session. Works like charm. But I don't want > him to use this max-daily-session in one run. I would like him to take > some breaks (say every two hours), so I defined a Session-Timeout of > 7200 seconds. But nothing prevents him from logging in just after the > Session-Timeout expired. > > So I would like to know if there's some parameter that defines the > minimum time between two sessions. I see, sorry I missed that part. If I need to do this I usually use a linux firewall and change the iptables rules through cron. There are firewall distro's with ready to use examples for this, but of course they are off-topic on this list and I don't know if you actually want to use them at all. If you want more info on this you can e-mail me off list, no problem. > But I think setting up a radius server is a little overkill when it's only > > to control > > your son's internet use. > > > > Let the ethics be my worry. It has proven its use already (we're talking > internet addiction here...). Sounds familiar ;-) Just thinking, can't you add/delete a check item to radcheck through some script? expiration Attribute or something? Let the script set/delete a (passed by) expiration date in radcheck. When the attribute is there he won't be able to login cause his account will be expired, when the attribute is not there, he can login :-) Something like this: mysql> select * from radcheck where `UserName` = 'hombrouckxeli'; +-----+---------------+---------------+----+---------------+ | id | UserName | Attribute | op | Value | +-----+---------------+---------------+----+---------------+ | 359 | hombrouckxeli | User-Password | := | ****masked**** | | 360 | hombrouckxeli | Expiration | := | 01 april 2007 | +-----+---------------+---------------+----+---------------+ 2 rows in set (0.00 sec) mysql> Kind regards Yves

1 0

segmentation fault in rlm_attr_rewrite and eaptls module
by nikitha 09 Apr '07

09 Apr '07

Hi All, I am running freeradius-1.1.1 for quite a long time. Never seen this kind of issue when few requests are sent to the radiusd. The issue is when many requests are coming, then radiusd is crashing or going in an infinite loop and hogging for 99.9% of CPU. Please find the debug logs below. modcall[authorize]: module "preprocess" returns ok for request 1522 radius_xlat: 'anonymous' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'anonymous' modcall[authorize]: module "copy_user_name" returns ok for request 1522 radius_xlat: '^(.*[\/]+)' Program received signal SIGSEGV, Segmentation fault. 0xb7df9693 in mallopt () from /lib/libc.so.6 (gdb) where #0 0xb7df9693 in mallopt () from /lib/libc.so.6 #1 0xb7df877c in malloc () from /lib/libc.so.6 #2 0xb7e2a329 in re_comp () from /lib/libc.so.6 #3 0xb7e2a176 in re_comp () from /lib/libc.so.6 #4 0xb7e29c4f in regcomp () from /lib/libc.so.6 #5 0xb7b2e4d6 in do_attr_rewrite () from /usr/lib/rlm_attr_rewrite-1.1.1.so #6 0xb7b2eb44 in attr_rewrite_authorize () from /usr/lib/rlm_attr_rewrite-1.1.1.so #7 0x08055f26 in module_post_auth () #8 0x0805660d in modcall () #9 0x08055f9a in module_post_auth () #10 0x0805609c in module_post_auth () #11 0x08056565 in modcall () #12 0x08055269 in find_module_instance () #13 0x08055b8a in module_authorize () #14 0x0804d7a1 in rad_authenticate () #15 0x08059d52 in rad_respond () #16 0x08059a22 in main () and when i restarted the server the crash happened in eaptls module. rad_recv: Access-Request packet from host 192.168.1.1:7988, id=114, length=319 User-Name = "anonymous" Called-Station-Id = "00-15-70-23-03-00:wpa_psk" Calling-Station-Id = "00-00-00-22-00-07" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 192.168.1.1 NAS-Identifier = "Wireless Services" NAS-Port-Id = "wpa_psk" Connect-Info = "CONNECT 54Mbps 802.11g" State = 0x72fe4ac90661f9590e32dcb0c7059d75 EAP-Message = 0x0202007019800000006616030100610100005d030146161ab12118da21a43b116bb44c8bed120272f7b2796c3976e35bd114643a5c00003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 Message-Authenticator = 0x9521947e080287f8034d050f25bc08ea Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2652 modcall[authorize]: module "preprocess" returns ok for request 2652 radius_xlat: 'anonymous' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'anonymous' modcall[authorize]: module "copy_user_name" returns ok for request 2652 radius_xlat: '^(.*[\/]+)' rlm_attr_rewrite: No match found for attribute Stripped-User-Name with value 'anonymous' modcall[authorize]: module "add_dollar_sign" returns ok for request 2652 modcall[authorize]: module "etc_passwd" returns notfound for request 2652 modcall[authorize]: module "etc_group" returns notfound for request 2652 modcall[authorize]: module "chap" returns noop for request 2652 modcall[authorize]: module "mschap" returns noop for request 2652 rlm_realm: No '/' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix_oblic" returns noop for request 2652 rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix_oblic_fs" returns noop for request 2652 rlm_realm: No '/' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "prefix_oblic" returns noop for request 2652 rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "prefix_oblic_fs" returns noop for request 2652 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix_at" returns noop for request 2652 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "prefix_at" returns noop for request 2652 rlm_realm: No '%' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix_percent" returns noop for request 2652 rlm_realm: No '%' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "prefix_percent" returns noop for request 2652 users: Matched entry anonymous at line 5 modcall[authorize]: module "files" returns ok for request 2652 rlm_eap: EAP packet type response id 2 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2652 modcall: leaving group authorize (returns updated) for request 2652 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'anonymous' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2652 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 Program received signal SIGSEGV, Segmentation fault. 0xb7e86693 in mallopt () from /lib/libc.so.6 (gdb) where #0 0xb7e86693 in mallopt () from /lib/libc.so.6 #1 0xb7e8577c in malloc () from /lib/libc.so.6 #2 0xb7bd8023 in eaptls_extract () from /usr/lib/libeap-1.1.1.so #3 0xb7bd81fc in eaptls_process () from /usr/lib/libeap-1.1.1.so #4 0xb7bc510f in eappeap_authenticate () from /usr/lib/rlm_eap_peap- 1.1.1.so #5 0xb7bde4fe in eaptype_call () from /usr/lib/rlm_eap-1.1.1.so #6 0xb7bde9bb in eaptype_select () from /usr/lib/rlm_eap-1.1.1.so #7 0xb7bdda81 in eap_authenticate () from /usr/lib/rlm_eap-1.1.1.so #8 0x08055f26 in module_post_auth () #9 0x0805660d in modcall () #10 0x08055f9a in module_post_auth () #11 0x0805609c in module_post_auth () #12 0x08056565 in modcall () #13 0x08055269 in find_module_instance () #14 0x08055bb2 in module_authenticate () #15 0x0804d43b in rad_check_password () #16 0x0804d9ac in rad_authenticate () #17 0x08059d52 in rad_respond () #18 0x08059a22 in main () Please let me know the details about this issue. Awaiting for your reply.. Thanks, Nikitha

2 9

unsubscribe
by tseveen＠wirelesscom.mn 08 Apr '07

08 Apr '07

1 0