May 2007 - Freeradius-Users - lists.freeradius.org

radrelay patch for 1.1.6
by Milan Holub 18 May '07

18 May '07

Hi Alan, when using -R switch with radrelay binary from latest 1.1.6 release: `radrelay -f -R5 -d /etc/freeradius -a /var/log/freeradius/radacct/radrelay -S /etc/freeradius/radrelay_secret -r <remote_host> detail` I was continuously flooded by similar messages: ... radrelay: Running and Processing Records. Seconds since startup: <continuously increasing> Records Read: <continuously increasing> Packets Sent: 0 Record Rate since startup: <some rate> Packet Rate since startup: 0.00 ... There was an empty detail file (without any writer) thus I did not expected any records to be read... Here is my tested patch: Index: src/main/radrelay.c =================================================================== RCS file: /source/radiusd/src/main/Attic/radrelay.c,v retrieving revision 1.22.2.3.2.4 diff -u -r1.22.2.3.2.4 radrelay.c --- src/main/radrelay.c 16 Mar 2007 13:22:03 -0000 1.22.2.3.2.4 +++ src/main/radrelay.c 17 May 2007 14:27:35 -0000 @@ -678,9 +678,11 @@ rad_unlockfd(fileno(fp), 0); fseek(fp, fpos, SEEK_SET); } while(0); - if (r_args->records_print && state == STATE_RUN){ + else { stats.records_read++; - if (stats.last_print_records - stats.records_read >= r_args->records_print){ + } + if (r_args->records_print && state == STATE_RUN){ + if (stats.records_read != stats.last_print_records && (stats.records_read - stats.last_print_records) % r_args->records_print == 0){ now = time(NULL); uptime = (stats.startup == now) ? 1 : now - stats.startup; fprintf(stderr, "%s: Running and Processing Records.\n",progname); I believe it should be fixed in 1.X... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

confusing about Simultaneous-Use (still)
by Trio Yulistianto 17 May '07

17 May '07

hi all im using Freeradius-1.1.6, with mysql database.i'm still confusing about simultaneous-use. i want to limiting the maximum number of simultaneous logons ( just 1 session can login for every 1 user in a same time) this is my radiusd.conf session { sql } and this is my database : mysql> select * from radcheck where username='dara@idola'; +----+-----------------+---------------------------+----+--------------+ | id | UserName | Attribute | op | Value | +----+-----------------+----------------------------+----+-------------+ | 55 | dara@idola | Password | == | denpasar | | 65 | dara@idola | Simultaneous-Use | := | 1 | +----+-----------------+---------------------------+----+--------------+ 2 rows in set (0.00 sec) mysql> select username,acctstoptime from radacct where username='dara@idola' and acctstoptime=0; +----------------+-------------------------------+ | username | acctstoptime | +----------------+--------------------------------+ | dara@idola | 0000-00-00 00:00:00 | +-----------------+-------------------------------+ 1 row in set (0.00 sec) with that config and data rows, user dara@idola can login for second session :( any help expected thanks trio

2 2

EAP-TTLS Accounting Bug
by Sam Schultz 17 May '07

17 May '07

I didn't see anything about it in the list of changes, but I was wondering if this issue has been fixed in any recent releases ( > 1.1.5) Quick summary of the problem is that the := operator wouldn't replace the current anonymous outer identity for the User-Name attribute, but rather would just add another User-Name attribute. All output then of course used the anonymous identity, which isn't helpful in the least for radius accounting, or user tracking. > -----Original Message----- > From: freeradius-users-bounces+jhubert=med- > web.com(a)lists.freeradius.org [mailto:freeradius-users- > bounces+jhubert=med-web.com(a)lists.freeradius.org] On Behalf Of > Sam Schultz > Sent: Wednesday, March 14, 2007 7:14 PM > To: freeradius-users(a)lists.freeradius.org > Subject: Re: RE : EAP-TTLS outer identity & accounting > > An entry like: > > DEFAULT Realm == "test", Autz-Type := sql-test > User-Name = "%{User-Name}" > > does add a new User-Name attribute with the proper value, but I need a > way to delete the anonymous@ entry still, because I Access- Accepts > like > this: > > Sending Access-Accept of id 134 to 192.168.0.5 port 5190 > User-Name := "anonymous@test" > User-Name := "test@test" > > Followed by Accounting-Requests that still contain the anonymous > entry, so it is still using the oldest (first?) User-Name attribute. > Is > there any way at all to REMOVE already set attributes so they aren't > re-sent to the NAS? > > For that matter, shouldn't the "use_tunneled_reply = yes" in the ttls > module configuration have kept me from having this problem? > > I also have copy_request_to_tunnel set to yes, but I doubt that should > be causing a problem like this. > > On Wed, 14 Mar 2007 13:03:21 -0500 Sam Schultz > <segfault90(a)hushmail.com> wrote: > >On Wed, 14 Mar 2007 11:25:20 -0500 Thibault Le Meur > ><Thibault.LeMeur(a)supelec.fr> wrote: > >>> -----Message d'origine----- > >>> De : > >>> freeradius-users- > bounces+thibault.lemeur=supelec.fr(a)lists.free > >>> radius.org > >>> [mailto:freeradius-users- > bounces+thibault.lemeur=supelec.fr@li > >>> sts.freeradius.org] De la part de Sam Schultz Envoyé : mercredi 14 > >>> mars 2007 17:13 À : freeradius-users(a)lists.freeradius.org > >>> Objet : Re: EAP-TTLS outer identity & accounting > >>> > >>> > >>> > >>> > >>> On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok > >>> <aland(a)deployingradius.com> wrote: > >>> >Sam Schultz wrote: > >>> >> > >>> >> This should be solvable by adding something like 'User-Name = > >>> >> %{User-Name}' to the DEFAULT entries in > the > >>users > >>> >file, > >>> >> correct? > >>> > > >>> > Yes. > >>> > >>> One of my users file DEFAULT entries look like this: > >>> > >>> DEFAULT Realm == "test", Autz-Type := sql-test, > User- > >>Name = > >>> "%u" > >>> > >>> However, FreeRADIUS tells me this: > >>> > >>> Error: Invalid operator for item User-Name: reverting to > '==' > >>> > >>> I assume I'm not supposed to forcibly change User-Name, so > what > >>> attribute would I set to return the correct username to > the > >NAS? > >> > >>> I know there is a run-time variable %(reply:User-Name}, > would I > >>> need to somehow update it with the correct value for User- > Name > >>> instead? > >> > >>Yes, by simply adding the User-Name = XXX to the reply items > >(that > >>is to say > >>not on the first line). Try something like this: > > > >This didn't make much sense at first, but I think I > understand it > >now. > >What you're saying is that the first line is only for check > items, > >which is why I couldn't set User-Name there. The second line > and > >beyond > >then are for, what? Reply items ONLY, or check & reply items? > Is > >this > >documented anywhere? I just did a quick check through the freeradius > >doc directory, and only found a rlm_fastusers document which > didn't > >have anything to say about format restrictions. > > > >> > >>DEFAULT Realm == "test", Autz-Type := sql-test > >> User-Name=`%{User-Name}` > >> > >>HTH, > >>Thibault

1 0

SQL query in Pre-Proxy
by Ivan Kalik 17 May '07

17 May '07

>do you mean that i have to do the following: in the radcheck i have to put username calling-station-id=number and in the radreply, username proxy-to-realm:=domain No. Put them both in radcheck: INSERT INTO radcheck SET UserName='thatname', Attribute='Calling-Station-Id', op='==', Value='thatnumber' INSERT INTO radcheck SET UserName='thatname', Attribute='Proxy-To-Realm', op=':=', Value='thatdomain' Use correct operators. "=" is not the same as "==" and is not allowed as check operator. Ivan Kalik Kalik Informatika ISP

1 0

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by robin gong 17 May '07

17 May '07

Thanks Pshem for your quick answer. I expect answer like folowing "rlm_ldap: user jjeep authorized succesfully modcall[authorize]: module "ldap" returns ok" But I got "rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0" Thanks Robin Pshem Kowalczyk wrote:Freeradius expects exactly one answer: rlm_ldap: object not found or got ambiguous search result kind regards Pshem On 22/05/07, xuebin gong <robin_gong(a)yahoo.com> wrote: > Hi, All, > > I am new user and want to integrate freeradius v1.1.6 and > openLADP v2.3.32 for authorization and > authentication. Our operating system is Fedora 5 > Linux. > > (1)Install freeRadius-1.1.6 > After following the instruction of installation in > http://wwww.freeradius.org, > install freeRadius-1.1.6 on Fedora Linux 5, run radius > server in debug mode > > radiusd -X > ...... > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > FreeRadius was installed succeefully. > > (2)Configure freeRadius-1.1.6 > (2.1) Configure radiusd.conf > (2.1.1) LDAP module > ldap{ > server = "10.0.0.118" > identity = "cn=Manager,dc=mtcable,dc=net" > password = mtncnl1970 > basedn = "dc=mtcable,dc=net" > filter = > "uid=%{Stripped-User-Name:-%{User-Name}}" > start_tls = no > dictionary_mapping = > ${raddbdir}/ldap.attrmap > ldap_connections_number = 5 > edir_account_policy_check=no > timeout = 4 > timelimit = 3 > net_timeout = 1 > } > (2.1.2) authorize module > uncomment ldap line > > authorize{ > ...... > ldap > ...... > } > > (2.1.3) authenticate module > uncomment block ldap block: > > authenticate{ > ...... > Auth-Type LDAP { > ldap > } > ...... > } > > > (2.2) edit /usr/local/etc/raddb/users > Uncomment the following lines: > > DEFAULT Auth-Type = LDAP > Fall-Through = 1 > > (3)Install openLDAP > (4)Configure openLDAP > (5)Add one LDAP entry for testing > > dn: uid=jjeep, ou=radius, rccd=AAA3140018f, > dc=mtcable,dc=net > userPassword:: aabbccdd > cn: jeep > uid: jjeep > radiusAuthType: local > radiusSimultaneousUse: 1 > homeDirectory: // > objectClass: top > objectClass: posixAccount > objectClass: radiusprofile > uidNumber: 7012 > gidNumber: 100 > > After add this entry to LDAP, we reset the password to > "888888" > > (5)Test > After run test command line > > radtest jjeep "888888" localhost 1 testing123 > > The following is information from running Radiusd -X: > > ...... > rad_recv: Access-Request packet from host > 127.0.0.1:32771, > id=192, length=57 > User-Name = "jjeep" > User-Password = "888888" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok > for request 0 > modcall[authorize]: module "chap" returns noop for > request 0 > modcall[authorize]: module "mschap" returns noop for > request 0 > rlm_realm: No '@' in User-Name = "jjeep", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for > request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for > request 0 > users: Matched entry DEFAULT at line 153 > modcall[authorize]: module "files" returns ok for > request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for jjeep > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 10.0.0.118:389, > authentication 0 > rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 > > 970 to 10.0.0.118:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: search failed > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns notfound > for req > uest 0 > rlm_pap: WARNING! No "known good" password found for > the use > r. Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for > request0 > modcall: leaving group authorize (returns ok) for > request 0 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group LDAP for request 0 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "jjeep" with password > "888888" > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authenticate]: module "ldap" returns > notfound for > request 0 > modcall: leaving group LDAP (returns notfound) for > request 0 > auth: Failed to validate the user. > Login incorrect (rlm_ldap: User not found): [jjeep] > (from cl > ient localhost port 1) > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > The following is logfile: > > ...... > May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 > ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" method=128 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 > RESULT tag=97 err=0 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > attr=radiusNASIpAddress radiusExpiration acctFlags > ntPassword lmPassword radiusCallingStationId > radiusCalledStationId radiusSimultaneousUse > radiusAuthType radiusCheckItem radiusReplyMessage > radiusLoginLATPort radiusPortLimit > radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork > radiusFramedAppleTalkLink radiusLoginLATGroup > radiusLoginLATNode radiusLoginLATService > radiusTerminationAction radiusIdleTimeout > radiusSessionTimeout radiusClass > radiusFramedIPXNetwork radiusCallbackId > radiusCallbackNumber radiusLoginTCPPort > radiusLoginService radiusLoginIPHost > radiusFramedCompression radiusFramedMTU radiusFilterId > radiusFramedRouting radiusFramedRoute > radiusFramedIPNetmask radiusFramedIPAddress > radiusFramedProtocol radiusServiceType radiusReplyItem > > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 > SEARCH RESULT tag=101 err=0 nentries=3 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > attr=uid > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 > SEARCH RESULT tag=101 err=0 nentries=3 text= > > It looks like LDAP search successfully and found 3 > entries, but redius server could not find any objects. > > What is wrong with my integration? > > Thanks In Advanced > > Robin -- View this message in context: http://www.nabble.com/Integrate-freeradius-v1.1.6-and-openLADP-v2.3.32-for-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Machine account authentication progress?
by Peter Savage 17 May '07

17 May '07

Has anything happened in this area, to allow machine authentication against AD? From reading the mailing list I believe it was a problem with ntlm_auth, is this any closer to getting fixed, if not, how do people work around it. We have laptops here that authenticate against the domain if it's available, or locally if not. There is a logon script if they are at the site. How best I work round this? -- Pete Savage - cbx33::silentk wiki.ubuntu.com/PeteSavage

3 16

expiration doesn't work in freebsd + mysql
by Richard Cotrina 17 May '07

17 May '07

Hello : I'm getting a weard error using expiration with mysql backend in FreeBSD. The same configuration works fine in linux (centos) but not in FreeBSD 6.1 In Linux, all works fine (freeradius 1.1.6 + mysql 5.0), I've tried both "==" and ":=" operators and everything goes well. In FreeBSD 6.1 (freeradius 1.1.6 + mysql 4.1) everything works fine until I enable Expiration in the user's attributes. Despite the fact that I use the same configuration, I got the following message, whatever the operator be : **************************************************************************** ************************ Invalid operator for item Expiration: reverting to '==' rlm_sql (sql): No matching entry in the database for request from user [test(a)test.com] **************************************************************************** ************************ Has anyone had a similar experience ? Kind Regards Richard Cotrina

1 1

Re: Pool-Name from Called-Station-Id
by Hugh Messenger 17 May '07

17 May '07

Hugh Messenger (that's me!) said: > Alan DeKok said: > > > DEFAULT Called-Station-Id =~ "^(\w+_pppoe_\d+)$", Pool-Name := > `%{1}` > > > > \w && \d may not be supported by the regex library on your system. You > > may have to use [a-fA-F] etc. explictely. > > I don't seem to be able to get this to work. This is my DEFAULT entry: > > DEFAULT Called-Station-Id =~ "^([A-z0-9]+_pppoe_[0-9]+)$", Pool-Name := > `%{1}` > Framed-IP-Netmask = 255.255.0.0, > Fall-Through = 1 > > ... and it seems to be matching on authentication requests, as per this -X > fragment: > > users: Matched entry DEFAULT at line 162 > > ... where line 162 is the above DEFAULT. And I've triple checked my > regexp > using my IDE's RX toolkit. But sqlippool isn't picking up that pattern > match as the pool name: > > rlm_sql_mysql: query: SELECT FramedIPAddress FROM radippool WHERE > pool_name = '' AND expiry_time < NOW() ORDER BY pool_name, (UserName <> > 'radiustest'), (CallingStationId <> '00:60:B3:45:6A:98'), expiry_time > LIMIT 1 FOR UPDATE > sqlippool_query1: SQL query did not return any results > > If I replace the regexp version with a specific one, like ... > > DEFAULT Called-Station-Id == "brantley_pppoe_141", Pool-Name := > "brantley_pppoe_141" > > ... it all works fine. *bump* I hate to bump my question like this, but I think it may have gotten lost in a flurry of activity that day. And I really would like to get this working. TIA for any suggestions. -- hugh

2 1

freeradius <=> MS IAS passthrough
by Ian Savoy 17 May '07

17 May '07

Does anyone have any specific tweaks to get MS IAS and freeradius "talking"? We're trying to share resources with another isp in the area - their IAS server needs to be able to auth against our freeradius server, and visa versa with our freeradius to their IAS. A link to a tutorial would be sooooo nice :) I've looked in the dictionaries, but i'm afraid i don't know enough about IAS to really make any sense out of it...other than the fact that it "just doesn't work." So, hints, tips, tricks, and/or tutorials would be oh so lovely :) Thanks in advance -Ian Savoy -- Ian Savoy Webforce Systems, Inc Operations Support/UNIX Engineer CompTIA A+ Certified Professional Tech. Support: 614-899-9257 x22 Website: http://www.ewebforce.net

6 10

radius+ldap+peap
by Arjuna Scagnetto 17 May '07

17 May '07

can someone tell me a good tutorial about making work freeradius with ldap and peap on a 802.1x architecture ? For the moment my freeradius server dies with a Segmentation Fault, i think it's caused by a misunderstanding between peap and ldap but i'm not sure. radius.conf{ ldap { server = "127.0.0.1" #identity = "cn=manager" #password = prova basedn = "dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectClass=radiusprofile)" password_attribute = userPassword } } user in ldap database { dn: uid=wclient,ou=dot1x,dc=example,dc=com objectClass: top objectClass: radiusprofile objectClass: inetOrgPerson cn: wclient sn: wclient uid: wclient description: 802.1x user userPassword: {SSHA}xxxxxxxxxxxxxxxxxxx } Now when i try to authenticate the wireless station freeradius die with a Segmentation Fault: ... _realm: No '@' in User-Name = "wclient", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for wclient radius_xlat: '(uid=wclient)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=wclient) rlm_ldap: Added password {SSHA}tymOzgljNoVkhZT+K1+jUIW7HKkX3Epe in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value {SSHA}tymOzgljNoVkhZT+K1+jUIW7HKkX3Epe & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user wclient authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 Segmentation fault thanks for helping Arjuna -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1