August 2007 - Freeradius-Users - lists.freeradius.org

Client-IP-Address not logged in detail
by Milan Holub 16 Aug '07

16 Aug '07

Hi Alan, despite the note in radiusd.conf: ... # It also adds the %{Client-IP-Address} attribute to the request. preprocess ... it looks like that the attribute is not added: >>>DEBUG rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent >>>DEBUG and I do not find it in detail file neither(where I would need it for radrelaying). Apparently the attribute is available since I've written following dummy instance of attr_rewrite module to add the attribute to detail file: ...from modules{}: attr_rewrite add_clientip { attribute = Client-IP-Address searchin = packet searchfor = ".*" replacewith = "%{Client-IP-Address}" new_attribute = yes max_matches = 1 append = no } and in accounting{} I have: ... # add Client-IP-Address (fix) add_clientip # create detail file for radrelay(1.X binary) radrelay-detail I've compiled --without-udpfromto option - not sure whether it might have any impact. Is there something screwed with my config or the Client-IP-Address attribute is really missing? Thanks for reply. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

4 6

Many questions about FreeRadius
by Pedro Henrique Morsch Mazzoni 16 Aug '07

16 Aug '07

Hi Everyone! Can I integrate FreeRadius with RSA securID? Can I use Cisco Downloable ACL´s? Can I create group profiles? Can I integrate with a TACACS server for command authorization? Can I integrate with the SIM RSA Envision? Tks! Pedro Mazzoni

2 1

Duplicate requests in a session
by Santiago Balaguer García 16 Aug '07

16 Aug '07

Hi people, 1) In my activity I realize that when the conexion to Internet of a NAS is NOT good (there are some reday in the DSL), the NAS send several Start requests. My problen is my RADIUS server ask for all these requests and they are inserted in my DB. So, when the user or the NAS finalize the session and NAS sends Stop Request, the credit associates to the user account is decremented several times. It happens so because I put a trgger in my DB to decrement the user credit atomatically. Can I avoid the problem of inserting several times the start request? If it is so, how?? 2) Is it supposed that the value of acctsessionid and acctuniqueid in radacct table are UNIQUE and they can not be duplicated ? Thanks, Santiago _________________________________________________________________ Grandes éxitos, superhéroes, imitaciones, cine y TV... http://es.msn.kiwee.com/ Lo mejor para tu móvil.

6 9

Enterasys Mac-auth Dynamic-VLAN
by Fabrizio Stoppani 16 Aug '07

16 Aug '07

Hello to everyone ! I have a problem with Enterasys switch SecureStack A2. It work with 802.1X and MAC-authentication but the dynamic vlan assignment works only the first one. I want use it with the MAC authentication (as with Cisco,HP,...) but the Enterasys switch don't accept the tunnel attributes that the Radius server send it. It seems that these are accepted only with 802.1X autentication. I use Freeradius with Mysql so I would want to know if there is a way to say to Freeradius to use the Calling-Station-Id as password for EAP module and use DEFAULT user for every authentication. Thanks a lot for your support. Fabrizio Stoppani

1 0

freeradius stops immediately
by Ruben.Savia＠alcatel-lucent.com.ar 16 Aug '07

16 Aug '07

Hello all. I am trying to run freeradius-1.1.5 but it stops immediately after executing the command ./radiusd -X The computer´s answer is "Finalizado" because I have chossen spanish as my Solaris language There is no log file. # ./radiusd -X Finalizado # uname -a SunOS xterminal 5.7 Generic_106541-04 sun4u SUNW,Ultra-30 Solaris Any help please? Thank you Ruben Savia Professional Services Specialist Gcia. Operaciones y Servicios ruben.savia(a)alcatel-lucent.com.ar Av. Vieytes 1710. (C1275AGT) Ciudad Autónoma de Buenos Aires Te : 4349-1111 int 1001 Fax: 4349-1129

2 1

juniper authentication with freeradius
by ashish verma 16 Aug '07

16 Aug '07

hi, oh.. i didnt have dictionary.juniper file under /etc/freeradius. so i added those lines in "dictionary" file under /etc/freeradius. and this is my juniper side configuration. authentication-order [ radius password ]; radius-server { 192.168.1.49 { port 1812; accounting-port 1813; secret "$9$mTnCOBEyrvO1SeKM-d"; ## SECRET-DATA } } i tried doing it without specifying the ports as well..but didnt work. under "users" file i have this edward Auth-type := Local, User-Password = "edward" Juniper-Local-User-Name = "fritz12" clients.conf contains client 192.168.1.10/24 { secret = secret shortname = junoscope.server.name type = Juniper:nas } On 8/16/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: juniper authentication with freeradius (Bj?rn Mork) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 16 Aug 2007 11:20:09 +0200 > From: Bj?rn Mork <bjorn(a)mork.no> > Subject: Re: juniper authentication with freeradius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <87wsvv3kfq.fsf(a)obelix.mork.no> > Content-Type: text/plain; charset=iso-8859-1 > > "ashish verma" <ashish.scit(a)gmail.com> writes: > > > I am trying to do juniper m7i router authentication with freeradius. > > Can someone provide me some documentation? > > > > I have configured juniper but i suppose i missing something on radius > side. > > You don't say how you configured neither the JUNOS box nor FreeRADIUS. > My guess is that you're lacking something on the router: > > http://www.juniper.net/techpubs/software/junos/junos84/swconfig84-system-ba… > > > > added following in dictionary file. > > why? They have been in the default dictionary.juniper for ages. > > > > Bj?rn > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 28, Issue 55 > ************************************************ >

2 1

juniper authentication with freeradius
by ashish verma 16 Aug '07

16 Aug '07

Hi, I am trying to do juniper m7i router authentication with freeradius. Can someone provide me some documentation? I have configured juniper but i suppose i missing something on radius side. added following in dictionary file. VENDOR Juniper 2636 ATTRIBUTE Juniper-Local-User-Name 1 string Juniper ATTRIBUTE Juniper-Allow-Commands 2 string Juniper ATTRIBUTE Juniper-Deny-Commands 3 string Juniper Thanks

2 1

Simple Freeradius configuration
by Kelly Ormsby 16 Aug '07

16 Aug '07

Hi all, I've installed freeradius 1.1.6 on Fedora core 2 (kernel 2.6.5-1.358) (I can't upgrade please don't go there). I did a basic configure/make/make install. The only changes to the default configuration is adding an entry to the clients.conf file to allow requests from the Cisco VPN gateway. So far as I can tell CHAP and CHAPv2 should work straight out of the box (as per this page http://deployingradius.com/documents/configuration/auth_type.html) I've tried to authenticate using a local /etc/passwd user, and I get the output posted below. Is the default configuration enough for it to consult the /etc/passwd files (I thought that is what "DEFAULT Auth-Type = System" did?) or is there something else I need to add. Can CHAP (or CHAPv2) use /etc/passwd? I'm a little confused about the differences and I'm sure thats not helping :) I'd really rather not list the users individually in the users file, I'd like there to still only be one place to add users, so I'd like to use /etc/passwd file only. I apologise if there is documentation listed on this, I really feel that I've searched everywhere I can and no one seems to give real details. Thanks, rad_recv: Access-Request packet from host 192.168.100.254:1645, id=45, length=152 Framed-Protocol = PPP User-Name = "denvertech" MS-CHAP-Challenge = 0x79c27ab491824ce5 MS-CHAP-Response = 0x010100000000000000000000000000000000000000000000000033f6aa08b02f18fa3e3013072a8f8f171469f179b7b7434b NAS-Port-Type = Virtual NAS-Port = 33 NAS-Port-Id = "Uniq-Sess-ID33" Service-Type = Framed-User NAS-IP-Address = 192.168.100.254 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 2 rlm_realm: No '@' in User-Name = "denvertech", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 2 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: MS-CHAP-Response is incorrect. modcall[authenticate]: module "mschap" returns reject for request 2 modcall: leaving group MS-CHAP (returns reject) for request 2 auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 45 to 192.168.100.254 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 45 with timestamp 46c3b8db Nothing to do. Sleeping until we see a request. -- Kelly Ormsby Senior Unix Systems Administrator Email: kelly7478(a)gmail.com Mobile: 0417 910 801

3 4

building RPM from source
by Fred Zinsli 15 Aug '07

15 Aug '07

Hi Everyone I am rather new to this, so I hope I am not asking something obvious. I am attempting to build an RPM from source on my FC5 box. The reason is that I am wanting to use hotcakes (a wifi administration app) and it requires 1.1.4 minimum and the latest stable for FC5 is 1.0.5 What I am actually wanting to achieve is a Freeradius install on my FC5 box that puts everything where I am expecting to find them on my FC5 box. I thought building an RPM from source was the idea, but there may be others I am unaware of. My issue is that I am wanting mysql (on separate server) support built into freeradius, but I can't find any information on how that is done within the spec file. Note: This install of freeradius is on a standalone machine, it will have nothing else but freeradius on it. Any thoughts or comments on where I can find the information I need would be most helpful. This is how I am trying to do it so far: $ cd ~ $ cp -a /usr/src/redhat/ rpmbuild $ echo '%_topdir %(echo $HOME)/rpmbuild' >> .rpmmacros $ wget ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.7.tar.gz $ cp freeradius-1.1.7.tar.gz ~/rpmbuild/SOURCES/ $ tar zxf freeradius-1.1.7.tar.gz freeradius-1.1.7/redhat/freeradius.spec $ cp freeradius-1.1.7/redhat/freeradius.spec ~/rpmbuild/SPECS/ $ cd ~/rpmbuild/RPMS/i386 $ rpm -Uvh freeradius-1.1.7-0.i386.rpm No mods to the spec file (information required). Regards Fred

4 5

Multiple (different) LDAP servers and authorisation
by Stewart James 15 Aug '07

15 Aug '07

Hi all, I have been roped in to look over an issue we have with migrating from Novell to AD. What we would like to do while we in the transitional phase is check both the AD and Novell LDAP services for authorisation and authentication (usernames are completely different so no need to be concerned with username clashes). I have managed to setup authentication fall through without any real issues, but, authorisation is having issues. Just to clarify, if I only specify one of the LDAP servers everything works like a treat, so the actual ldap server definitions are working fine in their own right. If I have the authorisation section setup: group LDAP { vudc01 { notfound=2 ok=return } novell { notfound=2 ok=return } } (I have also tried variations without the group LDAP line) Things eventually fail and the last useful message (I think) from -X -f is: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user It's not entirely clear what the freeradius LDAP module is doing BUT it would appear that it looks over both authorisation assertions and takes the one with least rights, but, I am not sure. As I stated earlier authentication fall through works like a treat (if in the users file I don't specify an LDAP-Group authentication works). If I only specify 1 ldap server to do authentication and authorisation, everything works, its only when I try to do authorisation via LDAP-Group AND try to do authorisation fall through as documentation above do I start getting errors. Can anyone offer any advice or pointers? Cheers, Stewart -X -f output: rad_recv: Access-Request packet from host 127.0.0.1:32909, id=60, length=60 User-Name = "USERNAME" User-Password = "PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "USERNAME", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=vu ' radius_xlat: '(uid=UID)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=vu, with filter (uid=USERNAME) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "files" returns notfound for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for USERNAME radius_xlat: '(samaccountname=USERNAME)' radius_xlat: 'dc=ad,dc=vu,dc=edu,dc=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ad,dc=vu,dc=edu,dc=au, with filter (samaccountname=USERNAME) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user USERNAME authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "vudc01" returns ok for request 1 modcall: leaving group redundant (returns ok) for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 60 to 127.0.0.1 port 32909 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 60 with timestamp 46c24e67 Nothing to do. Sleeping until we see a request.

3 5