September 2007 - Freeradius-Users - lists.freeradius.org

Asterisk+openser+Freeradius
by Live Great 26 Sep '07

26 Sep '07

Hi, Is this the solution to provide an accurate billing/accounting function? What is the goal for integrating this 3 software? I've been searched google for a while, but couldn't find a clear answer. Where can I download documentation about this setup? Your comment is much appreciated. Thanks SW

1 0

How to send different attributes a miscellaneous nas
by Medvedev Maxim 26 Sep '07

26 Sep '07

How I can solve a problem of sending of different attributes miscellaneous NAS from which the user in combination FR+sql or FR+ldap comes? > Multiple groups per user don't work properly. And that is what you want. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 26/9/2007, "Medvedev Maxim" <sp_root at mail.ru> pise: > >>In FreeRadius 1.1.7+LDAP group handling work ? >> >>> 1. You need to enter priority for the groups in usergroup table. >>> 2. SQL group handling doesn't really work in 1.1.x versions. Upgrade to >>> 2.0. >>> >>> Ivan Kalik >>> Kalik Informatika ISP >>> >>> Dana 25/9/2007, "Elaalala Erence" <sp_root at mail.ru> pise: >>> >>>>Hi, >>>> >>>>freeradius 1.1.7 + postgres 8.1.9 >>>> >>>>radgroupcheck not work (( >>>> >>>>http://wiki.freeradius.org/Rlm_sql >>>>point 5 not work (( >>>> >>>>Why attributes are summarised ? >>>> >>>>Help me! >> >> >> >>-- >>Best regards, >> Medvedev Maxim mailto:sp_root at mail.ru >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> -- Best regards, Medvedev Maxim mailto:sp_root@mail.ru

2 1

NAS IPs in LDAP?
by Jorgen Lundman 26 Sep '07

26 Sep '07

Currently using freeradius-1.1.2 Solaris openldap-2.3.19, but not live so upgrade is fine. I have successfully setup FreeRadius to use LDAP for the user/pass, and profiles. However on the legacy Radius servers, the administration that was most frequent is adding/removing/modifying the list of NAS IPs that is allowed to talk to us, and for which services. Plus this need to be synchronised with all Radius servers. Is it possible to also store the NAS IPs in LDAP, so changes can be done centrally? At the moment they are listed clients.conf. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

5 9

how can I control a user
by ann kok 26 Sep '07

26 Sep '07

Hi all how can I control to allow a user logon only in dynamic ip ipool in radius server? Thank you again ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

2 1

Exec-Program based on LDAP Attribute
by John Wever 26 Sep '07

26 Sep '07

I need to be able to fire off a script via the Exec-Program (or some other method) based upon a successful authentication and the value of an LDAP attribute on the user's account. I tried putting the following in the acct_users... DEFAULT Acct-Status-Type == Start, CustomAttrib == true Exec-Program = "/path/to/script.sh %u %{Framed-IP-Address} %{CustomAttrib}" I've tried setting the ItemType of the CustomAttrib to checkItem and replyItem, but neither method worked. My script needs access to the username and the Framed-IP-Address. Any suggestions?

2 3

unlang question
by Norbert Wegener 26 Sep '07

26 Sep '07

I am using a recent 2.0.0-pre cvs snapshot. For 802.1x authentication AD is querried for a valid machine account and VLAN, which the ldap modules put into the radius-attribute Huntgroup-Name. The client authenticates via a certificate. Everything works as expected. Nevertheless someone inspecting the switch logs found: 12277052: .Sep 26 13:33:45.914: RADIUS: Received from id 1645/86 139.25.78.162:1812, *Access-Challenge,* len 1130 12277053: .Sep 26 13:33:45.914: RADIUS: authenticator 41 6D FD 2B B1 E6 81 32 - 92 3A 05 C1 96 B9 A5 E9 12277054: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Private-Group[81] 18 "VL-SBS-AD02-0001" *12277055: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Medium-Type [65] 6 00:ALL_802 [6] *12277056: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Type [64] 6 00:VLAN [13] *12277057: .Sep 26 13:33:45.914: RADIUS: EAP-Message [79] 255 and claimed, the Access-Challenge with Tunnel-Private-Group, Tunnel-Medium-Type etc. are not RFC compatible. I can see those values in radiusd -AX, too, but didn't care. My question is: Is he right? If so: How would I have to change the configuration? In my sites-enabeld/default I have: ... # ldap1/2 set control:Huntgroup-Name. redundant { ldap1 ldap2 } ##################################################################################################################################### if ("%{sqlnastype:SELECT vl_vlan from vlan where vl_vlan = '%{control:Huntgroup-Name}' and vl_nasname='%{NAS-IP-Address}'}" == "%{control:Huntgroup-Name}" ) { # das vlan gibt es auf dem swicht update reply { Tunnel-Private-Group-ID ="%{control:Huntgroup-Name}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN } } .. This works as expected. Sending Access-Challenge of id 135 to 172.31.110.149 port 1645^M Tunnel-Private-Group-Id:0 = "VL-SBS-AD02-0001"^M Tunnel-Medium-Type:0 = IEEE-802^M Tunnel-Type:0 = VLAN^M EAP-Message = 0x0104040a0dc000001860160301004a02000046030146fa71a8d8d8395908fa88327d699ee4477b8e014f81fc6f5aabfabb26dda89a204f927ec5aaa134ac60f488278826fbd8be697e5826f45b2890e527d58ca26a0a00040016030113710b00136d00136a0005f6308205f2308204daa003020102020a136547850002003ae484300d06092a864886f70d01010505003081f6310b300906035504061302444531133011060a0992268993f22c64011916036e657431173015060a0992268993f22c64011916077369656d656e733110300e060355040a13075369656d656e7331453043060355040b133c49737375696e6720434120666f72206d6163^M EAP-Message = 0x68696e652063657274696669636174657320696e20746865205369656d656e7320414420666f72657374313a3038060355040b1331436f7079726967687420284329205369656d656e73204147203230303320416c6c20726967687473207265736572766564312430220603550403131b5369656d656e732049737375696e6720434120436c617373204144301e170d3037303832323233333131325a170d3038303231383233333131325a3025312330210603550403131a64653730313874632e77773930312e7369656d656e732e6e657430819f300d06092a864886f70d010101050003818d0030818902818100d420d44e29fdfd018e8ff279b4^M EAP-Message = 0x04d0421c8612c6cd6ba909bb50feca6a71089e6212ef9ae86a3a0cd12f201b25e62ec7395e1365a8bac4477551fed6c41183e2210a3b524e013f80952f7f7efef179f6b48d1a7e219a8e0e789d561b8472485f7792a6e51514018b40e1f90feb314aff3d7a55baceb56b72af1d1bb04ee8a4a30203010001a38202d4308202d0301d0603551d0e041604143349edcf20cbe55a68d010a8df8878bbce1714e4303306092b060104018237150a04263024300a06082b06010505070302300a06082b06010505070301300a06082b06010505080202300b0603551d0f0404030205a030270603551d250420301e06082b0601050507030206082b06010505^M EAP-Message = 0x07030106082b06010505080202303c06092b0601040182371507042f302d06252b060104018237150887e4bc2b85a7c80a85d19529a08c6d819ffa1381219eaf36869ee33d020164020103301f0603551d2304183016801453cf2cd0fe413db6c4731640813764d8702909993081e50603551d1f0481dd3081da3081d7a081d4a081d18681ce6c6461703a2f2f2f434e3d5369656d656e7325323049737375696e672532304341253230436c61737325323041442832292c434e3d6d63686d393335612c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e6669677572^M EAP-Message = 0x6174696f6e2c44433d7369656d656e732c44433d6e65^M Message-Authenticator = 0x00000000000000000000000000000000^M State = 0xcf369d304b83244706a446310ed5b92e^M Finished request 1 state 5^M Going to the next request^M The complete output can be found at http://www.wegener-net.de:/freeradius Norbert Wegener

2 1

R: merging accounting records from two databases
by Francesco Cristofori 26 Sep '07

26 Sep '07

> Hi, Hi Stella, I ran in your problem just quite weeks ago and I solved this way: - Use mysql replication for syncing the two database (you have to make db1 slave of db2 and db2 slave of db1: every record inserted in one db will be automatically inserted in the other one) - Use heartbeat (or whatever you like most) to configure a virtual ip for the two db servers. (eg: db1 has 10.0.0.1 , db2 has 10.0.0.2, virtual ip is 10.0.0.3) - Configure sql module to point to the virtual ip (eg: 10.0.0.3) so the radius servers are unaware of the underlying mysql cluster. You can find lots of docs on google about every topi listed above. > Cheers, > Stella Hth, Francesco.

1 0

merging accounting records from two databases
by Stella 26 Sep '07

26 Sep '07

Hi, We're setting up two radius servers and configuring them so the accounting records are inserted into a mysql database. For redundancy, we're having two radius servers and two database servers. Both radius servers will attempt to write the records to the primary database, if that fails, the secondary database will be used. However, I only see one place in the radius sql.conf file to set the database connection settings. Is there anyway to set the connection settings for a secondary database, or is there no failover? If not, what do people suggest we use? A load balancer or some such? Another problem with this setup is that there may be records in the secondary database which I need to add to the primary database. The main issue I have is when the start record of a session is in one database and the stop record is in the other. I need to match these two records up, so I have all the records in both databases. Is there any application out there that will do this or do I need to write my own? Surely someone else has encountered the same issue? So can anyone advise on the above or point me at some documentation that explains how to do this? All help much appreciated! Cheers, Stella

3 2

Strange CHAP/PAP issue (Version 1.1.6)[sic!]
by Wojciech Ziniewicz 26 Sep '07

26 Sep '07

Hello all, I have a small (about 400 users) network based on pppoe with freeradius authentication. For the last few days I am trying to switch to CHAP authentication. I've made proper changes to radiusd.conf and pppoe-server to demand CHAP auth from users and here's what I get. Here's what we've got in the database : RADCHECK : TEST Cleartext-password := TEST987 TEST Auth-Type := CHAP TEST Password == TEST987 READREPLY: TEST Service-Type = Framed TEST Framed-Compression = Van-Jacobson-TCP-IP TEST Framed-MTU = 1492 TEST Framed-IP-Netmask = 255.255.255.0 TEST Framed-IP-Address = 10.100.2.156 TEST Framed-Protocol = ppp TEST Auth-Type := CHAP TEST Password == TEST987 And the error is : a) here's the fragment from the syslog : Sep 26 01:34:37 beta pppd[5311]: Connect: ppp44 <--> eth2 Sep 26 01:34:37 beta pppd[5311]: rc_avpair_new: unknown attribute 60 Sep 26 01:34:47 beta pppd[5311]: Peer TEST failed CHAP authentication b) And fragment from the radius debug mode : rad_recv: Access-Request packet from host 127.0.0.1:3458, id=144, length=88 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "TEST" CHAP-Password = 0xdf6fe5d7a573bff814452731ef01f044df Calling-Station-Id = "00:E0:91:14:52:C3" NAS-IP-Address = 127.0.0.1 NAS-Port = 8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "attr_filter" returns noop for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 radius_xlat: 'TEST' rlm_sql (sql): sql_set_user escaped user --> 'TEST' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TEST' and access=1 ? ORDER BY id ' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: '' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'TEST' ORDER BY id ' radius_xlat: '' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 3 rlm_chap: login attempt by "TEST" with CHAP password rlm_chap: Using clear text password "TEST987" for user TEST authentication. rlm_chap: Password check failed modcall[authenticate]: module "chap" returns reject for request 3 modcall: leaving group CHAP (returns reject) for request 3 auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [TEST/<CHAP-Password>] (from client localhost port 8 cli 00:E0:91:14:52:C3) Delaying request 3 for 1 seconds Finished request 3 Going to the next request -------------- Any ideas ? Thanks a lot for your time and HELP! regards WZ -- Pozdrawiam, Wojciech Ziniewicz Administrator Cebit

3 8

simultaneous use --solved-- :-)
by Michael Ziemann 26 Sep '07

26 Sep '07

Hi all! I solved my simultaneous-use problems with AcctStopTime 0000-00-00 00:00:00 ... The reason was a wrong MySQL-Code in the sql.conf file: accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct- Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" I changed it to: # |-----> # | edited by Martin Kirchner & Michael Ziemann | Sep. 2007 # |-----> accounting_stop_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}', \ AcctOutputOctets = '%{Acct-Output-Octets}', \ AcctStopTime = FROM_UNIXTIME(UNIX_TIMESTAMP(`AcctStartTime`) + `AcctSessionTime` ) \ WHERE UserName = '%{SQL-User-Name}' \ AND AcctStopTime= '0000-00-00 00:00:00'" Now it works very well... The users can login, but they can't login twice at the same time... The accounting works perfect, too... Thanks for the good support and friendly responses. My project is finished now... Thanks for your patience! Michael Ziemann

2 1