January 2008 - Freeradius-Users - lists.freeradius.org

Re: multiple access credential
by arjuna＠ts.infn.it 23 Jan '08

23 Jan '08

> > For instance, the mail attribute ? You just have to change the filter in > the > ldap configuration i need different filter for different cases. ldap configuration section in radius.conf covers only one case, is it right? > >> May i use the huntgroup file to make freeradius look for different >> fields >> into the ldap dir? >> >> for example: >> >> ou=People > > Your example is not very clear, I think. > yes sorry, i sent the email while writing... :) my fault. ou=People uid=username wireless-access-password=whatever shell-access-password=whatever2 802.3-access-password=xx:xx:xx:xx:xx:xx something like this. So i need to get the right password on the base of the "NAS" ip (NAS is not the very right word). Now is it clearer? So, can a single radius server manages this scenario? Do i need realms or huntgroup files or something else? thanks arjuna

1 0

multiple access credential
by arjuna＠ts.infn.it 23 Jan '08

23 Jan '08

this is the problem: I need different kind of authentication against a Ldap dir, better with the same username (userid,uid). May i use the huntgroup file to make freeradius look for different fields into the ldap dir? for example: ou=People

2 1

FreeRadius V2.0.0 Simultaneous-Use Problems
by Dryw Paulic 22 Jan '08

22 Jan '08

Hello Everyone, On Freeradius Version 2.0.0, I have an issue with Simultaneous-Use. Multiple logins are being caught, but the issue seems to be that the checks seem to be catching much more than they should be. In particular, I was looking at this user: mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | dynamic | Auth-Type | == | Local | | 2 | static | Auth-Type | == | Local | | 8 | static | Simultaneous-Use | := | 1 | | 7 | dynamic | Simultaneous-Use | := | 1 | +----+-----------+------------------+----+-------+ 4 rows in set (0.00 sec) mysql> select * from radusergroup where username='Kat'; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | Kat | static | 1 | +----------+-----------+----------+ 1 row in set (0.00 sec) mysql> select * from radcheck where username='Kat'; +------+----------+------------+----+----------------------+ | id | UserName | Attribute | op | Value | +------+----------+------------+----+----------------------+ | 4946 | Kat | Password | == |testing123 | | 4947 | Kat | expiration | := | 15 Feb 2008 15:01:32 | +------+----------+------------+----+----------------------+ 2 rows in set (0.00 sec) I took a look at the SQL Queries used by freeradius to check the logins and decided to run them manually on my sql database: mysql> SELECT COUNT(*) FROM radacct WHERE username = 'Kat' AND acctstoptime = 0; +----------+ | COUNT(*) | +----------+ | 16 | +----------+ 1 row in set (0.00 sec) But if I run: mysql> select * from radacct where username ='Kat' \G; *************************** 26. row *************************** radacctid: 1789 acctsessionid: 00:0E:0C:2D:18:56:12008736891000 acctuniqueid: 9d581ecac1736df4 username: kat groupname: realm: nasipaddress: ###.###.###.### nasportid: nasporttype: Wireless-802.11 acctstarttime: 2008-01-20 23:22:02 acctstoptime: 2008-01-20 23:22:02 acctsessiontime: 1322 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: acctinputoctets: 425841 acctoutputoctets: 170623 calledstationid: 00:0E:0C:2D:18:56 callingstationid: 00:13:e8:6a:e1:cf acctterminatecause: Admin-Reset servicetype: framedprotocol: framedipaddress: 10.51.2.56 acctstartdelay: 0 acctstopdelay: 0 xascendsessionsvrkey: NULL 26 rows in set (0.00 sec) You can see from the last row returned that they are indeed logged out. But attempts to login are futile as radpostauth shows: +------+------+--------+---------------+--------------------------+ | id | user | pass | reply | date | +------+------+--------+---------------+--------------------------+ | 97264 | Kat | testing123 | Access-Reject | 2008-01-21 09:40:50 | +------+------+--------+---------------+--------------------------+ The problem is, if you try to log this person in the server saying that they are already logged in, because the simul_count_query is picking up *ALL* rows which have accountstoptime = 0. This is an problem because all the accounting records are kept in the same place as the start and stop records, which means that there will always be records with an acctstoptime=0 in that table. Am I doing anything wrong here? Any tips on how to fix this problem would be much appreciated. Thanks in Advance! Regards, Dryw Paulic

3 4

Imagestream
by Matthew Neumark 22 Jan '08

22 Jan '08

Any imagestream users know how to setup the router to get speed limiting queues from freeradius? Matt

1 0

Version 2.0.1 has been released.
by Alan T DeKok 22 Jan '08

22 Jan '08

Version 2.0.0 was released less than two weeks ago, and has proven to be very stable and bug-free. A few issues have recently been found and fixed, and "unlang" has has some minor changes which result in much simpler policies. As a result, we are releasing 2.0.1 today. See http://freeradius.org for the announcement and download links. Feature improvements * "unlang" has been expanded to do less run-time expansion, and to have better handling of typed data. See "man unlang" for documentation and new examples. Bug fixes * The 'acct_unique' module has been updated to understand the deprecated (but still used) Client-IP-Address attribute. * The EAP-MSCHAPv2 module no longer leaks MS-CHAP2-Success in packets. * Fixed crash in rlm_dbm. * Fixed parsing of syslog configuration. The changes in "unlang" simplify references to attributes, and add type-specific checking: if (Framed-IP-Address) { # was "%{Framed-Ip-Address}" in 2.0.0 ... # not possible in 2.0.0 if ((Framed-IP-Address > 192.168.0.1) && (Framed-IP-Address < 192.168.0.4)) { ... # refer to VALUEs by name: if (Service-Type == Login-User) { ... Alan DeKok.

2 1

Re: Problem with Vista EAP-PEAP Authentication
by debug afone 22 Jan '08

22 Jan '08

Hi, Yes, Freeradius has been compiled with freeradius.org sources. You'll find below the end of Freeradius debug output : Tue Jan 22 17:18:48 2008 : Debug: Thread 4 handling request 3, (1 handled so far) User-Name = "nsouleman" NAS-IP-Address = 10.40.0.114 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905b7e" Calling-Station-Id = "0019d2ae409a" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 32 NAS-Port-Id = "32" Framed-MTU = 1400 State = 0x4d65e25317851beaa7122ab0f6d7758f EAP-Message = 0x020400061900 Message-Authenticator = 0x5fe3280798b9c0bf7eb60427ac59acac Tue Jan 22 17:18:48 2008 : Debug: Processing the authorize section of radiusd.conf Tue Jan 22 17:18:48 2008 : Debug: modcall: entering group authorize for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 3 Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: '/usr/local/freeradius-1.1.6/var/log/radius/radacct/10.40.0.114/auth-detail- 20080122' Tue Jan 22 17:18:48 2008 : Debug: rlm_detail: /usr/local/freeradius-1.1.6/var/log/radius/radacct/%{Client-IP-Address}/auth -detail-%Y%m%d expands to /usr/locaar/log/radius/radacct/10.40.0.114/auth-detail-20080122 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: EAP packet type response id 4 length 6 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: - authorize Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: performing user authorization for nsouleman Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: '(&(objectclass=posixAccount)(uid=nsouleman))' Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: 'ou=Users,dc=angers,dc=afone,dc=fr' Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: performing search in ou=Users,dc=angers,dc=afone,dc=fr, with filter (&(objectclass=posixAccount)(uid=nsouleman)) Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Added password xxxxxxx in check items Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: looking for check items in directory... Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Adding sambaNTPassword as NT-Password, value 06ED974D43A7B40ACF5F9798C7060A4B & op=21 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Adding sambaLMPassword as LM-Password, value 2C720756F237E37AAAD3B435B51404EE & op=21 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: looking for reply items in directory... Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: user nsouleman authorized to use remote access Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "ldap" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall: leaving group authorize (returns updated) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rad_check_password: Found Auth-Type EAP Tue Jan 22 17:18:48 2008 : Debug: auth: type "EAP" Tue Jan 22 17:18:48 2008 : Debug: Processing the authenticate section of radiu Tue Jan 22 17:18:48 2008 : Debug: modcall: entering group authenticate for reque Tue Jan 22 17:18:48 2008 : Debug: modsingle[authenticate]: calling eap (rlm_ea Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: Request found, released from the li Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: EAP/peap Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: processing type peap Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_peap: Authenticate Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: processing TLS Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: ack handshake fragment handler Tue Jan 22 17:18:48 2008 : Debug: eaptls_verify returned 1 Tue Jan 22 17:18:48 2008 : Debug: eaptls_process returned 13 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Tue Jan 22 17:18:48 2008 : Debug: modsingle[authenticate]: returned from eap ( Tue Jan 22 17:18:48 2008 : Debug: modcall[authenticate]: module "eap" returns Tue Jan 22 17:18:48 2008 : Debug: modcall: leaving group authenticate (returns h Sending Access-Challenge of id 155 to 10.40.0.114 port 1073 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4ad057184faa4b804f88ebf214d9cbe0 Tue Jan 22 17:18:48 2008 : Debug: Finished request 3 Tue Jan 22 17:18:48 2008 : Debug: Going to the next request Tue Jan 22 17:18:48 2008 : Debug: Thread 4 waiting to be assigned a request Tue Jan 22 17:19:19 2008 : Debug: --- Walking the entire request list --- Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 0 ID 152 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 1 ID 153 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 2 ID 154 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 3 ID 155 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Nothing to do. Sleeping until we see a request.

1 0

rlm_opendirectory (FR 2.0.0)
by Info 22 Jan '08

22 Jan '08

Hello all, Quick Qs about the experimental rlm_opendirectory module: * Has anyone built in this module successfully? * Is it possible to add this in without the other experimental modules and, if so, what is the proper flag? (Note, I've tried on separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, and --with-modules="rlm_opendirectory" seemingly to no avail.) * Does the module need to be built against a server version of the Framework or should I be able to build this from the libraries on any os x workstation? Cheers, Jim ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

1 0

Problem with Vista EAP-PEAP Authentication
by debug afone 22 Jan '08

22 Jan '08

Hello, We are trying to authenticate Windows Vista clients using FreeRadius into a HP Procurve architecture. We configured FreeRadius to operate an EAP-PEAP authentication. This works fine with XP SP2 client but the process blocks with Windows Vista at this point : Sending Access-Challenge of id 70 to 10.40.0.114 port 1073 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x668d79caa2854b593ec7e91a8004030b I saw a few posts on the web regarding to this problem. Some users advise to install kb932063 microsoft hotfix but I still have my problem. A patch has been released in 1.1.3 version and then included to 1.1.4 an older. I use 1.1.6 version. The Option SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS take part of rlm_eap_tls.c file. Does anybody have an idea ? Regards, Nicolas SOULEMAN.

2 1

filling in missing attributes
by Duane Cox 22 Jan '08

22 Jan '08

Hello List I'm looking for a suggested solution to this problem. I'm running freeradius 2.0.0 and have a NAS that doesn't supply the NAS-Identifier or Called-Station-Id. I'm using rlm_sql to log acct information and would like to have this missing info filled in. Would it be best to use: rlm_attr_rewrite or use conditional syntax within the sql.conf ie. "%{%{Foo}:-%{Bar}}" Thanks Duane Cox

4 4

Building FreeRadius 2.0 on Mac OS X fails
by Walter Krivanek, VividVisions 22 Jan '08

22 Jan '08

Hi, I'm trying to build the current version of freeradius on my Mac OS X 10.5 Intel 64bit computer. First, I have troubles with the configure script. Even if I show the script my exact location of the MySQL include files using --with-mysql- include-dir and similar, I'm getting warnings that mysql.h has not been found and that the MySQL module will be disabled. BTW: This also happens on my Debian server, where MySQL is installed in the standard directories. Then, when running make, I'm getting the following error: ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (18) cpusubtype (0) is not an object file (bad magic number) ar: internal ranlib command failed Any thoughts? Thanks for your help! Walter

4 11