January 2008 - Freeradius-Users - lists.freeradius.org

FW: Help Needed Please freeradius traffic limiting
by Keith Dovale 16 Jan '08

16 Jan '08

Regards Keith Dovale <http://www.hostworx.co.za/> From: Keith Dovale Sent: Tuesday, January 15, 2008 6:24 PM To: 'FreeRadius users mailing list' Subject: Help Needed Please freeradius traffic limiting Ok I need to do this and if someone could help I would appreciate it as I am new to this 1. I Need to limit users by traffic and NOT session time (I setup the monthly counters to check but the counters cannot go beyond 2,148,000,000 and they fail I think this is due to the counters using the type as integer. If I can get this value to go beyond this this then sorts out my problem based on traffic.) 2. I need to execute a query to check the clients total traffic usage and compare it to their limit, if they have gone beyond their limit I need to be able to execute a disconnect. (The disconnect side I have got working manually, so if there is a way to trigger / execute a program on a interim update which will force a discon that will help, else if this can be done another way please let me know. 3. Any recommendations on how to go about the above issues which will do this in an easier way please let me know. Regards Keith Dovale <http://www.hostworx.co.za/>

3 2

Authorize/authenticate with LDAP
by Thierry CHICH 16 Jan '08

16 Jan '08

Hello, I have a small problem a little bit annoying, and it seems to me that a lot of people using LDAP don't know that they have the same problem. I explain : I have an access-point, and I want use EAP/TTLS in order to authenticate people on my LDAP server. The first time, I had then something like that: authorize { preprocess suffix eap files Autz-Type LDAP { ldap } } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } It is working. I am not sure it is the minimal configuration, but I don't care too much. My problem is the following: in my intel proset, if I am giving a false identity in my roaming profile with a good identity and a good password, it is working. The authorization step doesn't work as I want. The most important problem is that the accounting is using my roaming profile. I can partially solve the problem using : Autz-Type LDAP { ldap{ notfound = reject } } Then, the roaming profile must be a valid LDAP name. But I still can use an arbitrary valid LDAP name. In fact, the most important thing to me is that the accounting, and session logger use the good name. Is it a solution to my problem ? Thx, -- Thierry CHICH Equipe Réseaux / Rectorat de Clermont-Ferrand Tel: +33 4 73 99 30 54

4 6

Looking for some Ascend Max TNT documentation
by Chad Whitten 16 Jan '08

16 Jan '08

Hello, I run a few NAS devices, all Lucent/Ascend Max TNT with a freeradius server. Im trying to locate some documentation on the Max TNT to change some options and the site I used to use - hal-pc.org/~ascend doesnt seem to be available any longer. Thought I might try my luck here. What I am needing to do is simply turn off radius authentication for one of the boxes and let anything that connects - connect. -- Chad Whitten Metro Network Solutions (601) 366-6630 Phone (601) 366-6066 Fax (601) 842-6804 Cellular (601) 519-4172 Pager cwhitten(a)metronetsys.com

2 1

Re: LDAP Groups and EAP
by Brian Wilson 16 Jan '08

16 Jan '08

I tried updating to version 2.0. I like the debug interface much better, it makes it alot easier to read. Nice job! Unfortunately, this upgrade introduced a new issue for me. When doing group ldap searches, it looks like the Ldap-UserDN variable doesn't get populated. The server successfully binds and finds the user, but in the expand section: rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&objectClass=GroupOfNames)(member=%{Ldap-UserDN}))(&objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDN})))->(|(&objectClass=GroupOfNames)(member=))(&(objectClass=GrouOfUniqueNames)(uniquemember=))) It then fails to find the ldap group, because of the member= and uniquemember= are blank. A few lines below that, though, it comes up with the correct full DN search: rlm_ldap: performing search in cn=somegroup,ou=something,ou=something with filter (|(&objectClass=GroupOfNames)(member=))(&(objectClass=GrouOfUniqueNames)(uniquemember=))) rlm_ldap: object not found or got ambigous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing serach in cn=xxx,ou=something,ou=something with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values failed I tried using my old config from 1.1, as well as re-writing it, as well as using the new and old ldap.attrmap. This is verified to work in version 1.1 for me. This is against eDirectory, configured with the --with-edir option ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Saturday, January 12, 2008 3:40:39 AM Subject: Re: LDAP Groups and EAP Brian Wilson wrote: > I am running Freeradius 1.1.0 Please upgrade to at least 1.1.7. It solves a lot of security issues, *and* helps with the problem you're seeing, too. > When I try to authenticate, the radius server receives about 7 > Access-requests. That's the way EAP works. > Notice that there is no additional call to ldap_group between the > authorize and the resulting failure in the files module. The *inner* tunnel session doesn't match a huntgroup. > Is there something i'm missing in the configuration file? I would suggest trying 2.0. The new virtual server feature should make this configuration much simpler. The new "unlang" feature should also simplify the writing of policies. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 3

Freeradius + portuguese characters in Active Directory
by nikitha george 16 Jan '08

16 Jan '08

Hi, I am creating a user account in AD with portuguese character and have the freeradius configured properly. But i am not able to get the successfull authentication. For example, i added a user account "catónio" and displayname as "catónio" But the radius server log shows, sending a user name as "cat\5c303\5c263nio ". Do we need to do anything different to support languages other than english or am i missing some other configuration? FYI: If i change the user account to plain exglish characters then it works, so there are no issues with configuration settings. Any idea why it happens and how to get it work with? Thanks, Nikitha

3 8

SQL Groups and Autz-Type
by Etienne Pretorius 16 Jan '08

16 Jan '08

Hello List, I have a question regarding the ability of rlm_sql setting of the Autz-Type attribute. I am attempting to assign/add to the Autz-Type attribute for processing of sqlcounter instances based on the groups the user belongs to. User bob@testing belongs to a group DSL-LOCAL for local only DSL service. In the authorize section after the sql statement I have a sqlcounter called "MonthlyOctetsLocal" that need to be executed if the user belongs to the DSL-LOCAL group. # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql Autz-Type DSL-LOCAL { MonthlyOctetsLocal } debian:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf <cut> Module: Instantiated sql (sql) Module: Loaded SQL Counter sqlcounter: counter-name = "Monthly-Session-Octets-Local" sqlcounter: check-name = "Max-Monthly-Octets-Local" sqlcounter: reply-name = "(null)" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='%{%k}' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "monthly" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" <cut> Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32768, id=178, length=62 User-Name = "bob@testing" User-Password = "hello" Access-Type = "DSL" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "testing" for User-Name = "bob@testing" rlm_realm: No such realm "testing" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'bob@testing' rlm_sql (sql): sql_set_user escaped user --> 'bob@testing' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bob@testing' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bob@testing' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "pap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password hello rlm_pap: Using clear text password "hello". rlm_pap: User authenticated successfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Sending Access-Accept of id 178 to 127.0.0.1 port 32768 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Umm, nothing was executed within the Autz-Type section at all. So to test if the rlm_sql module is actually attempting to set the Autz-Type attribute I did this in the authorize section. # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # Autz-Type DSL-LOCAL { # MonthlyOctetsLocal # } MonthlyOctetsLocal Started the server again in debug mode: <cut> Module: Instantiated sql (sql) Module: Loaded SQL Counter sqlcounter: counter-name = "Monthly-Session-Octets-Local" sqlcounter: check-name = "Max-Monthly-Octets-Local" sqlcounter: reply-name = "(null)" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='%{%k}' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" <cut> Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32768, id=183, length=62 User-Name = "bob@testing" User-Password = "hello" Access-Type = "DSL" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "testing" for User-Name = "bob@testing" rlm_realm: No such realm "testing" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'bob@testing' rlm_sql (sql): sql_set_user escaped user --> 'bob@testing' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bob@testing' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bob@testing' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' *rlm_sql: Failed to create the pair: Unknown value DSL-LOCAL for attribute Autz-Type* rlm_sql (sql): Error getting data from database rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='%{User-Name}' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1199138400'' radius_xlat: 'SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='bob@testing' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1199138400'' sqlcounter_expand: '%{sql:SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='bob@testing' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1199138400'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='bob@testing' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1199138400'' rlm_sql (sql): - sql_xlat radius_xlat: 'bob@testing' rlm_sql (sql): sql_set_user escaped user --> 'bob@testing' radius_xlat: 'SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) ???FROM radacct WHERE UserName='bob@testing' ???AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1199138400'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 3 radius_xlat: '1073741824' rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user bob@testing, check_item=-1, counter=1073741824 modcall[authorize]: module "MonthlyOctetsLocal" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 183 to 127.0.0.1 port 32768 Reply-Message = "Your maximum monthly usage time has been reached" Waking up in 4 seconds... "rlm_sql: Failed to create the pair: Unknown value DSL-LOCAL for attribute Autz-Type" line in the above output indicates that the rlm_sql module is setting the attribute - or here attempting to do so. Anyway, why did the previous attempt not try and run the sqlcounter module instance? Any advise/help on this subject will be much appreciated. -- Kind Regards Etienne Pretorius

1 1

Group Membership query??
by Marc LEURENT 16 Jan '08

16 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Good evening, I'm sending a group membership query from openser to freeradius... I would like to send a group membership query, but it's a group authorize query that is received... Any idea? Thanks!!! See output below: Going to the next request Sending Access-Reject of id 62 to 172.24.4.1 port 35340 Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.24.4.1:35344, id=62, length=75 User-Name = "mleurent(a)sip.bob.net" Sip-Group = "suspended" Service-Type = Voice NAS-Port = 0 NAS-IP-Address = 172.24.4.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/freeradius/radacct/172.24.4.1/auth-detail-20080114' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.24.4.1/auth-detail-20080114 modcall[authorize]: module "auth_log" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall[authorize]: module "digest" returns noop for request 5 rlm_realm: Looking up realm "sip.bob.net" for User-Name = "mleurent(a)sip.bob.net" rlm_realm: No such realm "sip.bob.net" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 radius_xlat: 'mleurent(a)sip.bob.net' rlm_sql (sql): sql_set_user escaped user --> 'mleurent(a)sip.bob.net' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mleurent(a)sip.bob.net' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mleurent(a)sip.bob.net' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'mleurent(a)sip.bob.net' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mleurent(a)sip.bob.net' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 5 rlm_python [freeradius-cdrtool]: entering the authorization phase ... rlm_python [freeradius-cdrtool]: ignoring unsupported method. modcall[authorize]: module "python" returns ok for request 5 modcall: leaving group authorize (returns ok) for request 5 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [mleurent(a)sip.bob.net/<no User-Password attribute>] (from client private port 0) Delaying request 5 for 1 seconds Finished request 5 Going to the next request - --- Walking the entire request list --- Waking up in 1 seconds... - --- Walking the entire request list --- sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.V alue,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.V alue,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHi6GcN4+o+2LtdFwRAo6dAKDcrKrHkCQbAZVG760/THgVbvjAiQCgmEmi xhAa8CvRnHNc5E9wKRj7wjA= =K+hh -----END PGP SIGNATURE-----

2 1

radwho radzap problem
by Oguzhan Kayhan 16 Jan '08

16 Jan '08

Hello, I am using rlm_perl script for authentication. And logging radacct in sql. But it is strange that, i couldnt use radwho radzap radlast etc for a while.. had the error "file not found" etc.. So i manually created the files with touch. Now i can see theres records inside files, but still i cant see any data with radwho or radlast commands. And also, i can not zap staled sessions too with radzap, even i tried to clean sql log with a cleanstale.php script , some of my users still seem online. I am attaching the radiusd.conf file and i wonder if smbody can help me about this situation. Thanks a lot.

2 2

Freeradius is unable to connect to Oracle Server through an Oracle client
by Ripunjay 16 Jan '08

16 Jan '08

Hi, I have installed Oracle Client on a Linux Machine. Then I installed FreeRadius-1.1.4 Server on the same machine.I could succesfully create rlm_sql drivers for oracle. But even after supplying correct remote DB info in oraclesql.conf and sql.conf freeradius server is unable to connect to remote DB. There is some error that pops up on console - reads like : Could not resolve TNS name Plz help -- View this message in context: http://www.nabble.com/Freeradius-is-unable-to-connect-to-Oracle-Server-thro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

radsqlrelay v1.7 on freebsd 6.3
by roy 15 Jan '08

15 Jan '08

Apologies for cross-posting. Just wondering if anyone else was able to run radsqlrelay successfully on FBSD 6.3. I've ran into file lock issue right after I've tried running the pl script: # ls -al total 8 drwxr-xr-x 3 root wheel 512 Jan 14 13:39 . drwxr-xr-x 5 root wheel 512 Jan 14 11:42 .. drwxr-xr-x 2 root wheel 512 Jan 14 11:49 127.0.0.1 -rw-r--r-- 1 root wheel 51 Jan 14 11:49 sql-relay # radsqlrelay -b radius -d pg -h 172.16.10.100 -u postgres /home/radius/sql-relay error: Couldn't lock /home/radius/sql-relay.work: Invalid argument # ls -al total 8 drwxr-xr-x 3 root wheel 512 Jan 14 13:39 . drwxr-xr-x 5 root wheel 512 Jan 14 11:42 .. drwxr-xr-x 2 root wheel 512 Jan 14 11:49 127.0.0.1 -rw-r--r-- 1 root wheel 51 Jan 14 11:49 sql-relay.work Inspecting radsqlrelay shows the following lines: # /!\ OS-dependent structure # Linux struct flock # short l_type; # short l_whence; # off_t l_start; # off_t l_len; # pid_t l_pid; # c2ph says: typedef='s2 l2 i', sizeof=16 my $FLOCK_STRUCT = 's2l2i'; Application versions that are being used: FreeBSD 6.3-PRERELEASE p5-DBD-Pg-1.49 p5-DBI-1.60.1 postgresql-client-8.1.11 freeradius-devel-2.0.0.p2 radsqlrelay v1.7 I'm no real coder myself, hence, the need to seek direction. Any necessary change on the script that I need to make? Thanks again, roy

2 4