January 2008 - Freeradius-Users - lists.freeradius.org

Fixed time "single use" logins? (mailing list submission)
by michalp 28 Jan '08

28 Jan '08

(I apologise for duplicates) Hi, Is it possible to configure a set of temporary accounts supporting the scenario, where a user gets login, allowing him to be authorised for a fixed amount of time? I mean here of a service, (wireless access) where one buys a $5 card for 1hr of access. No matter how many times he logins to the network, he is allowed until 1 hr from first login with this particular login/password. After 1 hr he will be disconnected... Thanks, Michal -- View this message in context: http://www.nabble.com/Fixed-time-%22single-use%22-logins--%28mailing-list-s… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

RE: Creating rpm problem
by Laurent RAYSSIGUIER 28 Jan '08

28 Jan '08

Hello, >You need to change the freeradius.spec file in the /redhat folder. The >spec points to a .tar.gz for the source, and it's now a .tar.bz2. Or, >you could unpack the tar and gzip it to create the required source >file. I'm looking for bz2 reference in spec file and I don't find it. The SOURCE is tar.gz >Also, I think you might need to change a bit more, as the folder >structure relates to freeradius-server, and the spec file details >freeradius. I try this, but it don't work. I'm not developer and I don't knox how to do this. Best regards Laurent

1 0

Large installations of freeradius
by Imri Zvik 28 Jan '08

28 Jan '08

Hi, In continue to my effort to convince our executives that FreeRadius is the right choice for us, I was asked to find out names of sites with more than 500,000 users (that uses FreeRadius of course :) ). Can anyone help me with that? --imriz

2 1

Upgrade error for LDAP in Freeradius2.0
by Gopinath Reddy N 28 Jan '08

28 Jan '08

Hi, We have upgraded our freeradius1.6 to 2.0 We are using active directory for LDAP server. We have not changed any data in AD. But when we upgrade and try to connect using valid user id..user is getting rejected. Please let me know if there any issues I need to take before ugprading to 2.0 Iam using same bind DN and other strings in 2.0. rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 157.235.205.31:389, authentication 0 rlm_ldap: bind as cn=Administrator,cn=Users,dc=Crossfire,dc=symbol,dc=com/windows2003 to 157.235.205.31:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=Crossfire,dc=symbol,dc=com, with filter (sAMAccountName=satish) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 ******************************************************* rlm_ldap: performing search in cn=Users,dc=Crossfire,dc=symbol,dc=com, with filter (&(cn=sales)(|(&(objectClass=group)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result ******************************************************************************* rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=satish,CN=Users,DC=Crossfire,DC=symbol,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() expand: cn=Users,dc=Crossfire,dc=symbol,dc=com -> cn=Users,dc=Crossfire,dc=symbol,dc=com expand: (|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Users,dc=Crossfire,dc=symbol,dc=com, with filter (&(cn=sales)(|(&(objectClass=group)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=satish,CN=Users,DC=Crossfire,DC=symbol,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 26 ++[files] returns ok ++- entering policy redundant rlm_ldap: - authorize rlm_ldap: performing user authorization for satish expand: (sAMAccountName=%{User-Name}) -> (sAMAccountName=satish) expand: cn=Users,dc=Crossfire,dc=symbol,dc=com -> cn=Users,dc=Crossfire,dc=symbol,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Users,dc=Crossfire,dc=symbol,dc=com, with filter (sAMAccountName=satish) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... ****************************** WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? *************************************** rlm_ldap: user satish authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_secondary] returns ok ++- policy redundant returns ok rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [satish/<via Auth-Type = Reject>] (from client private-network-1 port 1 cli 00-16-CF-50-6C-8C) Thanks gnr

4 5

Question about unlang functionality
by Markus Moeller 27 Jan '08

27 Jan '08

I have a internal check Attribute My-Test defined as string. I have the following in authorize update reply { Reply-Message = " Hi " } switch control:My-Test { case "500" { update control { Auth-Type := Reject } update reply { Reply-Message = " Rejected " } } case { update control { Auth-Type := PAM } update reply { Reply-Message = " Accepted " } } Firstly I noticed that I can not update an attribute twice as I always get the reply message Hi. Secondly the switch case does not work but an if does if (control:My-Test == "500" ) { update control { Auth-Type := Reject } update reply { Reply-Message = " Rejected " } } else { update control { Auth-Type := PAM } update reply { Reply-Message = " Accepted " } } Is this a bug or wrong programming ? Thank you Markus

2 3

Creating rpm problem
by Laurent RAYSSIGUIER 27 Jan '08

27 Jan '08

Hello, I have a problem to create a rpm of freeradius-server-2.0.1. If i download tar.gz file and i try to create rpm, i've got this message : [root@ldap1 ~]# rpmbuild -ta freeradius-server-2.0.1.tar.gz error: File /root/freeradius-2.0.1.tar.gz: No such file or directory Scripts have freeradius-2.0.1 instead of freeradius-server. I don't knox how to correct this. I'm work on CentOS 5, so I try to download Fedora 8 srp.rpm which is the closer than my operating system. I can compile it but I had some errors when I install the resulting rpm files. - An error on eap when executing postinstall script - The /etc/init.d/freeradius file is an Suse Linux script and not a Redhat like script. I had corrected the script and freeradius works well because I don't use eap, but is there a solution to compile rpms from tar.gz correctly ? I don't find any solution on freeradius archive :-( Best regards Laurent

2 1

Commercial support
by Imri Zvik 27 Jan '08

27 Jan '08

Hi, We're considering implementing FreeRadius in our network. Our client base is approximately 1 million users. We would like to know if there are any companies who are willing to support FreeRadius commercially (including bug fixes, features development, and contracted SLA). I've checked the "Support" page, but I did not find any mentioning of the above. If you know someone who can provide us with such support, or if you offer such support your self, please contact me off-list. Thanks!

1 0

unlang question
by Andy Billington 27 Jan '08

27 Jan '08

hi all, am looking at whether to migrate to 2.0 to create a couple of possibilities and was wondering if I can: 1. create a main vritual server 2. use unlang to parse the incoming requests and then based on whether they match a regex, proxy them to different virtual servers or to an external 3rd party RADIUS? I'm sure Ive missed something in the docs so pls any pointers verey gratefully received ! Andy

2 3

rlm_perl and RLM_MODULE_REJECT
by Jean-Michel Caricand 27 Jan '08

27 Jan '08

Hi, I have a question on rlm_perl and RLM_MODULE_REJECT. If in a function (post_proxy) I return RLM_MODULE_REJECT I can see this in log : modcall[post-proxy]: module "perl1" returns reject for request 1 ... but my request is still accepted : Access-Accept not Access-Reject ! How to do that ? Thank. -- Jean-Michel Caricand Tél: 03.81.66.20.63 E-mail: jean-michel.caricand(a)lifc.univ-fcomte.fr Equipe systèmes Laboratoire d'Informatique de l'Université de Franche-Comté 16, route de Gray - 25030 BESANÇON CEDEX

3 8

Force Auth-Type
by Markus Moeller 27 Jan '08

27 Jan '08

Hi, I am new to freeradius and try to authenticate users with pam and authorize with ldap groups. I try to find a minimal configuration but have some problems forcing the Auth-Type to be PAM. I have radiusd.conf: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { ipaddr = * port = 0 type = auth } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files syslog_facility = daemon file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pam { pam_auth = radiusd } ldap { server = "192.168.2.1" port = 636 identity = "uid=ldapadmin,ou=external,dc=example,dc=com" password = controllme basedn = "ou=external,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls_mode = yes tls { start_tls = no cacertdir = /etc/certs } set_auth_type = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 suppress { User-Password } } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } } $INCLUDE sites-enabled/ sites-enabled/default: authorize { auth_log ldap } authenticate { pam } preacct { acct_unique } accounting { detail } ldap.attrmap: checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem If I run radiusd-X I get: rad_recv: Access-Request packet from host 127.0.0.1 port 63402, id=76, length=58 User-Name = "fred" User-Password = "hamster" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080123 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080123 expand: %t -> Wed Jan 23 19:53:47 2008 ++[auth_log] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for fred WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fred) expand: ou=external,dc=example,dc=com -> ou=external,dc=example,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: setting TLS CACert Directory to /etc/certs rlm_ldap: starting SSL rlm_ldap: (re)connect to 10.129.189.34:5636, authentication 0 rlm_ldap: bind as uid=ldapadmin,ou=external,dc=example,dc=com/controlme to 192.2.1.1:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=networks,ou=external,dc=example,dc=com, with filter (uid=fred) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user fred authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [fred/hamster] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 189 to 127.0.0.1 port 63418 Waking up in 4.9 seconds. Cleaning up request 0 ID 189 with timestamp +3 Ready to process requests. Only if I set set_auth_type = yes in radiusd.conf for ldap and change authorize in default to: Auth-Type LDAP { pam } I get a successful login. Is there any other way to force Auth-Type tp be PAM for all users ? Is there also a way to disable the use of the ldap.attribute mapping as I really don't need it ? Thank you Markus

2 7