October 2008 - Freeradius-Users - lists.freeradius.org

group variable
by Alexandre Chapellon 20 Oct '08

20 Oct '08

Hy all I would like to use the name of the group a user is member of to update the check item list. I though using unlang to do so, and an update directive but icannot find the variable name (if any) to use for the name of the group. I have "%{Group}" "%{Group-Name}" "%{SQL-GROUP}" but no success: expansions always gives me an empty string. The groups are stored in MySQL database. the update directive is at the end of the autorize section.... Does anyone knows how to refer to the group?

2 5

Multiple groups
by Jørn Kostøl 20 Oct '08

20 Oct '08

I'm trying to add multiple groups to a user, but only the group with the highest priority (lowest number) is being processed. I've tried this on Freeradius 1.1.7, 2.0.4 and 2.1.1. When I set the priorities different only the first is processed. If I set the priority to the same level only the first entry in the database is processed. Do I need to enable this feature somewhere, or what? Cheers, Jørn

2 1

Error in the negotiations certificates
by Martin Silvero 20 Oct '08

20 Oct '08

ok, this is out when i write "radiusd -X -x" : Mon Oct 20 12:08:36 2008 : Info: FreeRADIUS Version 2.0.5, for host x86_64-unknown-linux-gnu, built on Sep 3 2008 at 17:32:08 Mon Oct 20 12:08:36 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Mon Oct 20 12:08:36 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Oct 20 12:08:36 2008 : Info: PARTICULAR PURPOSE. Mon Oct 20 12:08:36 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Oct 20 12:08:36 2008 : Info: GNU General Public License v2. Mon Oct 20 12:08:36 2008 : Info: Starting - reading configuration files ... Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/snmp.conf Mon Oct 20 12:08:36 2008 : Debug: including files in directory /usr/local/etc/raddb/modules/ Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/files Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/always Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Mon Oct 20 12:08:36 2008 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Mon Oct 20 12:08:36 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Mon Oct 20 12:08:36 2008 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Mon Oct 20 12:08:36 2008 : Debug: main { Mon Oct 20 12:08:36 2008 : Debug: prefix = "/usr/local" Mon Oct 20 12:08:36 2008 : Debug: localstatedir = "/usr/local/var" Mon Oct 20 12:08:36 2008 : Debug: logdir = "/usr/local/var/log/radius" Mon Oct 20 12:08:36 2008 : Debug: libdir = "/usr/local/lib" Mon Oct 20 12:08:36 2008 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Mon Oct 20 12:08:36 2008 : Debug: hostname_lookups = no Mon Oct 20 12:08:36 2008 : Debug: max_request_time = 30 Mon Oct 20 12:08:36 2008 : Debug: cleanup_delay = 5 Mon Oct 20 12:08:36 2008 : Debug: max_requests = 1024 Mon Oct 20 12:08:36 2008 : Debug: allow_core_dumps = no Mon Oct 20 12:08:36 2008 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Mon Oct 20 12:08:36 2008 : Debug: checkrad = "/usr/local/sbin/checkrad" Mon Oct 20 12:08:36 2008 : Debug: debug_level = 0 Mon Oct 20 12:08:36 2008 : Debug: proxy_requests = yes Mon Oct 20 12:08:36 2008 : Debug: log { Mon Oct 20 12:08:36 2008 : Debug: stripped_names = no Mon Oct 20 12:08:36 2008 : Debug: auth = no Mon Oct 20 12:08:36 2008 : Debug: auth_badpass = no Mon Oct 20 12:08:36 2008 : Debug: auth_goodpass = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: client 10.0.31.40 { Mon Oct 20 12:08:36 2008 : Debug: require_message_authenticator = no Mon Oct 20 12:08:36 2008 : Debug: secret = "testing123" Mon Oct 20 12:08:36 2008 : Debug: shortname = "ap2" Mon Oct 20 12:08:36 2008 : Debug: nastype = "other" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Oct 20 12:08:36 2008 : Debug: proxy server { Mon Oct 20 12:08:36 2008 : Debug: retry_delay = 5 Mon Oct 20 12:08:36 2008 : Debug: retry_count = 3 Mon Oct 20 12:08:36 2008 : Debug: default_fallback = no Mon Oct 20 12:08:36 2008 : Debug: dead_time = 120 Mon Oct 20 12:08:36 2008 : Debug: wake_all_if_all_dead = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: home_server localhost { Mon Oct 20 12:08:36 2008 : Debug: ipaddr = 127.0.0.1 Mon Oct 20 12:08:36 2008 : Debug: port = 1812 Mon Oct 20 12:08:36 2008 : Debug: type = "auth" Mon Oct 20 12:08:36 2008 : Debug: secret = "testing123" Mon Oct 20 12:08:36 2008 : Debug: response_window = 20 Mon Oct 20 12:08:36 2008 : Debug: max_outstanding = 65536 Mon Oct 20 12:08:36 2008 : Debug: zombie_period = 40 Mon Oct 20 12:08:36 2008 : Debug: status_check = "status-server" Mon Oct 20 12:08:36 2008 : Debug: ping_check = "none" Mon Oct 20 12:08:36 2008 : Debug: ping_interval = 30 Mon Oct 20 12:08:36 2008 : Debug: check_interval = 30 Mon Oct 20 12:08:36 2008 : Debug: num_answers_to_alive = 3 Mon Oct 20 12:08:36 2008 : Debug: num_pings_to_alive = 3 Mon Oct 20 12:08:36 2008 : Debug: revive_interval = 120 Mon Oct 20 12:08:36 2008 : Debug: status_check_timeout = 4 Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: home_server_pool my_auth_failover { Mon Oct 20 12:08:36 2008 : Debug: type = fail-over Mon Oct 20 12:08:36 2008 : Debug: home_server = localhost Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: realm example.com { Mon Oct 20 12:08:36 2008 : Debug: auth_pool = my_auth_failover Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: realm LOCAL { Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Instantiating modules #### Mon Oct 20 12:08:36 2008 : Debug: instantiate { Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_exec Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating exec Mon Oct 20 12:08:36 2008 : Debug: exec { Mon Oct 20 12:08:36 2008 : Debug: wait = no Mon Oct 20 12:08:36 2008 : Debug: input_pairs = "request" Mon Oct 20 12:08:36 2008 : Debug: shell_escape = yes Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_expr Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating expr Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_expiration Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating expiration Mon Oct 20 12:08:36 2008 : Debug: expiration { Mon Oct 20 12:08:36 2008 : Debug: reply-message = "Password Has Expired " Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_logintime Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating logintime Mon Oct 20 12:08:36 2008 : Debug: logintime { Mon Oct 20 12:08:36 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Oct 20 12:08:36 2008 : Debug: minimum-timeout = 60 Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: radiusd: #### Loading Virtual Servers #### Mon Oct 20 12:08:36 2008 : Debug: server inner-tunnel { Mon Oct 20 12:08:36 2008 : Debug: modules { Mon Oct 20 12:08:36 2008 : Debug: Module: Checking authenticate {...} for more modules to load Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_pap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating pap Mon Oct 20 12:08:36 2008 : Debug: pap { Mon Oct 20 12:08:36 2008 : Debug: encryption_scheme = "auto" Mon Oct 20 12:08:36 2008 : Debug: auto_header = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_chap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating chap Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_mschap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating mschap Mon Oct 20 12:08:36 2008 : Debug: mschap { Mon Oct 20 12:08:36 2008 : Debug: use_mppe = yes Mon Oct 20 12:08:36 2008 : Debug: require_encryption = no Mon Oct 20 12:08:36 2008 : Debug: require_strong = no Mon Oct 20 12:08:36 2008 : Debug: with_ntdomain_hack = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_unix Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating unix Mon Oct 20 12:08:36 2008 : Debug: unix { Mon Oct 20 12:08:36 2008 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to module rlm_eap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap Mon Oct 20 12:08:36 2008 : Debug: eap { Mon Oct 20 12:08:36 2008 : Debug: default_eap_type = "md5" Mon Oct 20 12:08:36 2008 : Debug: timer_expire = 60 Mon Oct 20 12:08:36 2008 : Debug: ignore_unknown_eap_types = no Mon Oct 20 12:08:36 2008 : Debug: cisco_accounting_username_bug = no Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap-leap Mon Oct 20 12:08:36 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Mon Oct 20 12:08:36 2008 : Debug: Module: Instantiating eap-gtc Mon Oct 20 12:08:36 2008 : Debug: gtc { Mon Oct 20 12:08:36 2008 : Debug: challenge = "Password: " Mon Oct 20 12:08:36 2008 : Debug: auth_type = "PAP" Mon Oct 20 12:08:36 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-tls Mon Oct 20 12:08:37 2008 : Debug: tls { Mon Oct 20 12:08:37 2008 : Debug: rsa_key_exchange = no Mon Oct 20 12:08:37 2008 : Debug: dh_key_exchange = yes Mon Oct 20 12:08:37 2008 : Debug: rsa_key_length = 512 Mon Oct 20 12:08:37 2008 : Debug: dh_key_length = 512 Mon Oct 20 12:08:37 2008 : Debug: verify_depth = 0 Mon Oct 20 12:08:37 2008 : Debug: pem_file_type = yes Mon Oct 20 12:08:37 2008 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Mon Oct 20 12:08:37 2008 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Mon Oct 20 12:08:37 2008 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Mon Oct 20 12:08:37 2008 : Debug: private_key_password = "testing123" Mon Oct 20 12:08:37 2008 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Mon Oct 20 12:08:37 2008 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Mon Oct 20 12:08:37 2008 : Debug: fragment_size = 1024 Mon Oct 20 12:08:37 2008 : Debug: include_length = yes Mon Oct 20 12:08:37 2008 : Debug: check_crl = no Mon Oct 20 12:08:37 2008 : Debug: cipher_list = "DEFAULT" Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-peap Mon Oct 20 12:08:37 2008 : Debug: peap { Mon Oct 20 12:08:37 2008 : Debug: default_eap_type = "mschapv2" Mon Oct 20 12:08:37 2008 : Debug: copy_request_to_tunnel = no Mon Oct 20 12:08:37 2008 : Debug: use_tunneled_reply = no Mon Oct 20 12:08:37 2008 : Debug: proxy_tunneled_request_as_eap = yes Mon Oct 20 12:08:37 2008 : Debug: virtual_server = "inner-tunnel" Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Mon Oct 20 12:08:37 2008 : Debug: Module: Instantiating eap-mschapv2 Mon Oct 20 12:08:37 2008 : Debug: mschapv2 { Mon Oct 20 12:08:37 2008 : Debug: with_ntdomain_hack = no Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Error: rlm_eap: No such sub-type for default EAP type md5 Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Mon Oct 20 12:08:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Debug: } Mon Oct 20 12:08:37 2008 : Error: Errors initializing modules

2 1

understanding FreeRADIUS
by Tom D. Davidson 20 Oct '08

20 Oct '08

Hello, I have some usage questions about FreeRADIUS that I am not finding answers for on the wiki. Can FR: * Place user/device in VLAN based on authentication? AAA 802.1q-in-q? I guess this would be FR telling a router/switch to push or pop the tag based on policy? * Other than VLAN in priority queues, can RF AAA any QoS technologies? can it do the priority queues for VLANs? * AAA VPN - both client and server? * Rate limit? Distinquish committed rate, burst rate, and best effort? * AAA firewall ports? * Implement "walled gardens" on users and devices? Is this only for http(s), what about email, ftp, ect...? * AAA IP address assignment? No sure how this works, but device/user request an IP DHCP server checks auth before issuing one? could it change IP address on existing connection? * Account network usage per user per device per interface? FR architecture: * Does being a WPA user make a difference to any of these questions? What about being a device rather than a user? * Authorization policies are not "in" radius, but in the db or directory correct? So to change policy for a user or device, the change would be done through the data store and not through radius? But the policy logic would need to exists in FR (ie modules?)? OR does the policy logic come form the data store as well? * Is there an OS API or does all the direction come through the data store? * Is there any reason why FR couldnt be used as an all encompassing NAC (for WAN)? * Do my questions clearly demostrat that I do not understand FR? :) FR 2.0: Is 2.0 a move to DIAMETER or is DIA not evolutionary? Is 2.0 recommended for production or should operators stick with 1.x? Thank you for your help, tom

3 9

Freeradius not to read radgroupcheck table from MSSQL
by Xiaochen Jing 20 Oct '08

20 Oct '08

Hello, My Freeradius seems only to read radcheck table, not to read radgroupcheck table from MS SQL. Here is my settings: In /mssql/dialup.conf, I edit two queries for authorized_check_query and authorize_group_check_query, instead of using the default ones. Doing this is easy for our database programming. authorize_check_query = "RADIUS_authorize_check_query '%{SQL-User-Name}'" authorize_group_check_query = "RADIUS_authorize_group_check_query '%{SQL-User-Name}'" in sql.conf, read_group is set to yes. Then I suppose Freeradius should start to read group tables. When I test a user whose username is associated to a group name and pool-name, Freeradius returns only authentication successful, but no group info or IP is returned. Here is the debug: rad_recv: Access-Request packet from host 172.16.1.5 port 1723, id=20, length=57 User-Name = "dr.julien.olivier" User-Password = "acdq" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "dr.julien.olivier", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> dr.julien.olivier rlm_sql (sql): sql_set_user escaped user --> 'dr.julien.olivier' rlm_sql (sql): Reserving sql socket id: 2 expand: RADIUS_authorize_check_query '%{SQL-User-Name}' -> RADIUS_authorize_check_query 'dr.julien.olivier' query: RADIUS_authorize_check_query 'dr.julien.olivier' rlm_sql (sql): User found in radcheck table expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'dr.julien.olivier' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'dr.julien.olivier' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "acdq" rlm_pap: Using clear text password "acdq" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth rlm_ippool: Could not find Pool-Name attribute. ++[netplus] returns noop rlm_ippool: Could not find Pool-Name attribute. ++[staffnet] returns noop rlm_ippool: Could not find Pool-Name attribute. ++[julienne] returns noop rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> dr.julien.olivier rlm_sql (sql): sql_set_user escaped user --> 'dr.julien.olivier' ++[sql] returns noop Sending Access-Accept of id 20 to 172.16.1.5 port 1723 Finished request 122. Going to the next request Waking up in 4.9 seconds. Cleaning up request 122 ID 20 with timestamp +79236 Ready to process requests. I don't know where I set it wrong or anything I miss to configure. I mean if radcheck table works, it means at least the query that I changed is working. So I don't know with the same idea, why radgroupcheck does not work. Could anyone give me some ideas? Thanks so much XJ

3 6

redundant-load-balance and Ldap-Group
by Elizabeth Steinke 20 Oct '08

20 Oct '08

Greetings! I'm having an odd problem trying to implement load balancing/redundancy. I have added the following lines to my radiusd.conf authorize {... # # We want redundant ldap lookups ## redundant-load-balance { ldap1 ldap2 } ## # end redundancy ## } modules (... ldap ldap1 { } ldap ldap2 { } } Scenarios: This occurs using freeradius 1.1.7 (built from source) on a centos 5 box. If they both are specified correctly everything appears to work ok . When I purposely break ldap1 it works great and uses ldap2 for the LDAP lookup. When I break ldap2 and correct the IP address ldap1 is using to do lookups I get an access-reject packet back. Here is the snippet of the log (I am posting it for brevity, I will be more than happy to post all of radiusd -X) ---log bits for when it rejects the attempt-- lm_ldap: ...some ldap server in ldap fairy land... failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 69 here is rule 68-69: DEFAULT Huntgroup-Name =="some huntgroup", Auth-Type = ntlm_auth_cleartext Fall-Through = 1 DEFAULT Huntgroup-Name == "some huntgroup",Ldap-Group != "someldapgroup", Auth-Type := Reject I can then see rlm_ldap doing the lookup successfully on ldap1 lm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1:3268, authentication 0 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=..... rlm_ldap: looking for check items in directory... rlm_ldap: Adding memberOf as Ldap-Group == "..." What I think is happening is since the LDAP lookup failed the user is indeed not a user of the group (doesn't exist etc..) so it matches on the failure, since its first match it doesn't matter that is matches on the second lookup. It still gives me a failure. Is their a way keep it from rejecting the attempt if ldap2 is down?

3 5

Machine Authentication
by Casartello, Thomas 20 Oct '08

20 Oct '08

I've tried to find something on the past posts on this list about this. I think I found what the problem is but was unable to find a solution. I'm trying to make it so I can authenticate machines using the computer name. I know I need to set the ntlm_auth command correctly but I couldn't find to what or is there another solution? Here's my output: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for host/billlgateway.ads.wsc.ma.edu with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=host/billlgateway.ads.wsc.ma.edu [mschap] mschap2: 72 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c0b3cf2bed56caa9 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ef761f39a5775d58921cf42503c587f05060638411cf8555 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Thomas E. Casartello, Jr. Wireless Network Technician Linux Specialist Information Technology Westfield State College Westfield, MA 01086 (413) 572-8245

4 11

Re: Question on implementing Vendor-Specific Attributes
by A BlueCoder 20 Oct '08

20 Oct '08

On Mon, Oct 20, 2008 at 12:09 AM, A BlueCoder <bluecoder008(a)gmail.com>wrote: > Hi, > > I have a need to implement Vendor-Specific Attributes using a FreeRadius > approach (version 0.9.3 on Solaris). > > I understand probably rewriting a rml module would solve this problem and > probably the most effective way. However, given the shortage of time, i > would like to explore configuration options (without code writing) if > possible. > > Here are the requirements: > > 1. Access-Request Requests; > > 2. Request Attributes -- with VSA (implemented with a Vendor-specific > dictionary). > > 3. Response Attributes -- with VSA (implemented with a Vendor-specific > dictionary). > > 4. There is a map from attributes in (2) to (3), which is what i am trying > to implement. > > e.g. > > If the request NAS-IP-Address = 111.111.111.111, i would like to response > with attribute: VSA1 = 10000001, > If the request NAS-IP-Address = 111.111.111.112, i would like to > response with attribute: VSA1 = 10000002, > If the request NAS-IP-Address = 111.111.111.113, i would like to > response with attribute: VSA1 = 10000003, > If the request NAS-IP-Address = 111.111.111.114, i would like to > response with attribute: VSA1 = 10000004, > > etc.... > > What's the best way which i can configur without writing a full-fledge rlm > module? > > Thanks in advance, > > BC > > > >

2 1

cisco vpn authentication, freeradius and best practices
by Elizabeth Steinke 19 Oct '08

19 Oct '08

Greetings, I have a best practices question. I am currently building a freeradius+LVS cluster to replace an existing radius server. In the process I am trying to do things as solidly as possible. Part of this process is tidying up the users file. In the process I noticed a rule that made me a little squishy. The purpose of the rule is to handle incoming requests from a cisco pix for VPN authentication. It is supposed to validate it using ntlm_auth. There are two ntlm_auth definitions in the radiusd.conf. One handles MS-CHAP and one is for ntlm_auth_plaintext. I tested this rule with radtest (Making the necessary modifications and it worked fine. DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group = "CN=somevpn...", Auth-Type := ntlm_auth_plaintext DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group != "CN=somevpn...", Auth-Type := Reject Is it a good idea to force the auth-type in the users file? is there a cleaner way to do this? While rewriting the rules file I am pairing accept and denies as above. Is that necessary or will it turn out to be horribly inefficient?

3 3

Re: Allocate IP address
by Rasool Jalali 19 Oct '08

19 Oct '08

hi Please write a example code for my process : I have a table that have a couple of tel numbers : User->Connect->if his/her number is in called_number_table =>give to him a valid IP User->Connect->if his/her number is NOT in called_number_table => give him an invalid IP(192.168.x.y) Which section is suitable for my purpose?authentication-authorization or post-auth PLZ Thanks. ----- Original Message ---- From: "tnt(a)kalik.net" <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Saturday, October 18, 2008 9:08:30 PM Subject: Re: Allocate IP address It does work. Post the whole debug. Ivan Kalik Kalik Informatika ISP Dana 18/10/2008, "Rasool Jalali" <r_jalali(a)ymail.com> piše: >hi >it dose not work.Output : > >+++[control] returns noop > >PLZ help me > > > >----- Original Message ---- >From: "tnt(a)kalik.net" <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Saturday, October 18, 2008 3:36:17 PM >Subject: Re: Allocate IP address > >update control { ... > >Ivan Kalik >Kalik Informatika ISP > > >Dana 18/10/2008, "Rasool Jalali" <r_jalali(a)ymail.com> piše: > >>hi all >>i have a code like this in auth-post section : >>if (condition) { >> allocate from pool_1 >>} >>else { >> allocate from pool_2 >>} >> >>I write this code but it dose not work : >> >>if (condition) { >> update reply { >> Pool-Name : = pool_1 >> } >>} >>else { >> update reply { >> Pool-Name : = pool_2 >> } >>} >> >>PLZ help me >>tanx. >> >>__________________________________________________ >>Do You Yahoo!? >>Tired of spam? Yahoo! Mail has the best spam protection around >>http://mail.yahoo.com >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1