October 2008 - Freeradius-Users - lists.freeradius.org

Setting Auth-Type to Accept using unlang
by Abel Alejandro 14 Oct '08

14 Oct '08

Hello, I want freeradius to assign to a specific ippool any invalid user (user not found or wrong password) as well as accept it. I am trying to do the following in post-auth but so far I can get freeradius to send the Reply-Message, DNS, etc... but it will still send Reject-Access. I am guessing that doing Auth-Type := "Accept" is too late in post-auth. Post-Auth-Type REJECT { if (!NAS-IP-Address == X.X.X.X) { update reply { Reply-Message = "Restricted Access" MS-Primary-DNS-Server = X.X.X.X MS-Secondary-DNS-Server = X.X.X.X RP-Max-Sessions-Per-User = 100 } update control { Auth-Type := "Accept" Pool-Name := "invaliduser_pool" } # Get an address from the IP Pool. invaliduser_pool sql } } I am using the latest version of freeradius 2.1.1. Regards, Abel.

3 5

Re: R: TLV format in WiMAX dictionary
by Alan DeKok 14 Oct '08

14 Oct '08

Stefano Colagreco wrote: > ASN-GW receive attribute but not recognize attribute of WiMAX QoS. Then it's not WiMAX compatible. Simple, isn't it? > Looking at the trace of ASN-GW i've noticed the following mistakes: > > - vendor-unkonwn-type29:00 06 06 00 07 D0 00 Mistake? If you don't want to do QoS, don't send it a QoS attribute. If the ASN-GW doesn't support QoS, buy a standards-compatible gateway. > ASN-GW I used is guaranteed as fully compliant with WiMAX standard. Well, ask for your money back, or for an updated version that's compliant with the WiMAX standard. The QoS attribute has been around for a LONG time in WiMAX. Over a year, IIRC. So there's no excuse for the vendor to ignore it. Alan DeKok.

1 0

Re: R: TLV format in WiMAX dictionary
by tnt＠kalik.net 14 Oct '08

14 Oct '08

>Looking at the trace of ASN-GW i've noticed the following mistakes: > >- vendor-unkonwn-type29:00 06 06 00 07 D0 00 > >ASN-GW I used is guaranteed as fully compliant with WiMAX standard. > Fine. So you can ask them for the updated dictionary then. Ivan Kalik Kalik Informatika ISP

1 0

Re: TLV format in WiMAX dictionary
by Alan DeKok 14 Oct '08

14 Oct '08

Stefano Colagreco wrote: > I try to use freeradius-2.1.1 to autenticate wimax user. In dictionary.wimax > some attribute is defined TLV. I try to send its to ASN-GW in two ways. > > First way - One attribute with multivalue: That won't work. > Second way - A sequence of attribute: That will work. It's been tested with equipment from multiple vendors. > WiMAX-QoS-Id=01 > WiMAX-Media-Flow-Type=Robust-Browser > WiMAX-Schedule-Type=BEST-EFFORT > WiMAX-Traffic-Priority=0 > WiMAX-Maximum-Sustained-Traffic-Rate=512000 > > In the first case I receive an Access-Reject (for invalid TLV format). > In the second send all attribute to ASN-GW but some of it do not come > recognized. What does that mean? "Some are not recognized"? Alan DeKok.

2 1

TLV format in WiMAX dictionary
by Stefano Colagreco 14 Oct '08

14 Oct '08

I try to use freeradius-2.1.1 to autenticate wimax user. In dictionary.wimax some attribute is defined TLV. I try to send its to ASN-GW in two ways. First way - One attribute with multivalue: WiMAX-QoS-Descriptor = "WiMAX-QoS-Id=01;WiMAX-Media-Flow-Type=Robust-Browser;WiMAX-Schedule-Type=BE ST-EFFORT;WiMAX-Traffic-Priority=0;WiMAX-Maximum-Sustained-Traffic-Rate=5120 00" Second way - A sequence of attribute: WiMAX-QoS-Id=01 WiMAX-Media-Flow-Type=Robust-Browser WiMAX-Schedule-Type=BEST-EFFORT WiMAX-Traffic-Priority=0 WiMAX-Maximum-Sustained-Traffic-Rate=512000 In the first case I receive an Access-Reject (for invalid TLV format). In the second send all attribute to ASN-GW but some of it do not come recognized. What is the right form for TLV attribute? Thanks all in advance! Stefano

1 0

Spaces inside usernames
by Mark J Elkins 14 Oct '08

14 Oct '08

This is on FreeRADIUS Version 1.1.7. I use 'mysql' to authenticate users. I had one customer use a name something like "fred @domain.dom" - ie - there is a space after 'fred' and before the '@' sign. This was being logged in my 'radacct' table with the space intact. I've since managed to find the customer and fix the 'space'. I've also changed radiusd.conf ... nospace_user = before nospace_pass = before (nospace_pass - seems like a good idea as well!) (Both were previously set to "no") The user was authentication just fine - so some sort of stripping of the realm was happening before validation - so some sort of "ignore the space" appears to have been happening... but what I'd like to know is will "nospace_user = before" fix future problems of this sort? ???? In addition - in my SQL statement - if the user does not provide a realm - then I append a default realm - which also may have allowed the name to authenticate... (I have some old users who are set in their ways). I see I also compare the two parts (username and realm) separately. authorize_check_query = "SELECT userid as id,UserName,'Password' as Attribute,password as Value,'==' as op FROM useracct WHERE Username='%{Stripped-User-Name}' AND realm=( case when '%{Realm}'='NULL' then 'domain.dom' else '%{Realm}' end) AND status>2 ORDER BY id" -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

Re: access rights for some users ou users groups with
by BADAOUI Nasr-Eddine (P) 14 Oct '08

14 Oct '08

I've configured my tables as follows : mysql> select * from usergroup; +----+----------+-------------+ | id | UserName | GroupName | +----+----------+-------------+ | 13 | st234824 | test_radius | +----+----------+-------------+ mysql> select * from radcheck; +----+----------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------+----+------------------------------------+ | 1 | st234824 | Crypt-Password | := | LqI8nHgSp/pTY | +----+----------+----------------+----+------------------------------------+ mysql> select * from radgroupcheck; +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 4 | test_radius | Auth-Type | := | TLS | +----+-------------+-----------+----+-------+ mysql> select * from nas; +----+---------------+-----------+-------+-------+------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+---------------+-----------+-------+-------+------------+-----------+-------------+ | 6 | 192.168.9.155 | switch | cisco | 1812 | bonjour | | | | 9 | 192.168.9.154 | webmail01 | other | 1812 | testing123 | | | Which type of attributes should I use to access from "webmail01", but not "switch" for example ? thanks ________________________________ De: freeradius-users-bounces+nasr-eddine.badaoui=ratp.fr(a)lists.freeradius.org de la part de freeradius-users-request(a)lists.freeradius.org Date: lun. 13/10/2008 19:30 À: freeradius-users(a)lists.freeradius.org Objet : Freeradius-Users Digest, Vol 42, Issue 80 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. access rights for some users ou users groups with freeradius and mysql (BADAOUI Nasr-Eddine (P)) 2. Re: access rights for some users ou users groups with freeradius and mysql (tnt(a)kalik.net) 3. Re: One user - Different Service Type depending on NAS (Alan DeKok) 4. Re: NAS-Identifier (Paul Bartell) 5. FR2.1.1 Solaris 5.10 x86 32-bit race condition (Chris Howley) 6. Re: FR2.1.1 Solaris 5.10 x86 32-bit race condition (Alan DeKok) 7. Authentication ok but not login on a Netopia (Gamaliel Bedolla) 8. syntax errors on mysql ip pools (Marcelus Trojahn) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 Oct 2008 13:51:28 +0200 From: "BADAOUI Nasr-Eddine (P)" <nasr-eddine.badaoui(a)ratp.fr> Subject: access rights for some users ou users groups with freeradius and mysql To: <freeradius-users(a)lists.freeradius.org> Message-ID: <E50F5250B1B60045B2B10390D6FFE79462BC7E(a)EXCHANGEA2.info.ratp> Content-Type: text/plain; charset="iso-8859-1" Hi, I'd like to know how to authorize some users or users's group created in mysql tables can logged only on some mysql's clients, with freeradius. Mysql's tables are : nas table for clients radcheck table for users radgropucheck table usergroup table many thanks

2 1

Regex remove realm from username
by Eric Martell 13 Oct '08

13 Oct '08

Hi.. I searched thru the forums but not getting the right username after using regex. The request I am getting is : test(a)google.com and I need to strip everything after @ and pass the username as test. I am using ldap for auth. This is the config I have in ldap. if (User-Name =~ /^([^@]+)(@.*)$/) { // just want to dblchck is the right regex update request { Stripped-User-Name := "%{0}" } } filter = "(uid=%{Stripped-User-Name})" //filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" //filter = "(uid=%{Stripped-User-Name})" encryption_scheme = crypt I get the following while ldap lookup expand: (uid=%{Stripped-User-Name}) -> (uid=) Here is the radius -X log ; rad_recv: Access-Request packet from host 216.2.193.1 port 55751, id=107, length=65 User-Name = "test(a)google.com" User-Password = "test123" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "google.com" for User-Name = "test(a)google.com" rlm_realm: No such realm "google.com" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++- entering group rlm_ldap: - authorize rlm_ldap: performing user authorization for test(a)google.com expand: (uid=%{Stripped-User-Name}) -> (uid=) expand: dc=xyz,dc=net,o=internet -> dc=xyz,dc=net,o=internet rlm_ldap: ldap_get_conn: Checking Id: 0

3 3

eap md5 and cisco 1250 ap?
by Jonathan D. Proulx 13 Oct '08

13 Oct '08

Hi All, I'm trying to get am MacOS 10.5 client to connect to a cisco 1250 ap running IOS 12.4(10b) authenticating against Freeradius 1.1.7 on Ubuntu (8.04). Yeh md5 is a bad idea, but it should be a simple first step. The only changes I made to the default Freeradius config were to add the client info for the 1250 and one user: jon Cleartext-Password := "password" Freeradius sends: Sending Access-Accept of id 56 to 192.168.32.10 port 1645 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "jon" Finished request 95 Which the AP sees: *Mar 1 17:13:08.871: RADIUS: Received from id 1645/54 192.168.32.34:1812, Access-Accept, len 49 *Mar 1 17:13:08.871: RADIUS: authenticator 80 F5 FE FA 84 E9 7A EB - C9 D0 0C F2 E5 07 9C 02 *Mar 1 17:13:08.871: RADIUS: EAP-Message [79] 6 *Mar 1 17:13:08.871: RADIUS: 03 02 00 04 [????] *Mar 1 17:13:08.871: RADIUS: Message-Authenticato[80] 18 *Mar 1 17:13:08.871: RADIUS: 61 20 78 47 53 68 E0 80 20 7F 10 04 95 CE 64 9D [a xGSh?? ?????d?] *Mar 1 17:13:08.871: RADIUS: User-Name [1] 5 "jon" *Mar 1 17:13:08.871: RADIUS(000000B0): Received from id 1645/54 *Mar 1 17:13:08.871: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes *Mar 1 17:13:09.919: %DOT11-7-AUTH_FAILED: Station 001e.c2b7.f0de Authentication failed But note the AUTH_FAILED at the. The Mac client then just spins retrying athentication. I must be missing something so stupidly obvious noone else has ever missed it, as I can't seem to find anyone onlline who's had trouble with simple md5 auth... Help? Thanks, -Jon

3 11

syntax errors on mysql ip pools
by Marcelus Trojahn 13 Oct '08

13 Oct '08

Hello, I've been trying for a few days to configure a new freeradius server with mysql IP pools support and I noticed there's a few errors with the syntax of some queries on sqlippool.conf for mysql. First of all, some queries would never match because the schema provided with freeradius for the radippools table would set the 'expiry_time' field as default to NULL and then the queries would try something like expiry_time < NOW(), which would never match if the field as NULL. So, the correct schema for the database would be: CREATE TABLE radippool ( id int(11) unsigned NOT NULL auto_increment, pool_name varchar(30) NOT NULL, framedipaddress varchar(15) NOT NULL default '', nasipaddress varchar(15) NOT NULL default '', calledstationid VARCHAR(30) NOT NULL, callingstationid VARCHAR(30) NOT NULL, expiry_time DATETIME NOT NULL, username varchar(64) NOT NULL default '', pool_key varchar(30) NOT NULL, PRIMARY KEY (id) ); And the, the complete ippool.conf should be: -- begin ----------- # ## This series of queries allocates an IP address allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE pool_key = '${pool-key}'" ## This series of queries allocates an IP address ## (Note: If your pool-key is set to Calling-Station-Id and not NAS-Port ## then you may wish to delete the "AND nasipaddress = '%{Nas-IP-Address}' ## from the WHERE clause) allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND \ AND nasipaddress = '%{Nas-IP-Address}'" ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ FOR UPDATE" # ## If you prefer to allocate a random IP address every time, i # ## use this query instead # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ # WHERE pool_name = '%{control:Pool-Name}' \ # AND expiry_time IS NULL \ # ORDER BY RAND() \ # LIMIT 1 \ # FOR UPDATE" ## If an IP could not be allocated, check to see if the pool exists or not ## This allows the module to differentiate between a full pool and no pool ## Note: If you are not running redundant pool modules this query may be ## commented out to save running this query every time an ip is not allocated. pool-check = "SELECT id FROM ${ippool_table} \ WHERE pool_name='%{control:Pool-Name}' LIMIT 1" ## This is the final IP Allocation query, which saves the allocated ip details allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE framedipaddress = '%I'" ## This series of queries frees an IP number when an accounting ## START record arrives start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" ## This series of queries frees an IP number when an accounting ## STOP record arrives stop-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees an IP number when an accounting ## ALIVE record arrives alive-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting ON record arrives on-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting OFF record arrives off-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}'" -- end of file -------------- I might add I'm not any Mysql expert so any opinions about what I said are really welcome... I've tested it and apparently it works and I couldn't find any potential bugs so far... I hope my english is not that rusty :) -- Marcelus Trojahn

1 0