October 2008 - Freeradius-Users - lists.freeradius.org

Re: vsa and authenticate-only service-type
by ganesh subramonian 29 Oct '08

29 Oct '08

Hi, I was trying to use the pam_radius module with the steel-belted-radius-server. This server does not send vsa's in the reply if i send an "authenticate only" in the access-request. is this really expected? any idea whether other radius servers be doing something like this? thanks ganesh >The pam_radius module currently uses the service-type authenticate-only when sending an access-request. > >The rfc says this about "authenticate only": >Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept > >Does this mean that if I want the server to send some VSA in the reply-message i should not use this? No. "no authorization information *needs* to be returned" - not required but you *can* do it if you want. >Is it OK to not send any service-type? Yes, that or any other attribute in the reply. For services that *really* don't require any authorization attributes. Ivan Kalik Kalik Informatika ISP Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

SSID based checking for Simultaneous-Use?
by ST Wong (ITSC) 29 Oct '08

29 Oct '08

Hi all, I'm using free radius 2.1.1. I got request from boss to enable simultaneous login checking for particular SSID. I've no idea since seems same groups of users may use different SSID's. Would anyone advise if Is it possible to do that? Thank you very much. Regards, /ST Wong

2 1

Is this possible?
by Dajka Tamás 28 Oct '08

28 Oct '08

Hi, I want to use a freeradius server for the following purposes: - grant authorizaton to Cisco switches via LDAP (group membership checking, etc). - make a WIFI with WPA+802.1x via MS IAS/RRAS (the main auth is done by the IAS, so the freeradius acts as client for IAS/RRAS, and the WIFI APs act as radclients for freeradius) - wired 802.1x via MS IAS/RRAS Is this possible in one server? Thanks, Viper

2 1

Need help for configuration - LDAP with custom files Failover
by Dajka Tamás 28 Oct '08

28 Oct '08

Dear All, I'm facing a problem with Freeradius 2.0.4. I want to make a configuration to allow our Cisco routers to auth via RADIUS. For this, we're using a password file now (let's call it ciscopwd) and another file for granting rights. I want to change the config file, so that the auth is done by LDAP (plain passwords), BUT if the LDAP is not available the ciscopwd file will do the job. How can this be done? (moreover, I want to have some LDAP group limitations on the logins) Thanks in advance, Tamas

2 14

Simultaneous-Use check not working
by DAve 28 Oct '08

28 Oct '08

Good afternoon, I have inherited an aged ICRadius install and I am in process of converting to FreeRadius 1.1.7. Currently I have a master DB on our Management server replicating to two radius servers. Each radius server has a unique sql instance to send accounting data to the master DB. Everything is working, the DB conversion from ICRadius to FreeRadius went fine. In testing the only issue I have found is I am unable to stop Simultaneous use. I read the docs carefully, checked the Wiki, and I believe I have everything configured properly. Using RadiusTest 2.4.3 and radwho I see the following. I check for a login using radwho and I see I have a session, I then attempt both a new auth and start accounting again and still radwho shows only one login. [root@radius1 /usr/local/etc/raddb]# radwho Login Name What TTY When From Location yellowhous yellowhousejake shell S1 Mon 11:35 192.168.4 192.168.0.1 --------------------10/27/2008 11:55:13 AM Test started [check newrad1]------------------------- Info:Sending Access-Request of id 0 to 10.0.241.95:1645 Password = "marlin" User-Name = "yellowhousejake" Framed-IP-Address = 192.168.0.1 Acct-Session-Id = "201" Info: Access-Accept packet from host 10.0.241.95:1645, id=0, length=89 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-Compression = Van-Jacobson-TCP-IP Filter-Id = "std.ppp" Framed-MTU = 1500 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:13 AM Test finished [check newrad1]------------------------- --------------------10/27/2008 11:55:40 AM Test started [start acct]------------------------- Info:Sending Accounting-Request of id 0 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Start NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=0, length=20 Info:Sending Accounting-Request of id 1 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Alive NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=1, length=20 Total approved auths: 2 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:40 AM Test finished [start acct]------------------------- --------------------10/27/2008 11:55:40 AM Test started [start acct]------------------------- Info:Sending Accounting-Request of id 0 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Start NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=0, length=20 Info:Sending Accounting-Request of id 1 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Alive NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=1, length=20 Total approved auths: 2 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:40 AM Test finished [start acct]------------------------- [root@radius1 /usr/local/etc/raddb]# radwho Login Name What TTY When From Location yellowhous yellowhousejake shell S1 Mon 11:55 192.168.4 192.168.0.1 Here are the parts of my conf I believe I need to check for simultaneous use. ## radiusd.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = no callerid = "yes" } accounting { radutmp ## sradutmp sql_acct } session { radutmp sql_acct } ## sql.conf # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE UserName='%{SQL-User-Name}' \ AND AcctStopTime = 0" Note I enabled radutmp after sql was failing to stop the second login. I am certain I have missed something simple but I am unable to find it. Any help, cluesmacks, etc are appreciated. DAve -- I am watching the debate and I am very disappointed. The rules are simple, "answer the question". I would vote right now, and I can in Indiana, for the man who answered the question directly, in less than a minute, and then sat down before the green light was out.

3 8

freeradius- update radacct
by Oguzhan Kayhan 28 Oct '08

28 Oct '08

Hello, I have freeradius virtual configurations. Until today all were working without a problem. But today i created a new one and i have a tiny problem about it. It doesnt update sql queries until the user logs off. SO i can not track the statistics of online users and transferred data etc via mysql. But as i see freeradius gets the following packets below in normal intervals And if it was an error about sql.conf i think it wont write the data when user disconnected too.It just does not update the online users data..and i wonder why..Seems like it does not create user data at the begining so it can not update the data too. ----------------------------------------------------------------- expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('4906e32a00000001', '83f3f3b94fce6dc1', '7798-1', '', '192.168.182.1', '1', 'Wireless-802.11', DATE_SUB('2008-10-28 13:01:21', INTERVAL (3401 + 0) SECOND), '3401', '', '', '0' << 32 | '34293752', '0' << 32 | '1270253', '00-0E-0C-6E-6E-7C', '00-14-22-A1-BB-AB', '', '', '192.168.182.2', '0', '') NAS-IP-Address = 192.168.182.1 -------------------------------------------------- This is the virtual config and sql.conf parameters i am using (which are same of the previous virtual servers actually) ------------------------- server lojnet { authorize { preprocess files update control { Auth-Type := perl } perl_lojnet } authenticate { Auth-Type Perl { perl_lojnet } } preacct { acct_unique files } accounting { detail unix sql_lojnet } session { sql_lojnet } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } ----------------------------------- and the sql part belongs to this virtual server -------------------------------------- sql sql_lojnet { database = "mysql" driver = "rlm_sql_${database}" # Connection info: server = "xxxxxxxxx" login = "xxxxxxxxx" password = "xxxxxxxxxx" # Database table configuration for everything except Oracle radius_db = "lojnet" acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "usergroup" # If set to 'yes' (default) we read the group tables # If set to 'no' the user MUST have Fall-Through = Yes in the radreply table # read_groups = yes # Remove stale session if checkrad does not see a double login deletestalesessions = yes # Print all SQL statements when in debug mode (-x) sqltrace = no sqltracefile = ${logdir}/sqltrace.sql # number of sql connections to make to server num_sql_socks = 5 # number of seconds to dely retrying on a failed database # connection (per_socket) # number of seconds to dely retrying on a failed database # connection (per_socket) connect_failure_retry_delay = 60 #readclients = yes # Table to keep radius client info nas_table = "nas" # Read driver-specific configuration $INCLUDE sql/${database}/dialup.conf }

2 4

rlm_unix cannot find users (2.1.0)
by Martin Pauly 28 Oct '08

28 Oct '08

Hi all, I am trying to upgrade from an ancient 1.0.5 to 2.1.0, and ran into trouble where I least expected it. Underneath is Debian Lenny system run as Linux vserver. I have a large set of users handled by LDAP, and a small group (admins with only a few logins) that I used to handle by setting up a bunch of local unix accounts and doing Auth-Type := System. So my users file looks like pauly Auth-Type := System, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Matched local user entry %{User-Name} in users file", [ more local accounts ...] DEFAULT Auth-Type := Reject, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Illegal username %{User-Name} for this type of request" DEFAULT User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry with User-Name %{User-Name}" In sites-available/default, I have 'unix' in both the authorize and authenticate section. The debug output upon a request reads: rad_recv: Access-Request packet from host 192.168.x.y port 1645, id=204, length=77 NAS-IP-Address = 192.168.x.y NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "pauly" Calling-Station-Id = "our-special-id" User-Password = "xxxxxx" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "pauly", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{Calling-Station-Id} -> our-special-id [files] users: Matched entry pauly at line 17 expand: Matched local user entry %{User-Name} in users file -> Matched local user entry pauly in users file ++[files] returns ok [ the whole thing is sent to LDAP for authorization now which succeeds, but could perhaps be avoided anyway] ++- entering policy redundant {...} [ldap stuff ...] [ldap2] user pauly authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap2] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> pauly attr_filter: Matched entry DEFAULT at line 11 So to me it looks like rlm_unix can't find me :-( I've read about rlm_passwd, but I don't need any caching or the like. Oh, and user freerad is in group shadow. But as I understand it, this is no longer relevant for my case since rlm_unix uses getpwent which is supposed to handle access to /etc/shadow, right? Thanks for any hint Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

let radius distinguish more cases
by alois blasbichler 28 Oct '08

28 Oct '08

hello list I have a question to understanding better radius. For this i make a simple example-scenario : I want to use my radius for 2 things : 1. wireless-access for laptops with machine authentication over a wireless switch with ip 1.1.1.1 2. authentication for the login to my switches for some admin-users My machines (case 1) are in a samba-domain and saved in a openldap-DB in the tree : basedn = "ou=samba-machines,dc=sb-brixen,dc=it" My users (case 2), where i select my admins with a ldap-filter are also in an openldap-dB in the tree: basedn = "ou=users,dc=sb-brixen,dc=it" How and where i distinguish this 2 cases? In the standard configuration, what i have understood radius let try the clients a lot of possibilities and i have read its better to not restrict the auth-methods. A possibility to solve my question is to make 2 files under /modules like ldap1 and ldap2 for my separate cases - but now my problem : Where i say that my wireless switch gos to ldap1 (with mschap) and my switches (for example all the network 1.1.20.x) gos to ldap2 (with ldap-authentication) : in users, or maybe in raddb/sites-available/default In clients.conf i have defined my switches and my network. For the users-file i have seen som examples like : DEFAULT Huntgroup-Name = "vpn-pix",Auth-Type := ldap But where i define "Huntgroup-Name = "vpn-pix"" is this the normal name in the client.conf ? Thank you for a response luis

2 1

Insert billiplan code in radacct table during authenticaiton
by Bishal 27 Oct '08

27 Oct '08

Hi all, I am using freeradius for AAA of my cable users. Now what I want to do is, insert billiplan code 001 into radacct table during authentication so that I can view online users according to billingplan code. There will be Billingplan field in radcheck table and when users tries to login the script will check the radcheck table and update that billingplan code into radacct table. Is it possible with rlm_perl module? Thank you Bishal

4 8

EAP-MSK & WiMAX-MSK validity?
by Stefano Colagreco 27 Oct '08

27 Oct '08

Hi All, i use: - WiMAX-MSK = EAP-MSK and all it works correctly, and I suppose It's validity is only for the authentication session, it is right? - WiMAX-AAA-Session-Id: is set as a pseudo-random value. It's correct? It's value is related to the duration of the session? Thanks all in advance! Stefano

1 0