February 2008 - Freeradius-Users - lists.freeradius.org

None
by Alexandre Chapellon 14 Feb '08

14 Feb '08

Hello, I want to use freeradius 2.0.1 to do accouting for my DSL users. I would like to acheive the following setup: NASes send request to the first radius (SunOS radius) which only handles authentication request and proxies accouting request to Freeradius (v2.0.1). I'd like freeradius to do several things: 1 - Do accounting to a mysql database 2 - Send accounting responses to the first radius 3 - proxy/copy accouting data to severals home server (3 servers: 1 billing server and 2 content filtering servers) To do this I setup freeradius 2.0.1 with 1 default virtual server writing accouting to mysql and to a detail file and one other virtual server which listen the detail file ( listen { type = detail....} ) and proxies request The problem is that the proxying is done for one request and stops when the response has been received.... so others request that are in the detail file are not proxied! does anybody have an idea / use this kind of setup?

2 1

FR & Unix pws
by Lemaster, Rob 14 Feb '08

14 Feb '08

I am using FreeRADIUS v1.0.5 in a non-production lab environment. I am using the group and passwd files for RADIUS authentication. I'm not using the standard ones, but copies that I have created just for FreeRADIUS and stored in another directory (so it doesn't interfere with regular systems administration). What hashing algorithm is used to store passwords in passwd? Does FreeRADIUS have an option to read passwords in clear text? Is there an easy way to create hashed passwords from some Unix command-line utility? Thanks for your time! 4 out of 10 women surveyed think Alan DeKok is a sex magnet.

2 1

EAP-TTLS/PAP tunneling issue
by Edwin van Zyl 13 Feb '08

13 Feb '08

Hi, FreeRadius Version 1.1.7 I'm looking for some help with regards to setting up EAP-TTLS. I've managed to make some progress, but can't get past the following problem which gets printed in the debug logs: rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. "rlm_eap_ttls: Non-RADIUS attribute in tunneled authentication is not supported" The message gets generated when attribute length > 255, but none of the attributes I send through are that large. I'm using JRadius to simulate Radius traffic over EAP-TTLS/PAP and are sending through the following when receiving the message. Sending RADIUS Packet: ---------------------------------------------------------- Class: class net.sf.jradius.packet.AccessRequest Attributes: User-Name = edwinvanzyl Tunnel-Password = edwinvzyl09 State = [Binary Data (length=16)] EAP-Message = [Binary Data (length=79)] Message-Authenticator = [Binary Data (length=16)] Can anyone please assist? Kind Regards, Edwin

3 11

SQL Escape Chars
by Arran Cudbard-Bell 13 Feb '08

13 Feb '08

Hi, Am I right in thinking that most alpha numeric characters are escaped before being inserted into SQL databases, and that the resultant string is =<Ascii value as hex> ? For example, the Reply-Message 'HP Networking equipment makes me sad, angry and staby.' would be entered as 'HP Networking equipment makes me sad=2C angry and staby.' Or is it just sensitive SQL chars that are written in this form ? Is this going to change at some point in the future, or can I safely start replacing these with HTML special when displaying FreeRADIUS'd attributes ... -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

1 0

rlm_ippool error problem
by Asaad 13 Feb '08

13 Feb '08

Dear All : rlm_ippool return duplicate ip address in past i used version Version 1.0.5 , so i thought that may be bug in the version so i installed Version 2.0.1 and the problem is still appears but in the last version the problem appears always in specific ips for example x.x.117.63 , x.x .119.162 after lot of debug i doubte in the pool defintions starting not from 1 and the mask!!!! ippool nonsub_pool { range-start = x.x.116.177 range-stop = x.x.119.254 netmask = 255.255.252.0 cache-size = 833 session-db = ${raddbdir}/dbnon.ippool ip-index = ${raddbdir}/dbnon.ipindex override = no } any idea or hint please Thanks _________________________________________________________________ Connect and share in new ways with Windows Live. http://www.windowslive.com/share.html?ocid=TXT_TAGHM_Wave2_sharelife_012008

1 0

radiusd dying
by Frank Winkler 13 Feb '08

13 Feb '08

Hi there ! After 1.1.7 had been running for about a month without any problems, radiusd has now died silently or completely stuck (it has to be "kill -9"ed) a couple of times. In either case, I get no logs about what's wrong. My platform is Solaris 10/x64 with quite current patches. Are there any known issues? TIA fw

2 1

accounting - no huntgroups
by Phil Mayers 13 Feb '08

13 Feb '08

I've never had cause to look at it before, but I discovered today that accouting doesn't support huntgroups; specifically, an attempt to match on Huntgroup-Name in acct_users Is this expected? How does one normally specify Acct-Type based on a huntgroup, if (say) the Class attribute is already being used?

4 6

Re: I can't get 'access-accept' from Linux clients (SOLVED)
by Sergio Belkin 13 Feb '08

13 Feb '08

2008/1/10, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk>: > Hi, > > Hi, > > I can't still figure it out why I can't access from Linux clients. > > I use version 1.1.7 of freeradius. Linux client is a Fedora 8 system. > > what is the linux client config? > > i see the following in your debug > > rlm_eap: Request found, released from the list > rlm_eap: EAP/md5 > rlm_eap: processing type md5 > rlm_eap_md5: User-Password is required for EAP-MD5 authentication > rlm_eap: Handler failed in EAP/md5 > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 84 > modcall: leaving group authenticate (returns invalid) for request 84 > auth: Failed to validate the user. > > > i would also advise that you upgrade to 2.0.0 - not only could this > issue be resolves anyway - its a hell of a lof easier to debug - far > less EAP messages! > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Well, Finally I get the blessed "Access-Accept" for Linux clients too. How I did that? Well, I upgraded to radius 2.0.1. maybe it could be helpful for many people my settings, well I won't hide as alchemy secret ;) radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = xxx.qq.yyy.pp port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = no require_encryption = yes } ldap { server = "ldap.cadorna.biz" port = 636 identity = "cn=freeradius,ou=applications,dc=cadorna,dc=biz" password = sambombas basedn = "ou=people,dc=palermo,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_debug = 0x0028 tls_cacertfile = /etc/raddb/cacert.pem tls_randfile = /dev/urandom tls_require_cert = "allow" access_attr = "radiusAllowed" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } eap.conf: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no md5 { } tls { certificate_file = /etc/pki/tls/certs/pepe.xp-crt.pem private_key_file = /etc/pki/tls/certs/pepe.xp-key.pem CA_file = /etc/pki/tls/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes copy_request_to_tunnel = no use_tunneled_reply = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } users: DEFAULT Ldap-UserDN = `uid=%{User-Name},ou=people,dc=cadorna,dc=biz` DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Enjoy ;) and thanks for your support!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1

help.. MD5 with PAP
by cengiz co�kun 13 Feb '08

13 Feb '08

Hi, I have configured freeradius 2.0.0 EAP-ttls and configured a mysql db to store the users. It was working fine until i recently decided to convert the database-stored passwords to md5 encryption. Since then, i am getting the below output, despite all my efforts. I tried all the things i could find on the internet with no result. Can anybody help? ( I am a beginner for freeradius server, so it may be very simple though) . Kind regards, I have authenticate { Auth-Type PAP { pap } Auth-Type md5 { pap } in the authenticate section, and pap { encryption_scheme = md5 authtype = md5 auto_header = yes } in the modules/radiusd.conf file. I have the following in my mysql - radcheck definition. +----+----------------------+----------------+----+----------------------------------+----------------------+ | id | username | attribute | op | value | operator | +----+----------------------+----------------+----+----------------------------------+----------------------+ | 90 | t1 | Crypt-Password | := | 83f1535f99ab0bf4e9d02dfd85d3e3f7 | cengiz | and the following in radgroupcheck table. +----+-----------+--------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------+ | 1 | dynamic | Auth-Type | := | MD5 | | 2 | dynamic | Service-Type | == | Framed-User | +----+-----------+--------------+----+-------------+ radiusd -X radtest t1 t1 10.1.1.170 0 testing123 rad_recv: Access-Request packet from host 10.1.1.170 port 32878, id=131, length=54 User-Name = "t1" User-Password = "t1" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.1.1.170/auth-detail-20080213 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.1.1.170/auth-detail-20080213 expand: %t -> Wed Feb 13 13:36:39 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "t1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{User-Name} -> t1 rlm_sql (sql): sql_set_user escaped user --> 't1' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 't1' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 't1' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 't1' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "t1" rlm_pap: No password configured for the user. Cannot do authentication ++[pap] returns fail auth: Failed to validate the user. Login incorrect: [t1/t1] (from client testUserShortName port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> t1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 131 to 10.1.1.170 port 32878 Waking up in 4.9 seconds. Cleaning up request 0 ID 131 with timestamp +2 Ready to process requests. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

RE: I can't get 'access-accept' from Linux clients
by Ivan Kalik 13 Feb '08

13 Feb '08

... >rlm_ldap: Added password {SSHA}F8XliBuxscoShNf0k7RxlC7niB7ISswp in check items ... >rlm_eap_md5: User-Password is required for EAP-MD5 authentication ... You can't use encrypted passwords with EAP-MD5. http://deployingradius.com/documents/protocols/compatibility.html Ivan Kalik Kalik Informatika ISP

5 10