March 2008 - Freeradius-Users - lists.freeradius.org

freeradius 2GB problem
by Rahul Nakra 20 Mar '08

20 Mar '08

I am using freeradius 2.0. With the default schema which comes with that. Following is the database entry. It shows a new user never logged in before. If i give value of Max-All-Data 2147483646 it works fine. Anything above it doesnt work. Attached is the radius log where it displays negative value for sqlcounter. mysql> select * from radcheck; +----+----------+--------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------+----+------------+ | 1 | rahul | password | == | rahul | | 2 | rahul | Max-All-Data | := | 2147483648 | +----+----------+--------------+----+------------+ 2 rows in set (0.00 sec) sqlcounter -------------------------- sqlcounter usagelimitDOWN { counter-name = Max-All-Session-Data check-name = Max-All-Data reply-name = Mikrotik-Xmit-Limit sqlmod-inst = sql key = User-Name reset = never query="select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{%k}'" } User-Name = "rahul" User-Password = "rahul" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "rahul", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{User-Name} -> rahul rlm_sql (sql): sql_set_user escaped user --> 'rahul' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rahul' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rahul' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rahul' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{User-Name}'' expand: select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{User-Name}' -> select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' sqlcounter_expand: '%{sql:select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul'}' rlm_sql (sql): - sql_xlat expand: %{User-Name} -> rahul rlm_sql (sql): sql_set_user escaped user --> 'rahul' expand: select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' -> select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul'} -> rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user rahul, check_item=-2147483648, counter=0 ++[usagelimitDOWN] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [rahul/rahul] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> rahul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Reply-Message = "Your maximum never usage time has been reached" Waking up in 4.9 seconds. Cleaning up request 0 ID 106 with timestamp +55 Ready to process requests. Regards Rahul Nakra

2 1

MACAddress silent authentication in LDAP using freeradius2.0.2
by Eric Martell 20 Mar '08

20 Mar '08

Please let me know if this topic is already discussed or has doc/wiki. If yes please guide me to the right thread. Thanks. We are going to use MACaddress as silent authentication. When the users tries to connect to the WIFI Access point, Aptilo Networks is going to send MacAddress as User-Name attribute of freeradius. User-Password attribute will be empty. We are storing MAC Addresses in the LDAP under the device tree thru user interface tools. The LDAP tree is as, deviceid = 111 macaddress = 001122334455 devicename = Personal PC. deviceid = 222 macaddress = 001199887766 devicename = SIP Phone. How do I configure ldap module in the freeradius so that it checks if the MACaddress exists in LDAP and returns Access-Accept or Access-Reject along with reply of devicename. Not sure how do I handle this in authorization or authentication or post-auth? There are NO passwords. I am using freeradius-2.0.2. Is there a way I can use "unlang" ? Thanks and Regards. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 6

Freeradius Execute Script
by fvt3 20 Mar '08

20 Mar '08

I understand that it is possible to have Freeradius execute a script when a user authenticate. What I want to do is to be able to pass that user name and the client's ip address to the script. This is my setup, I have freeradius with mysql setup. radgroupreply table: testprogramExec-Program-Wait==/usr/local/etc/raddb/test.pl When user Joe authenticates with his credential, radius would look in mysql and execute the test.pl script. How can I pass the user name "joe" and client's ip address to the test.pl script? Thanks in advance .. ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

Re: listen { type = detail } - Forked accounting
by Arran Cudbard-Bell 20 Mar '08

20 Mar '08

Hi, With eduroam, its good practice to proxy accounting packets back to the home server. But it's also very useful to record those accounting packets. Before I just set up the proxy in pre-acct, then listed the SQL module in accounting, and let the accounting server sent the accounting-reply... I never really liked this way because if the remote accounting server was down, it would mean lots of repeat accounting packets. What I was to do now is write out the accounting packet to two detail files, something like acct-buffer-sql and acct-buffer-proxy. Use one file to populate our local SQL db, and the other to deal with proxying the accounting information back to the home server. This would mean duplicate accounting-response packets being sent, which isn't ideal. Is there any way to stop the server sending an accounting response packet when it receives the reply from the home server ? Thanks, Arran

2 1

incorrect shared secret entry authenticates successfully for freerradius
by sanjeev.kumarroy＠wipro.com 20 Mar '08

20 Mar '08

Hi, I am using the following configuration: O/S: rhel4_u5_i386 Freeradius 1.1.7 Client to test: NTRadPing 1.5 Steps undertaken: -------------------- - Installed a fresh system with rhel4_u5_i386 - Build and compile freeradius 1.1.7 on it. - Update the clients.conf file to add the client entries for the machine that uses NTRadPing 1.5 (IP of the client machine and the shared secret) - Start the radiusd daemon in debug mode (radiusd -X) - Now generate a simple PAP authentication request using NTRadPing. (Port is 1812, also provide the shared secret correctly). The authentication passes successfully as it should. Now give a junk secret key in the NTRadPing utility. The access is rejected. - However when the same cases are tried for CHAP we can see the difference. In the first case the authentication is successful; however when we give a junk shared secret the authentication should ideally have been rejected. However the authentication passes successfully. NOTE: I tried the same for MSCHAPv1 and MSCHAPv2 authentication using VPN client. There I can see clearly that the access is not granted to the VPN client. However when we look at the radius logs it can be seen that the Authentication requests responds with a Successful message. Any help or info in this regards would be highly appreciated. Thanks. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

4 8

Re: FreeRADIUS + OpenLDAP + NAS (it?s make me crazy!!! please HELP)
by Koko Kurniawan 20 Mar '08

20 Mar '08

Thank you... now it works and success. but if my client disconnect and reconnect again, now it doesn't need to input user name and password again. It's directly connected .. Is it right??? --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

2 1

Post-proxy and rlm_perl
by Julien Leloup 20 Mar '08

20 Mar '08

Hi, I have to use FreeRadius v2.0.1 in a proxy configuration for translating attributes between two vendor specific equipements (Alcatel-Lucent and Redback). In a first phase (pre-proxy so), I use the preproxy_user file to add attributes to the proxied requests and attr_filter to block others. In a second phase (post-proxy phase I assume), when the reply comes from the home FreeRadius, I have to go through the same kind of process (add attributes which values are taken from a database), but I can't find a equivalent of preproxy_user file to the post-proxy phase. I think that using a perl script with rlm_perl will do this work in the post-proxy function, but when I try to manipulate attributes from the home server response, I can't find them in the %RAD_REQUEST, %RAD_REPLY hashes, and I can see this kind of logs : rlm_perl: Added pair Attribute1 = Value1 ... with the attributes I need from the home server, but after the execution of my code in post-proxy function. I found in the wiki that %RAD_PROXY or %RAD_PROXY_REPLY could be my solution, but when I'm trying to use them, I got an error during the launching of radiusd. Does anyone know how I can get the attributes coming in the Access-Accept from my server, and put new attributes in the Access-Accept send to the original client ? Find a way to make this in rlm_perl could be a solution but if there is an other solution, directly in a FreRadius mechanism I missed during my research, I will use it instead :) Regards, Julien Leloup Axione 130/132 Boulevard Camélinat 92240 MALAKOFF FRANCE

2 2

rlm_exec use
by T Kid82 20 Mar '08

20 Mar '08

Hi everyone, I have been trying to get RADIUS to run a perl script which would authenticate users (and yes I have tried rlm_perl but I decided against it). So far all I have in the perl script itself is ------------------------------------ #!/usr/bin/perl use strict; use Data::Dumper; exit 3; ---------------------------------- This is what my debug output says when I run radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 33397, id=236, length=56 User-Name = "matt" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 1645 +- entering group authorize Exec-Program output: Exec-Program: returned: 3 ++[exec] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [matt/testing] (from client localhost port 1645) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> matt attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds ------------------------------------------------------------------------------------------------- This is what I have in my radiusd.conf authorize { exec } authentication { Auth-Type Exec { exec } } ----------------------------------------------------------------------------------------------- I would think this should let all users pass through but it doesnt seem to be doing that. What am I missing here? Thanks in advance for your help, -- Tauseef

3 6

Wifi with Welcome message?
by Guillaume Chartrand 20 Mar '08

20 Mar '08

Hi, Is it possible to send or execute a script to a user when he authenticated thru wi-fi connection with particular NAS. Like when user joe successfully authenticated with the sql database, if he was connected with NAS IP address X, he receive a Welcome message X and if he authenticated with NAS Y, he receive Welcome message Y. Currently I have Freeradius 2.0 with authentification on a mssql database and it work and give an ip address to the client when is authenticated. Guillaume

3 2

CRL signature failure
by lowbassman＠gmail.com 19 Mar '08

19 Mar '08

I have a cronjob that pulls down a CRL, runs openssl to verify it's OK, and then stops radius, copies the crl into place, and then starts radius. Occasionally, around two or three times a month, I get the following errors and no one can auth to radius until the next run of the cronjob when the CRL is again pulled down. Wed Mar 19 15:01:00 2008 : Error: --> verify error:num=8:CRL signature failure Wed Mar 19 15:01:00 2008 : Error: TLS Alert write:fatal:decrypt error Wed Mar 19 15:01:00 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Mar 19 15:01:00 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Wed Mar 19 15:01:00 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Any ideas what might be causing this or how I might determine the cause? Thanks, ~Matt

1 0