April 2008 - Freeradius-Users - lists.freeradius.org

Windows AD Integration
by Lemaster, Rob 07 Apr '08

07 Apr '08

Can FreeRADIUS be integrated into Windows Active Directory for user credentials and privelige based on Active Directory group? What is the best way to integrate FreeRADIUS into Windows Active Directory? Thanks! FreeRADIUS: It's what's for dinner.

2 1

RADIUS Packet Debugging
by Lemaster, Rob 07 Apr '08

07 Apr '08

Does FreeRADIUS have a functionality that allows the administrator to debug RADIUS requests and responses? Something that will show the request and response with attributes, etc.. Thanks! FreeRADIUS: The other white meat.

2 1

Missing NAS-Port in Access request with respect to RFC 2865
by Ramm-Ericson, Johannes 07 Apr '08

07 Apr '08

Hello Freeradius-users, >From what I see in the mailing list archives several freeradius users have historically run into trouble with Access-Request information sent by NASes and particularly the lack of the NAS-Port attribute. I've run into it quite often recently and was wondering if I may have found a way to solve it. The workaround I currently employ is to configure acct_users to let the access request from the NAS in question through anyway but it's a workaround. If possible I'd like to find the *correct* solution.... :-) The RFC 2865 http://www.freeradius.org/rfc/rfc2865.html#NAS-Port states that: "Either NAS-Port or NAS-Port-Type (61) or both SHOULD be present in an Access-Request <http://www.freeradius.org/rfc/rfc2865.html#Access-Request> packet, if the NAS differentiates among its ports." >From what I understand the current Freeradius code interprets the RFC statement so that if the NAS-Port attribute is not sent then the access request is not processed and subsequently denied (in rlm_radutmp.c - line 404). if (!port_seen) { However; shouldn't the statement from the RFC be intertpreted such that if *neither* the NAS-Port or the NAS-Port-Type is set then the access request should not be processed and subsequently denied? I'm thinking something along the lines of changing line 404 of rlm_radutmp.c to: if (!port_seen && !nas_port_type) { I'll apologise in advance if my all too rusty programming skills are making me misunderstand the situation entirely... Best Regards, Johannes Ramm-Ericson ----------------------------------------------------------- The information in this e-mail, and attachment(s) thereto, is strictly confidential and may be legally privileged. It is intended solely for the named recipient(s), and access to this e-mail, or any attachment(s) thereto, by anyone else is unauthorized. Violations hereof may result in legal actions. Any attachment(s) to this e-mail has been checked for viruses, but please rely on your own virus-checker and procedures. If you contact us by e-mail, we will store your name and address to facilitate communications in the matter concerned. If you do not consent to us storing your name and address for above stated purpose, please notify the sender promptly. Also, if you are not the intended recipient please inform the sender by replying to this transmission, and delete the e-mail, its attachment(s), and any copies of it without, disclosing it.

3 3

compare check items in LDAP - pairs do not match
by mel 07 Apr '08

07 Apr '08

Hi, When I set compare_check_items in modules { ldap {} }, I'm getting the errors below: rad_recv: Access-Request packet from host 127.0.0.1 port 58575, id=39, length=96 User-Name = "user10" User-Password = "abc123" Calling-Station-Id = "00:18:DE:28:7C:7C" Message-Authenticator = 0xcfe57cf5ca3366338fd35142085e45b8 EAP-Message = 0x02d2000b01757365723130 +- entering group authorize ++[preprocess] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for user10 expand: (uid=%u) -> (uid=user10) expand: dc=iiu,dc=edu,dc=my -> dc=iiu,dc=edu,dc=my rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iiu,dc=edu,dc=my, with filter (uid=user10) rlm_ldap: checking if remote access for user10 is allowed by radiusFilterId rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute macAddress as RADIUS attribute Calling-Station-Id == "00:18:DE:28:7C:7C" rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{sha}Y2fEjdGT1W6nsLqtJbGUVeUp9e4=" rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusFilterId as RADIUS attribute Filter-Id = "1" rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Invalid user (rlm_ldap: Pairs do not match): [user10/abc123] (from client localhost port 0 cli 00:18:DE:28:7C:7C) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> user10 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 39 to 127.0.0.1 port 58575 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 39 with timestamp +42 Ready to process requests. In ldap.attr, Calling-Station-Id is mapped to macAddress. In modules checkval, item-name is Calling-Station-Id, while check-name is macAddress. The macAddress is stored using ":" as delimiter in OpenLDAP What I was tasked to do is to authorize the user based on the password and macAddress pair. Prior to this, I've been able to do the following successfully - basic LDAP authentication with username/password stored in LDAP - EAP-TTLS with username/password stored in LDAP - EAP-GTC with username/password stored in LDAP - PAP with username/password stored in LDAP These have been tested locally (using radtest and radeapclient) and also via a NAS. Regards, --mel

1 0

mera vsa on freeradius
by Budi Wibowo 07 Apr '08

07 Apr '08

dear all anybody have mera vsa or dictionary for freeradius? i want to make call performance base on the that. br budi

1 0

EAP Authentication
by Devinder Singh 06 Apr '08

06 Apr '08

Hi I have set up Free Radius to allows users to set up certificates on their notebook and get access to the Internet. When i set EAP i cant sem to allow monowall captiv portal users to login to the RADIUS Server. Is there any settings to be done in users.conf file or radiusd .conf file to allow users to login via the monowall captive portal login page. FREE Radisu rejects login from the caprive portal login. Shoud i be using MSCHAP or can i still use EAP. Thank you Devinder

2 7

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

That looks familiar? :P How about for the other tables? any pointers? ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 21:11:58 Subject: Re: Freeradius + CHAP "I modified my rachek table to look like this. as you have mentioned. mysql> select * from radcheck -> ; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | s | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec)" That should do it. Ivan Kalik Kalik Informatika ISP Dana 6/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. >Anyone kind enough to provide me some sample data that I could insert in my sql table? > >----- Original Message ---- >From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Sunday, April 6, 2008 19:25:48 >Subject: Re: Freeradius + CHAP > >Hi, > >> Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. > >sql.conf > > >i'd advise removing the 1.0.1 that your distro dropped in. > >rpm -e freeradius > >then you know all action (eg dictionaries) is from 2.0.3 > >just read the config files - all the files they use then become >clear. red sql.conf and you'll see which engine/dialup.conf >etc is used > >alan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. Anyone kind enough to provide me some sample data that I could insert in my sql table? ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 19:25:48 Subject: Re: Freeradius + CHAP Hi, > Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. sql.conf i'd advise removing the 1.0.1 that your distro dropped in. rpm -e freeradius then you know all action (eg dictionaries) is from 2.0.3 just read the config files - all the files they use then become clear. red sql.conf and you'll see which engine/dialup.conf etc is used alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Why my schema is not working?
by snaut＠snaut.ru 06 Apr '08

06 Apr '08

And any ideas? I'm sure, that this bug is very important. >Yes, a'm fix it. -----Original Message----- From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org [mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, April 04, 2008 4:57 PM To: freeradius-users at lists.freeradius.org Subject: RE: Why my schema is not working? And the warning about using User-Password is now gone from the debug? Ivan Kalik Kalik Informatika ISP Dana 4/4/2008, "Dmitry A. Sysoev" <snaut at snaut.ru> piše: >SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4732 250092020001115 at evdo.uln.skylink.ru Cleartext-Password >EBLAImXtaUidLnSa := > > SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4147 250092020001115 at evdo.uln.skylink.ru Callback-Id >0250092020001115 == > >SELECT GroupName FROM usergroup WHERE >UserName='250092020001115 at evdo.uln.skylink.ru' OR CLID='' order by >priority > >1 blackholed > >SELECT >radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgro >upche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE >(usergroup.Username = '250092020001115 at evdo.uln.skylink.ru' or >usergroup.CLID = '') AND usergroup.GroupName = radgroupcheck.GroupName >ORDER BY usergroup.PRIORITY,radgroupcheck.id > >1 181 blackholed Auth-Type Reject := >2 182 blackholed Fall-Through No = > > > >-----Original Message----- >From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org >[mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] >On Behalf Of Ivan Kalik >Sent: Friday, April 04, 2008 4:32 PM >To: freeradius-users at lists.freeradius.org >Subject: RE: Why my schema is not working? > >What happens when you copy and paste the query from the debug? Can you >post the result? > >I would doubt that the code is "alergic" to that particular group and >works for others. "blackholed" doesn't look like a reserved word. >Queries are executed by mysql not radius server. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >

1 0

Special Characters for special Attributes
by Leander S. 06 Apr '08

06 Apr '08

Hi, I use FreeBSD 7.0 and have mpd as PPPoE Server & FreeRADIUS & PGSQL succesfully running. My goal now is it to shrink down the Bandwidth for each user with the help of IPFW and Dummynet which is supported by mpd and shouldn't be that big of a deal. That's how my /usr/local/etc/raddb/users looks like: ############################################### test User-Password == "testpasswd" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 1.2.3.4, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1492, Framed-Compression = Van-Jacobsen-TCP-IP, mpd-table += "1=11.1.11.1", mpd-table += "1=1.2.3.4", mpd-pipe += "1=bw 20Kbyte/s", mpd-pipe += "5=bw 10Kbyte/s", mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", mpd-rule += "100=allow all from any to any", [...] ############################################### The last few lines are responsible for limiting the bandwidth but those brackets causing trouble because FreeRADIUS doesn't send it like that to mpd5. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- ... somebody told me: IPFW rules are operated using shell+ipfw execution. So you should add slashes before shell special chars, like "(" or ")": mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", PS: you RADIUS configuration syntax may require additional slashing for that slashes. :) [...] Enable 'log +radius2' in mpd and make sure that rules coming to mpd with that slashes added. If there will be no slashes, then you RADIUS config strips them and you should add slashes for slashes. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- here is a part of mpd5's log to have look how RADIUS sending those attributes to mpd5: ############################################### [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] ############################################### ^^ ... so you see .. one of that slashes is missed ... BUT how do I get those two Lines: [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] looking like they do look in the /usr/local/etc/raddb/users ? Thank you Regards, Leander

2 1