April 2008 - Freeradius-Users - lists.freeradius.org

Redundant SQL
by Breuer Nicolas 28 Apr '08

28 Apr '08

Hello I'm using a redundant config for the module ip_pooling # Get an address from the IP Pool. redundant { ip_pooling ip_pooling2 handled } If ip_pooling failed > go to ip_pooling2 using the sql2 connection to an other mysql server. SQL2 is correctly loaded I started radius. Ok - on SQL1. If i kill mysqld without restarting the server. rlm_sql_mysql: MYSQL check_error: 2002 received sqlippool_command: database query error in: 'COMMIT' rlm_sql (sql): Released sql socket id: 2 rlm_sqlippool: IP address could not be allocated. +++[ip_pooling] returns noop IP Allocation FAILED from ip_pooling (did cli port user XXX) The system doesn't load the SQL2. I need to restart the radius to have the sql2 working and the ip allocated.

2 1

Use passwd for MAC filtering?
by Wolfgang Burger 28 Apr '08

28 Apr '08

Hi, I`m trying to add a MAC-Filter to my existing FreeRadius deployment. For some of my users I`m using TLS and want to be able to bind the certificates to a MAC address. I`ve tried to use passwd. In my radiusd.conf ... passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:mac-add" } ... mac-add is added in dictionary ... ATTRIBUTE mac-add 3005 string ... Then, in sites-enabled/default: ... authorize { ... maclist if ( mac-add != Calling-Station-ID ) { reject } ... maclist (for now): Mac445:0017F2ECCC75 What I get is this: rlm_passwd: Added mac-add: '0017F2ECCC75' to config_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) (Attribute mac-add was not found) So I changed radiusd.conf to: ... passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:~mac-add" } ... Result (full log at end of message): rlm_passwd: Added mac-add: '0017F2ECCC75' to request_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) ? Evaluating (mac-add != Calling-Station-ID ) -> TRUE +++? if (mac-add != Calling-Station-ID ) -> TRUE +++- entering if (mac-add != Calling-Station-ID ) ++++[reject] returns reject +++- if (mac-add != Calling-Station-ID ) returns reject Is it even possible to add setup a MAC-Filter this way? Or is it just some sort of datatype missmatch (" vs ')? Thank you all Best regards Wolfgang Burger <burgerw(a)immunbio.mpg.de> mac339:~ system$ sudo radiusd -X FreeRADIUS Version 2.0.2, for host powerpc-apple-darwin8.11.0, built on Feb 14 2008 at 15:25:18 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file //etc/raddb/radiusd.conf including configuration file //etc/raddb/proxy.conf including configuration file //etc/raddb/clients.conf including configuration file //etc/raddb/snmp.conf including configuration file //etc/raddb/eap.conf including configuration file //etc/raddb/sql.conf including configuration file //etc/raddb/sql/mysql/dialup.conf including configuration file //etc/raddb/sql/mysql/counter.conf including configuration file //etc/raddb/policy.conf including files in directory //etc/raddb/sites-enabled/ including configuration file //etc/raddb/sites-enabled/default including dictionary file //etc/raddb/dictionary main { prefix = "/" localstatedir = "//var" logdir = "//var/log/radius" libdir = "//lib" radacctdir = "//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "//var/run/radiusd/radiusd.pid" checkrad = "//sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 192.168.1.24 { require_message_authenticator = no secret = "xxx" shortname = "netgear1" } client 192.168.1.132 { require_message_authenticator = no secret = "xxx" shortname = "netgear2" } client 192.168.1.133 { require_message_authenticator = no secret = "xxx" shortname = "netgear3" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "xxx" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "xxx" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no use_open_directory = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "//var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eapuser eap eapuser { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/certs/server.pem" certificate_file = "//etc/raddb/certs/server.pem" CA_file = "//etc/raddb/certs/ca.pem" private_key_password = "xxx" dh_file = "//etc/raddb/certs/dh" random_file = "//etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating eapguest eap eapguest { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/mpiibcerts/Mac339.pem" certificate_file = "//etc/raddb/mpiibcerts/Mac339.pem" CA_file = "//etc/raddb/mpiibcerts/root.pem" private_key_password = "xxx" dh_file = "//etc/raddb/mpiibcerts/dh" random_file = "//etc/raddb/mpiibcerts/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "//etc/raddb/mpiibcerts/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "//etc/raddb/huntgroups" hints = "//etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "//etc/raddb/users" acctusersfile = "//etc/raddb/acct_users" preproxy_usersfile = "//etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_passwd Module: Instantiating guestlist passwd guestlist { filename = "/Library/WebServer/path/guestlist" format = "*User-Name:Cleartext-Password::Simultaneous-Use" delimiter = ":" ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 4 keyfield 0(User-Name) listable: no Module: Instantiating maclist passwd maclist { filename = "/etc/raddb/maclist" format = "*User-Name:~mac-add" delimiter = ":" ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Module: Linked to module rlm_always Module: Instantiating reject always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "//etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "//etc/raddb/certs/server.pem" certificate_file = "//etc/raddb/certs/server.pem" CA_file = "//etc/raddb/certs/ca.pem" private_key_password = "xxx" dh_file = "//etc/raddb/certs/dh" random_file = "//etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "//etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.24 port 1034, id=52, length=177 Message-Authenticator = 0xa5734a24826bc1b4f6f1cd74965941a1 Service-Type = Framed-User User-Name = "Mac445" Framed-MTU = 1488 Called-Station-Id = "00184DFCC7B8:MPIIB-Users" Calling-Station-Id = "0017F2ECCC75" NAS-Identifier = "netgear1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b014d6163343435 NAS-IP-Address = 192.168.1.24 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Mac445", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++? if (Called-Station-ID =~ /:MPIIB-Guests$/) ? Evaluating (Called-Station-ID =~ /:MPIIB-Guests$/) -> FALSE ++? if (Called-Station-ID =~ /:MPIIB-Guests$/) -> FALSE ++? if (Called-Station-ID =~ /:MPIIB-Users$/) ? Evaluating (Called-Station-ID =~ /:MPIIB-Users$/) -> TRUE ++? if (Called-Station-ID =~ /:MPIIB-Users$/) -> TRUE ++- entering if (Called-Station-ID =~ /:MPIIB-Users$/) rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation +++[eapuser] returns updated expand: %{Called-Station-Id} -> 00184DFCC7B8:MPIIB-Users +++[files] returns noop rlm_passwd: Added mac-add: '0017F2ECCC75' to request_items +++[maclist] returns ok +++? if (mac-add != Calling-Station-ID ) ? Evaluating (mac-add != Calling-Station-ID ) -> TRUE +++? if (mac-add != Calling-Station-ID ) -> TRUE +++- entering if (mac-add != Calling-Station-ID ) ++++[reject] returns reject +++- if (mac-add != Calling-Station-ID ) returns reject ++- if (Called-Station-ID =~ /:MPIIB-Users$/) returns reject Invalid user: [Mac445/<via Auth-Type = EAP>] (from client netgear1 port 1 cli 0017F2ECCC75) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Mac445 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.24 port 1034, id=52, length=177 Waiting to send Access-Reject to client netgear1 port 1034 - ID: 52 Sending delayed reject for request 1 Sending Access-Reject of id 52 to 192.168.1.24 port 1034 Waking up in 4.9 seconds. Cleaning up request 1 ID 52 with timestamp +8 Ready to process requests.

2 2

Unlang SQL
by Breuer Nicolas 28 Apr '08

28 Apr '08

Hello, I'm using an unlang into my post-auth section using the module sql3 (based on sql module but with a different database) if ("%{sql3:Select type from XXX where username='%{User-Name}' }" == "22") { } but the function is not working unless i declare the sql3 module before the unlang. Is it normal ? The problem was also the sql3 module call the sql module with the radacct logging and it's not very clean to call once more this file to just use an unlang function... Breuer Nicolas Content & Marketing Manager. Network Supervisor. BELCENTER ISP & PORTALS Avenue Henri Conscience, 94 B -1140 Bruxelles Tél. :+32 2 243 0 243 Fax :+32 2 243 0 244 Mobile :+32 486 50 27 87 E-Mail : Nicolas.Breuer(a)Belcenter.biz http://www.BelCenter.be | http://www.BelCenter.net http://www.BelCenter.lu | http://www.BelCenter.nl

2 1

Dear freeradius-users@list.xs4all.nl April 87% 0FF
by VIAGRA � Official Site 28 Apr '08

28 Apr '08

1 0

Key problem
by xiningtom_1986 26 Apr '08

26 Apr '08

Hello!I add a new eap type and I konw that there is a session key that needs to be sent to the client through the AP.Do you know how to generate the key?Where should I add the code,in the rlm_eap.c or rlm_eap_XXX?Thank you! Xiningtom_1986

3 4

Deny/Allow access between clients
by Julian Stöver 26 Apr '08

26 Apr '08

Hi, I would like to know if its possible to deny/allow traffic between clients or groups. I've already searched for a solution but I just found out how to limit some ports for a user. Thanks for you help. bye julian

2 1

Have some questions - new to FreeRadius
by thekat 25 Apr '08

25 Apr '08

Greetings all.. Overview Our local network folks have a FirePass VPN to allow external access to an application. We are needing to setup a Radius server to authenticate to the FirePass VPN appliance. Testing. I have FreeRadius 1.1.7 set up on a zone on a Solaris 10 box and have begun testing.. This zone will only do this one task.. (Packages installed from SunFreeware - Blastwave FreeRadius package is 1.01) - Going through the output from /local/sbin/radiusd -X - Tested with radtest test test localhost 0 testing123 One error - Although this might be normal Output Sending Access-Request of id 169 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=169, length=20 --------------- I am also reading the entire radiusd.conf file to get familiar with the settings. Per the FAQ it *looks* like I need to use CHAP for authentication but have currently not gotten any farther than that. Sent an email to F5 (makers of FirePass) requesting information as to what protocol the "Radius" setting is expecting.. If anyone has any input if this combination will work,

3 8

Re: Start at boot Freeradius
by Gustavo Chavelas 25 Apr '08

25 Apr '08

Yes, radiusd its in /etc/init.d -----Mensaje original----- De: freeradius-users-bounces+gchavelas=bfmx.com.mx(a)lists.freeradius.org [mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org] En nombre de freeradius-users-request(a)lists.freeradius.org Enviado el: Viernes, 25 de Abril de 2008 11:57 a.m. Para: freeradius-users(a)lists.freeradius.org Asunto: Freeradius-Users Digest, Vol 36, Issue 161 Message: 2 Date: Fri, 25 Apr 2008 16:27:34 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Start at boot Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080425152734.GA4491(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > When I try to add my FR at BOOT from my Linux with chkconfig, it's sends and > follow error: > # service radiusd does not support chkconfig have you put the radiusd init script into eg /etc/init.d/ ? alan

2 1

Radius-based windows authentication
by Mike Perdide 25 Apr '08

25 Apr '08

Hello, I'm working on VLAN assignement with FreeRadius, with windows XP users. The FreeRadius server is using openLdap, and works overs EAP-TTLS. The goal of my work is for the users to be on different Vlans depending on their status. The radius part is working fine, since the switch sets the right vlan when the user gives his login and password. My question was : is it possible to authenticate via radius at the windows login screen ? For now, it is using the samba database, but if I want to set up a dynamic vlan assignement, the network needs to be up before the samba partitions are mounted. Thanks !

4 7

Start at boot Freeradius
by Gustavo Chavelas 25 Apr '08

25 Apr '08

Hello again to all. I'm very happy why my FR it's working fine again and I have Vista support too. Thank a lot of Alan Dekok, I was installed the 1.7 version. Later I will try to upgrade, but at this moment it's all. FR is the best. Now, mmmm, I have maybe a fool question but I need help again. When I try to add my FR at BOOT from my Linux with chkconfig, it's sends and follow error: # service radiusd does not support chkconfig If I run manually # radiusd <- alone or with -X -A, etc it work fine. How can I to add FR at boot? Thanks for your answers to all. Gustavo.

3 2