May 2008 - Freeradius-Users - lists.freeradius.org

Re: Can i have a group of roles
by avihai marchiano 27 May '08

27 May '08

Lets say i have the following roles: 1. admin 2. tech 3. student 4. simple Group - is a collection of roles. Group1 = role (admin,student) Group2(student,simple) User has group, for example user1 have group2. Is it make sense to build authorization is this way or to prefer to define roles without group and then i need to define for each user all the roles that he has (in this way if i have common combination of roles i will need to define all of them again and again for each user that use them). Thank you ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 27, 2008 1:33:05 PM Subject: Re: Can i have a group of roles >I am new to Radiues. Make an effort to spell the word correctly. >I need the user to have group. The group is group of roles? >Can i do this or i need to define the roles in a "flat way" (i mean that i need to define all roles). >Does someone has an example? > Do you have an example of what you want to do? You want the same user to have different login credentials ... for what? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Can i have a group of roles
by avihai marchiano 27 May '08

27 May '08

Hey, I am new to Radiues. I want to create a simple configuration, only for testing. I need the user to have group. The group is group of roles? Can i do this or i need to define the roles in a "flat way" (i mean that i need to define all roles). Does someone has an example?

2 1

mysql queries help needed
by gaetano ortisi 27 May '08

27 May '08

Hello, I am developing a small project to manage accounts provided by a captive portal solution chillispot-freeradius-mysql, and I need help about working with sql tables to do those few tasks the web interface should provide to admin users. I need to know how to: - add an account - remove an account - show all accounts with the total time of all their connections >From what I understand, add an account is simple, all I have to do is add a record to radcheck table like after checked that the username is not already present:   mysql> select username from radcheck where username = 'John Doe'; .. (if 0 rows returned, continue)   mysql> insert into radcheck (username, attribute, value) values ('John Doe', 'Password', 'x2jadfds'); However in an example from the oreilly book that the op is left as the default value ('=='), while in another software that do a task like what I what should like to do (phpmyprepaid), the attribute is "User-Password", and the op is ":=". What difference?   To remove an account, I should delete all the records in radcheck that have the username I want to remove, so:   mysql> delete from radcheck where username = 'John Doe';   But I would like to know, if the user has currently a session active, i.e. it is connected to the service provided, it is immediately disconnected or the session continue? And moreover, I have some problems with radacct. How to do the last task? On the web I found few resources about manage freeradius with mysql. Suggestions? Links? Thanks,             tano ___________________________________ Scopri il Blog di Yahoo! Mail: trucchi, novità, consigli... e la tua opinione! http://www.ymailblogit.com/blog/

3 2

Is Multiple radcheck tables possible?
by Pete Kay 27 May '08

27 May '08

Hi, I want to have two radcheck tables, one for storing user-password for system accessing and the other for storing user-password for management interface accessing. Is it possible to config the server to switch to different table according to some parameters pass by the client? I think it can be done by having two servers and each server has its own config and each config has its own dialup sql setting. However, since I would hope to see if it is possible to do it with just one server. Thanks in advance for any suggestion. Regards, Pete

3 2

authentic and authorize
by Zahra Bahar 27 May '08

27 May '08

Hi, there is freeradius sever uses ldap server for authorization and authentication of a VPN server. I set another vpn server with the same setting as previous one, but it accepts all users with error username and password. if username is true it will check the password but if enter non-valid username it accepts that. I don't know what is wrong.

3 2

RE: can not initiate sim, no RAND1 attribute
by Kalyani Garigipati (kagarigi) 27 May '08

27 May '08

Hi , Could someone take time and reply on this please.. Regards, Kalyani -----Original Message----- From: Kalyani Garigipati (kagarigi) Sent: Monday, May 26, 2008 4:54 PM To: 'freeradius-users(a)lists.freeradius.org' Subject: can not initiate sim, no RAND1 attribute Hi, Now I am able to start the Radiusd without any errors. But I am getting the following messages when I initiate EAP-SIM request to free Radius rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim can not initiate sim, no RAND1 attribute rlm_eap: Default EAP type sim failed in initiate rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [dummy(a)cisco.com/<via Auth-Type = EAP>] (from client cisco port 0 cli dummy(a)cisco.com) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> dummy(a)cisco.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. I have configures EAP -type as SIM in eap.conf Regards, Kalyani

3 2

is there normal way to create a user that can not log on until a future date?
by Rob Fowler 27 May '08

27 May '08

I am setting up a hotspot in a cafe that is not very high tech. They offer free wifi in a well known cafe down here in Darlinghurst Sydney (All radius users welcome :) ) To prevent abuse I was planning on making daily access keys. The idea was to make a year of them and print them in a book. The first person in would simply look up the date in the secret book put it into the cash register to print on the receipt. Setting the 'Expiration' time is simple (and works well) but I want to prevent someone from simply copying a key far in the future and using it until then so I want to make each key only valid for a day. (Yes I know this does not prevent them from photocopying the whole book, but that's a lot harder than getting a key for this time next year) Ideally everyone for that day will get the same key (I made an application to populate the database with simple two word tokens). I think I can probably do it with the SQL interface by only selecting from 'check records' that are current but is there a 'proper' way to do this? Surely a dialup ISP would set a 'start date', before which a user can not log in? Sorry if this has already been answered but I have searched the list and don't seem to be able to find a term that will give me an answer. - Rob Fowler - Sydney

4 5

Help with dialupadmin
by Joel MBA OYONE 26 May '08

26 May '08

Hi guys, Am i on the right place to find help with dialup_admin? MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

mysql simultaneous login detection
by Gabriel J Marais 26 May '08

26 May '08

Hi I have been trying to setup freeradius with mysql to detect and reject simultaneous logins for the past two days and been reading up, but I can't get it working at all. Perhaps someone here has some more information on a working example for me... ? mysql> select UserName, GroupName from usergroup where UserName = 'testgiga(a)saudsl.co.za'; +-----------------------+-----------------+ | UserName | GroupName | +-----------------------+-----------------+ | testgiga(a)saudsl.co.za | UNSHAPED_NORMAL | +-----------------------+-----------------+ 1 row in set (0.00 sec) mysql> select * from radgroupcheck where GroupName = 'UNSHAPED_NORMAL'; +----+-----------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------------+------------------+----+-------+ | 9 | UNSHAPED_NORMAL | Auth-Type | := | Local | | 12 | UNSHAPED_NORMAL | Simultaneous-Use | := | 1 | +----+-----------------+------------------+----+-------+ 2 rows in set (0.00 sec) mysql> select * from radgroupreply where GroupName = 'UNSHAPED_NORMAL'; +----+-----------------+-----------------------+----+-----------------+----- -+ | id | GroupName | Attribute | op | Value | prio | +----+-----------------+-----------------------+----+-----------------+----- -+ | 42 | UNSHAPED_NORMAL | Framed-Protocol | = | PPP | 0 | | 41 | UNSHAPED_NORMAL | Acct-Interim-Interval | = | 3600 | 0 | | 36 | UNSHAPED_NORMAL | Configuration-Token | = | UNSHAPED_NORMAL | 0 | | 43 | UNSHAPED_NORMAL | Session-Timeout | = | 3600 | 0 | | 46 | UNSHAPED_NORMAL | Port-Limit | = | 1 | 0 | +----+-----------------+-----------------------+----+-----------------+----- -+ 5 rows in set (0.00 sec) My radius.conf file as follows :- prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 10.0.0.128 port = 1812 hostname_lookups = no allow_core_dumps = yes regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no #$INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } # Unix /etc/passwd style authentication # unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } # EDIT MY GJM sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Framed-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } # # The "always" module is here for debugging purposes. Each # instance simply returns the same result, always, without # doing anything. always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module currently has no configuration. # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{expr:2 + 3 + %{exec: uid -u}}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. expr { } # # The 'digest' module currently has no configuration. # # "Digest" authentication against a Cisco SIP server. # See 'doc/rfc/draft-sterman-aaa-sip-00.txt' for details # on performing digest authentication for Cisco SIP servers. # digest { } # # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. # # The RADIUS attributes from the user request will be placed # into environment variables of the executed program, as # described in 'doc/variables.txt' # exec { wait = yes input_pairs = request } } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { auth_log sql } authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } } # # Pre-accounting. Decide which accounting type to use. # preacct { acct_unique suffix } # # Accounting. Log the accounting data. # accounting { detail sql radutmp # sql # sql_log } session { sql } post-auth { sql # sql_log } pre-proxy { } post-proxy { } My extract from the sql.conf file :- simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Any pointers much appreciated ! Regards Gabriel

4 9

EAP-TLS & deny access?
by uhel＠gmx.net 26 May '08

26 May '08

Hi, how can i deny access to a user (a certificate)? Is a CRL (with the CA_path and c_rehash stuff) the only possibility to deny access or is it possible to have a *whitelist* (like the CA_path and c_rehash stuff but as a whitelist) with certs that are allowed? I'm using Freeradius 1.1.7 with EAP-TLS which works fine so far. I'm not using any SQL or LDAP backend only the *users* file. -- regards uHel

2 2