July 2008 - Freeradius-Users - lists.freeradius.org

RE: Seek through several RADIUS severs without realms
by Ronen Kfir 31 Jul '08

31 Jul '08

As I didn't get any response yet, I would like to make my self clearer: I'm looking for alternative ways to differ among authenticated users, other then realms. I thought that the way to do it is, as I described bellow. The thing is I'm not sure how to implement this idea with in Free RADIUS. Please help me in the configuration and implamantation of this concepts. Thank you, Ronen My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

SQL module mixes up packets when putting it to database
by Khalukhin Alexander 31 Jul '08

31 Jul '08

Hi all! I'm using 'sql' module in accounting to log all the radius packets from remote radius client (cisco 2600). I've investigated, that accounting packets are received in right order ("Start" then "Stop"), but putted into DB log table in wrong order ("Stop" then "Start"). Here are the logs: ============ /var/log/radius/radacct/x.y.z.a/detail-20080724 ================= Thu Jul 24 09:48:26 2008 Acct-Session-Id = "57000000000008F7" Calling-Station-Id = "4959636156" Called-Station-Id = "74955891937" Cisco-AVPair = "call-id= F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6" h323-setup-time = ".09:48:16.191 MSD Thu Jul 24 2008" h323-gw-id = "voice5.di-net.ru" h323-conf-id = "F0FF23AA 587A11DD B8009A2D 9B5B4497" h323-call-origin = "originate" h323-call-type = "VoIP" Cisco-AVPair = "h323-incoming-conf-id=F0FF23AA 587A11DD B8009A2D 9B5B4497" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:74955891937" User-Name = "4959636156" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = *Start* Service-Type = Login-User NAS-IP-Address = 89.208.190.6 Acct-Delay-Time = 0 call-id = "F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6" h323-incoming-conf-id = "F0FF23AA 587A11DD B8009A2D 9B5B4497" subscriber = "Unknown" session-protocol = "sipv2" gw-rxd-cdn = "ton:0,npi:0,#:74955891937" Client-IP-Address = 89.208.190.6 Acct-Unique-Session-Id = "51b334248c332b3b" Timestamp = 1216878506 Thu Jul 24 09:48:27 2008 Acct-Session-Id = "57000000000008F7" Calling-Station-Id = "4959636156" Called-Station-Id = "74955891937" Cisco-AVPair = "call-id= F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6" h323-setup-time = ".09:48:16.191 MSD Thu Jul 24 2008" h323-gw-id = "voice5.di-net.ru" h323-conf-id = "F0FF23AA 587A11DD B8009A2D 9B5B4497" h323-call-origin = "originate" h323-call-type = "VoIP" Cisco-AVPair = "h323-incoming-conf-id=F0FF23AA 587A11DD B8009A2D 9B5B4497" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:74955891937" Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 0 h323-connect-time = ".09:48:16.371 MSD Thu Jul 24 2008" h323-disconnect-time = ".09:48:16.371 MSD Thu Jul 24 2008" h323-disconnect-cause = "1" h323-remote-address = "89.208.190.4" Cisco-AVPair = "release-source=4" h323-voice-quality = "0" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:0,pi:1,si:0,#:4959636156" Cisco-AVPair = "gw-final-xlated-cdn=ton:0,npi:0,#:74955891937" Cisco-AVPair = "gw-final-xlated-cgn=ton:0,npi:0,pi:1,si:0,#:4959636156" User-Name = "4959636156" Acct-Status-Type = *Stop* Service-Type = Login-User NAS-IP-Address = 89.208.190.6 Acct-Delay-Time = 0 call-id = "F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6" h323-incoming-conf-id = "F0FF23AA 587A11DD B8009A2D 9B5B4497" subscriber = "Unknown" session-protocol = "sipv2" gw-rxd-cdn = "ton:0,npi:0,#:74955891937" release-source = "4" gw-rxd-cgn = "ton:0,npi:0,pi:1,si:0,#:4959636156" gw-final-xlated-cdn = "ton:0,npi:0,#:74955891937" gw-final-xlated-cgn = "ton:0,npi:0,pi:1,si:0,#:4959636156" Client-IP-Address = 89.208.190.6 Acct-Unique-Session-Id = "51b334248c332b3b" Timestamp = 1216878507 =========== /var/log/radius/sqltrace.sql ================ INSERT INTO ACC ("ACCT-STATUS-TYPE", "NAS-IP-ADDRESS", "H323-CALL-ORIGIN", "CALLED-STATION-ID", "CALLING-STATION-ID", "ACCT-SESSION-ID", "CALL-ID", "SIP-TO-TAG", "SIP-FROM-TAG", "SIP-TRANSLATED-REQUEST-URI", "USER-NAME", "SIP-SOURCE-IP-ADDRESS", "SIP-SOURCE-PORT", "ACCT-SESSION-TIME", "H323-CONNECT-TIME", "H323-SETUP-TIME", "H323-DISCONNECT-TIME", "H323-DISCONNECT-CAUSE", "IPHOP-COUNT", "IPHOP1", "IPHOP2", "IPHOP3", "H323-CONF-ID") VALUES ('*Start*', '89.208.190.6', 'originate', '74955891937', '4959636156', '57000000000008F7', ' F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6', '', '', '', '4959636156', '', '', '', '', '.09:48:16.191 MSD Thu Jul 24 2008', '', '', '', '', '', '', 'F0FF23AA 587A11DD B8009A2D 9B5B4497'); INSERT INTO ACC ("ACCT-STATUS-TYPE", "NAS-IP-ADDRESS", "H323-CALL-ORIGIN", "CALLED-STATION-ID", "CALLING-STATION-ID", "ACCT-SESSION-ID", "CALL-ID", "SIP-TO-TAG", "SIP-FROM-TAG", "SIP-TRANSLATED-REQUEST-URI", "USER-NAME", "SIP-SOURCE-IP-ADDRESS", "SIP-SOURCE-PORT", "ACCT-SESSION-TIME", "H323-CONNECT-TIME", "H323-SETUP-TIME", "H323-DISCONNECT-TIME", "H323-DISCONNECT-CAUSE", "IPHOP-COUNT", "IPHOP1", "IPHOP2", "IPHOP3", "H323-CONF-ID") VALUES ('*Stop*', '89.208.190.6', 'originate', '74955891937', '4959636156', '57000000000008F7', ' F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6', '', '', '', '4959636156', '', '', '0', '.09:48:16.371 MSD Thu Jul 24 2008', '.09:48:16.191 MSD Thu Jul 24 2008', '.09:48:16.371 MSD Thu Jul 24 2008', '1', '', '', '', '', 'F0FF23AA 587A11DD B8009A2D 9B5B4497'); ========== Data from DB acc table =========== ID ACCT-STATUS-TYPE CALL-ID H323-CONF-ID ---------- ------------------ ----------------------------------------------------- ------------------------------------ 1134861 Stop F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6 F0FF23AA 587A11DD B8009A2D 9B5B4497 1134862 Start F217BA24-587A11DD-83D18BF5-E033E9AB(a)89.208.190.6 F0FF23AA 587A11DD B8009A2D 9B5B4497 ID here is autoincremented primary key (taked from sequence - DB is Oracle 10gR2). As you can see, right order of packets ("Start" then "Stop") is violated. I need them to appear in database in right order. This error happens once-twice per day, in hours of medium load average. Maybe I should use only one database connection in oracle_sql (now num_sql_socks=5 in /etc/raddb/oraclesql.conf)? Or what it can be? Give me a clue, please Server info: FreeRADIUS Version 1.1.7, for host x86_64-redhat-linux-gnu, built on Jan 31 2008 at 18:32:53 CentOS release 5.2 (Final) Linux Registrar 2.6.18-53.1.21.el5 #1 SMP Tue May 20 09:35:07 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux

5 9

acct and syslog
by Mustapha Bouikhif 31 Jul '08

31 Jul '08

Hi folks, Is there a simple way to send accounting logs (of FR 2.0.5) to syslog ? I mean the various detail files: auth_log, reply_log, pre||post_proxy_log ... It is possible to append them to radius.log (who can be maintained by syslog) but i think is a bad idea. thanks for any clues... -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

3 5

Re: EAP Autentication OK but missing some user attributes to client <20080731081208.GA20439@wildfire.net.ic.ac.uk>
by Davi Baldin 31 Jul '08

31 Jul '08

How can I control access simultaneously to a single user connected via wifi? Using these attributes I control cisco access. Regards, Davi. Davi Baldin JVS do Brasil - IBM BP Premier davi(a)jvsinfo.com.br (19) 3211-1266 (19) 9266-6793 (JVS) (19) 9615-6681 Phil Mayers <p.mayers(a)imperial.ac.uk> Enviado por: freeradius-users-bounces+davi=jvsinfo.com.br(a)lists.freeradius.org 31/07/2008 05:13 Favor responder a FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Para FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Assunto Re: EAP Autentication OK but missing some user attributes to client <20080731081208.GA20439(a)wildfire.net.ic.ac.uk> On Wed, Jul 30, 2008 at 04:42:45PM -0300, Davi Baldin wrote: >List, > >I was finished with successful FreeRadius 2 with EAP configuration and >MSCHAP2. Everything OK, but when the Access-Accept package are sent back >to client, we missing some attributes mapped from LDAP user account. > >I need to sent attribute Expiration and Simultaneous-Use to client. How >can I get this? This is a wrong configuration made by me, or a limitation >of the EAP protocol? Expiration and Simultanous-Use are not attributes you send to the client. They're private attributes that control the server. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

EAP Autentication OK but missing some user attributes to client
by Davi Baldin 31 Jul '08

31 Jul '08

List, I was finished with successful FreeRadius 2 with EAP configuration and MSCHAP2. Everything OK, but when the Access-Accept package are sent back to client, we missing some attributes mapped from LDAP user account. I need to sent attribute Expiration and Simultaneous-Use to client. How can I get this? This is a wrong configuration made by me, or a limitation of the EAP protocol? Another symptom is the radhwo does not list the autenticated user from EAP, just from cisco client. This is part of log: rlm_ldap: LDAP attribute radiusExpiration as RADIUS attribute Expiration == "May 28 2009 00:00:00 BRT" rlm_ldap: LDAP attribute sambaAcctFlags as RADIUS attribute SMB-Account-CTRL-TEXT == "[XU]" rlm_ldap: LDAP attribute sambaNtPassword as RADIUS attribute NT-Password == 0x3335333030343442414443453434394536443045324434453445313530423444 rlm_ldap: LDAP attribute sambaLmPassword as RADIUS attribute LM-Password == 0x4133344533324230433035303233374641414433423433354235313430344545 rlm_ldap: LDAP attribute radiusSimultaneousUse as RADIUS attribute Simultaneous-Use == 1 ++[ldap-eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success Using saved attributes from the original Access-Accept rlm_eap: Freeing handler ++[eap] returns ok +- entering group session expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> bhsouza ++[radutmp] returns ok Login OK: [dbht] (from client davi port 36 cli 0019d27646d4) } # server test-eap Sending Access-Accept of id 0 to 192.168.231.254 port 3074 Idle-Timeout = 1800 User-Name = "dbht" MS-MPPE-Recv-Key = 0x8ddec5a7f80e852a6a74a4519becba99244be80b9f78e0a9ea0a8386ff1270c5 MS-MPPE-Send-Key = 0x42a07c62a4820564cae4a28c13bdc13d2f6e7a924b2bf794b21ef27520de7510 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. May anyone help me? Regards, Davi. Davi Baldin JVS do Brasil - IBM BP Premier davi(a)jvsinfo.com.br (19) 3211-1266 (19) 9266-6793 (JVS) (19) 9615-6681

2 1

Re: Openser+radiusclient-ng+Freeradius+IAS
by António Rio Costa 30 Jul '08

30 Jul '08

Thanks, for the idea. I will try to understand what is going wrong using wireshark. > Date: Wed, 30 Jul 2008 08:38:14 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Openser+radiusclient-ng+Freeradius+IAS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48900C56.6020508(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Antonio Rio Costa wrote: > > 1 Can radiusclient-ng authenticate in IAS ???? If so how? I've tried it > > and IAS says that there is an malformed radius message. > > Use wireshark to grab copies of the packets. Put the pcap files on a > web page, and post the URL here. > > > 2 Putting freeradius in the midlle of the radiusclient-ng and IAS shoud > > he act as a proxy between the radiusclient-ng and the IAS? this > > configuration works? has anyone done it? > > Try it. It's not hard. > > Or, use freeradius-client. There have been a number of bug fixes to > the code. > > Alan DeKok. >

1 0

Adding a counter to raddb/sql/mysql/counter.conf
by Liran Tal 30 Jul '08

30 Jul '08

Hey, How about adding more widely used counters to the counter.conf collection? One suggestion is the Access-Period counter which is provided with the attachment. Regards, Liran Tal.

1 0

%{2} not expanding for accounting packets?
by Phil Mayers 30 Jul '08

30 Jul '08

We've got some switches that don't include the MAC address in the Calling-Station-Id of accounting packets. To simplify the config, I use an unlang expression to add it: if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) { update request { Calling-Station-Id = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } However, the output of that is: 00::22:33:44:55 ...which is odd: rad_recv: Accounting-Request packet from host 172.16.54.36 port 32770, id=92, length=113 Acct-Status-Type = Start User-Name = "001E0BA09F67" NAS-IP-Address = 172.16.54.36 Acct-Session-Id = "Tue Jul 29, 2008 18:54:00" Service-Type = Login-User NAS-Port = 1035 NAS-Port-Type = Ethernet Tunnel-Private-Group-Id:0 = "14" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Acct-Delay-Time = 0 server macauth { +- entering group preacct calling-mac-1: Could not find value pair for attribute Calling-Station-Id ++[calling-mac-1] returns noop calling-mac-2: Could not find value pair for attribute Calling-Station-Id ++[calling-mac-2] returns noop called-mac-1: Could not find value pair for attribute Called-Station-Id ++[called-mac-1] returns noop called-mac-2: Could not find value pair for attribute Called-Station-Id ++[called-mac-2] returns noop ++? if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) ?? Evaluating !(Calling-Station-Id) -> FALSE ?? Evaluating (NAS-Port-Type == Ethernet) -> TRUE ?? Evaluating (User-Name =~ /(..)(..)(..)(..)(..)(..)/) -> TRUE ++? if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) -> TRUE ++- entering if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> 00::0B:A0:9F:67 Similar expressions in the "authorize" section appear to work. Anyone have any ideas?

2 3

peap/mschapv2 + mysql + filter-id
by Adam W. Sewell 30 Jul '08

30 Jul '08

I've been working trying to setup freeradius to work with peap/mschapv2 backended by a mysql database on Enterasys switches. I've got almost everything working except for when a user authenticates with a 802.1x supplicant with peap/mschapv2, freeradius sends an access-accept packet but does not append the Filter-Id that is required for Enterasys switches to switch the default port policy. However, when I authenticate to the management portion of the switch, which uses pap, it authenticates and sends the Filter-Id as it should. I'm not sure what I'm missing here and I honestly don't know what configs you guys would need to see to help with this. So if I can provide any logs or config files, please let me know. Thanks for any help.

2 2

SIGHUP
by Raffael Himmelreich 30 Jul '08

30 Jul '08

Hi there again, I'm trying to change the detailfile location on the fly. But when I edit the value in the config file and send the process a HUP signal this is what I get: Wed Jul 30 09:45:11 2008 : Debug: Received HUP signal. Wed Jul 30 09:45:11 2008 : Debug: Module: Trying to reload module "detail" Wed Jul 30 09:45:11 2008 : Debug: detail { Wed Jul 30 09:45:11 2008 : Debug: detailfile = "/dev/null" Wed Jul 30 09:45:11 2008 : Debug: header = "%t" Wed Jul 30 09:45:11 2008 : Debug: detailperm = 384 Wed Jul 30 09:45:11 2008 : Debug: dirperm = 493 Wed Jul 30 09:45:11 2008 : Debug: locking = no Wed Jul 30 09:45:11 2008 : Debug: log_packet_header = no Wed Jul 30 09:45:11 2008 : Debug: } Unfortunately "/dev/null" is the old value. What I try to archive is dynamic relaying. I want to enable and disable relaying while the server is running. I'm open to other solutions too. :) best regards

2 1