January 2009 - Freeradius-Users - lists.freeradius.org

unscribe
by liadalex＠libero.it 08 Jan '09

08 Jan '09

please unscribe from list

1 0

Framed-IP-Address override NAS pool?
by up＠3.am 07 Jan '09

07 Jan '09

Hi: In my years running a dialup ISP, I used Cistron Radius and Cisco and Lucent NAS's. I am no using FreeRadius and a Cisco router to authenticate pptp VPN users. The default IP address pool is defined in the Cisco like this (parsed): interface Virtual-Template1 peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ! ip local pool vpnpool 192.168.0.1 192.168.0.254 That works fine authenticating unix system users using this raddb/users config (one of the supplied samples): DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP I now want to assign a few users different, static IPs using this: testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement). Is there something else that needs to be done to allow this? Thanks in advance! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 6

unsubscribe
by Milan Holub 07 Jan '09

07 Jan '09

unsuscribe

1 0

EAP-TLS
by Brian Ertel 07 Jan '09

07 Jan '09

Hi, I've modified the eap.conf, clients.conf, and users respectfully but am getting the below error when started radius: Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: No EAP type configured, module cannot do anything. radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. The following are the config's I made. Please let me know if you see anything that needs to change just to get radius start. eap.conf default_eap_type =tls tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random clients.conf client 148.85.0.0/16 { # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 31 characters in length. # secret = XXXXXXX # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # shortname = WAPS users DEFAULT Auth-Type :=EAP Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "300", Thanks, Brian

2 1

NAS-Identifier and radgroupcheck table
by Arrigo Savio 07 Jan '09

07 Jan '09

6 14

Re: rlm_perl - dbi - freetds works on radiusd -X but fails to sql connect in background
by nes pa 07 Jan '09

07 Jan '09

selinux was the culprit, thank you very much! On Wed, Jan 7, 2009 at 2:22 PM, nes pa <nespala(a)gmail.com> wrote: > I've changed the example.pl perl script so it 'use DBI;' to query a Sybase > server via freetds. > > Any hints welcome for solution or better tools to debug/strace into the > perl script. > > > > > > >

1 0

rlm_perl - dbi - freetds works on radiusd -X but fails to sql connect in background
by nes pa 07 Jan '09

07 Jan '09

I've changed the example.pl perl script so it 'use DBI;' to query a Sybase server via freetds. It works fine when running in foreground "radiusd -X" while testing. However, if ran in background, the perl script gets triggered, but the dbi connect fails: my $dbh = DBI->connect("dbi:Sybase:server=*****", $user, $passwd, {PrintError => 0}); Error: rlm_perl: perl_embed:: module = /etc/raddb/myperlscript.pm , func = authenticate exit status= Unable for connect to server OpenClient message: LAYER = (0) ORIGIN = (0) SEVERITY = (78) NUMBER = (41) Server ******, database Message String: Server is unavailable or does not exist. * Tethereal shows that there is no network activity towards the Sybase server. * At first I guessed using user radiusd instead of root would sabotage access to /etc/freetds.conf and/or freetds libraries, but changing radiusd.conf so it keep root priviledges didn't help. * I've been checking environment parameters between foreground and background, but could not find a discriminator. * Assuming some chroot'ing getting done by radiusd I have moved freetds.conf inside /etc/raddb ( and /etc/raddb/etc ) to no avail. * I have ran strace -f -p <pid> in the hope to see what the perlscript tries to do when invoked by a radius request, but I only see it writing the error to the /var/log/radius/radius.log * Changed the hostname towards ip address in /etc/freetds.conf to avoid a failing name resolving. Any hints welcome for solution or better tools to debug/strace into the perl script.

2 1

Digest authentication and perl authorization
by Luciano Afranllie 07 Jan '09

07 Jan '09

Hi, I have a test deployment with a sip proxy (kamailio) and a back to back user agent (sippy b2bua) pointing to freeradius. SIP proxy is making digest authentication of users and that is working fine. My plan is to use b2bua for prepaid calls authorization and call dropping (sip proxy forward calls from prepaid users to b2bua) so, I want b2bua to make just authorization of calls (this is, balance check). I am thinking in something like this: - Radius client (b2bua) sends an access-request with Service_type = "Authorize-Only" - Adding perl module to authorization section. - In authorize function of perl module check if the balance is enough to make the call. if yes add an attribute to the reply with granted credit time and return return RLM_MODULE_OK. If no, return RLM_MODULE_REJECT. My questions are: how is the best way of making authorization without authentication? - Should perl module set Auth-Type := Accept if the user is authorized? - What should I need to add in the users file for this to work, something like this? DEFAULT Auth-Type := Accept, Service-Type == "Authorize-Only" Thanks for your time. Regards Luciano

3 3

Freeradius process dies with some (bad?!) EAP requests
by Nelson Vale 07 Jan '09

07 Jan '09

Hi all, We have several machines running freeradius 2.0.2 as authentication server, and we're facing a strange and very critical problem. Occasionally radius server just dies with no apparent reason. When I look at the logs, the last lines I see before it happens are like: "... Error: rlm_eap: No EAPsession matching the State variable. Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request ..." ** I've googled for problems like this and I found some simillar occurrences, but no solutions provided... Is this a known problem that is fixed in a recent version? This is a big issue for us because this causes several thousands of users to complain about it, so we would appreciate your help... Thx, Nelson Vale

4 3

FreeRadius with radiusclient-ng and Cisco h323 VoIP attributes
by Dean Elwood 07 Jan '09

07 Jan '09

Hi there, I'm having real trouble getting FreeRadius and radiusclient-ng to talk to each other with Cisco h323 attributes. I believe I have set up FreeRadius correctly. I can connect using radiusclient-ng and do standard AUTH commands and all works fine. As soon as I try to add an attribute like:- h323-conf-id = '78FF6EBC 2F74D29E 4F400B22 8B4AA1C1' I get this parse error from radiusclient-ng:- : can't parse AV pair I assumed that this meant that radiusclient-ng didn't recognise the h323-conf-id attribute, so I included in the radiusclient-ng *client* dictionary the following:- VENDOR Cisco 9 ATTRIBUTE Cisco-AVPair 1 string Cisco ATTRIBUTE h323-call-origin 26 string Cisco ATTRIBUTE h323-remote-address 23 string Cisco ATTRIBUTE h323-conf-id 24 string Cisco ATTRIBUTE h323-setup-time 25 string Cisco ATTRIBUTE h323-call-origin 26 string Cisco ATTRIBUTE h323-call-type 27 string Cisco ATTRIBUTE h323-connect-time 28 string Cisco ATTRIBUTE h323-disconnect-time 29 string Cisco ATTRIBUTE h323-disconnect-cause 30 string Cisco ATTRIBUTE h323-voice-quality 31 string Cisco ATTRIBUTE h323-gw-id 33 string Cisco ATTRIBUTE h323-incoming-conf-id 35 string Cisco The client appears to be happy with this dictionary file (at least the client runs and still does standard AUTH's ok), but I still get the parse error on the h323 vars. The fact that the parse error states an error parsing "AV pair" makes me think that these attributes need to be formatted in a particular way. Could that be it? Any assistance or pointers in the right direction would be much appreciated.... Thanks, Dean

2 2