October 2009 - Freeradius-Users - lists.freeradius.org

Several LDAP searches
by Francisco Javier Valdera Garcia 16 Oct '09

16 Oct '09

Hello, I am configuring a freeradius server (version 2.1.7). I need two listen sections, both to authenticate users using the same LDAP server. The thing is that I need to do different searches with different filters, depending on which listen section is asked. What is the best way to configure this, if there is one? I have read the documentation, the wiki and the configuration files and I couldn't figure it out. Thanks in advance.

2 2

Freeradius + OpenLdap + WindowsXP(Wifi)
by Kleber Larroyd 15 Oct '09

15 Oct '09

Freeradius 1.1.7 Openldap Windows XP SP2 (WPA-TKIP / Protected EAP (PEAP)) Have any idea ? Where can i find the solution ? When i trying connect freeradius server with wireless over access point i get this error: Tue Oct 13 12:00:45 2009 : Debug: Finished request 7 Tue Oct 13 12:00:45 2009 : Debug: Going to the next request Tue Oct 13 12:00:45 2009 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.155.123:1812, id=77, length=117 User-Name = "kleberl" NAS-IP-Address = 192.168.155.123 NAS-Port-Type = Wireless-802.11 State = 0xcdb24b80885193f00e1673d06eb7859c EAP-Message = 0x029600261900170301001b8cfe319046bdc5f99d42805f852d4695a57e722889822c7a01be3f Message-Authenticator = 0x9d1262ea1db0eca8f5ecaaee93e7ff1d Tue Oct 13 12:00:45 2009 : Debug: Processing the authorize section of radiusd.conf Tue Oct 13 12:00:45 2009 : Debug: modcall: entering group authorize for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "preprocess" returns ok for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "chap" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "mschap" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_realm: No '@' in User-Name = "kleberl", looking up realm NULL Tue Oct 13 12:00:45 2009 : Debug: rlm_realm: No such realm "NULL" Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "suffix" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: - authorize Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: performing user authorization for kleberl Tue Oct 13 12:00:45 2009 : Debug: radius_xlat: '(uid=kleberl)' Tue Oct 13 12:00:45 2009 : Debug: radius_xlat: 'ou=People,dc=stars,dc=net' Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: performing search in ou=People,dc=stars,dc=net, with filter (uid=kleberl) Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: looking for check items in directory... Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: looking for reply items in directory... Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: user kleberl authorized to use remote access Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "ldap" returns ok for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: EAP packet type response id 150 length 38 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "eap" returns updated for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall: leaving group authorize (returns updated) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 13 12:00:45 2009 : Debug: auth: type "EAP" Tue Oct 13 12:00:45 2009 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 13 12:00:45 2009 : Debug: modcall: entering group authenticate for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Request found, released from the list Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: EAP/peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: processing type peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Authenticate Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_tls: processing TLS Tue Oct 13 12:00:45 2009 : Debug: eaptls_verify returned 7 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_tls: Done initial handshake Tue Oct 13 12:00:45 2009 : Debug: eaptls_process returned 7 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: EAPTLS_OK Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Received EAP-TLV response. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Tunneled data is valid. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Handler failed in EAP/peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Failed in EAP select Tue Oct 13 12:00:45 2009 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authenticate]: module "eap" returns invalid for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall: leaving group authenticate (returns invalid) for request 8 Tue Oct 13 12:00:45 2009 : Debug: auth: Failed to validate the user. Tue Oct 13 12:00:45 2009 : Debug: Delaying request 8 for 1 seconds Tue Oct 13 12:00:45 2009 : Debug: Finished request 8 Tue Oct 13 12:00:45 2009 : Debug: Going to the next request Tue Oct 13 12:00:45 2009 : Debug: Waking up in 6 seconds... Tue Oct 13 12:00:51 2009 : Debug: --- Walking the entire request list --- Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 0 ID 69 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 1 ID 70 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 2 ID 71 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 3 ID 72 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 4 ID 73 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 5 ID 74 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 6 ID 75 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 7 ID 76 with timestamp 4ad4961d Sending Access-Reject of id 77 to 192.168.155.123 port 1812 EAP-Message = 0x04960004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 8 ID 77 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Nothing to do. Sleeping until we see a request. # --------------- EAP.CONF ---------------- eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } mschapv2 { } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes } } # ---------- RADIUSD.CONF----------------- ldap { server = "localhost" identity = "cn=admin,dc=stars,dc=net" password = secret55 basedn = "ou=People,dc=stars,dc=net" filter = "(uid=%u)" start_tls = no #access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix ldap eap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } # -----------USERS ------------------ DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP _________________________________________________________________ Você sabia que com o Hotmail você tem espaço ilimitado para guardar seus e-mails? Começe a usar já! http://www.microsoft.com/brasil/windows/windowslive/products/hotmail.aspx

4 4

dialup_admin query problem
by Whorled Services 15 Oct '09

15 Oct '09

I am using dialup_admin 1.80 from within the current freeradius 2.1.7 release. freeradius is working fine, and some dialup_admin menu selections are working correctly. One that isn't is User Statistics. I have configured dialup admin to not use the 'totacct' table by setting "general_stats_use_totacct: no" in admin.conf When I select User Statistics, dialup_admin is still running a query for fields in the totacct table: 091015 10:08:21 22 Connect freeradius@localhost on 22 Init DB radius 22 Query EXPLAIN SELECT * FROM nas 22 Query SELECT * FROM nas 22 Init DB radius 22 Query EXPLAIN SELECT * FROM radacct WHERE acctdate >= '2009-10-08' AND acctdate <= '2009-10-15' ORDER BY connnum desc 22 Query SELECT * FROM radacct WHERE acctdate >= '2009-10-08' AND acctdate <= '2009-10-15' ORDER BY connnum desc The table name 'radacct' is correct. The query for field 'acctdate' is incorrect, that field is in 'totacct' & not present in 'radacct'. I know one solution is to set "general_stats_use_totacct: yes" & run the tot_stats scripts daily, but that it is not working with the 'radacct' table makes me concerned that I may have a configuration issue that could lead to further problems. Is there some other configuration option needed to make this work properly? TIA Linux version 2.6.27.27 (root@darkstar) (gcc version 4.2.4) #1 SMP Wed Jul 22 07:27:34 AKDT 2009 apache 2.2.13 php 5.2.10 zend 3.3.9 mysql 5.0.67 FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Dec 5 2008 at 10:35:21 dialup_admin 1.80 -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

1 0

Good number of Max Connections to run freeradius
by Alisson 15 Oct '09

15 Oct '09

What is a good number of max_connections on Mysql to run FreeRadius? i'm using max_connections=500 -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 2

Re: PAP / ntlm_auth fails unless "DEFAULT Auth-Type = ntlm_auth" in users.
by Ivan Kalik 15 Oct '09

15 Oct '09

> I've been jacking around trying to fix this for several hours - but no > go. I've RTFM several times, and read several docs such as: > http://wiki.freeradius.org/Combining_authentication_of_AD_accounts_%28nt > lm_auth%29_with_accounts_stored_elsewhere > > > > When I say "fix" - it's always been "broken" - it's never worked without > the DEFAULT entry in users. Most all my accounts are in AD so the > DEFAULT works for me, but I'm using this issue as a learning > opportunity, but instead it's just a frustration opportunity. > > > > I'll post all my confs (2.1.6) and -X output if needed, but just looking > for some hints to help determine why when the process fails through to > PAP, it won't use ntlm_auth - it will only use "files" Post the debug. Ivan Kalik Kalik Informatika ISP

2 1

Postgres
by Sparkes, David 15 Oct '09

15 Oct '09

Hi, I would like to get Freeradius working with a PostgreSQL database: are there any handy HOWTOs or Tutorials that explain how to do this? I am running RedHet EL5. Relevant Packages: freeradius2.x86_64 2.1.7-2.el5 installed freeradius2-libs.x86_64 2.1.7-2.el5 installed freeradius2-postgresql.x86_64 2.1.7-2.el5 installed freeradius2-python.x86_64 2.1.7-2.el5 installed freeradius2-utils.x86_64 2.1.7-2.el5 installed postgresql.x86_64 8.1.11-1.el5_1.1 installed postgresql-libs.i386 8.1.11-1.el5_1.1 installed postgresql-libs.x86_64 8.1.11-1.el5_1.1 installed postgresql-server.x86_64 8.1.11-1.el5_1.1 installed Regards, Dave

5 10

To proxy, or not to proxy, that is the question ...
by Dean, Barry 15 Oct '09

15 Oct '09

I currently run two virtual servers, one for our local secure wireless and one for eduroam customers. The local one receives RADIUS packets from Bradford Campus Manager, which is responsible for Network Access Control and stamps Auth-OK replies with the VLAN for the user. What I want to do is combine these wireless services, so that we just have eduroam. The functionality we will need, will be: The requests will come to the eduroam server address. if (no domain specified) then who are ya? fi if (domain is non-local) then proxy to user's home site. fi if (domain is local AND authenticating from a local NAS) then authenticate locally by proxy to Bradford Campus Manager (Campus Manager will receive the stripped user@realm as user and proxy to the local server address) else authenticate and return ACK/NACK to remote server in usual way for one of our users visiting remote site fi The part I am not sure how to do is the last part, a conditional proxy based on source NAS. I assume I need to dip into unlang, but can I put that into the proxy.conf file? realm local.site.ac.uk { if( NAS-IP-Address ~= /192.168.*/ ) then # match my likely clients... set-up A else set-up B fi } Or whatever (I don't speak unlang, yet!), or have I got to determine the source of the request somewhere else and use unlang to re-write the realm to some special sentinel value that would be caught in proxy.conf like: realm local.site.ac.uk { do the normal thing } realm special.local.site.ac.uk { do the clever NAC proxy stuff } As usual, thanks for your time and hope someone can steer me in the right direction before my head explodes. (Yes I did read the docs, didn't help in this case!) ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department

3 3

PAP / ntlm_auth fails unless "DEFAULT Auth-Type = ntlm_auth" in users.
by Gary Gatten 15 Oct '09

15 Oct '09

I've been jacking around trying to fix this for several hours - but no go. I've RTFM several times, and read several docs such as: http://wiki.freeradius.org/Combining_authentication_of_AD_accounts_%28nt lm_auth%29_with_accounts_stored_elsewhere When I say "fix" - it's always been "broken" - it's never worked without the DEFAULT entry in users. Most all my accounts are in AD so the DEFAULT works for me, but I'm using this issue as a learning opportunity, but instead it's just a frustration opportunity. I'll post all my confs (2.1.6) and -X output if needed, but just looking for some hints to help determine why when the process fails through to PAP, it won't use ntlm_auth - it will only use "files" Thanks! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

acct_users WARNING in 2.1.7
by Craig Campbell 15 Oct '09

15 Oct '09

I've upgraded from 2.1.6 to 2.1.7 and the following error is now appearing in my debug output. [/usr/local/etc/raddb/acct_users]:36 WARNING! Check item "Tmp-String-0" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items acct_users contains the following, (Line 36 is the line beginning with DEFAULT) #CEC Exec-Program = "%{exec:/usr/local/sbin/acctstop.sh}", DEFAULT Acct-Status-Type == Stop Tmp-String-0 = "%{exec:/usr/local/sbin/acctstop.sh}", Fall-Through = no What have I done wrong? It seems to be ok, and be doing what I desire..... but I want the config to be CLEAN. All I really want is to run a script when an accounting STOP record is received. Am I doing it wrong? Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4509 (20091015) __________ The message was checked by ESET Smart Security. http://www.eset.com

2 1

3GPP string Attributes, containing encapsulated information...
by Stefan A. 15 Oct '09

15 Oct '09

Hi there, Is there a way to get Information out of the 3GPP-GPRS-Negotiated-QoS-profile? The Attribute is defined in the dictionary as: ATTRIBUTE 3GPP-GPRS-Negotiated-QoS-profile 5 string The Value of a String might be: 99-0B811F7396878774010000 To get the encapsulated "Traffic Class", I will need the most left 3 bits of the first '7' of the string. It would be 7 --> 0111 --> 011 --> 3 Is there a function available, to do this? Following the complete Attribute: AVP: l=33 v=3GPP(10415) t=3GPP-GPRS-Negotiated-QoS-profile(5): UMTS GTP QoS Profile Length: 25 UMTS GTP QoS Profile Version: 99 Hyphen separator: - 00.. .... = Spare: 0 ..00 1... = QoS delay: Delay class 1 (1) .... .011 = QoS reliability: Unack GTP/LLC, Ack RLC, Protected data (3) 1000 .... = QoS peak: Up to 128 000 oct/s (8) .... 0... = Spare: 0 .... .001 = QoS precedence: High priority (1) 000. .... = Spare: 0 ...1 1111 = QoS mean: Best effort (31) 011. .... = Traffic class: Interactive class (3) ...1 0... = Delivery order: Without delivery order ('no') (2) .... .011 = Delivery of erroneous SDU: Erroneous SDUs are not delivered ('no') (3) Maximum SDU size : 1500 octets Maximum bit rate for uplink : 1024 kbps Maximum bit rate for downlink : 1024 kbps 0111 .... = Residual BER: 1/100 000 = 1x10^-5 (7) .... 0100 = SDU Error ratio: 1/10 000 = 1x10^-4 (4) 0000 00.. = Transfer delay: Subscribed Transfer Delay (in MS to network direction) (0) .... ..01 = Traffic handling priority: Priority level 1 (1) Guaranteed bit rate for uplink: Subscribed guaranteed bit rate for uplink (in MS to network direction) (0) Guaranteed bit rate for downlink: Subscribed guaranteed bit rate for downlink (in MS to network direction) (0) Thank You. Stefan

1 0