October 2009 - Freeradius-Users - lists.freeradius.org

Adding vendor specific attributes to dictionary
by Patric 09 Oct '09

09 Oct '09

Hi all :) Hope someone can point me in the right direction once again! freeradius v 2.1.3 I am attempting to add vendor specific attributes to my dictionary without success :( I was given the following information to add: Class Number Attribute Value Type VENDORATTR 12345 Vendor-Attribute-A 1 string VENDORATTR 12345 Vendor-Attribute-A 2 string Now since VENDORATTR is not a freeradius dictionary format I assume this comes from a different RADIUS server, which I need to now implement in my freeradius dicitonary. I have had a look at the dictionary man page, and see that one can use ATTRIBUTE for this, but since the Number is the same for both attributes I would assume that I need to define a vendor specific attribute encapsulation so that I can list multiple attributes for this vendor, but this does not seem to be working for me - This is what I have done: File dictionary: ---------------- $INCLUDE /usr/share/freeradius/dictionary $INCLUDE /etc/raddb/dictionary.myvendor File dictionary.myvendor: ------------------------- VENDOR MyVendor 12345 BEGIN-VENDOR MyVendor ATTRIBUTE Vendor-Attribute-A 1 string ATTRIBUTE Vendor-Attribute-B 2 string END-VENDOR MyVendor When I attempt to start my freeradius server with this dictionary file all I get is the following message to std out: Errors reading dictionary: dict_init: /etc/raddb/dictionary.myvendor[1]: dict_init: /etc/raddb/dictionary.myvendor[1]: dict_init: /etc/ Thats it - even in debug mode no other message is printed. Any pointers would as always be very much appreciated :) Many thanks and have a great Friday, Patric

3 5

when to use exec / echo external script query
by cory＠gateway.net.au 09 Oct '09

09 Oct '09

freeradius 1.1.3-1.1 freeradius mysql Redhat Linux Fedora 6 I was looking for information on at what point i would fire an external script. What i wish to do is once a client is authenticated and a framed-ip address allocated to fire an external script to push the IP address into my postfix access table and remove it on disconnect. If anyone has suggestions and can advise on this please chime in. Cory

3 2

Help with freeradius
by Jason Berenson 08 Oct '09

08 Oct '09

Greetings, I am migrating from Solaris 8 to Solaris 10 and in the process upgrading freeradius from 0.9.3 to 2.1.7. I'm having some difficulty in getting it to work. I've pretty much copied the users and radiusd.conf files over from the old server. Here's some output with debugging turned on. This is from a cisco 7206 trying to authenticate against the new radius server. My goal is to have the radius server use getpw() to find the login since we scrapped NIS for LDAP which runs on a different server. rad_recv: Access-Request packet from host x.x.x.x port 1645, id=2, length=84 User-Name = "jason" User-Password = "test" NAS-Port = 2 NAS-Port-Id = "tty2" NAS-Port-Type = Virtual Calling-Station-Id = "y.y.y.y" NAS-IP-Address = x.x.x.x Thu Oct 8 14:12:07 2009 : Debug: +- entering group authorize {...} Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[preprocess] returns ok Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[chap] returns noop Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Thu Oct 8 14:12:07 2009 : Debug: No '@' in User-Name = "jason", looking up realm NULL Thu Oct 8 14:12:07 2009 : Debug: No such realm "NULL" Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[suffix] returns noop Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Thu Oct 8 14:12:07 2009 : Debug: users: Matched entry jason at line 14 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[files] returns ok Thu Oct 8 14:12:07 2009 : Debug: Found Auth-Type = System Thu Oct 8 14:12:07 2009 : Debug: +- entering group UNIX {...} Thu Oct 8 14:12:07 2009 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 1 Thu Oct 8 14:12:07 2009 : Auth: [unix] invalid password "jason" Thu Oct 8 14:12:07 2009 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[unix] returns reject Thu Oct 8 14:12:07 2009 : Debug: Failed to authenticate the user. Thu Oct 8 14:12:07 2009 : Auth: Login incorrect: [jason/test] (from client fonseca port 2 cli y.y.y.y) Thu Oct 8 14:12:07 2009 : Debug: Delaying reject of request 1 for 1 seconds Thu Oct 8 14:12:07 2009 : Debug: Going to the next request Thu Oct 8 14:12:07 2009 : Debug: Waking up in 0.9 seconds. Thu Oct 8 14:12:08 2009 : Debug: Sending delayed reject for request 1 Sending Access-Reject of id 2 to x.x.x.x port 1645 Thu Oct 8 14:12:08 2009 : Debug: Waking up in 4.9 seconds. Here's the relevant parts of the users file: DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." # # Staff users here # jason Auth-Type := System Fall-Through = Yes I've included what I think is needed from the radius.conf file. If more is needed please let me know and I'll forward it over. -Jason unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # #passwd = /usr/local/etc/raddb/passwd #shadow = /usr/local/etc/raddb/shadow #group = /usr/local/etc/raddb/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. #Auth-Type MS-CHAP { # mschap #} # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # Auth-Type UNIX { unix } # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. # eap }

2 2

Re: Memory leak or misunderstanding - rlm_perl?
by Mihail Vasiliev 08 Oct '09

08 Oct '09

Alexander Clouter > Alan DeKok <aland(a)deployingradius.com> wrote: >>> >>> I am running freeradius-2.1.6 with all AAA logick hidden in perl >>> module, >>> thus using rlm_perl. >>> >>> Having about 1000-10000 client connections per day radiusd consumes >>> about >>> 1Gb of memory per day (I restart it daily). >>> >>> The only (possibly) important thing - I am using several external >>> modules >>> in my main perl module. >> >> Perl's garbage collector isn't perfect. It may be that you really do >> need to restart to get memory cleaned up. >> > At the end of the request handling function, it might be work getting > your script to look at how much memory it has consumed[1] and then > commit Seppuku; hopefully FreeRADIUS is primed to notice the suicide and > restart the perl module from scratch. > > A trivial fix, but if you have long running state information you might > need to do some reworking to move some data into a DB file or something > (*not* an SQL database...please :) Well, I actualy already do it - I store the actual data in memcached, running as a stand-alone process. Well, thank you anyway. > > Cheers > > [1] http://www.perlmonks.org/?node_id=115098 > > -- > Alexander Clouter > .sigmonster says: Beware of a tall black man with one blond shoe. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Memory leak or misunderstanding - rlm_perl?
by Mihail Vasiliev 08 Oct '09

08 Oct '09

Hello, all. I am running freeradius-2.1.6 with all AAA logick hidden in perl module, thus using rlm_perl. Having about 1000-10000 client connections per day radiusd consumes about 1Gb of memory per day (I restart it daily). The only (possibly) important thing - I am using several external modules in my main perl module. I can supply code of perl modules, if necessary. radiusd config (with stripped off comments): prefix = /usr/local exec_prefix = /usr/local sysconfdir = /usr/local/etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = ${localstatedir}/lib/radiusd log_file = ${logdir}/radius.log libdir = /usr/local/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 listen { ipaddr = me.radius port = 1645 type = auth } listen { ipaddr = me.radius port = 1646 type = acct } log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } hostname_lookups = no allow_core_dumps = yes regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 300 } modules { chap { authtype = CHAP } unix { cache = no shadow = /etc/shadow } mschap { use_mppe = no } realm suffix { } preprocess { } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } perl { module = /etc/raddb/esdfreeradius.pm func_authenticate = esd_authenticate func_authorize = esd_authorize func_preacct = esd_preacct func_accounting = esd_accounting func_checksimul = esd_checksimul func_post_auth = esd_post_auth func_detach = esd_detach } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 10.0.1.1 range-stop = 10.0.254.254 netmask = 255.255.255.255 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess perl chap suffix } authenticate { Auth-Type CHAP { chap } Auth-Type perl { perl } } preacct { preprocess acct_unique } accounting { perl } session { perl } post-auth { } pre-proxy { } post-proxy { }

4 3

Proxying accounting to create a "tee"
by John Morrissey 07 Oct '09

07 Oct '09

I'm looking to process RADIUS accounting locally (SQL) as well as proxy it to a remote host (to some third party software that also wants to receive a copy of all accounting). Is this possible with FreeRADIUS? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

6 30

Expired unix system passwords
by James Smallacombe 07 Oct '09

07 Oct '09

Hi: We have a client running FreeRadius 2.1.6 on a Linux box authenticating against shadow passwords. I've gone over the radiusd.conf and it appears that the expire module is enabled by default in the global config (there are no virtual servers here). However, FreeRadius appears to be ignoring this attribute and authenticating users with expired passwords anyway. I tried expiring the account and that worked, but it would be much better to have it respect expired passwords. Is there something I missed? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

4 7

Weekly and daily logs
by Sergio Belkin 07 Oct '09

07 Oct '09

Sorry for the stupid question Is possible on FreeRADIUS Version 2.1.1 create log files both on daily and weekly basis? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Re: Proxy/Realm problem in 2.1.7
by Ivan Kalik 07 Oct '09

07 Oct '09

> Since upgrading FR to 2.1.7 from 2.1.3 and 2.1.1 on our 2 servers > there's been an issue with our proxy pool. > > There are three servers in the auth and acct pools, but unless I comment > two of them out (as below) I receive a 'Request Denied' message back in > response to the first access-request packet that is proxied to one of > the auth servers. > > Is this a bug in 2.1.7, or is there a difference in configuration file > format between the versions? > > # POOL Server config... > > pool_config { > test_username = 'test-user(a)remote-realm.com' > test_password = '***************' > secret0 = '***************' > secret1 = '***************' > secret2 = '***************' > } > > realm pool { > nostrip > auth_pool = pool_auth > acct_pool = pool_acct > } > > # Server Pools > server_pool pool_auth { > type = client-port-balance > # home_server = pool0 > home_server = pool1 > # home_server = pool2 > } > > server_pool pool_acct { > type = client-port-balance > # home_server = pool0 > home_server = pool1 > # home_server = pool2 > } > > home_server pool0 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server0.net > secret = ${pool_config.secret0} > port = 1812 > type = auth+acct > } > > home_server pool1 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server1.net > secret = ${pool_config.secret1} > port = 1812 > type = auth+acct > } > > home_server pool2 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server2.net > secret = ${pool_config.secret2} > port = 1812 > type = auth+acct > } Start the server in debug mode. You will see how does home server configuration resolve and is something not as expected. Ivan Kalik Kalik Informatika ISP

1 0

Attr-Rewrite and Users File
by Anja Ruckdaeschel 07 Oct '09

07 Oct '09

Hi there! Please help.... I´m doing a attr_rewrite with an attribute in the request: attr_rewrite strip-vpn { attribute = Acct-Session-Id searchin = packet searchfor = "^[^$]+([\(])([^$]+).+$" replacewith = %{2} new_attribute = no max_matches = 1 append = no } Radius doing the rewrite seems okay to me... [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test1 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test1)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test1' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Later in the files modules I´d like to use the stripped value for checking against an ldap-group: DEFAULT User-Name =~ "^(\.*)([a-zA-Z]{3}[0-9]{5})", Huntgroup-Name == "test", ldapgroups1-Ldap-Group=="cn=%{Acct-Session-Id},o=test,c=de" So, if the user is a member of the group cn=test1,o=test,c=de he should get an access-accept, else he should be rejected. The FIRST request after RADIUS started it looks like this: expand: cn=%{Acct-Session-Id},o=test,c=de -> cn=test1,o=test,c=de rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... and it´s working as it should be. The next request from the same user but with test2 instead of test1 in the request: [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test2 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test2)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test2' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Now radius doesn´t do the expansion like it did for the first request, but the search in the group with the value used in the request before: rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... Is there some kind of caching or do I miss something? Thank you very much Anja --------------------------------------------------------------------------------------------- Anja Ruckdäschel M.A.; Rechenzentrum der Universität Regensburg; Universitätsstr.31; 93 053 Regensburg Telefon: +49 941 943 4826 ---------------------------------------------------------------------------------------------

3 5