October 2009 - Freeradius-Users - lists.freeradius.org

Problem sanitising usernames in accounting
by Jonathan Gazeley 07 Oct '09

07 Oct '09

I'm seeing a problem with stripping usernames during accounting. Accounting is done on a separate physical server from the authentication (which works fine). Most of our users don't include a domain so their accounting works normally. Some users do send the domain (UOB) and this breaks the accounting because the backslash doesn't seem to get escaped. The account detail files have entries like User-Name = "UOB\\username" but when this gets inserted into the database the backslash(es) are not escaped and if the username starts with n, r or some other letters, the database sees \n, \r and inserts linebreaks and other undesirable characters. Then selecting from the database to generate statistics returns garbage, obviously. At the top of dialup.conf I replaced sql_user_name = "%{User-Name}" with sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" but Stripped-User-Name does not have a value. I'm not interested in the domain in my accounting, so does anyone have any guidance on how to safely strip/sanitise the usernames? Thanks, Jonathan -- ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless& VPN Team Information Services University of Bristol ----------------------------

2 2

Radius proxy and attribute class 25
by Ville Leinonen 07 Oct '09

07 Oct '09

Hi all, I have setup fr (2.1.6) proxy against MS NPS it works fine and even chalenge-responce works great. But now i have one problem NPS sends attribute 25 (class) back to the fr server and it's seems that fr brokes that/or dont accepts that attribute class. When class should be eg. OU=Test_users fr says something like ?=xxx?Xx++xXX (in clear text). Any suggestions? Br, Ville

3 2

radius + dhcp
by marco perugini 07 Oct '09

07 Oct '09

hi list! i've two services: radius server and dhcp server. does anyone know if i can assign static address according to realm and not to mac? thanks in advance and best regards, marco -- 4it *4IT **S.r.l. **Marco Perugini* *| system administrator** * --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 339.39.81.246 Fax +39 06 97601683 m.perugini(a)4it.it <mailto:m.perugini@4it.it> www.4it.it <http://www.4it.it/> "Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie." "This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you."

2 3

Understansding
by jon jon 06 Oct '09

06 Oct '09

Hello, I have a access point that is connected to a chillispot server, which then communicates to an external freeradius server. I have a mysql server also on the freeradius server. I am just tyring to figure out how this is all working. When a wireless client comes in they are unauthencticated users, which will be redirectedto uam homepage, located on the external radius server. The user is then brought to the hotspotlogin.cgi. Then the username and password are sent over to the radius server to check to see if the user matches the user in the mysql database. If authenticated, then the radius server sends a packet back to chillispot, saying yes accept the user, and redirect them to a web page that I specify. (is that correct?) Does the user remain connected to the freeradius server, since the pop up window that comes up is from there anyway, or is it chillispot that is then taking over. Which server is actually allowing the user onto the internet? I am thinking it is chillispot since that is handling dhcp. In the database is a table that is used to allow open and close time, that the wireless is avaible everyday, wouldn't that mean that the user would have to remain connected to the freeradius server? thanks, jon jon

2 2

Re: Cisco VPN 3000 and Simultaneous Use via checkrad
by Ivan Kalik 06 Oct '09

06 Oct '09

> In order to implement simultaneous use checking in my environment I > added a subroutine to checkrad that handles snmp checks to the Cisco > 3000 series VPN concentrators. I am happy to share my work/experience > with anyone that may have a similar environment. While we are on the subject of Cisco and checkrad.pl, I have found that sometimes trouble can be found here: if ($port < 20000) { # # The AS5350 doesn't support polling the session ID, # so we do it based on nas-port-id. This only works # for analog sessions where port < 20000. # Yes, this means that simultaneous-use on the as5350 # doesn't work for ISDN users. # $login = snmpget($ARGV[1], $pass, "$csm.2.9.2.1.18.$port"); print LOG " user at port S$port: $login\n" if ($debug); } else { $login = snmpget($ARGV[1], $pass, "$csm.9.150.1.1.3.1.2.$sess_id"); print LOG " user with session id $ARGV[4] ($sess_id): " . "$login\n" if ($debug); } There are devices that don't support that first OID. Solution is to comment out if section: # if ($port < 20000) { # # The AS5350 doesn't support polling the session ID, # so we do it based on nas-port-id. This only works # for analog sessions where port < 20000. # Yes, this means that simultaneous-use on the as5350 # doesn't work for ISDN users. # # $login = snmpget($ARGV[1], $pass, "$csm.2.9.2.1.18.$port"); # print LOG " user at port S$port: $login\n" if ($debug); # } else { $login = snmpget($ARGV[1], $pass, "$csm.9.150.1.1.3.1.2.$sess_id"); print LOG " user with session id $ARGV[4] ($sess_id): " . "$login\n" if ($debug); # } This alteration will get the script working properly for 7xxx routers that fail default check (ie. they don't support OID that checks who is on the port - instead they peek into local accounting to see if there is an active session for that accounting id). Ivan Kalik Kalik Informatika ISP

1 0

How can I output Cisco-AVPair Attributes in linelog?
by David Mitchell 06 Oct '09

06 Oct '09

Greetings, I'm playing with using the linelog module to syslog accounting records. The basics are pretty straightforward to configure, and I have them working. What I can't figure out is how to include the ssid in the linelog output. 'radiusd -X' kindly dumps the contents of the received accounting requests: rad_recv: Accounting-Request packet from host 10.2.2.2 port 1646, id=62, length=234 Acct-Session-Id = "0000004D" Called-Station-Id = "001b.d517.4080" Calling-Station-Id = "0026.4aea.ba42" Cisco-AVPair = "ssid=TEST" Cisco-AVPair = "vlan-id=228" Cisco-AVPair = "nas-location=Office" WISPr-Location-Name = "Office" User-Name = "testuser" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "301" NAS-Port = 301 Service-Type = Framed-User NAS-IP-Address = 10.2.2.2 Acct-Delay-Time = 0 The SSID is in a Cisco-AVPair. I can include them all via Start = "Connect: User: %{User-Name} ( client: %{Calling-Station-Id} location: %{WISPr-Location-Name}) %{Cisco-AVPair[*]}" or the first one by using %{Cisco-AVPair[1]}. But I have no guarantee that the ssid will be the first AV pair. I've tried using unlang constructs to pull the data out, but can't figure out the right syntax. I'm trying something like the config below, just to see if the 'if/else' clauses even fire and they don't. No matter what I put in for the regexp, SSID never gets redefined to TRUE or FALSE. It always outputs as 'Junk'. I'm sure this is doable, I just don't know the exact syntax. Any ideas? Thanks in advance. >From linelog configuration: Accounting-Request { SSID="Junk" Pairs = "%{Cisco-AVPair[0]}" if ( Pairs =~ /.*/ ) { SSID="TRUE" } else { SSID = "FALSE" } Start = "Connect: User: %{User-Name} ( client: %{Calling-Station-Id} location: %{WISPr-Location-Name}) SSID:${SSID} ${Pairs}" -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

4 6

Cisco VPN 3000 and Simultaneous Use via checkrad
by McCormick, Bill 06 Oct '09

06 Oct '09

Greetings, In order to implement simultaneous use checking in my environment I added a subroutine to checkrad that handles snmp checks to the Cisco 3000 series VPN concentrators. I am happy to share my work/experience with anyone that may have a similar environment. Sincerely, Bill McCormick

1 0

[Link two authentication requests for Wimax]
by Thomas Fagart 06 Oct '09

06 Oct '09

Hello, I would like to know if this is possible to do the following with Freeradius. eg to ask him to have memory. Description I've got one authentication request (called request 1) coming from an ASN GW that will contain the mac adress of the CPE in some attribute. Freeradius will send an access accept. This authentication success will enable the CPE to get connected to the base station. (EAP-TTLS) Then I will have a second authentication request (called request 2) coming from a Broadband Access Server. This equipement will transform DHCP request into a Radius request. This authentication request will also have in some attributes, the mac addresses of the CPE. Questions Is that possible to configure freeradius to send an authentication success to request 2 only if request 1 has been seen and has been successfully authenticate. (based on the mac address) ? What are the module that could be used (probably sql to be able to keep track of request 1) ? Thanks Thomas

3 4

Update on MS-CHAP Authentication / Bug 17
by Garber, Neal 06 Oct '09

06 Oct '09

Here's some feedback I received (off-list) regarding the patch for bug 17.. I received an E-mail from someone experiencing the userid case sensitivity issue with EAP/MS-CHAPv2 in FR. He applied the patch attached to bug 17 and confirmed that it fixed the problem for him. I too have the patch applied (for about 6 weeks now) to two of our FR servers and haven't seen any issues. Neal -----Original Message----- From: Garber, Neal Sent: Friday, October 02, 2009 1:58 AM To: 'Marco D'Ettorre' Subject: RE: MS-CHAP Authentication / Bug 17 Thank you for sharing your experience Marco. At some point, I'd like to post your information to the FreeRADIUS list as Alan DeKok wanted to see positive feedback from testers before he accepted my patch. Is that Ok? Thanks again for your time and I'm pleased that the patch helped resolve your problem. Neal -----Original Message----- From: Marco D'Ettorre Sent: Thursday, October 01, 2009 4:55 PM To: Garber, Neal Subject: Re: MS-CHAP Authentication / Bug 17 Hi Neal, I applied your patch to 2.1.7. Before writing you I was testing v1.1.8; then I tried 2.1.7 before applying the patch (with the same issue) and finally with your patch. The issue is solved. Now I can logon the workstation with both upper and lower cases, and automatic ms-chap authentication always works. I have not still wrote you an email because I did like to include more details, extract of log files and configurations, but I was too busy with other activities to do. I'll send you some details as soon as possible. Thank you Marco Garber, Neal ha scritto: > > Hi Marco, > > Did you have a chance to apply the patch and test? If I can help, let > me know.. > > Neal > ------------------------------------------------------------------------ > *From:* 'Marco D'Ettorre' > *Sent:* Wednesday, September 23, 2009 5:31 PM > *To:* Garber, Neal > *Subject:* Re: MS-CHAP Authentication / Bug 17 > > Hi Neal, > > I'm having the problem and I'd like to solve it as quick as possible. > > I am a fan of opensource developing (my main interest is testing > OpenLDAP, and I'm also one of the manteiners of italian OpenLDAP ML), > and I'll be very happy to help you if I can. I will post you the > results of my tests (and a description of the environment). > > Thank you > M. > > ----- "Neal Garber" ha scritto: > Absolutely! You can get it from http://bugs.freeradius.org > <http://bugs.freeradius.org/> (then enter 17 for the bug number). > Thanks for your interest. > > Out of curiosity, are you having the problem described in the bug or > are you just a kind soul who wants to help me by testing this? > > Neal > ------------------------------------------------------------------------ > *From:* Marco D'Ettorre> > *Sent:* Wednesday, September 23, 2009 12:31 PM > > *To:* Garber, Neal > > *Subject:* MS-CHAP Authentication / Bug 17 > Hi, > > > > is your patch available for download? > > > > Thanks > > M. > > *Ing. Marco D'Ettorre* > Consultant > *SysNet s.r.l.* > *Gruppo Partners Associates*

2 1

Status server & python example
by John Doppke 06 Oct '09

06 Oct '09

Does anyone have an example of getting stats from freeRadius via status-server using python and pyrad? To me it looks like I'm sending the correct packet, but the server complains about the message authenticator or shared secret. I'm pretty sure I'm calculating it per RFC. An authentication request with the same secret works, so I don't think it's that. Regards, -John Doppke

2 1