October 2009 - Freeradius-Users - lists.freeradius.org

regular expressions in proxy.conf
by Ana Gallardo 03 Nov '09

03 Nov '09

Hello, I'm using Debian and Freeradius 2.0.4-3. I want to use a regular expression in proxy.conf file to match any request that contain the word "domain" in the realm (suffix mode). ### /etc/freeradius/proxy.conf realm "~(domain)+" { # authhost = LOCAL # not strictly necessary # accthost = LOCAL # not strictly necessary } Then, in authorize section I have: ### /etc/freeradius/sites-available/default authorize { preprocess mschap suffix eap { ok = return } if ("%{Realm}" =~ /(temp\.)?domain\.es$/){ update control { Intentos-Reject = ... } } files switch "%{Realm}" { case "temp.domain.es" { sql } case "domain.es" { redundant { ldap2 ldap1 ldap3 } } case { update control { Auth-Type := Reject } } } expiration pap } And, in users file: ### /etc/freeradius/proxy.conf DEFAULT Intentos-Reject > 10, Auth-Type := Reject Reply-Message = "NUMERO DE INTENTOS FALLIDOS(%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}}" My problem is: the Realm that Freeradius add to the request is the regular expression... Here is my debug information: rad_recv: Access-Request packet from host 127.0.0.1 port 60112, id=208, length=68 User-Name = "XXX(a)domain.es" User-Password = "YYY" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "domain.es" for User-Name = "XXX(a)domain.es" rlm_realm: Found realm "~(domain)+" rlm_realm: Adding Stripped-User-Name = "XXX" rlm_realm: Adding Realm = "~(domain)+" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/) expand: %{Realm} -> ~(domain)+ ? Evaluating ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE ++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE ++[files] returns noop expand: %{Realm} -> ~(domain)+ ++- entering switch %{Realm} +++- entering case ++++[control] returns noop +++- case returns noop ++- switch %{Realm} returns noop I can resolve this adding this to proxy.conf: ### /etc/freeradius/proxy.conf realm "domain.es" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } realm "temp.domain.es" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } realm "~(domain)+" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } But I don't know if that is the best way to resolve my problem, so I would like to reinforce my decision. Thanks in advance and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________

2 2

raddebug before 2.1.4
by marco perugini 02 Nov '09

02 Nov '09

hi list! my simple question is: is there a way to use the powerfull/wonderfull raddebug script with version 2.1.1? or the only way is to start the server with -x option? thanks and regards, marco -- 4it *4IT **S.r.l. **Marco Perugini* *| system administrator** * --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 339.39.81.246 Fax +39 06 97601683 m.perugini(a)4it.it <mailto:m.perugini@4it.it> www.4it.it <http://www.4it.it/> "Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie." "This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you."

3 10

802.1x Strange active directory with MSCHAP issue
by sea you 02 Nov '09

02 Nov '09

Hello List, I'm trying to set up freeradius for users to authenticate against Active Directory. The problem is that it seems to be that the client tries and somehow succeeds but then it sends Access-Challenge again. ntlm_auth from commandline works fine. If someone could pls take a look at it, and point me to the problem source. # freeradius -Xx [snip] rad_recv: Access-Request packet from host 10.X.X.X port 1645, id=170, length=272 User-Name = "DOMAIN\\USER_NAME" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-0E-18-6F-02" Calling-Station-Id = "00-22-68-10-E9-9D" EAP-Message = 0x0209006219001703010057dbed00fdb2ac2eebb7a9749b351455a9e261b8101109c397d32e7feda500fe9ab5be56aa8f0f553b050009e48c8201f1ead322025b3b996d9e78b3906eddcbef18660af56ffb77a3d66552c6bdf6b8a4acadb1e68ff4d0 Message-Authenticator = 0x060bb882f3abde473de477df5ec50d83 NAS-Port-Type = Ethernet NAS-Port = 50203 NAS-Port-Id = "FastEthernet2/3" Called-Station-Id = "00170E186F0" State = 0x651daded6314b44b23e510c28ece2035 NAS-IP-Address = 10.X.X.X Thu Oct 29 10:08:14 2009 : Info: +- entering group authorize {...} Thu Oct 29 10:08:14 2009 : Info: ++[preprocess] returns ok Thu Oct 29 10:08:14 2009 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.X.X.X/auth-detail-20091029 Thu Oct 29 10:08:14 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.X.X.X/auth-detail-20091029 Thu Oct 29 10:08:14 2009 : Info: [auth_log] expand: %t -> Thu Oct 29 10:08:14 2009 Thu Oct 29 10:08:14 2009 : Info: ++[auth_log] returns ok Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns noop Thu Oct 29 10:08:14 2009 : Info: [IPASS] No '/' in User-Name = "DOMAIN\USER_NAME", looking up realm NULL Thu Oct 29 10:08:14 2009 : Info: [IPASS] No such realm "NULL" Thu Oct 29 10:08:14 2009 : Info: ++[IPASS] returns noop Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Found realm "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Stripped-User-Name = "USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Realm = "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Authentication realm is LOCAL. Thu Oct 29 10:08:14 2009 : Info: ++[ntdomain] returns ok Thu Oct 29 10:08:14 2009 : Info: [eap] EAP packet type response id 9 length 98 Thu Oct 29 10:08:14 2009 : Info: [eap] Continuing tunnel setup. Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns ok Thu Oct 29 10:08:14 2009 : Info: Found Auth-Type = EAP Thu Oct 29 10:08:14 2009 : Info: +- entering group authenticate {...} Thu Oct 29 10:08:14 2009 : Info: [eap] Request found, released from the list Thu Oct 29 10:08:14 2009 : Info: [eap] EAP/peap Thu Oct 29 10:08:14 2009 : Info: [eap] processing type peap Thu Oct 29 10:08:14 2009 : Info: [peap] processing EAP-TLS Thu Oct 29 10:08:14 2009 : Info: [peap] eaptls_verify returned 7 Thu Oct 29 10:08:14 2009 : Info: [peap] Done initial handshake Thu Oct 29 10:08:14 2009 : Info: [peap] eaptls_process returned 7 Thu Oct 29 10:08:14 2009 : Info: [peap] EAPTLS_OK Thu Oct 29 10:08:14 2009 : Info: [peap] Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 02 09 00 46 31 ed 83 a9 6d bc 8a 55 45 16 3f PEAP tunnel data in 0010: 41 13 c8 eb 17 08 00 00 00 00 00 00 00 00 2a 0f PEAP tunnel data in 0020: 3a 33 97 72 a7 f0 09 9e 9d 13 00 64 df f8 d0 13 PEAP tunnel data in 0030: f5 0c 46 d8 94 0d 00 49 42 4d 45 4d 45 41 5c 68 PEAP tunnel data in 0040: 75 65 34 39 31 62 7a Thu Oct 29 10:08:14 2009 : Info: [peap] EAP type mschapv2 Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled request EAP-Message = 0x0209004b1a0209004631ed83a96dbc8a5545163f4113c8eb170800000000000000002a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d0049424d454d45415c687565343931627a server { Thu Oct 29 10:08:14 2009 : Debug: PEAP: Setting User-Name to DOMAIN\USER_NAME Sending tunneled request EAP-Message = 0x0209004b1a0209004631ed83a96dbc8a5545163f4113c8eb170800000000000000002a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d0049424d454d45415c687565343931627a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\USER_NAME" State = 0xd4de0819d4d7123b2e87e4d75e5d8f2c Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-0E-18-6F-02" Called-Station-Id = "00170E186F0" Calling-Station-Id = "00-22-68-10-E9-9D" NAS-Port-Type = Ethernet NAS-Port = 50203 NAS-Port-Id = "FastEthernet2/3" NAS-IP-Address = 10.X.X.X server inner-tunnel { Thu Oct 29 10:08:14 2009 : Info: +- entering group authorize {...} Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns noop Thu Oct 29 10:08:14 2009 : Info: [IPASS] No '/' in User-Name = "DOMAIN\USER_NAME", looking up realm NULL Thu Oct 29 10:08:14 2009 : Info: [IPASS] No such realm "NULL" Thu Oct 29 10:08:14 2009 : Info: ++[IPASS] returns noop Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Found realm "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Stripped-User-Name = "USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Realm = "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Authentication realm is LOCAL. Thu Oct 29 10:08:14 2009 : Info: ++[ntdomain] returns ok Thu Oct 29 10:08:14 2009 : Info: [eap] EAP packet type response id 9 length 75 Thu Oct 29 10:08:14 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns updated Thu Oct 29 10:08:14 2009 : Info: ++[files] returns noop Thu Oct 29 10:08:14 2009 : Info: ++[expiration] returns noop Thu Oct 29 10:08:14 2009 : Info: ++[logintime] returns noop Thu Oct 29 10:08:14 2009 : Info: Found Auth-Type = EAP Thu Oct 29 10:08:14 2009 : Info: +- entering group authenticate {...} Thu Oct 29 10:08:14 2009 : Info: [eap] Request found, released from the list Thu Oct 29 10:08:14 2009 : Info: [eap] EAP/mschapv2 Thu Oct 29 10:08:14 2009 : Info: [eap] processing type mschapv2 Thu Oct 29 10:08:14 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Thu Oct 29 10:08:14 2009 : Info: [mschap] Told to do MS-CHAPv2 for USER_NAME with NT-Password Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USER_NAME Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --domain=%{mschap:NT-Domain:-SOMETHING.DOMAIN.NET} -> --domain=DOMAIN Thu Oct 29 10:08:14 2009 : Info: [mschap] mschap2: 7e Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=713fa3f8ce6f4b85 Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d Thu Oct 29 10:08:14 2009 : Debug: Exec-Program output: NT_KEY: D3EF67E4795483D8C8ECCD398929BD83 Thu Oct 29 10:08:14 2009 : Debug: Exec-Program-Wait: plaintext: NT_KEY: D3EF67E4795483D8C8ECCD398929BD83 Thu Oct 29 10:08:14 2009 : Debug: Exec-Program: returned: 0 Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns ok Thu Oct 29 10:08:14 2009 : Debug: MSCHAP Success Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns handled } # server inner-tunnel Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d30354537393244373946463135444637443039333735354230303941433932373038353432363132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4de0819d5d4123b2e87e4d75e5d8f2c Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d30354537393244373946463135444637443039333735354230303941433932373038353432363132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4de0819d5d4123b2e87e4d75e5d8f2c Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled Access-Challenge PEAP tunnel data out 0000: 1a 03 09 00 2e 53 3d 30 35 45 37 39 32 44 37 39 PEAP tunnel data out 0010: 46 46 31 35 44 46 37 44 30 39 33 37 35 35 42 30 PEAP tunnel data out 0020: 30 39 41 43 39 32 37 30 38 35 34 32 36 31 32 Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 170 to 10.X.X.X port 1645 EAP-Message = 0x010a004a1900170301003f7a8338c8443aab925281cc99d62063e56bce7edc3a0fe618ef8cae86ffa7bdb310d88c30c000f2402e10963c02a43374f9b12818980ce2821a51182b132654 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x651daded6217b44b23e510c28ece2035 Thu Oct 29 10:08:14 2009 : Info: Finished request 8. [snip] Thanks in advance, cU

3 3

Send Reject When User Logged In Already
by boyali kus 02 Nov '09

02 Nov '09

Dear Users, In my test environment I use a Mikrotik RB333 as NAS and FreeRADIUS 2.1.7. How can I make this Simultaneous Use Checking Queries work? Although I uncommented simul_count_query in dialup.conf I cannot see any difference and users can still logon simultaneously (radwho displays same users twice as connected). I do not want to FreeRADIUS to query NAS (with SNMP etc) in order to know if user is connected, I want simply use this sql queries and send a reject packet if user seems connected in RADIUS. Should I write a stored procedure for authorize_check_query and send reject if there is a record of this user in radacct table which has a null acctstoptime? Meanwhile NAS sends accounting packets successfully and RADIUS receives them. I am really stuck! Debug Output: FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 18 2009 at 10:59:17 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "102.145.225.81" port = "" login = "raduser" password = "rad6m" radius_db = "raddb" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "CALL fr_authorize_check('%{SQL-User-Name}')" authorize_reply_query = "CALL fr_authorize_reply('%{SQL-User-Name}')" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to raduser@102.145.225.81:/raddb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=localsecret rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Read entry nasname=102.145.225.82,shortname=RB333,secret=rb333secret rlm_sql (sql): Adding client 102.145.225.82 (RB333, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

3 6

Freeradius in OpenBSD
by C. Diego Raffaelli A. 30 Oct '09

30 Oct '09

Hi all. I would like to know if installing freeradius in any O.S., can be useful to AAA to LAN users. As a PPPOE authentication in a ADSL user, but int this case, there are no phone line, its only a LAN but extended by city, by Fibra Optica. (F.O.) Could i create accounts to authenticate my "clients"? Thanks in advance /// Hola a todos. Me gustaria saber si instalando Freeradius en cualquier S.O puede ser util para realizar AAA en usuarios de una LAN. Tal como una autenticacion de usuarios ADSL,pero en este caso no a traves de linea telefonica, es solo una red LAN extendida por la ciudad a traves de fibra optica. ¿Podria crear cuentas para "autenticar" mis "clientes"? Gracias de antemano -- = = = = = Carlos Diego Raffaelli A. MSN: carlosdiego.ra(a)hotmail.com

2 1

Radacct isn´t registering FramedIpAdress (sometimes)!
by t_rider 30 Oct '09

30 Oct '09

3 5

Hello. OpenBSD and Free Radius
by C. Diego Raffaelli A. 30 Oct '09

30 Oct '09

Hi all. I'm trying to install a Radius server into Open BSD for AAA for my lan users. Basically, i would like to offer username and password for each one of them. i hope to manage its bandwidth too. i have the instructions for DHCP server, Firewall, but radius. i only has encountered openbsd as pppoe client and i would like to give AAA for my users. thanks a lot. -- Carlos Diego Raffaelli A

2 1

Database Problem
by Paul Ryszka 30 Oct '09

30 Oct '09

Hello, I am using FreeRadius v 1.1.3 (lastest in the cenOS) and everything is going quite ok but I am not sure how to construct database tables to use for authorization (I am using MS SQL as a backend) I get the connection to database and can do queries against it so at this point it is standard ODBC connection that is working. I cannot choose the right attributes to put to the database for authentication to happened. I always get "unknown attribute" no matter if I use "Cleartext-Password" or "Auth-Type". That are two that I found in various documentation on the web. Obviously authentication fails. I would really appriciate if you would be able to tell me how the simplest (user/password with nothing extra returned back) authentication can be done using database backend. Regards Paul

3 6

Filter Access-Challenge Attributes
by Ben Wiechman 30 Oct '09

30 Oct '09

Is the following stub for filtering Access-Challenge attributes from sites-available/default for future use? # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post_auth # handled # override the "updated" code from attr_filter # } # } Uncommenting the lines causes the server to fail to start because that instance of the attr_filter module isn't defined. However subsequent testing (and a quick dive into the code) show that attr_filter isn't supported in the authenticate section. Should this stub simply be ignored at this point or am I missing something? Ben

2 2

Asking to Ana Gallardo
by C. Diego Raffaelli A. 30 Oct '09

30 Oct '09

Querida Ana: Un gusto compartir contigo un mailing list. Lamentablemente, no tengo la solucion a tu problema, se que seguramente esperas eso, lo siento :( Mas al contrario tengo una pregunta. Has instalado FreeRadius en Debian y ademas has creado un NAS (Netw. autentication server? ) Esto te servira para que, por ejemplo usuarios tuyos se autentiquen en el Radius y el NAS les de acceso a ciertos dispositivos? te pregunto esto porque yo necesito implementar algo asi, tengo una red LAN que se extiende por la ciudad y necesito brindar nombre de usuario y contraseña para gestionar no tanto el tiempo, sino el ancho de banda que se les provee y ademas poder dar de baja o reconectar su usuario. Nosotros usamos esto para brindar internet. Yo estoy intentando hacerlo en OpenBSD ya que tengo un manual que indica casi todos los servicios (DHCP; DNS... y varios otros,,, EXCEPTO FREE RADIUS! ) :( Me gustaria saber no el "como" lo instalaste en Debian, sino para que lo estas usando y si estas usando un NAS.,,, una base de datos. Gracias por tu respuesta. PD.- Sorry for my...... SPANISH!!!! xD -- = = = = = Carlos Diego Raffaelli A. MSN: carlosdiego.ra(a)hotmail.com

2 1