November 2009 - Freeradius-Users - lists.freeradius.org

operator !* in update {}
by Jakob Hirsch 13 Nov '09

13 Nov '09

Hi, according to unlang: > !* Delete all occurances of the named attribute, no matter what the value. but when I want to use it like that: post-auth { Post-Auth-Type REJECT { update reply { Idle-Timeout !* 0 Session-Timeout !* 0 } } } but freeradius (2.1.7) does not seem to like it: > /etc/freeradius2//sites/ui.site.conf[205]: Parse error after "Idle-Timeout" other operators work, e.g. ... update reply { Idle-Timeout -= 7200 Session-Timeout -= 86400 } ... but that's not handy... Regards, Jakob

3 3

Learning Freeradius Server
by kachin Agarwal 13 Nov '09

13 Nov '09

Hi all, I m new to freeradius server. I jus want to understand the flow of freeradius server and how does it run. So somebody could help me start with it on how to read the code. which is the program code to start with. Thanx & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

3 3

Re: Freeradius-Users Digest, Vol 55, Issue 58
by Gilbert Lo 13 Nov '09

13 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

[Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]]
by Wagner Pereira 12 Nov '09

12 Nov '09

3 5

Re: FreeRadius with 3COM
by Guk Victor 12 Nov '09

12 Nov '09

> Hi All, thanks. Now the 3COM is authenticationing on freeradius. But i > don?t know how to set diferent priorities to users; My 3COM is 4210 > and have 3 levels of priority. Does anybody know how to send the level > of priority by freeradius? Thanks. If I got it right you, you need access to the switch for a management: console, telnet, web. Then do the following: # local-user admin password simple YOUR_PASSWPRD service-type ssh telnet terminal level 3 # user-interface aux 0 7 authentication-mode password set authentication password simple YOUR_PASSWPRD user-interface vty 0 4 authentication-mode password user privilege level 3 set authentication password simple YOUR_PASSWPRD #

2 1

Deprecate the X-Ascend-* attributes in dictionary.ascend?
by Bjørn Mork 12 Nov '09

12 Nov '09

The dictionary.ascend file contains both Ascend VSAs and some historical Ascend specific extensions in the lower (1-255) RADIUS attribute space. These are prefixed with "X-Ascend-". But nowadays, quite a few of these collide with official standard attributes. Although this is not a problem for the RADIUS server or other applications mapping from name to value, it does pose a problem for applications mapping from value to name. E.g. radclient, which will happily believe that 123 is X-Ascend-Call-Attempt-Limit instead of the RFC 4818 defined Delegated-IPv6-Prefix: ~$ radclient -x localhost:1812 auth foo -f test Sending Access-Request of id 237 to 127.0.0.1 port 1812 User-Name = "ipv6-foo(a)example.com" Password = "bar" rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=237, length=100 Framed-IP-Address = 192.168.3.4 Framed-IPv6-Prefix = 2001:db8:2:1::/64 Framed-Interface-Id = 8765:5678:abcd:1234 X-Ascend-Call-Attempt-Limit = 0x003020010db8000300000000000000000000 ERX-Ipv6-Primary-Dns = 2001:db8::53 Even worse, I believe rlm modules like rlm_perl which also map from value to name for their internal representation of the attributes, will do the same. I.e., if you write a script for rlm_perl, expecting a Delegated-IPv6-Prefix, you'll be up for a surprise... My suggestion is splitting dictionary.ascend in two separate dictionary files, keeping only the VSA part included by default. Or at least split out all attributes colliding with standard attributes. Bjørn

1 1

Re: Freeradius-Users Digest, Vol 55, Issue 55
by Gilbert Lo 12 Nov '09

12 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

The best deals on pilules in the web. Show her that you want her!
by Awotwi Barton 12 Nov '09

12 Nov '09

http://flupsiagvec.net/ Give your desire the significant support! Laughable prices on male supplements! Best counter-measure against loss of sensual potential. Don't hesitate - order today! It is your time to make love with hellish heat and heaven delight! Try the best from the sphere of love-boosting solutions!

1 0

SSL renegotiation ?
by John 12 Nov '09

12 Nov '09

Hi, I found a new man-in-the-middle attack with SSL. http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-d… I am afraid if freeRADIUS use SSL renegotiation? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection. Does freeRADIUS use SSL renegotiation ? Thanks. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

I need some help with freeradius 2.0.4
by Wagner Pereira 11 Nov '09

11 Nov '09

Hi, guys. Please, could someone read this output from freeradius' debugging mode to help me? Thanks in advance. (I just omitted some informations such as IP, User-Password etc) My scenario is: - Server: Debian GNU/Linux lenny x86_64 kernel 2.6.26-2-amd64 - Freeradius 2.0.4 - MySQL 5.0.51a - Calling Station: Windows XP Professional 32 bits SP3 - Software client: SSH Secure Shell 3.2.9 - NAS client: Cisco6500 Catalyst - IOS versão 12.2(17r)S4 Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 121 with timestamp +17 Ready to process requests. rad_recv: Access-Request packet from host NAS-IP-Address port 21645, id=121, length=82 NAS-IP-Address = NAS-IP-Address NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "User-Name" Calling-Station-Id = "Calling-Station-Id" User-Password = "User-Password" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "User-Name", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "User-Name" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{User-Name} -> User-Name rlm_sql (sql): sql_set_user escaped user --> 'User-Name' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'User-Name' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'User-Name' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'User-Name' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pop-sp' ORDER BY id rlm_sql (sql): User found in group pop-sp expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'pop-sp' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "User-Password" rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [User-Name/User-Password] (from client cisco6500 port 1 cli Calling-Station-Id) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> User-Name rlm_sql (sql): sql_set_user escaped user --> 'User-Name' expand: %{User-Password} -> User-Password expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'User-Name', 'User-Password', 'Access-Accept', '2009-11-11 11:33:27') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'User-Name', 'User-Password', 'Access-Accept', '2009-11-11 11:33:27') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 121 to NAS-IP-Address port 21645 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Login-User Framed-MTU := 1500 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 121 with timestamp +23 Ready to process requests. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

2 4