February 2009 - Freeradius-Users - lists.freeradius.org

are multivalued LDAP-attibutes in authorization for replyItems possible?
by Tim Stone 22 Feb '09

22 Feb '09

Hello, I want to return to the radius client radius attributes from LDAP (authorization). I configured the module "LDAP" in radiusd.conf and the authorization in default site in the authorization section due to uncomment "ldap". Then i added my attribute mappings in the ldap.attrmap: replyItem Session-Timeout ldapTimeOut replyItem Idle-Timeout ldapTimeOut replyItem Colubris-AVPair ldapColAvPair and started the radiusd again. All working well, If a attribute is set in the LDAP-Account, the radius client is getting this too. But the ldapColAvPair is a multivalued attribute in LDAP. If I add more then one Value in LDAP for ldapColAvPair, the radiusd delivers only one (the first) to the radius client. Is this normal or can I configure the radiusd to return all values from the multivalued LDAP attribute? Thanx in advance, Tim Stone

3 3

How to Authenticate Mysql Users whit freeradius editing the users file
by Juan Pablo Botero 20 Feb '09

20 Feb '09

Hi. I had been installed freeradius 2.0.4 in debian 4.0 and with daloradius like web management interface Now i'm have an inconvenient with the users that i have in mysql. That users can autenthicate in mysql but, can't get authenticate completly; i think you know waht I mean. Freeradius don't authenticate with mysql, so it uses another ways like EAP, PAP an others. I had been edited the users file in the attribute auth-type with various values: Local, EAP, PAP, System... I got this when i try to loggin i got this: rad_recv: Access-Request packet from host 127.0.0.1 port 32814, id=68, length=212 Vendor-14559-Attr-8 = 0x312e302e3132 User-Name = "juanpal" User-Password = "juanpal" NAS-IP-Address = 192.168.181.1 Service-Type = Login-User Framed-IP-Address = 192.168.181.2 Calling-Station-Id = "08-00-27-0A-F7-67" Called-Station-Id = "08-00-27-C0-08-85" NAS-Identifier = "nas01" Acct-Session-Id = "499d9aa800000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Logoff-URL = "http://192.168.181.1:3990/logoff" Message-Authenticator = 0xd5b4b59894a7fbb350da9e2f90d9eb5c +- entering group authorize ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090219 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090219 expand: %t -> Thu Feb 19 13:13:58 2009 ++[auth_log] returns ok expand: %{Realm} -> ++[attr_filter] returns noop ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "juanpal", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 61 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry DEFAULT at line 201 ++[files] returns ok expand: %{User-Name} -> juanpal rlm_sql (sql): sql_set_user escaped user --> 'juanpal' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'juanpal' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'juanpal' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='juanpal' rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [juanpal/juanpal] (from client localhost port 1 cli 08-00-27-0A-F7-67) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 68 to 127.0.0.1 port 32814 Service-Type = Login-User Session-Timeout := 2400 Waking up in 4.9 seconds. Cleaning up request 0 ID 68 with timestamp +10 Ready to process requests. As you see, the user juanpal authenticate with mysql but the next step stop him My user file has this: DEFAULT Auth-Type := Local, Crypt-password = User-Password Fall-Through = yes Whit auth-type = System, the users need to be Systems users. Whit aut-type = ACCEPT, anyone can loggin. I don't know what try now, i had been google, read in many forums. Thanks a lot. -- Juan Pablo Botero Administrador de Sistemas informáticos http://jpill.wordpress.com eSSuX: http://slcolombia.org/eSSuX Linux Registered user #435293

2 8

newbie question for freeradius
by ipfreak 20 Feb '09

20 Feb '09

Hi all: i would like to use unix file /etc/passwd to authenticate users on my routers and somehow it always fails: rad_recv: Access-Request packet from host 192.168.10.101:61706, id=153, length=53 User-Name = "tester" User-Password = "test" NAS-Identifier = "lab_1" NAS-IP-Address = 192.168.6.1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_unix: GID too long in line: # $FreeBSD: src/etc/master.passwd,v 1.40.18.1 2008/11/25 02:59:29 kensmith Exp $ rlm_unix: [test]: invalid password rad_recv: Access-Request packet from host 192.168.10.101:61706, id=153, length=53 Sending Access-Reject of id 153 to 192.168.10.101 port 61706 here is the config for :users": DEFAULT Auth-Type = System Fall-Through = 1 i have user "tester" in /etc/passwd with password "test" in the freebsd box. Thanks in advance -- View this message in context: http://www.nabble.com/newbie-question-for-freeradius-tp22063719p22063719.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Secure FreeRADIUS & LDAP
by Dan Hawker 20 Feb '09

20 Feb '09

Hi All, I used to use FreeRADIUS *years* back (iirc pre v1) on Linux and it worked rather well :) Not touched it since, however have just started a new contract and there is a requirement to use a RADIUS server to connect to our LDAP box (Red Hat Dir Server) to in turn authenticate some users/equipment that can't auth directly, but due to the nature of the environment, all datastores and comms have to be secured/encrypted. As the host will be RHEL5, FreeRADIUS would seem the ideal candidate (comes with it, although a rather ancient 1.1.3 version by default, can upgrade if needed), however before I start installing and testing, wondered whether it will satisfy the secure part of the requirements. So... My questions... # Can freeradius talk to the ldap box using TLS/SSL (ldaps) # Can freeradius read hashed credentials from the LDAP store and then actually use them??? # There may be a requirement to use certificates for auth, can the ldap/freeradius module handle certs??? Am sure there will be other issues/questions but until then. TIA Dan -- -- Dan Hawker danhawker(a)googlemail.com --

3 3

Re: FreeRADIUS and Active Directory
by Mike Loosbrock 20 Feb '09

20 Feb '09

On Feb 19, 2009, at 11:11 AM, Tomas wrote: > Do I need to change my modules/mschap config? Currently I have: > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=% > {Stripped-User-Name:-%{User-Name:-None}} --challenge=% > {mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" As Ivan eluded to earlier, you need to use '--username=%{mschap:User- Name}' in your ntlm_auth command-line. The mschap module automagically turns 'host/PC1.ad.lab.com' into 'PC1$', (the username that AD uses to authenticate the machine). You may also need to specify the domain with '--domain=%{mschap:NT-Domain}'. Mike Loosbrock Bethel University Network Services 651-638-6723

1 0

daloRADIUS: Web Platform to manage FreeRADIUS
by liran tal 20 Feb '09

20 Feb '09

Hey Everyone, I here-by would like to recommend daloRADIUS as a web platform for managing many aspects of a FreeRAIDUS deployment, among them: Users, Groups, Realms, Attributes, Dictionaries and much more. For those of you who are unfamiliar with daloRADIUS, it also provides many other functionalities such as Graphs, Accounting, Reporting, Backups, Connectivity tests and others. I have been a part of this community for a very long time and I haven't publicly declared daloRADIUS until now because I wanted to wait for it to be at it's most stable stage where I truly think it is mature and feature-rich for both new comers and well established radius gurus. I will be happy to receive your feedback, for good and bad. We're currently at the stage of building a roadmap for the next version so this is the time to put your wish-list out. Thanks for your attention, Resources: Website: http://daloradius.sourceforge.net/ Official web: http://daloradius.com Regards, Liran.

2 3

Freeradius 2.1.3 : regular expression (=~) always matches ?
by marc fradin 20 Feb '09

20 Feb '09

I try to upgrade from 1.0.1 (fedora core 3) to 2.1.3 all seems to work fine except regular expressions in my users file for example DEFAULT User-Name =~ "anonymous" always matches but DEFAULT User-Name == "anonymous" is correctly filtered any idea ? thanks marc

2 1

How to get attributes from active-directory ?
by John 20 Feb '09

20 Feb '09

hi, Now my freeRADIUS(1.1.6) can talk to active-directory. How to get attributes (such as "Session-Timeout" and "Termination-Action" ..) from AD ? >From the debug, freeRADIUS use NTLM_AUTH to authenticate the username/password. Is there another tool for me to get the user's attributes? I am using Odyssey client with EAP-peap type. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

Unexpected closed sessions in database
by Marinko Tarlac 20 Feb '09

20 Feb '09

Hi friends. I have small problem with freeradius and accounting (with database). Something is closing opened sessions and I can't see what is the reason. It seems that accounting_onoff_query was triggered by "something" and acctterminatecause field is empty so I don't see anything. accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - \ unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ vrijeme = '%S' \ WHERE acctstoptime = 0 \ # WHERE acctstoptime IS NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" Session is still alive in NAS but just like I said, account. doesn't work. I'm using old sql schema so WHERE acctstoptime IS NULL \ is commented and replaced with WHERE acctstoptime = 0 \ in sql.conf i set no for deletestalesessions because I don't need this function. # Remove stale session if checkrad does not see a double login deletestalesessions = no FreeRadius is 2.1.3 Any ideas how to trace and solve this problem ? Thanks

4 6

Inner identity in accounting logs
by Jonathan Gazeley 19 Feb '09

19 Feb '09

I have an existing FreeRadius setup for an 802.1x wireless network. Currently the accounting is done to a MySQL database. Presently, the username appearing in these records is the outer identity. I want to use the authenticated inner identity, such that I can rely on my accounting data e.g. for billing. I know that accounting packets are not sent through the inner-tunnel and so I can't simply move my accounting to the inner-tunnel. I suppose what I'm after is a way to tie a session at authentication to the associated session in accounting. Is there any sort of ID that is used both in inner-tunnel authentication and accounting, that can be relied upon? Otherwise am I looking at using something like the MAC address of the client? The other option might be using vendor supplied attributes from the Cisco controllers. Has anyone done this before? Thanks, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

6 20