March 2009 - Freeradius-Users - lists.freeradius.org

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

------------------------------ > > Message: 7 > Date: Thu, 12 Mar 2009 12:17:56 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090312121756.GD28045(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). > > if it doesnt mention it, how do you know it can do it? > > you're only real choice is to sniff ALL the traffic on the wire > from the zinwell and see what the heck its sending. if it doesnt > send any accounting then theres nothing magical that FreeRADIUS > (or any other RADIUS server) can do - as the RADIUS server > doesnt tell the NAS to 'oi, send me stuff!' - the NAS is configured > to do accounting and then where to send it. if its good, the NAS > sends accounting packets as per the RFCs.....but from personal > experience 90% of devices out there break accounting in wierd > and wonderful ways..be it cisco, hp, 3com, zyxel, hauwei etc. Could you dive me Model? ex: DWL-2100ap... etc. Thanks > > once you DO get accounting packets to the RADIUS server, then thats > when the real fun begins! ("oh, but i wanted unique per client > sessions that could be matched to the real user!" argggh! ;-) ) > > alan _________________________________________________________________ Drag n’ drop—Get easy photo sharing with Windows Live™ Photos. http://www.microsoft.com/windows/windowslive/products/photos.aspx

1 0

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

Hi Ivan, The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). Could you tell me thar have to be another think at GroupReply and suggest some nas devices? Thanks. > Date: Thu, 12 Mar 2009 00:11:44 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <9kef2EDk.1236813104.0870720.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. > > > > So read Zinwell documentation about enabling accounting. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

4 3

Version 2.1.4 has been released
by Alan DeKok 12 Mar '09

12 Mar '09

This version comes 3 months after 2.1.3, which is a bit more of a delay than we would like. However, it includes a number of minor bug fixes, and some interesting new features. The best new feature is one that has been needed for a long time. The (easy) ability to see debugging output from a "live" server. You can now do this via the "raddebug" command. FreeRADIUS 2.1.4 Thu Dec 25 17:40:00 CEST 2008; , urgency=medium Feature improvements * Permit multiple "-e" in radmin. * Add support for originating CoA-Request and Disconnect-Request. See raddb/sites-available/originate-coa. * Added "lifetime" and "max_queries" to raddb/sql.conf. This helps address the problem of hung SQL sockets. * Allow packets to be injected via radmin. See "inject help" in radmin. * Answer VMPS reconfirmation request. Patch from Hermann Lauer. * Sample logrotate script in scripts/logrotate.freeradius * Add configurable poll interval for "detail" listeners * New "raddebug" command. This prints debugging information from a running server. See "man raddebug. * Add "require_message_authenticator" configuration to home_server configuration. This makes the server add Message-Authenticator to all outgoing Access-Request packets. * Added smsotp module, as contributed by Siemens. * Enabled the administration socket in the default install. See raddb/sites-available/control-socket, and "man radmin" * Handle duplicate clients, such as with replicated or load-balanced SQL servers and "readclients = yes" Bug fixes * Clean up control sockets when they are closed, so that we don't leak memory. * Define SUN_LEN for systems that don't have it. * Correct some boundary conditions in the conditional checker ("if") in "unlang". Bug noted by Arran Cudbard-Bell. * Work around minor building issues in gmake. This should only have affected developers. * Change how we manage unprivileged user/group, so that we do not create control sockets owned by root. * Fixed more minor issues found by Coverity. * Allow raddb/certs/bootstrap to run when there is no "make" command installed. * In radiusd.conf, run_dir depends on the name of the program, and isn't hard-coded to "..../radiusd" * Check for EOF in more places in the "detail" file reader. * Added Freeswitch dictionary. * Chop ethernet frames in VMPS, rather than droppping packets. * Fix EAP-TLS bug. Patch from Arnaud Ebalard * Don't lose string for regex-compares in the "users" file. * Expose more functions in rlm_sql to rlm_sqlippool, which helps on systems where RTLD_GLOBAL is off. * Fix typos in MySQL schemas for ippools. * Remove macro that was causing build issues on some platforms. * Fixed issues with dead home servers. Bug noted by Chris Moules. * Fixed "access after free" with some dynamic clients.

10 25

Running an external script
by Jonathan Gazeley 12 Mar '09

12 Mar '09

In my my inner-tunnel virtual server, authorize section, I have some code like this, for sorting users into vlans: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } This was put together in a hurry and is pretty undesirable, as the perl script (which queries a slow database) is executed twice. Of course in any other language, one would simply save the return value of the script in a variable and reference it twice - but quoting "man unlang": " Note that unlike C, there is no way to declare variables". So is there a way to store the return value such that I can execute the script only once? Or how about something like: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := %{control.Tunnel-Private-Group-Id} } Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

3 3

Config. Help please - ldap and Active Directory
by Leighton Man 12 Mar '09

12 Mar '09

Hi, I'm new to freeradius (3 weeks experience) and mailing lists (second attempt) so please have patience. I have freeradius 1.1.7 (prebuilt package) on Solaris 10 configured to authenticate against Active Directory using ntlm-auth. All working OK. Now I'm trying to return different reply attributes depending on Active Directory group membership and restrict which groups can authenticate. Ldap lookups against the active directory root fail with operation error. Reconfiguring Active Directory is not a viable option so I have to specify an OU=xxxx in the query. I have configured two instances of the ldap module for authorisation, one to query the staff ou and the other to query the student ou. Both work OK for valid queries but if the user does not exist in the ou the server still authenticates the username/password and grants access if valid. Relevant debug output: rlm_ldap: performing search in ou=students, dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=stafftest) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_student" returns notfound for request 8 modcall: leaving group student (returns notfound) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list ............................... rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 104 to 10.127.240.217 port 1645 Relevant bits of radiusd.conf: ldap ldap_student{ server = "server.hud.ac.uk" identity = "cn=user,ou=Specials,ou=Staff,dc=ad,dc=hud,dc=ac,dc=uk" password = secret port = 636 basedn = "ou=students, dc=ad, dc=hud, dc=ac, dc=uk" filter = "(sAMAccountName=%{mschap:User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } ........................................ instantiate { exec expr ldap_staff ldap_student } authorize { preprocess mschap suffix eap Autz-Type staff{ ldap_staff } Autz-Type student{ ldap_student } files } authenticate { Auth-Type MS-CHAP { mschap } eap } I want to reject the user if they are not in the relevant ou. I must be missing something obvious. Can anyone help please? Thanks in advance, Leighton

4 17

bugs.freeradius.org unavailable?
by Bjørn Mork 11 Mar '09

11 Mar '09

Is it just me, or has bugs.freeradius.org died? I've tried from two different local ISPs without any luck. bjorn@canardo:~$ telnet bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 ti0036a380-l1.ti.telenor.net (88.88.0.180) 8.133 ms 10.113 ms 12.467 ms 2 ti0001d320-ge0-1-4-10.ti.telenor.net (146.172.83.41) 15.125 ms 17.632 ms 20.250 ms 3 ti0001c310-xe7-1-1.ti.telenor.net (146.172.98.145) 70.634 ms 71.198 ms 71.574 ms 4 ti3004c310-ae5-0.ti.telenor.net (146.172.100.53) 65.706 ms 68.951 ms 71.912 ms 5 ti3003c310-ae4-0.ti.telenor.net (146.172.100.46) 73.231 ms 75.950 ms 78.359 ms 6 ti9002b300-ae0-0.ti.telenor.net (146.172.105.38) 80.615 ms 75.509 ms 76.336 ms 7 xe-0-3-0.cr1.lhr1.uk.nlayer.net (195.66.224.37) 76.788 ms 76.429 ms 76.588 ms 8 xe-2-2-0.cr1.nyc3.us.nlayer.net (69.22.142.9) 140.652 ms 104.673 ms 105.095 ms 9 xe-2-1-0.cr2.ord1.us.nlayer.net (69.22.142.6) 125.930 ms 165.239 ms 165.139 ms 10 111.xe-3-3-0.cr2.ord1.us.scnet.net (216.246.88.146) 132.910 ms 134.031 ms 133.772 ms 11 v21.ar1.ord1.us.scnet.net (216.246.95.243) 135.433 ms 135.307 ms 135.239 ms 12 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 136.447 ms 135.575 ms 135.738 ms 13 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 137.034 ms 126.885 ms 127.757 ms 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 *^C bjorn@canardo:~$ telnet -b 84.215.114.143 bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute -s 84.215.114.143 bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 10.234.0.1 (10.234.0.1) 91.665 ms 91.640 ms 92.866 ms 2 cm-84.208.4.126.getinternet.no (84.208.4.126) 92.968 ms 95.435 ms 95.529 ms 3 cm-84.208.26.1.getinternet.no (84.208.26.1) 95.505 ms 95.551 ms 95.544 ms 4 cm-84.208.26.6.getinternet.no (84.208.26.6) 92.866 ms 92.827 ms 95.060 ms 5 64.213.76.97 (64.213.76.97) 99.490 ms 100.178 ms 100.262 ms 6 xe-4-0-0.cr1.nyc2.us.nlayer.net (69.31.95.229) 202.685 ms 118.586 ms 118.625 ms 7 xe-4-2-0.cr1.ord1.us.nlayer.net (69.22.142.85) 159.379 ms 150.007 ms 150.088 ms 8 111.xe-3-3-0.cr1.ord1.us.scnet.net (216.246.88.162) 137.391 ms 138.172 ms 138.256 ms 9 v21.ar1.ord1.us.scnet.net (216.246.95.243) 138.306 ms 138.322 ms 138.260 ms 10 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 138.349 ms 142.180 ms 142.210 ms 11 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 142.238 ms 142.226 ms 142.263 ms 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 *^C The reason for wanting to access bugs.freeradius.org is a small dictionary patch I have. I assume the correct procedure still is opening a bug and attaching the patch? Bjørn

2 1

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 11 Mar '09

11 Mar '09

Hi Ivan, I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. Below are informations from my Zinwell G220 Plus, but away, o receibe an error as you see. Do you know what mean? Jan 1 18:55:16 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:55:17 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:55:27 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:55:28 wlan0: Open and authenticated Jan 1 18:56:47 wlan0: A wireless client is deauthenticated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:57:09 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:57:10 wlan0: Open and authenticated Here is my radius . rad_recv: Access-Request packet from host 192.168.1.20:1024, id=114, length=229 User-Name = "leo" NAS-IP-Address = 192.168.1.20 NAS-Port = 0 Called-Station-Id = "00059e887861" Calling-Station-Id = "0016cfb3814e" NAS-Identifier = "ZPlus AP" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700501900170301002087c1a68cee5e03e609b11b139ced4a1e1aac47b5519ace27d5598fa118de8177170301002019b9c21c89dac32bc991955f2eef609c8b1080b69fcb1adff8c5573546fc6cb7 State = 0xfa58367a8e0b8dd7abe16b9498e1d636 Message-Authenticator = 0x3f71351c1f04c73b0a85847aa94352b8 Thanks > >So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. > > First run freeradius in debug mode (radiusd -X). If you don't see > accounting packets use wireshark. If wireshark can't see them check if > you have enabled accounting on your AP. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

2 1

accounting manipulation
by Alexandre Chapellon 11 Mar '09

11 Mar '09

I have a working freeradius2 setup, in which I proxy accounting tickets to many home_servers using details file writing and detail listeners. For one of this home_server (let's call it HS1) I want to rewrite the Acct-(In|Out)put-Octets and Acct-(|n|Out)put-Gigawords with a value* taken from another home_server (let's call it HS2). I thought I could you use the perl module to do the math in the pre-proxy section of my HS1 Vhost, but i realised i have to ensure rewriting of attributes have to be done after and only after proxying accounting to HS2... Teh problem remains in the fact proxying to HS2 and proxing to HS1 are two separates virtualhosts... how can i ensure proxying to HS1 (and so attribute rewriting) will be done only after proxying to HS2? I am not a perl guru (either) is it possible to update attrbutes using rlm_perl? how? (the wiki dind't told me much about it) * Actually, the value should be the result of snmp or sql or else done on HS2... with math operation done on it to get the new Acct-(In|Out)put-Octets and Acct-(|n|Out)put-Gigawords values.... OMG i'm not sure it's very clear!

1 0

Re: radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol
by Peter Param 11 Mar '09

11 Mar '09

>You have two different versions of OpenSSL installed. Thanks for that Alan. I've blown everything away and started from scratch and installed openssl 0.98j and used the following freeradius configuration: ./configure --bindir=/usr/bin \ --sbindir=/usr/sbin \ --sysconfdir=/etc \ --localstatedir=/var \ --libdir=/usr/lib \ --includedir=/usr/include \ --with-radacctdir=/var/log/freeradius/radacct \ --with-raddbdir=/etc/freeradius \ --with-openssl-includes=/usr/local/openssl/include \ --with-openssl-libraries=/usr/local/openssl/lib ...but I'm getting the following configuration errors even tho the libraries and includes (and header files mentioned) are in the right places. Can these errors be ignored? (a make file was successfully created) checking openssl/des.h presence... no configure: WARNING: openssl/des.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/des.h: proceeding with the compiler's result checking for openssl/des.h... yes checking openssl/hmac.h usability... yes checking openssl/hmac.h presence... no configure: WARNING: openssl/hmac.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/hmac.h: proceeding with the compiler's result checking for openssl/hmac.h... yes checking openssl/md4.h usability... yes checking openssl/md4.h presence... no configure: WARNING: openssl/md4.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/md4.h: proceeding with the compiler's result checking for openssl/md4.h... yes checking openssl/md5.h usability... yes checking openssl/md5.h presence... no configure: WARNING: openssl/md5.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/md5.h: proceeding with the compiler's result checking for openssl/md5.h... yes checking openssl/sha.h usability... yes checking openssl/sha.h presence... no configure: WARNING: openssl/sha.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/sha.h: proceeding with the compiler's result checking for openssl/sha.h... yes configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs. cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

FreeRADIUS 2.1.4 on FreeBSD 7.0
by Aldo Zavala 11 Mar '09

11 Mar '09

Hello, I just would like to know if there are some hints for compiling the FreeRADIUS 2.1.4 on the FreeBSD 7.0, should I compile it with the GNU gmake? what tips can share with me on this? Thanks, Aldo

2 1