March 2009 - Freeradius-Users - lists.freeradius.org

Version 2.1.0 has been released.
by Alan DeKok 05 Aug '09

05 Aug '09

We are happy to announce the release of Version 2.1.0 of the FreeRADIUS server, with some major new features. Highlights include improved SNMP support, dynamically-defined clients, much more flexible (and readable) debugging mode, WiMAX support, fast reauthentication for PEAP and TTLS, and a command-line tool to administer a running server. The administration tool can stop the server, HUP it, or in limited cases, change the configuration of a running server, and cause just one module to reload it's configuration. Alan DeKok. Detailed change log: FreeRADIUS 2.1.0 Fri Sep 5 13:20:01 CEST 2008; , urgency=medium Feature improvements * Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients. * SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README * SNMP statistics are available through Status-Server packets. See raddb/sites-available/status * Added more Microsoft attributes from bug #568. * The "linelog" module has more functionality and flexibility. See raddb/modules/linelog. * The debugging output has been sanitized. It should be much more readable. * Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the "log" section of radiusd.conf. * Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax * Added session resumption for PEAP and TTLS. See raddb/eap.conf, "cache" sub-section. * Added "radmin" command-line tool for administering a running server. See "man radmin" and raddb/sites-available/control-socket. Bug fixes * Double escaping of '\\' in the "users" (and some other) files has been fixed. If you have '\\' in the "users" file, your configuration WILL NEED TO BE CHECKED, AND FIXED! * Parse "security" section in radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566. * Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces. * Fix handling of giaddr in DHCP responses. * Corrected parsing of status_check in home_server so that it works. * Fix hints so that "Puser" works again. * Removed length restrictions on attribute names in the dictionaries. * Update socket code to avoid C compiler optimizations.

6 14

RADIUS attributes: acctoutputoctects and acctinputoctect in mikrotik
by Santiago Balaguer García 19 May '09

19 May '09

7 7

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

Freeradius+Java application api call and authenticate
by sollunga 16 Apr '09

16 Apr '09

i am using Cisco ACS for authenticating my vpn users, now i thought of using two factor auth in place against the direct authentication by ACS, on this process one of the googling guided me to try proxying the ACS to Freeradius and call some scripts to talk to the java application. now by making the ACS to do proxying at network configuration, i can see the request is flowing to freeradius from ACS, and the freeradius does "" [chap] rlm_chap: Attribute "User-Name" is required for authentication. ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 27 for 1 seconds "" after a while it says "" [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "Doe" with CHAP password [chap] Using clear text password "hello" for user Doe authentication. [chap] chap user Doe authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 63 to "" i am trying to figure out where could be the issue once after this process, i need to send the same to a java application and get a success status from there and authenticate this user. could it be possible? team i am a newbie here, i am just a sys admin, and now trying extend my knowledge, please help me. -- View this message in context: http://www.nabble.com/Freeradius%2BJava-application-api-call-and-authentica… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

Handling of duplicates in clients.conf
by Garber, Neal 13 Apr '09

13 Apr '09

I'm running FR 2.0.3 and I just found that if there is more than one client with the same IP address in clients.conf, then it will stop processing the remainder of the file and continue startup. The only indication it has done this are 2 error messages that are easily missed when running with debug on. I checked git.freeradius.org and noticed that the client.c committed on 09-March now ignores duplicates if they are exactly the same. In my case, everything was the same except the name. My question is, wouldn't it be better to continue processing the remainder of the file even when there are duplicates that aren't identical or alternatively to preclude the server from starting (I'd vote for the former). Ignoring what could be hundreds of clients that follow the error doesn't seem useful. I propose ignoring all duplicates and having client_add return ok (1). This would log the error for any duplicates (even duplicates that aren't completely identical), but allow processing to continue for the remainder of the file.

5 12

What can cause the "Exiting normally" without prompting
by switchport＠hotmail.com 06 Apr '09

06 Apr '09

hi, i am testing freeradius 2.1.X by radclient , when the number of requests arrive 6million+, freeradius will "Exiting normally" without prompting. the testing freeradius have pgsql module. thanks.

4 7

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Re: Help checking group membership with FreeRadius
by Chris Li 02 Apr '09

02 Apr '09

> Date: Mon, 23 Mar 2009 11:22:22 -0400 > From: Josh Hiner <josh(a)remc1.org> > Subject: Help checking group membership with FreeRadius > To: freeradius-users(a)lists.freeradius.org > Message-ID: <200903231522.n2NFMNxv077788(a)mxdrop218.xs4all.nl> > Content-Type: text/plain; charset=UTF-8 > Currently we have a radius server that performs authentication off our samba domain controller for wireless users. This works great. I would like to limit users so they must be a member of the wireless group in order to connect. Since the /etc/group file is on a different server I believe I cannot use the etc_group module. Also, in order to use that module the user must have a valid account on the radius server as well. > Any ideas on checking group membership? I use ntlm_auth in the mschap module for authentication in Freeradius ver 2.1.3-1. i had a similar problem a few days ago run "getent passwd username" to see if you can get a line like: smith:*:100:3243::/home/smith:/usr/bin/sh if you do, '3243' is the principal group ID of the user my solution: use a perl script 'chkgrpmembership.pl'. to check the group membership of the user. the script set 'Group' attribute if the user is found. 1. chkgrpmembership.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { my $getentResult = qx(getent passwd $RAD_REQUEST{'User-Name'}); my @resultArray = split ":", $getentResult; my $arraySize = scalar @resultArray; # Group ID 11184 = staff # Group ID 12705 = student if ($arraySize != 0) { my $groupID = $resultArray[3]; if ($groupID == 11184) { $RAD_REPLY{'Group'} = "Staff"; } elsif ($groupID == 12705) { $RAD_REPLY{'Group'} = "Student"; } else { # We only allow Staff and Student group return RLM_MODULE_REJECT; } } else { #user no found in AD return RLM_MODULE_REJECT; } return RLM_MODULE_OK; } 2.add the following lines to the modules section of radius.conf perl { module = /etc/freeradius/chkgrpmembership.pl func_authorize = authorize } 3. In the Authorize section, uncomment 'files'. Then add a line containing 'perl' after it. In the Authentication section add Auth-Type Perl { perl } 4. if you use EAP/TLS, you need to enable use_tunneled_reply, in (peap and/or ttls section) eap.conf 5. finally, you can a line to 'users' file DEFAULT Group != "wireless", Auth-Type := Reject (Sorry for starting a new thread, i subscribed to the "digest" version of the mailing list) Chris

2 1

rlm_python example?
by Hristo Trendev 01 Apr '09

01 Apr '09

I am trying to figure out how to properly setup freeradius with rlm_python. The module loads and scripts execute, but I seem to miss something when I try to return value pairs to be used in the reply packet (Access-Accept). I have tried with the following script: def authorize (params): print params return (0, ('Reply-Message', 'banned1'), ('Reply-Message', 'banned2')) and received (when I run with -X option): -----snip----- +- entering group authorize {...} rlm_python:authorize: tuple element 0 is not a tuple rlm_python:authorize: tuple element 1 is not a tuple rlm_python:authorize: tuple element 0 is not a tuple rlm_python:authorize: tuple element 1 is not a tuple ++[python] returns reject -----snip----- I have also tried changing it to: def authorize (params): print params return (0, ('Reply-Message', 'banned')) but then I get: -----snip----- +- entering group authorize {...} rlm_python:authorize: tuple must be (return, replyTuple, configTuple) ++[python] returns ?? -----snip----- Can someone point me in the right direction? What is supposed to be passed in configTuple? How do I return multiple value pairs at? I was able to make it work with rlm_exec, but I'd like to use the the python module instead. I am using freeradius on ubuntu 8.04. installed via apt-get from hardy-backports (2.1.0+dfsg-0ubuntu2~hardy1) BR, Hristo

2 2