March 2009 - Freeradius-Users - lists.freeradius.org

about VSA attribute
by Tseveendorj 30 Mar '09

30 Mar '09

Hello, I'm trying to implement ADSL service via cisco router by NAS, FreeRADIUS 2.1.3 by AAA server and daloRADIUS. On the cisco router I defined some policy-map for traffic shape. In the radgroupreply table contains following attribute with value. "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" Question is How to define 2 difference policy-map on the one user in FreeRADIUS Databse. example: "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" "cisco-avpair", ":= ", "ip:sub-policy-Out=1Mbps" Really appreciate any help. Sincerely, Tseveen

2 4

help
by William Esteves 29 Mar '09

29 Mar '09

I have one answer, maybe its cause im newba in freeradius =] the situation is, sometimes my bd in mysql (that run on another computer) crash or have problems, how can i autenticate all users with any password or any usernames? Then i let my clients coneccted and can fix my db server how can i do this? thanks 4all William Esteves _________________________________________________________________ Confira vídeos com notícias do NY Times, gols direto do Lance, videocassetadas e muito mais no MSN Video! http://video.msn.com/?mkt=pt-br

2 1

running freeradius with eap/tls :(
by Wiem Tounsi 29 Mar '09

29 Mar '09

hello; I have to run freeradius with 802.1X protocol : EAP/TLS. i did all my possible but i had no chance to connect my client (wpa_supplicant with the server).. My AP is also well configured.. here i'll send you the debug I have from freeradius and the client... freeradius detect a signal but there is no connection with EAP/TLS.. please, help me to now the problem.. i'm too late.. thank you . *the outpu of freeradius when trying to connect the client:* root@xxxxt:/usr/local/etc/raddb# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.0.228:2159, id=12, length=156 Acct-Session-Id = "00000019-00000043" Acct-Status-Type = Start Acct-Authentic = Local User-Name = "001b770fdb97" NAS-IP-Address = 127.0.0.1 NAS-Port = 2 Called-Station-Id = "00-1E-2A-C6-61-58:xxxx" Calling-Station-Id = "00-1B-77-0F-DB-97" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.0.228,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "00000019-00000043",User-Name = "001b770fdb97"' rlm_acct_unique: Acct-Unique-Session-ID = "2454d13eda8ab416". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "001b770fdb97", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/ 192.168.0.228/detail-20090321' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.228/detail-20090321 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: '001b770fdb97' modcall[accounting]: module "radutmp" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 12 to 192.168.0.228 port 2159 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 12 with timestamp 49c53da1 Nothing to do. Sleeping until we see a request. *the output of client:* phare@phare:~$ sudo wpa_supplicant -Dwext -iwlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf Associated with 00:1e:2a:c6:61:58 Authentication with 00:1e:2a:c6:61:58 timed out. CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys ioctl[SIOCSIWENCODEEXT]: No such file or directory CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-SCAN-RESULTS

2 3

Authentication Digest
by Varadharajan Seshadri 28 Mar '09

28 Mar '09

Hi, I would like to have my SIP clients authenticate with Active Directory (AD). I am using RADIUS in the middle to do the digest based authentication between by sip client and AD. SIP Client ---> RADIUS Client ---> RADIUS Server (IAS of windows server) ----> Activer Directory is my setup. I downloaded RADIUS Client version 1.1.6 (which is the latest i find in freeradius.org) to do the digest based Auth. Following is the AV pair i used to form my Request packet, as per RFC 4590/5090 PW_USER_NAME PW_SERVICE_TYPE PW_DIGEST_REALM PW_DIGEST_METHOD PW_DIGEST_ALGORITHM PW_DIGEST_URI RADIUS server (IAS of Windows) complains of malformed packets. If any of you have used digest based authentication, using Freeradius client, i would like you to help me with this. Also, i am not sure how to add message autehnticator to this request message, which i understand is mandatory. Not sure if this is THE issue. Thanks Varad Windows Live Messenger. Multitasking at its finest. _________________________________________________________________ Twice the fun—Share photos while you chat with Windows Live Messenger. http://www.microsoft.com/india/windows/windowslive/messenger.aspx

2 3

Filtering reply attributes for certain NAS devices
by Paul Hanson 28 Mar '09

28 Mar '09

Quick question (I hope)... What options do I have to limit or mask certain attributes depending upon the NAS device? I have approx 14 devices that need specific attributes but other devices have issues with some optional reply attributes. My current setup uses two LDAP instances, PostgreSQL database, exec scripts for attribute rewrites and I'm using default_profile for global attributes via LDAP and optional per user attributes in LDAP too. As usual, freeradius generally has a multitude of ways to achieve the same task....what options/alternatives/combinations do I have??? Regards ***Disclaimer*** This email and any attachments may contain confidential and/or privileged material; it is for the intended addressee(s) only. If you are not a named addressee, you must not use, retain or disclose such information. The Waterdale Group (3477263), comprising of CPiO Limited (2488682), Ardent Solutions Limited (4807328), eSpida Limited (4021203), Advanced Digital Technology Limited (1750478) and Intellisell (6070355) whilst taking all reasonable precautions against email or attachment viruses, cannot guarantee the safety of this email. The views expressed in this email are those of the originator and do not necessarily represent the views of The Waterdale Group Nothing in this email shall bind The Waterdale Group in any contract or obligation. For further information visit www.waterdalegroup.co.uk

2 1

Exec-Program-Wait w/ FreeRADIUS 2.1.3
by Jeremiah Millay 27 Mar '09

27 Mar '09

I'm having trouble getting FreeRADIUS to run programs called by Exec-Program-Wait in the newest version of FreeRADIUS (version 2.1.3). I'm using a custom C script that used to work with all versions of FreeRADIUS prior to version 2. I have an entry like this in the users file which is matching my access-requests: DEFAULT Suffix == "@test.net", Auth-Type := Accept Exec-Program-Wait = "/usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password}", Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Fall-Through = No Here is my debugging output when I attempt to authenticate (doesn't appear to execute my program): Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 49411, id=74, length=76 User-Name = "jmillay(a)test.net" User-Password = "blah" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] expand: %t -> Tue Mar 17 13:58:23 2009 ++[auth_log] returns ok [suffix] Looking up realm "test.net" for User-Name = "jmillay(a)test.net" [suffix] Found realm "test.net" [suffix] Adding Stripped-User-Name = "jmillay" [suffix] Adding Realm = "test.net" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 26 [files] expand: /usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password} -> /usr/local/sbin/checkradacct jmillay blah ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [jmillay(a)test.net] (from client 10.1.1.1 port 0) Sending Access-Accept of id 74 to 10.1.1.1 port 49411 Ascend-Data-Filter += "ip in forward tcp est" Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp" Ascend-Data-Filter += "ip in drop tcp dstport = 25" Ascend-Data-Filter += "ip in forward 0" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 74 with timestamp +21 Any suggestions? I read in the docs that Exec-Program and Exec-Program-Wait are deprecated but I haven't found any clear documentation on how to configure rlm_exec to duplicate what I am trying to do. Thanks in advance, Jeremiah

4 4

EAP/TLS -- FreeRadius -- 802.1x
by phil lemelin 27 Mar '09

27 Mar '09

Good morning FreeRadius users. I'm going forward with my attempt to configure freeradius and 802.1x to try to secure part of a wired network. I have been reading about FreeRadius, 802.1x, EAP/TLS and XSupplicant. I came accross a link that doesnt work in the freeradius wiki about exactly those subject but I found something on the linux documentation project ( http://tldp.org/HOWTO/html_single/8021X-HOWTO/ ) which seems to cover this subject. I was wondering if users here have experience with this subject and have more documentation on the subject. My main concern being that most documents on the subject date back to 2004 and I dont know if they are still valid with the freeradius version i'm using ( 1.1.3 -> CentOS install ). Thank you in advance. -- Philippe-Alexandre Lemelin

3 11

Re: same user on different service
by "Николай Г. Петров" 27 Mar '09

27 Mar '09

Thanks for help!! It's work!! , but now have a problem from cisco. From aaa server console mode all it's OK: $ echo "User-Name=user100,User-Password=pass,Service-Type=NAS-Prompt-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 31, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0" $ echo "User-Name=user100,User-Password=pass,Service-Type=Framed-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 33, code 2, length = 68 Called-Station-Id = "1133" Service-Type = Framed-User Framed-Protocol = PPP Cisco-AVPair = "ip:addr-pool=dynpool" file "users" usr100 User-Password := "pass", Service-Type == NAS-Prompt-User Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=0" usr100 Auth-Type := Local, User-Password := "pass" Called-Station-Id == "1133", Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair ="ip:addr-pool=dynpool" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Auth-Type := Reject Reply-Message = "%{User-Name}, don't have access!" User 'user100' try to login to cisco shell: Line has invalid autocommand " ppp negotiate"Connection closed by foreign host. radiusd -X rad_recv: Access-Request packet from host 192.168.10.100:1812, id=19, length=79 NAS-IP-Address = 192.168.10.100 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "user100" Calling-Station-Id = "192.168.10.120" User-Password = "pass" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user100", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry user100 at line 641 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 19 to 192.168.10.100 port 1812 Called-Station-Id == "1133" Service-Type = Framed-User Framed-Protocol = PPP Cisco-AVPair = "ip:addr-pool=dynpool" Finished request 0 Going to the next request View this debug log, think problem to side a cisco, not a freeradius??? Cisco some how send wrong attribute, know you how to relove the problem?

2 1

Re: same user on different service
by "Николай Г. Петров" 27 Mar '09

27 Mar '09

Ok, thank you about answer!! Please, I have a yet a question: every time when I try to login from same username with same password, successfully login user which is first meet in a users file. How can I delineate this users over Service-Type which include a aaa packet??? - from cisco console (NAS-Prompt-User) -from dialup (Framed-User) file "hint" DEFAULT Suffix == ".ppp", Strip-User-Name = Yes Hint = "HNT", Service-Type = Framed-User, Framed-Protocol = PPP file "users" usr100 User-Password := "pass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=0" usr100 Auth-Type := Local, User-Password := "pass" Called-Station-Id == "1133", Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair ="ip:addr-pool=dynpool" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Auth-Type := Reject Reply-Message = "%{User-Name}, don't have access!" $ echo "User-Name=usr100,User-Password=pass,Service-Type=NAS-Prompt-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 244, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0" $ echo "User-Name=usr100,User-Password=pass,Service-Type=Framed-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 244, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0"

2 1

using a database for CRL management
by Aníbal Pacheco 26 Mar '09

26 Mar '09

hello all! any possibility to use a database for CRL management? imho there is no way since I think FR uses directly openssl commands and it needs the crl and the revoked certs as files inside the CA_path directory? right? I'm thinking to use a database filesystem like DBI-Fuse or something like that. thank you. tom.

1 0