March 2009 - Freeradius-Users - lists.freeradius.org

RE: fake user and unregistered user forwarding
by Ümit AYDINLI(Teknotel) 24 Mar '09

24 Mar '09

Hi, First, Sorry for bad English. I need a idea.Im using freeradius on cisco equipment and mrtg tool. Remote users are come other virtual-access interface.Cannot receve remote users data traffics. How can do assign static virtual-access interface on remote users.That is possible? Regards.

2 3

Expiration vs WISPr-Session-Terminate-Time
by Santiago Balaguer García 24 Mar '09

24 Mar '09

Hi, Today I did some test with radreply.WISPr-Session-Terminate-Time and radcheck.Expiration. It is supposed both attributes do the same, but Expiration is from AAA server side, meanwhile Session-Terminate-Time is from NAS side. However, there is a difference if you want to to set a username with Session-Timeout (johndoe, Session-Timeout, :=, 3600) since the NAS rewrite the Session-Timeout according to the Date in Session-Terminate-Time. This behaviour does not happen with Expiration attribute. Do you confirm this? _________________________________________________________________ ¿Quieres ver los mejores videos de MSN? Enciende Messenger TV http://messengertv.msn.com/mkt/es-es/default.htm

1 0

Re: freeRaidus-PAM:: .so file error
by krishna Mohan 24 Mar '09

24 Mar '09

> Why are you developing something for a server version years out of date??? Why not use current version? Read doc/bugs about how to debug this.One of the products am working with is using FR 1.1.5The same .so library is working for another FR1.1.5 which is compiled.pamtester is displaying segmentation fault soon after invoking pam_start().Thanks,Sri.

1 0

How to log failed login attempts?
by bastardinho69 24 Mar '09

24 Mar '09

Hi, i am using FreeRADIUS 2.0.5. Successfull logins into cisco routers are logged great (using Accounting), but i need to log also the failed attempts. In /var/log/radius.log radius does log the failed attempts, BUT if in clients.conf i have created client as 10.0.0.0/8 (a network, not a host), then in the log file i will see the NAS ip address 10.0.0.0/8, which is not enough. I need to see the exact NAS ip address. It would be insane to add every single router into the clients.conf file, so i assume there is a way how to solve this. I hope u guys can help me, i will appreciate it ;) Thanks.

2 1

freeRaidus-PAM:: .so file error
by krishna Mohan 24 Mar '09

24 Mar '09

Hi,Am using freeradius 1.1.5 with pam configured.Wrote my pam application (mypam.so) file and trying to authenticate a user.No compilation errors while generating .so library.But getting "segmentation fault" error radiusd is executing a request.Btw,I have two setups; one with source compiled (fr1.1.5-tar.gz) and other rpm installed (fr1.1.5-i386.rpm). The generated .so is working perfectly with setup1.Earlier, got "PAM unable to resolve symbol: pam_sm_authenticate PAM unable to resolve symbol: pam_sm_setcred" error.  Added two dummy routines for both pam_sm_authenticate() and pam_sm_setcret(), to the pam auth module, so that they always return success.radiusd -X output:-------------------rad_recv: Access-Request packet from host 127.0.0.1:32768, id=19, length=46        User-Name = "john90"        User-Password = "password"  Processing the authorize section of radiusd.confmodcall: entering gr! oup authorize for request 0  modcall[authorize]: module "preprocess" returns ok for request 0radius_xlat:  '/var/log/radius/radacct/detail-20090324'rlm_detail: /var/log/radius/radacct/detail-%Y%m%d expands to /var/log/radius/radacct/detail-20090324  modcall[authorize]: module "detail" returns ok for request 0radius_xlat:  'john90'rlm_sql (sql): sql_set_user escaped user --> 'john90'radius_xlat:  'SELECT id,UserName,Attribute,AES_DECRYPT(Value,'IMAGRadSqlKey'),op FROM radcheck WHERE Username = 'john90' ORDER BY id'rlm_sql (sql): Reserving sql socket id: 3radius_xlat:  'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = 'john90' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'radius_xlat:  'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'john90' ORDER BY id'radius_xlat:&n! bsp; ''rlm_sql (sql): Released sql socket id: 3  modcall[authoriz e]: module "sql" returns ok for request 0rlm_pap: Found existing Auth-Type, not changing it.  modcall[authorize]: module "pap" returns noop for request 0modcall: leaving group authorize (returns ok) for request 0  rad_check_password:  Found Auth-Type pamauth: type "PAM"  Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 0pam_pass: using pamauth string <radiusd> for pam.conf lookupSegmentation faultAppreciate your help in resolving this.

2 1

Logging the return code from the ldap authentication to SQL.
by Augusto G. Andreollo 23 Mar '09

23 Mar '09

Hello all. I have the need to log the return code from the LDAP authentication to our database (I'm adding it to the postauth table scheme). I've already modified the database scheme (ok), the attribute map, to create a new attribute called "reason" (ok) and the insert queries (ok). All of this is working fine, including the complete authentication, all the way thru Access-Accept and Accounting. My problem now is getting the return code into the variable, according to the LDAP module results. I've made two attempts so far, and neither gave me too much success: First, with a series of IFs and ELSIFs: authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } if (rejected) { update control { reason = "rejected" } } elsif (fail) { update control { reason = "fail" } } elsif (notfound) { update control { reason = "not found" } } elsif (ok) { update control { reason = "ok" } } else { update control { reason = "ERROR" } } } } Which gives: rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap1] user user@university authenticated succesfully +++[ldap1] returns ok ++- policy redundant returns ok ++? if (rejected) ? Evaluating (rejected) -> TRUE ++? if (rejected) -> TRUE ++- entering if (rejected) {...} +++[control] returns ok ++- if (rejected) returns ok ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping else for request 0: Preceding "if" was taken +- entering group post-auth {...} (and then it goes on to successfuly add the string "rejected" to the database. Again, that part is working smoothly). My second attempt was with a switch statement, as follows: authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } switch "%{control:rcode}" { case ok { update control { reason = "ok" } } case rejected { update control { reason = "rejected" } } case notfound { update control { reason = "notfound" } } case fail { update control { reason = "fail" } } case { update control { reason = "ERROR" } } } } } Which gives me the following (Again, I've skipped what I believe to be unneeded): rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap1] user user(a)university.com authenticated succesfully +++[ldap1] returns ok ++- policy redundant returns ok expand: %{control:rcode} -> ++- entering switch %{control:rcode} {...} +++- entering case {...} ++++[control] returns ok +++- case returns ok ++- switch %{control:rcode} returns ok +- entering group post-auth {...} And then goes to successfully write "ERROR" the database. (to save room, i've already tried encasing the case options in quotes, as 'rejected', 'ok', etc.. that gives me the exact same results. So does putting it on double quotes, as "ok", "rejected", etc..) So, any ideas? btw: $ radiusd -v radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.0, built on Jan 9 2009 at 07:02:31 -- Augusto G. Andreollo CCUEC/DCNET/SREDE Universidade Estadual de Campinas - UNICAMP +55 19 3521-2276 -- "Wit beyond measure is men's greatest treasure."

4 8

FreeRadius, PostgreSQL and DaloRadius
by Sunday Olutayo 23 Mar '09

23 Mar '09

Login attempt after setup result in error. Please what do I do wrong? Database connection error Error Message: DB Error: not found Debug: Unable to include the DB/postgresql.php file for 'postgresql://radius:radpass@127.0.0.1/radius' Sunday

2 1

Correct operator in radcheck
by Santiago Balaguer García 23 Mar '09

23 Mar '09

Hi, I am several years working woth freeradius, bit recently I surgeg me a question: I do not want that johndoe account never connect from NASES with Client IP: * 195.56.53.23 * 96.53.26.59 * 56.15.86.35 * 56.15.86.36 I know I have to use the attribute Client-IP-Address, so radckech will content: username attribute op value ------------------------------------------------ johndoe Cleartext-Password := mypassword johndoe Client-IP-Address ?? 195.56.53.23 johndoe Client-IP-Address ?? 96.53.26.59 johndoe Client-IP-Address ?? 56.15.86.35 johndoe Client-IP-Address ?? 56.15.86.36 What is the correct op that I have to write? Thank you!! _________________________________________________________________ Descubre todas las formas en que puedes estar en contacto con amigos y familiares. http://www.microsoft.com/windows/windowslive/default.aspx

2 1

Help checking group membership with FreeRadius
by Josh Hiner 23 Mar '09

23 Mar '09

Currently we have a radius server that performs authentication off our samba domain controller for wireless users. This works great. I would like to limit users so they must be a member of the wireless group in order to connect. Since the /etc/group file is on a different server I believe I cannot use the etc_group module. Also, in order to use that module the user must have a valid account on the radius server as well. Any ideas on checking group membership? I use ntlm_auth in the mschap module for authentication in Freeradius ver 2.1.3-1. Here is the string in the users file to limit to the wireless group (its all on one line, email may wrap it): DEFAULT Called-Station-Id =~ "CCISD-REMC1", Group != "wireless", Auth-Type := Reject here is my ntlm_auth line: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=ISD --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" thanks for any help =D *** This Email was sent by a system administrator in REMC #1.

1 0

fake user and unregistered user forwarding
by Ümit AYDINLI(Teknotel) 23 Mar '09

23 Mar '09

Hi, Sory for bad English. Are we forward fake user and unregistered users to fake ip or redirect page. We are using freeradius on platform freebsd, databse server on postgresql. That is possible? Regards.

3 2