April 2009 - Freeradius-Users - lists.freeradius.org

NAS table
by Nizar Zulmi 14 Apr '09

14 Apr '09

anyone can help.. i want to set my radius server reading the NAS from table NAS on radius database. my radius are still reading NAS from clients.conf. apreciate your help.

3 3

LDAP with fallback on local authentication?
by Justin Steward 13 Apr '09

13 Apr '09

Hi guys, I'm sure these are questions that have been asked a thousand times, but can't for the life of me find the answers I'm looking for. My first problem is this: I want to store reply attributes for my users in a MySQL database, however I want them to authenticate against an LDAP server. No problem, I sort of have this working. Except the reply attributes get sent even on an Access-Reject packet. This seems undesirable to me. My second problem is this: The LDAP server isn't necessarily in the same building as the radius server. I want users to be able to fall back on locally stored passwords in the MySQL database should the LDAP server be down for some reason. I'd thought that setting Fall-Through=yes and having a DEFAULT Auth-Type = local would have done this, but no dice. Any suggestions? Regards, Justin

5 12

Help for radius configuration
by Basant Agarwal 13 Apr '09

13 Apr '09

Hello , I want to install freeradius server for the authentic wifi users , whose database is stored in ldap server ..Users who will use the wifi are mostly windows xp /vista users. what i have tried: (1) Install openssl by apt-get install command ... (Also By the source code by the commands ./configure make make make install) (2) installed freeradius-1.1.7 ./configure make make install (3) used default configuration and added one entry in the users file .. (Also tried for installing with apt-get install freeradius freeradius-ldap freeradius-eappeap .. ) It worked well with radtest from localhost .. But when i try from laptop ..it does not work .. After That i tried to configure eap type peap since i came to know that windows xp /vista support EAP/PEAP for wifi authentication . with this configuration also radtest works well ...but from laptop it does not work (4) I receive the following request from AP Message-Authenticator = 0x3f459af06e42a2a0b7cf9c1d80092e31 Service-Type = Framed-User User-Name = "testap" Framed-MTU = 1488 Called-Station-Id = "00-15-E9-C9-F3-80:MNIT-DC-AP" Calling-Station-Id = "00-16-6F-7C-DB-2D" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01746573746170 NAS-IP-Address = 172.16.1.80 NAS-Port = 1 NAS-Port-Id = "STA port # 1" I want to ask you that how radius server with get authentic the user since it is not getting user password or hashed password ..?? (4) I have tried all the above process for the freearadius-2.1.4 also , (When i try to install freeradius-2.1.4 it does not include eap/peap even i have installed openssl previously ... No problem with freeradius-1.1.7) I have tried all installation on debian/ubuntu/deepofix. I want to ask .. Is this compulsory to configure EAP/PEAP since our end users would have windows xp/ vista ..?? what will be basic configuration ..?? I am sorry .. i am not posting any debug output here .. reason is -- i have been posted those already , got solutions for that but still i am not getting things working.. probably i got things wrong hence i am posting all things which i need .. Please give your views on what i have understood wrong ..!! and what should i do ..?? Please provide me the steps for this scenario ...!!!

2 1

no entries in radacct
by John Millican 13 Apr '09

13 Apr '09

Complete Newb to FreeRadius here. I have: radiusd -v radiusd: FreeRADIUS Version 2.1.5, for host x86_64-unknown-linux-gnu, built on Apr 1 2009 at 15:51:57 built from freeradius-server-2.1.4.tar.gz on an OpenSuSE 10.X server using postgresql 8.3.3 Authorize works well, all my NAS info is in the NAS table, and I have dial up clients using now on a very limited basis. My problem is that I can not get the accounting to work in postgres, my radacct table is empty. Everything I have read has said to put sql in the accounting section and I have done this. I also uncommented the section: $INCLUDE sql/${database}/dialup.conf At the end of the log file I have this: radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr /usr/local/etc/raddb/modules/counter[71]: Failed to link to module 'rlm_counter': rlm_counter.so: cannot open shared object file: No such file or directory Errors initializing modules I "assume" this is my problem? I did a find for rlm_counter.so and, guess what, it was not found. I then looked for just rlm_counter and it was found in freeradius-server-2.1.4/src/modules/rlm_counter from the tarball. I did read a list post from back in October of 2002 that talked about libtool not working well on SuSE, not sure if this is still the case. Any pointers? Am I going down the wrong road? Is there anything else that is glaringly missing? Any other relevant info I need to add here to aid in getting help? Thanks for any help. -- JohnM

3 4

Looking to pay someone for a customization
by Eric Geier 13 Apr '09

13 Apr '09

Hi, if anyone is interested in customizing the source code for me, please check out either site: http://www.getacoder.com/projects/c_developer_radius_expe_102912.html http://www.odesk.com/jobs/Developer-with-RADIUS-Experience_~~f48a82c177d7e1b 3?tot=129&pos=7 I would like FreeRADIUS to check incoming requests based upon the domain (derived from the username), instead of the NAS IP addresses. Thanks! Eric

1 0

Offloading password verification
by Phil Meech 13 Apr '09

13 Apr '09

Hi All, I'm running version 1.18 currently on Ubuntu 2.6.24-19-server; configured to use MYSQL for all auth and accounting requests. I have been asked to move the password verification away from MySQL and use an external username/password DB (managed by another company), for which my only method of access is an http API (given a username and password the API returns either 1 or 0). All attributes will still be held in the current MySQL freeradius DB; and all the users that exist in the API DB will also exist in the same current MySQL DB. The password is passed as PAP through to freeradius currently from the NAS devices, and the API also expects a plaintext password. I was thinking I could use the perl module to achieve this; but am a little lost with where to start (writing the perl script is fine). I guess the point of my post is how to keep all the attributes in MySQL and only offload the password to the API; and where this change would fit in to the radiusd.conf file? Any advice would be gratefully received. Many Thanks, Phil

3 2

dynamic ip address allocation problem for wifi system
by kalesameer 13 Apr '09

13 Apr '09

I have implemented a wifi authentication system wherein users authenticate themselves using their username and password. I am using EAP-PEAP for this purpose.Further, I want to assign ip addresses to the users dynamically.From whatever documentation i have read, I gather that using rlm_ippool module does not work for EAP authentication.Also,FreeRADIUS does not support DHCP fully. I am using OpenLDAP as a database which stores entries of all the users authorised to use the wireless system.FreeRADIUS version is 2.1.1. So,first of all,am I correct in saying that rlm_ippool cannot be used with EAP authentication for assigning ip addresses to clients(not access points but end users of wifi system)?Also,is there any patch or sample code available for allocating ip addresses dynamically using DHCP?And if both the above methods are not possible, then is there any other way to assign ip addresses to clients dynamically? -- View this message in context: http://www.nabble.com/dynamic-ip-address-allocation-problem-for-wifi-system… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

rlm_perl don't support tagged attributes
by Igor Belikov 13 Apr '09

13 Apr '09

Hello Freeradius-users, FreeRADIUS Version 2.1.5 (it was downloaded as 2.1.4, but it writes about itself as 2.1.5) Portion from "radiusd -X" output Module: Linked to module rlm_perl Module: Instantiating erxlogontime perl erxlogontime { module = "/usr/local/freeradius-2.1.4/etc/raddb/servicelogintime.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth_erx" } File servicelogintime.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle post_auth sub post_auth_erx { &radiusd::radlog(1, "***** custom post_auth procedure *****"); # For debugging purposes only #&log_request_attributes; #for (keys %RAD_REPLY) #{ # &radiusd::radlog(1, "RAD_REPLY: $_ = $RAD_REPLY{$_}"); #} return RLM_MODULE_NOOP; } procedure post_auth_erx executed as expected portion from debug output: +- entering group post-auth {...} GOT CLONE -1212740928 0x82bbaf0 rlm_perl: ***** custom post_auth procedure ***** but after returning from post_auth_erx all tags from attributes are resetted to zero: Sending Access-Accept of id 186 to 192.168.100.73 port 60654 ERX-Service-Login-Time:0 = "Al1800-2359,Al0000-0859" ERX-Qos-Profile-Name = "SP_WCL" ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Statistics:0 += time-volume ERX-Service-Statistics:0 += time-volume ERX-Service-Activate:0 += "world(1000000)" ERX-Service-Activate:0 += "city(10000000)" ERX-Service-Activate:0 += "deny" ERX-Service-Interim-Acct-Interval:0 += 600 ERX-Service-Interim-Acct-Interval:0 += 600 If we comment out module servicelogintime.pl, we receive correct tagged attributes: Sending Access-Accept of id 154 to 192.168.100.73 port 65168 ERX-Service-Login-Time:1 = "Al1800-2359,Al0000-0859" ERX-Service-Activate:1 += "world(1000000)" ERX-Service-Statistics:1 += time-volume ERX-Service-Interim-Acct-Interval:1 += 600 ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Service-Activate:2 += "city(10000000)" ERX-Service-Statistics:2 += time-volume ERX-Service-Interim-Acct-Interval:2 += 600 ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Activate:3 += "deny" ERX-Qos-Profile-Name = "SP_WCL" -- Best regards, Igor mailto:ivb@is.ua

1 0

Log and datatime
by peppeska 13 Apr '09

13 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is possible to log the date and time of connection and disconnection of each user? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |ggippone(a)yahoo.it --------- http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkni/rQACgkQkA6hcnFZI/a1XACg1Y3VkjixKecvn9SYtOxWVNdE YtYAoJZKm27pygq7LcmkSF1dWgg4ERYZ =Tdgk -----END PGP SIGNATURE-----

2 1

Handling of duplicates in clients.conf
by Garber, Neal 13 Apr '09

13 Apr '09

I'm running FR 2.0.3 and I just found that if there is more than one client with the same IP address in clients.conf, then it will stop processing the remainder of the file and continue startup. The only indication it has done this are 2 error messages that are easily missed when running with debug on. I checked git.freeradius.org and noticed that the client.c committed on 09-March now ignores duplicates if they are exactly the same. In my case, everything was the same except the name. My question is, wouldn't it be better to continue processing the remainder of the file even when there are duplicates that aren't identical or alternatively to preclude the server from starting (I'd vote for the former). Ignoring what could be hundreds of clients that follow the error doesn't seem useful. I propose ignoring all duplicates and having client_add return ok (1). This would log the error for any duplicates (even duplicates that aren't completely identical), but allow processing to continue for the remainder of the file.

5 12