April 2009 - Freeradius-Users - lists.freeradius.org

Different realms for different databases
by liran tal 20 Dec '09

20 Dec '09

Hey, To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows: authenticate { ... Autz-Type SQL_EXAMPLE2 { sql_example2 } ... } Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section. What would be the way to configure accounting for the different realms in their correct databases? FreeRADIUS 1.1.7 and MySQL 5. Regards, Liran.

3 9

Re:Help with md5 database encryption (Oscar Trejo)
by Oscar Trejo 11 Oct '09

11 Oct '09

The version of the freeradius is v 1.1.0 I hope these is what you ask me. Thanks !!! > What freeradius version is this? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 23/9/2008, "Oscar Trejo" <racso83(a)gmail.com> piše: > > >Hi, I had a freeradius server working, but only when the password are > saved > >on the database on plain-text with out encryption, my question is about > how > >to save the instructions on the table radcheck and radgroupcheck to work > >with Password encryption MD5. > > > >My working free radius tables had > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | Password | == | uno | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | Local | > >+----+-----------+-----------+----+-------+ > > > > > > > >When i had the password with simple plaint text with out encryption the > >result is the next > > > >Auth: Login OK: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > >But I want to save the password with MD5 encryption, the freeradius load > >correctly the module pap, chap and eap with out errors, but when i try to > >change the configuration for example : > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | MD5-Password | == | 1eaa8bb195869a23f081acbb5bf08527 | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | PAP | > >+----+-----------+-----------+----+-------+ > > > > > >the free radius log gave me the next error: > > > > > >Error: rlm_sql_getvpdata: database query error > >Info: rlm_sql (sql): No matching entry in the database for request from > user > >[oscar] > >Auth: Login incorrect: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > > > >But i need the encryption with MD5, any suggestion > > > >Before any answer I gave you thanks for the help > > >

5 6

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3

Version 2.1.0 has been released.
by Alan DeKok 05 Aug '09

05 Aug '09

We are happy to announce the release of Version 2.1.0 of the FreeRADIUS server, with some major new features. Highlights include improved SNMP support, dynamically-defined clients, much more flexible (and readable) debugging mode, WiMAX support, fast reauthentication for PEAP and TTLS, and a command-line tool to administer a running server. The administration tool can stop the server, HUP it, or in limited cases, change the configuration of a running server, and cause just one module to reload it's configuration. Alan DeKok. Detailed change log: FreeRADIUS 2.1.0 Fri Sep 5 13:20:01 CEST 2008; , urgency=medium Feature improvements * Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients. * SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README * SNMP statistics are available through Status-Server packets. See raddb/sites-available/status * Added more Microsoft attributes from bug #568. * The "linelog" module has more functionality and flexibility. See raddb/modules/linelog. * The debugging output has been sanitized. It should be much more readable. * Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the "log" section of radiusd.conf. * Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax * Added session resumption for PEAP and TTLS. See raddb/eap.conf, "cache" sub-section. * Added "radmin" command-line tool for administering a running server. See "man radmin" and raddb/sites-available/control-socket. Bug fixes * Double escaping of '\\' in the "users" (and some other) files has been fixed. If you have '\\' in the "users" file, your configuration WILL NEED TO BE CHECKED, AND FIXED! * Parse "security" section in radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566. * Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces. * Fix handling of giaddr in DHCP responses. * Corrected parsing of status_check in home_server so that it works. * Fix hints so that "Puser" works again. * Removed length restrictions on attribute names in the dictionaries. * Update socket code to avoid C compiler optimizations.

6 14

RADIUS attributes: acctoutputoctects and acctinputoctect in mikrotik
by Santiago Balaguer García 19 May '09

19 May '09

7 7

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

ldap filter depending on NAS
by Matthieu Lazaro 05 May '09

05 May '09

Hello, My freeRadius setup works very well using PEAP/TLS binding on the ldap using only one filter. Now I have two very different types of NAS and I need to filter users that may have access to one NAS or the other or both. My idea was to use the unlang in the ldap module to write my policy, but it's not working. in /etc/freeradius/modules/ldap we have: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "127.0.0.1" identity = "__snipped__" password = "__snipped__" basedn = "dc=__snipped__,dc=com" #WORKING : #filter = "(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" #NOT working: if (NAS-IP-Address == 10.1.1.2) { filter = "(&(|(accessTo=WIFI_XX)(accessTo=WIFI_YY))(uid=%{Stripped-User-Name:-%{User-Name}}))" } else { filter = "(&(accessTo=VPN)(uid=%{Stripped-User-Name:-%{User-Name}}))" } base_filter = "(objectclass=radiusprofile)" ___snipped-the rest of this section is OK___ } It all happens as if the "if () { ... } else { ... } " is completely ignored (and thus it defaults to check if the uid exists) (ie: neither filter1 nor filter2 appears when debugging. But when we only put filter, it appears when debugging) I think I'm missing a lot of details in the configuration and I have not figured out how to do this with hints|huntgroups|clients files. Any help on why this is not working or an other simple solution is welcome. Best Regards, Matt

4 27

RE: rlm_perl DBI problems
by Alexander Kosykh 02 May '09

02 May '09

Hi. Back to my problem with perl Then I comment my own module rejectlog in sites-enable/mysite FR begin to work fine at least 18 hours. Some ideas why it can bring an error in DBI if it's sub function in perl don't use DBI at all? Any other offers how to log reject users in special format? I don't want log rejected user in radius.log file. In my case it for radius system log - not for users. I've try to turn on log only badpassword users but it log all good and bad password users L bug in FR? Thers part of my config log { destination = files file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } radiusd: FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd6.2, built on Apr 10 2009 at 12:18:46

3 3

Possible bug in rlm_perl
by Josh Hiner 01 May '09

01 May '09

I think I may have found a bug in rlm_perl? I have written script with the aid of another freeradius list member that checks to see if a user is in a certain samba windows group. If they are not in the group (the wireless group) the module rejects the login. The module works perfectly except for those users who's usernames begin with a letter t. For instance ISD\josh will succeed but ISD\\ted will fail. I have done much testing and cant find my script to be the issue. Look below for debug output for the perl module. Notice that right after the ++[files] line I print out the radius items for debugging. Notice the User-Name value is correct going into the perl script. Notice on the exit of the perl script on each debug that the username is correct. Then notice later in each debug where these lines are: Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel) but when the username begins with a "t" it fails here like this: Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via TLS tunnel) Notice only one backslash. I have tried to make it succeed by adding backslashes (for users that start with t) but no success. It will do ISD\\\tbraun and ISD\tbraun but never ISD\\tbraun. Therefore, with users that start with "t" I always get User-name does not match eap identity failure. Thanks for any help. At the very bottom after the debug output you will find my simple perl script that is well commented. -Josh ------- Successful attempt -------- ++[files] returns noop They key is User-Name and the value is ISD\\josh.They key is EAP-Message and the value is 0x020900061a03.They key is EAP-Type and the value is MS-CHAP-V2.They key is State and the value is 0xfeecb38bffe5a965a0ca1cd92ce6c42b.They key is FreeRADIUS-Proxied-To and the value is 127.0.0.1. rlm_perl: Added pair User-Name = ISD\josh rlm_perl: Added pair EAP-Message = 0x020900061a03 rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair State = 0xfeecb38bffe5a965a0ca1cd92ce6c42b rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL ++[perl] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ISD\\josh" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ISD\\josh" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later --------- End snip of successful attempt --------- --------- Failed attempt from user who's username begins with a "t" (tbraun) --------- ++[files] returns noop They key is User-Name and the value is ISD\\tbraun.They key is EAP-Message and the value is 0x0207000f014953445c74627261756e.They key is EAP-Type and the value is Identity.They key is FreeRADIUS-Proxied-To and the value is 127.0.0.1.rlm_perl: Added pair User-Name = ISD\tbraun rlm_perl: Added pair EAP-Message = 0x0207000f014953445c74627261756e rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 ++[perl] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ----------- End of snip of failed attempt ---------------- ----------- Begin paste of perl script ------------------ #!/usr/bin/perl -w use strict; # use ... use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { my $sambagroup = "10007"; #This is the numeric ID of the samba group my $domain = "ISD"; #Testing stuff to print out all radius attributes from hash my $key = ""; my $value = ""; while (($key, $value) = each (%RAD_REQUEST)){ print "They key is $key and the value is $value."; } #End of testing my $auth_user = $RAD_REQUEST{'User-Name'}; #Windows adds host/ to the begining of every machine name during login. #The following block of code cleans off host/ and replaces it with #the login domain and tags a $ at the end for wbinfo group query. if ($auth_user =~ /\bhost\b/ ) { $auth_user =~ s/^host\/// ; $auth_user = "$auth_user\$"; } #Here I add the domain to the beginning of the username if the domain doesnt exist there #already. if ( $auth_user !~ /^\b$domain\b/ ) { $auth_user = "$domain\\\\$auth_user"; } #End of username/machine name cleanup. #The next line is the wbinfo query to see what samba groups the user is a member of. my @resultArray = qx(wbinfo -r $auth_user); my $arraySize = scalar @resultArray; my $groupID = ""; if ($arraySize != 0) { foreach $groupID (@resultArray) { if ($groupID == $sambagroup) { #The below line re-writes the value stored in #the radius user-name attribute in the rad_request #hash. For some reason freeradius feeds in #DOMAIN\\\\username instead of DOMAIN\\username. #This causes the eap module to fail because the #returned value from this module doesnt match the EAP #identity. #this is from testing --> $RAD_REQUEST{'User-Name'} = "ISD\\\\tbraun" #The following line cleans two of the slashes "\\" out of the user-name before we return from the #perl module. These two slashes get added in. I'm not sure how or why. $RAD_REQUEST{'User-Name'} =~ s/^$domain\\/$domain/; #Here I exit the subroutine and tell FreeRadius I updated #some junk. return RLM_MODULE_UPDATED; # return RLM_MODULE_OK; } } } else { #user not in the required group. return RLM_MODULE_REJECT; #YOU have been denied.... } }

5 7