May 2009 - Freeradius-Users - lists.freeradius.org

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

From: Johan Meiring <jmeiring(a)pcservices.co.za> > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > I for one use it quite extensively, and it works very > well! > > Without it you cannot safely allow dual logins. > > (e.g. if a user with 100MB left, logs in twice at the same > time, he will get 200MB) > Do you update it via a new connection or you update it via the same accounting connection ? If the later, could you share how do you do it ? Rgds.

2 1

Help Regarding Freeradius Server Inactivity and client access
by pushpraj nimbalkar 15 May '09

15 May '09

Hello All, I have working Freeradius(freeradius-2.1.3-1.fc10.i386) server with Mysql and chillispot. I just want to know what should happen when user is authenticated and after few time freeradius server stops working(due to any reason). In my case user stays on-line even though freeradius server is not working. For e.g. user A connects to my network radius server authenticates to user and after authentication say after 5 minutes radius server stopped working but user A still accessing internet as long as possible. I think if server stops working client should be disconnected. Regards, Pushpraj N.

3 3

Re: update disconnect
by mctiew＠yahoo.com 15 May '09

15 May '09

--- On Thu, 5/14/09, Alan DeKok <aland(a)deployingradius.com> wrote: > > > Though the exec method works but I have to open up the > port, which means > > the firewall thinks that's a separate connection, > which is lousy. > > Well... it *is* a separate connection. The > Disconnect-Request packet > is sent from a *new* source port to the disconnect port of > the client. > In the case of doing an "update disconnect" instead of exec, does it use the destination port of the accounting packet as the source, or it is also using a new source port ? > > And why do you think that something happening > *second* is logged > before something happening *first*? > Because the log seems to say there was a MYSQL error, no fields and SQL query did not succeed and so on.

2 1

Re: User in multiple groups with different login time
by Pramada Batchu 14 May '09

14 May '09

Can you give an example of script? Also how should the script be invoked? Thanks, Pramada >> I am trying to assign one user to multiple groups and each group has a >> different login time. Is it possible to check the user against each >> group's login time and allow access if anyone of them matches. > >No. Login-Time can't be used like that. You will have to write a script >that checks if the user is allowed to log in. > >Ivan Kalik >Kalik Informatika ISP

2 1

Need sanity check: steps to setting up certificate enrollment for dot1x/PEAP/Active Directory
by john 14 May '09

14 May '09

Hi all, I need help thinking my deployment plans through. I hope folks on the list will help me clarify my thinking. I intend to setup .1X access control on our LAN via freeradius. Here's what this would look like. Windows 2003 Standard Ed/Active Directory <=>Winbind/Samba <=>Freeradius <=> NAS <=> <PEAP/MSCHAPV2> <=>Windows XP/sp2 work stations. I'd like to enforce network access by making freeradius check for host certificates (by using 'EAP-TLS-Require-Client-Cert = Yes' under the PEAP section in eap.conf). So that only computers with valid host certs AND domain credentials will be allowed port access via the NAS to the LAN. My understanding is that best practice says that each computer cert should be unique. I think I could use two approaches to creating certs, and getting them to the client. Here's the two alternatives I think would work: Scenerio # 1 For 300 host machines on LAN 1. from the /certs directory use the MAKE scripts to generate a unique client.pem using the FQDN of each host. 2. copy and install host cert (fqdn.pem) and ca.der to each windows xp/sp2 client This would all be done by hand e.g. we would need to sit down at every host and install the cert. If this general outline is correct which file on freeradius would we remove if we wished to revoke a hosts certificate? If I am way off base here, I'd love to get corrected. Is there anyway to automate this procedure in our LAN environment other than scenario #2 below? Scenario #2 In order to auto-magically distribute unique computer certs to Windows 2003 domain members I understand that Windows 2003 Enterprise Edition has the ability to create a template certs and roll a unique cert for each host joined to the domain. And also to push the customized cert to each domain members via GPO. However, we don't currently run Win2k3 Enterprise edition but we would consider buying it if we thought that it would save us a lot of time for installation and future management of certs. Using this approach I think we would need to do the following. 1. from the /certs directory use 'make server.csr' to create a Certificate Signing request which we would then import to our Active Directory CA. 2. We would need to follow the steps outlined here http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-October/msg… to get our server cert which we generated on Freeradius signed by the Active Directory CA. 3. We could then import that signed cert into AD for automatic distribution and enrollment per http://www.wicked-styles.com/bitsandpieces/articles/enterprise_wi-fi_securi… I hope folks can help fill in the missing pieces here and also let me know which approach makes sense given the number of clients we have and the environment I've outline above. Has anyone had any experience with either scenario? Is there a better way than the ones I've outlined? Thanks very much! John

2 4

radius help
by jon jon 14 May '09

14 May '09

I have am using slackware 12.1 and installed freeradius version 2.1.5. I have read the Install and the Readme me file. I am trying the radtest program out and I start the radius server in debugging mode in one virtual screen and do a "radtest test test localhost 0 testing123" from another virtual screen, I get a access reject of my packets. So the good thing is that my radius server is receiving the packets. Now I move on to see if I create a user called bob in the users file. I put this at the top of the file: bob Cleartext-Password := "hello" and run radtest again using "radtest bob hello localhost 0 testing123" and still get access reject message. So I know that my server is up and running, but the user is being rejected because of the password not matching, right?

3 4

help on OpenSUSE installation
by mx5450 14 May '09

14 May '09

Team, I'm trying to set up freeradius 2.1.4 in a AMD 64 X2 system with an OpenSUSE 11.1 (x86_64.iso) OS. I must tell you that I'm new to Linux and Freeradius. According to the instructions on freeradius.org/radiusd/install I can either: 1. Get a pre-installed binary package (Peter Nixon) 2. get the FreeRADIUS tarball When I try to get the binary package (http://download.opensuse.org/repositories/network:/aaa/openSUSE_11.1/) I get a list of files/folders which I dont know what to do with them: i586/ network:aaa.repo repodata/ src/ x86_64/ As I got stuck, I tried to "build it" (? new term to me), by placing the tarball in usr/src/packages/SOURCES; extracting the freeradius.spec and placing it in usr/src/packages/SPECS. Then I run from the terminal prompt: rpmbuild -ba usr/src/packages/SPECS/ freeradius.spec However I got the message: marcos@win-219e0010bba:~> rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: db-devel is needed by freeradius-server-2.1.4-0.x86_64 e2fsprogs-devel is needed by freeradius-server-2.1.4-0.x86_64 gcc-c++ is needed by freeradius-server-2.1.4-0.x86_64 gdbm-devel is needed by freeradius-server-2.1.4-0.x86_64 gettext-devel is needed by freeradius-server-2.1.4-0.x86_64 glibc-devel is needed by freeradius-server-2.1.4-0.x86_64 libtool is needed by freeradius-server-2.1.4-0.x86_64 ncurses-devel is needed by freeradius-server-2.1.4-0.x86_64 openldap2-devel is needed by freeradius-server-2.1.4-0.x86_64 openssl-devel is needed by freeradius-server-2.1.4-0.x86_64 pam-devel is needed by freeradius-server-2.1.4-0.x86_64 postgresql-devel is needed by freeradius-server-2.1.4-0.x86_64 python-devel is needed by freeradius-server-2.1.4-0.x86_64 unixODBC-devel is needed by freeradius-server-2.1.4-0.x86_64 zlib-devel is needed by freeradius-server-2.1.4-0.x86_64 apache2-devel is needed by freeradius-server-2.1.4-0.x86_64 cyrus-sasl-devel is needed by freeradius-server-2.1.4-0.x86_64 krb5-devel is needed by freeradius-server-2.1.4-0.x86_64 libapr1-devel is needed by freeradius-server-2.1.4-0.x86_64 libmysqlclient-devel is needed by freeradius-server-2.1.4-0.x86_64 marcos@win-219e0010bba:~> I read about this and regarding the dependencies it seems that some "features" are not installed and that I need the OpenSUSE disk to load them from the YAST. However I can not seem to find what the "sh: apxs2-prefork: command not found" message is about or how to fix that. I'm stuck again. Could you help with this? Thanks in advance

3 2

FreeRADIUS Active Directory Integration
by Davies, Mike 14 May '09

14 May '09

We're not able to get the user authenticated. [root@u701radius02 raddb]# wbinfo -a dw68406a%garrett05 plaintext password authentication succeeded challenge/response password authentication succeeded [root@u701radius02 raddb]# ntlm_auth --request-nt-key --domain=dom002 --username=dw68406a --password=garrett05 NT_STATUS_OK: Success (0x0) [root@u701radius02 raddb]# radiusd -X FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 172.18.134.248 { require_message_authenticator = no secret = "testing123" shortname = "172.18.134.248" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOM002 --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 172.18.134.36 port = 0 } listen { type = "acct" ipaddr = 172.18.134.36 port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address 172.18.134.36 port 1812 Listening on accounting address 172.18.134.36 port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address 172.18.134.36 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.18.134.248 port 1025, id=216, length=227 Framed-MTU = 1466 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "Puyallup_5412a" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 9 NAS-Port-Type = Ethernet NAS-Port-Id = "A9" Called-Station-Id = "00-1f-28-39-c5-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" EAP-Message = 0x0201001401444f4d3030325c4457363834303641 Message-Authenticator = 0xb3953b3cb40087233b51cc35bde7b183 +- entering group authorize {...} ++[preprocess] returns ok [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=DW68406A [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> DOM002\DW68406A attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 216 to 172.18.134.248 port 1025 Waking up in 4.9 seconds. Cleaning up request 0 ID 216 with timestamp +20 Ready to process requests. ^C [root@u701radius02 raddb]# Thanks, Mike Davies Network Engineer Fred Meyer 503-797-7753 ________________________________ This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 3

Proposed release of 2.1.6
by Alan DeKok 14 May '09

14 May '09

We plan on releasing 2.1.6 this week. Please test the pre release at: http://git.freeradius.org/pre/ If there are any concerns, problems, errors, etc., please let us know before we release the final version. Alan DeKok.

7 22

update disconnect
by Ming-Ching Tiew 14 May '09

14 May '09

I am trying to get the 'update disconnect' to work putting this into the preacct section :- --------------------------------------------------------- if ( "%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) { update disconnect { Reply-Message = "You have been disconnected by the administrator!" } #%{exec:/usr/local/dialup_admin/bin/disconnect.sh %{User-Name} %{Acct-Session-Id} %{NAS-IP-Address} %{Packet-Src-Port} } "%{sql:DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" } --------------------------cut---------------------------- The update disconnect did not work but the (commented) exec using a script based on radclient works, What's wrong ? Though the exec method works but I have to open up the port, which means the firewall thinks that's a separate connection, which is lousy. The update disconnect did not work but the (commented) exec using a script based on radclient works, What's wrong ? Though the exec method works but I have to open up the port, which means the firewall thinks that's a separate connection, which is lousy. Secondly, the sql DELETE, seems to be executed twice, here is the log :- ----------------------------cut------------------------------------ expand: %{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'} -> 1 ? Evaluating ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) -> TRUE ++? if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) -> TRUE ++- entering if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) {...} +++[disconnect] returns noop sql_xlat expand: %{User-Name} -> test1 sql_set_user escaped user --> 'test1' expand: DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now' -> DELETE FROM radcheck WHERE UserName = 'test1' and attribute = 'Acct-Logout-Now' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): failed after re-connect SQL query did not succeed rlm_sql (sql): Released sql socket id: 3 expand: %{sql:DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'} -> +++[expand] returns noop ++- if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) returns noop ---------------------------cut-------------------------------------- If I understand the log correctly, the second sql access is displayed first, that's why there is a failure, whereas the first sql access is displayed later, but it's a noop. Any comments ?

2 1