May 2009 - Freeradius-Users - lists.freeradius.org

Re: FreeRadius+wimax asn gw
by Ming-Ching Tiew 22 May '09

22 May '09

I am pretty new to this too but I think you have to send back some reply attributes which the ASN gateway can understand and can enforce it. As to what attributes the ASN gateway can understand, I suppose this is vendor specific. --- On Fri, 5/22/09, Denis K <denis(a)tojikiston.com> wrote: > From: Denis K <denis(a)tojikiston.com> > Subject: FreeRadius+wimax asn gw > To: freeradius-users(a)lists.freeradius.org > Date: Friday, May 22, 2009, 8:53 AM > > Dear All, > > I'm trying to configure radius as a AAA server for WiMAX > ASN GW. > I've generated certs and have added them to a ASN. Auth is > work ok. I've got > access-accept, but after this I need to discribe a service > for wimax user, > parametrs such as QoS, Servic flow, static ip etc. > Where should I add them? How to create a service? Is where > any documentation > aboute it? > > thanks in advance > -- > View this message in context: http://www.nabble.com/FreeRadius%2Bwimax-asn-gw-tp23666799p23666799.html > Sent from the FreeRadius - User mailing list archive at > Nabble.com. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

How to: freeRADIUS with PostgreSQL Backend!
by Just E. Mail 22 May '09

22 May '09

I have setup a working freeRADIUS server & now want to add PostgreSQL as backend for storage of data. I have read the freeRADIUS documentation and researched the internet on this subject. What I am looking for is any kind of Step-by-Step document detailing sequential steps needed to setup a PostgreSQL back end for freeRADIUS. Has someone written such a document? Is there such a writeup available?

3 2

Add clients into nas table
by Ming-Ching Tiew 22 May '09

22 May '09

May I ask if I am using sql to store the client list in the sql table 'nas', is there a way for me to ask freeradius to refresh the list ? Or is it that I must kill and restart freeradius ? Regards.

3 2

usr-hiper and freeradius 2.1.5 accounting problem
by haries fajar nugroho 22 May '09

22 May '09

Hi All, I wanna migrate my radius server from icradius to freeradius 2.1.5. i have two ras modem for my nas (patton and usr-hiper). When I do some migration simulation, client that connect from patton goes normally (authentication,accounting,authorization). But when they use usr-hiper (system version :V5.1.6/Non-Encr), the client could connect to the network but the accounting goes wrong. In my freeradius debugging mode, the error message was : rad_recv: Accounting-Request packet from host x.x.x.x (* encrypted ip) port 1646, id=63, length=405 Received Accounting-Request packet from x.x.x.x (* encrypted ip) with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. The usr-hiper accounting settings : HiPer>> sh accounting RADIUS ACCOUNTING SETTINGS The Primary Server Status is: ENABLED Primary Server is: x.x.x.x(* encrypted ip) Primary First Backup Server is: 0.0.0.0 Primary Second Backup Server is: 0.0.0.0 Primary Destination Port is: 1648 Primary First Backup Destination Port: 1646 Primary Second Backup Destination Port: 1646 Primary Preference: 1 Primary First Backup Preference: 2 Primary Second Backup Preference: 3 Max Primary Retransmissions: 0 The Secondary Server Status is: ENABLED Secondary Server is: 0.0.0.0 Secondary First Backup Server is: 0.0.0.0 Secondary Second Backup Server is: 0.0.0.0 Secondary Destination Port is: 1646 Secondary First Backup Destination Port: 1646 Secondary Second Backup Destination Port: 1646 Secondary Preference : 1 Secondary First Backup Preference: 2 Secondary Second Backup Preference: 3 What I have tried to solve it : 1. I've tried to make multi port for accounting packet (1646 & 1648), because i thought that the error message refer to wrong accounting port. But the accounting still wrong. 2. I've tried to use default freeradius secret at the freeradius side with testing123 without changing the secret at the ras modem. But still failed. Do you have another solution ? Thanks before :)

2 1

accounting with 802.1X: some clients trigger multiple starts at a time
by Sam Hooker 22 May '09

22 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, We're running SQL accounting for the FR servers authenticating our 802.1X users, now. I'm seeing some annoying duplicate entries, and am wondering if anyone else has had this experience: mysql> SELECT acctsessionid, username, nasipaddress, acctstarttime, callingstationid FROM radacct WHERE acctstoptime IS NULL ORDER BY acctstarttime; +-----------------------------------+------------+-----------------+---------------------+------------------+ | acctsessionid | username | nasipaddress | acctstarttime | callingstationid | +-----------------------------------+------------+-----------------+---------------------+------------------+ ... | 4a15bfef/00:23:12:07:e9:c4/74507 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 192.168.2.17 | | 4a15bfef/00:23:12:07:e9:c4/74505 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | w.x.38.213 | | 4a15bfef/00:23:12:07:e9:c4/74514 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 10.250.61.133 | | 4a15bfef/00:23:12:07:e9:c4/74516 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 192.168.1.25 | | 4a15bfef/00:23:12:07:e9:c4/74513 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | w.x.38.213 | ... I would think this to be pretty normal-looking, except: 1) in this particular group, all the usernames and MAC components of the acctsessionid are the same (i.e., this is one node causing multiple accounting starts to be sent); and 2) our 802.1X wireless clients would not have IP addresses in RFC1918 space. Ever. Most of the time, a group like this will include an address in our real wireless address range (that's what I've replaced with "w.x.38.213"), but sometimes not. If the callingstationid weren't different for each entry, I'd think "retries" or "EAP-FAST". (I think I see EAP-FAST activity going on elsewhere; or, at least, that's what I assume it is.) As far as I can tell, this occurs pretty infrequently, given the number of users we have, but it does occur consistently for a given set of users in a given day, which makes me think it's something about their location on the network. Reducing all the accounting detail to a spreadsheet, I see that this is a flurry of start and stop messages (and one Interim-Update!), and will comb through that closely tomorrow morning. Seems odd, though, that there would be a stop logged to the detail, but not to SQL, in this case. I have little- to no visibility into the networking configuration (our systems and network groups bristle at each other; a situation I'm trying to remedy), but I do know this: One department is located across the street from our main campus. It connects to the Internet by way of a commodity ISP. It is, however, close enough to pick up one of our APs, and the enterprising IT guy for that department has set up a Windows box as a wireless client, and bridged that into their LAN for access to institutional resources. (He has been duly chastised for this.) In at least that case, I've seen their LAN IPs (in a reasonably-unusual RFC1918 subnet) as the callingstationid. (Oddly, though, this is sometimes the LAN IP of their print server, or default gateway -- some artifact of bridging?) This makes me think that there are more clients out there that can see more than one subnet at a time, and just report in with whatever IP they feel like. I suppose my real question is this: Is there anything I can do, from the FR server end, to winnow out one reliable accounting entry per event? Sure, I can make my reports (like 'radwho') filter WHERE callingstationid LIKE 'w.x.%', but that runs the risk of missing entries where the group fails to include one of our "legit" addresses. Alternatively, has anyone else faced this and addressed it on the client side? ("Tell the rogue departments to comply with your network policies," is a valid answer and, frankly, my favorite.) As ever, pointers to pre-existing threads answering this are welcome; I couldn't come up with the right combination of search terms to find them myself... Cheers, - -sth sam hooker|sth@noiseplant.com|http://www.noiseplant.com Are you satisfied? ([y]/n): -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.5) iEYEARECAAYFAkoVzbIACgkQX8KByLv3aQ3tVQCdEOfZCztHLnmvCvfiuax1Y6Qu pA0AoLhQLZCIP/0DwXWje1PY41suMq8o =JDqP -----END PGP SIGNATURE-----

2 1

freeRADIUS - New Install testing!
by Just E. Mail 21 May '09

21 May '09

Installed freeradius-2.2.1 (RPM). Installation & configuration went well. RADIUS starts with no problem. "radiusd -XC" output shows no errors. Now I want to do some preliminary testing. In the older versions, I used to run the command: radtest <User> <P/W> localhost <Port> <Secret-Key> and see the output to verify that RADIUS server was up and running. After I did the above install, "radtest" command is not included. How does one test a new freeRADIUS installation? Is "radtest" replaced by another command? Is there any GUI testing tool for RADIUS?

2 2

RE: Freeradius-Users Digest, Vol 49, Issue 95
by Ivan Kalik 21 May '09

21 May '09

> 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) > > ____________________________________________________________________________ > >> Radius Client --> Radius Proxy > >> 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > >> 192.168.24.3 --> IPS2(192.168.24.4) > > ____________________________________________________________________________ > > You say: > >>>Yes. Proxy server will change NAS-IP-Address from the original NAS >>> >>address into it's own. That is OK. > > > > It not works. In my scenario I have two different NAS-IP-Address(a > NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). > That's because that can't work: # Note: "type = proxy" lets you control the source IP used for # proxying packets, with some limitations: # # * Only ONE proxy listener can be defined. # * A proxy listener CANNOT be used in a virtual server section. # * You should probably set "port = 0". # * Any "clients" configuration will be ignored. You can't define two IPs on which to proxy. You need two proxy servers for that: proxy1 gets requests from NAS -> if it's for isp1 proxy to 192.168.14.4 from 192.168.14.3 if it's for isp2, proxy to proxy2 (also from 192.168.14.3) proxy2 will have 192.168.24.3 configured as proxy port and proxy to 192.168.24.4 (isp2) You can even have proxy1 and proxy2 on the same machine, one listening on 1812+ ports and other on 1645+ ports. They just can't be the same radiusd process. Ivan Kalik Kalik Informatika ISP

2 1

RE: Freeradius-Users Digest, Vol 49, Issue 95
by Marco De Magistris 21 May '09

21 May '09

Hi Ivan, 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) ____________________________________________________________________________ You say: >>Yes. Proxy server will change NAS-IP-Address from the original NAS >>address into it's own. That is OK. It not works. In my scenario I have two different NAS-IP-Address(a NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). Radius Proxy sees 3 different ip address: - 192.168.1.3: ipaddress client side. - 192.168.14.3: ipaddress for isp1 - 192.168.14.3: ipaddress for isp2 In my opinion the packet (received from Radius Client) is sent towards the default gateway. The following link describes the same scenario: http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org… They introduce proxyip = 10.10.10.10 in proxy.conf. Thanks again. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 15.55 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 95 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: question about windows users (Bartosz Chodzinski) 2. Re: R: Sql Counter reads only the first 4 digits (Alan DeKok) 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) 4. R: R: Sql Counter reads only the first 4 digits (Mauro Iorio - Smart Soft s.r.l.) 5. Re: question about windows users (Bartosz Chodzinski) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 15:23:22 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: Re: question about windows users To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1f06c2db0905200623k5e90f148naaadaf7402c82c16(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" ok I changed it to default proxy_requests = yes $INCLUDE proxy.conf /etc/freeradius/certs/Makefile was #client.crt: client.csr server.crt server.key index.txt serial # openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf is now: client.crt: client.csr ca.pem ca.key index.txt serial openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf changes in client.cnf was: certificate = $dir/server.pem serial = $dir/serial private_key = $dir/server.key commonName = user(a)example.com is now: certificate = $dir/ca.pem serial = $dir/serial private_key = $dir/ca.key commonName = user_certificate now after instalation ca.der and client.p12 in windows everything in certificate stores seams to be ok. there is no exclamation mark on user_certificate, and certification path is ok back to the server: Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=240, length=147 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "user_certificate" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501757365725f6365727469666963617465 Message-Authenticator = 0x0d65a52fd78035c3c828c30d2a2442d9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user_certificate", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 240 to 192.168.5.206 port 1812 EAP-Message = 0x0101001604100c91af03e9cd5c25126407d36f22684a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5a5cfd0b5a4cb20491e5ee122e4a622 Finished request 0. Going to the next request On Wed, May 20, 2009 at 2:39 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >>> The steps you took show that you are NOT following the guide. > >>> Good luck. You clearly are *not* interested in solving the problem. > > > > the guide in radiusd.conf says: > > #The server has proxying turned on by default. If your system is NOT > > # set up to proxy requests to another server, then you can turn proxying > > # off here. This will save a small amount of resources on the server. > > I tried to read carefully with undrestanding, I dont use proxy, my system > > not sending request to another server, so I turned it off. > > You might not want to, but you *are* proxying your requests. You have > created client certificate with predefined data in client.cnf - which is > part of the proxy demonstration setup. So, leave proxy settings alone and > concentrate on doing what you have been advised - changing data in > client.cnf so created client certificate won't have @example.com as part > of the username. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

Version 2.0.4 We use "digest" authentication. It works properly. (with a little problem I will ask in another thread) The essential part of the debug: Thu May 21 09:41:17 2009 : Debug: ++[digest] returns ok Thu May 21 09:41:17 2009 : Auth: Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10) The reply message get at "client 10.14.1.5" but our system expects in the reply the "Session-Timeout". How to insert "Session-Timeout" into the reply message? I've read thoughtfully all parts of the configs where that parameter is mentioned. I've tried many - syntactically good an bad - config line without any success. Have I problem with reading? Ludwig M.

3 2

Interim Accouting
by Ming-Ching Tiew 21 May '09

21 May '09

May I know the common practise of radius accounting, it is common to expect the radius client to provide "interim" accounting, ie it sends accounting info every so many seconds interval before the session is closed ? I just checked Coova chilli, it does it for the clients session based on a configurable interval. But for the administrative account of the NAS itself, it does not do any interim accounting. Please comment. Regards.

4 3