June 2009 - Freeradius-Users - lists.freeradius.org

Remote IP Authentication
by Barny Ritchley 11 Jun '09

11 Jun '09

Hello I am having trouble with authentication to freeradius. I cant find any info on the Cisco-compatible Remote IP authentication method. I have looked everywhere and cannot see how to authenticate by h323-remote-address to freeradius. The Radius Request looks like: User-Name = '2001' Calling-Station-Id = '2001' Called-Station-Id = '012356789' h323-remote-address = '172.101.91.1' i want to check against the h323-remote-address. If it is an ip which is stored against a username, then the authentication should be successful. i am using MySQL and i tried adding this to the radcheck table: attribute: h323-remote-address op: == value: 172.101.91.1 and variations on the above theme, but with no luck. All i get at the moment is: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Any help is really appreciated. Many thanks Barney

2 2

rlm_perl/radius issues with db connections
by Meyers, Dan 11 Jun '09

11 Jun '09

I'm having a few issues with FreeRadius 2.1.4 (2.1.6 isn't in ports yet) and MySQL 5.1 on FreeBSD 6.2. Specifically, I am using the CLONE method in my perl script to create my database handles every time a new thread is spawned. If I start radius and then do 'show processlist' on the MySQL server I see no connections from the radius server. If I then send a single update from radclient I get a connection in show processlist, and a timely response to my request. However in our live environment the radius server is fairly heavily used by a large number of NASes, so as soon as it is turned on it gets a large influx of requests, and the logs fill with 'Error: WARNING: Unresponsive child for request X' messages. This goes on for a good 10-20 seconds or so, during which the processlist on the MySQL server still shows no connections. Then, suddenly, the error messages stop and all my connections appear in the processlist. I'm *think* this delay is in instantiating perl for each radius thread, as the error messages still get spammed into the log for 10-20 seconds even if my authenticate and accounting perl functions simply contain 'return RLM_MODULE_OK;'. I am guessing that once perl has been instantiated for the radius thread the creation of db connections and such occurs quite quickly, but if radius suddenly tries to start a large number of perl processes at once the server gets bogged down. This behaviour can be replicated in our test environment using radclient. No matter how long I wait after starting the radius server, I always get these error messages as soon as I start bombarding the server with requests. And of course until I start bombarding it it doesn't need to start any extra threads. The initial issue was that we were getting these error messages in the live environment after some time of the server running, and they weren't ever going away. You had to restart radius to get rid of them, and there was a reasonable chance that they'd reappear as soon as you restarted it. I *believe* the issue there was actually to do with mysql requests hanging as well as perl starting, although I am still unsure as to why, as our client was compiled with the thread safe options and the server doesn't appear to have resource issues. That was, however, with 2.0.3. The issue of the threads never becoming responsive again doesn't *appear* to exist in 2.1.4, from my testing. An issue we are still seeing, however, is that sometimes no results are returned from the db. DBD doesn't throw an exception or error, we just get an empty result set back occasionally. I'm investigating that at the mo. I was just wondering if anyone else had come across any similar problems, and how you got around them. Ideally, i'd like for the perl process to be instantiated before radius starts trying to use the thread for requests. That way the radius server would simply not respond to a request if no threads were ready and free, and my NASes could retry/fail over/whatever, whereas at the moment it seems to be sending back rejects while perl is still instantiating in the thread. I could also then tell radius to start with a reasonable number of threads to handle 'normal' load, and it wouldn't actually say it was ready to process requests, and start sending anything back, until all my normal required threads and their respective perl processes had been started. -- Dan Meyers Network Specialist, Lancaster University E-Mail: d.meyers(a)lancaster.ac.uk

2 1

NAS MAC Authentication
by Jacob Baloul 11 Jun '09

11 Jun '09

Hi All, I have several NAS / Hotspots installed behind a NAT. They are all WRT54GL routers with OpenWRT + Chili and authenticating against FreeRadius + DaloRadius which is NOT in this NAT. Meaning FreeRadius sees all of the WRT's as coming from the same public IP, which also happens to be dynamic. My question is, can I authenticate and maintain session based on the NAS MAC address as apposed to the public dynamic ip address? Moving the Radius server into the NAT is not an option as it is being hosted in a different country. Thanks for the help, Jacob

2 1

Sleep before a response?
by Stephen Bowman 10 Jun '09

10 Jun '09

I have a broken NAS with a bad race condition, and need to delay responses to it (like "sleep 1;"). Is there an easy method (maybe via unlang?) to do this?

2 1

Re: Lower case - Solved
by Michel Bulgado 10 Jun '09

10 Jun '09

On Tue, 2009-06-09 at 16:09 -0700, Chris wrote: > On Jun 9, 2009, at 3:52 PM, Ivan Kalik wrote: > > >> I migrated my freeradius version 1.1.3-1.4.el5 that came with CentOS > >> 5.3 to version 2.1.6-2. > >> > >> I am looking for an option that I had in my previous configuration > >> and > >> does not find it on this new, maybe it is removed. the fact is that > >> many > >> of my users sometimes tend to write the username with the first > >> letter > >> in upper or miniscule. > > > > That works just for pap requests. Use lc perl function to rewrite > > username/pass in perl module. > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > Here's what I'm using: > > perl_tolower.pm: > > > use strict; > use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); > # > # This the remapping of return values > # > use constant RLM_MODULE_REJECT=> 0;# /* immediately > reject the request */ > use constant RLM_MODULE_FAIL=> 1;# /* module failed, > don't reply */ > use constant RLM_MODULE_OK=> 2;# /* the module is > OK, continue */ > use constant RLM_MODULE_HANDLED=> 3;# /* the module > handled the request, so stop. */ > use constant RLM_MODULE_INVALID=> 4;# /* the module > considers therequest invalid. */ > use constant RLM_MODULE_USERLOCK=> 5;# /* reject the > request (useris locked out) */ > use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found > */ > use constant RLM_MODULE_NOOP=> 7;# /* module succeeded > withoutdoing anything */ > use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs > modified) */ > use constant RLM_MODULE_NUMCODES=> 9;# /* How many > return codes there are */ > > sub authorize { > $RAD_REQUEST{'User-Name'} = lc($RAD_REQUEST{'User-Name'}); > return RLM_MODULE_OK; > } > > sub preacct { > $RAD_REQUEST{'User-Name'} = lc($RAD_REQUEST{'User-Name'}); > return RLM_MODULE_OK; > } > > sub xlat { > return RLM_MODULE_OK; > } > > radiusd.conf: > > modules { > perl { > module = /usr/local/etc/raddb/perl/perl_tolower.pm > } > ... > } > > Enable perl modules in authorize and preacct. I think order matters > here, so you probably want them near the top... > > sites-enabled/default: > > authorize { > perl > } > > preacct { > perl > } Thanks Chris I solved the problem with users who write their login in uppercase and lower case Michel

1 0

Authentication failure - PEAP - MS-CHAPv2
by kissg 10 Jun '09

10 Jun '09

Dear List, I'm having a strange issue with FreeRADIUS 2.1.4, using a configuration with the following items: - Cisco Aironet 1130AG access point - Ubuntu-based server with FreeRADIUS and OpenLDAP - Client machines (Windows XP SP2, Ubuntu 9.04) The issue I have is, that I don't get a response from the client after the server sends an Access-Challange packet. The certificates were made with the bootstrap script of FreeRADIUS, so it already contains the OIDs required by Windows. The AP is configured correctly, IP-address, port numbers and shared secret are properly set up, I've already checked them. Users are stored in an LDAP database and each user has a sambaNTPassword attribute, which contains an NT-hashed password. LDAP-RADIUS attribute mappings are properly set (NT-Password -> sambaNTPassword). The strange thing is, that I can successfully authenticate using an EAP test tool (eapol_test), no errors show up in the output. Using another AP with a slightly different configuration (using smbpasswd instead of LDAP for authorization) works, too. I've also read, that XP SP2 is incompatible with third-party RADIUS-servers. I decided to install SP3, but it did not help. What I can see, is an Access-Challange message at the end of the debug output. What can be wrong with my configuration? Can it be, that it's an incompatibility issue between FreeRADIUS and the access point? Thank you for your help in advance! Best regards: Gergely Kiss

5 8

Robust proxy accounting
by Chris Howley 10 Jun '09

10 Jun '09

Alan, I used the example configuration and got the same result. >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } 1) The following is in the robust-proxy-accounting file. # (5) Define the virtual server to write the packets to the detail file # This will be called when ALL home servers are down, because of the # "fallback" configuration in the home server pool. server acct_detail.example.com { accounting { detail.example.com } } # (6) Define a virtual server to handle pre/post-proxy re-writing server home.example.com { pre-proxy { # Insert pre-proxy rules here } post-proxy { # Insert post-proxy rules here # This will be called when the CURRENT packet failed # to be proxied. This may happen when one home server # suddenly goes down, even though another home server # may be alive. # # i.e. the current request has run out of time, so it # cannot fail over to another (possibly) alive server. # # We want to respond to the NAS, so that it can stop # re-sending the packet. We write the packet to the # "detail" file, where it will be read, and sent to # another home server. # Post-Proxy-Type Fail { detail.example.com } } # Read accounting packets from the detail file(s) for # the home server. # # Note that you can have only ONE "listen" section reading # detail files from a particular directory. That is why the # destination host name is used as part of the directory name # below. Having two "listen" sections reading detail files # from the same directory WILL cause problems. The packets # may be read by one, the other, or both "listen" sections. listen { type = detail filename = "${radacctdir}/detail.example.com/detail-*:*" load_factor = 10 } # All packets read from the detail file are proxied back to # the home servers. # # The normal pre/post-proxy rules are applied to them, too. # # If the home servers are STILL down, then the server stops # reading the detail file, and queues the packets for a later # retransmission. The Post-Proxy-Type "Fail" handler is NOT # called. # # When the home servers come back up, the packets are forwarded, # and the detail file processed as normal. accounting { # You may want accounting policies here... update control { Proxy-To-Realm := "acct_realm.example.com" } } } 2. I moved the following from the robust-proxy-accounting file to the proxy.conf file. # (1) Define two home servers. home_server home1.example.com { type = acct ipaddr = 129.11.162.17 port = 1813 secret = <remvoved> # Mark this home server alive ONLY when it starts being responsive status_check = status-server #status_check = request #username = "test_user_status_check" # Set the response timeout aggressively low. # You MAY have to increase this, depending on tests with # your local installation. response_window = 6 } # (2) Define a virtual server to be used when both of the # home servers are down. home_server acct_detail.example.com { virtual_server = acct_detail.example.com } # Put all of the servers into a pool. home_server_pool acct_pool.example.com { type = load-balance # other types are OK, too. home_server = home1.example.com # add more home_server's here. # If all home servers are down, try a home server that # is a local virtual server. fallback = acct_detail.example.com # for pre/post-proxy policies virtual_server = home.example.com } # (3) Define a realm for these home servers. # It should NOT be used as part of normal proxying decisions! realm acct_realm.example.com { acct_pool = acct_pool.example.com } Chris Howley

3 2

RE: [freeradius] fail-over ldap + reply-item missing
by François Mehault 10 Jun '09

10 Jun '09

Hum, now all works perfectly. My reply-item are present now, I will try now to understand why it works. Thanks to Ivan Kalik for his help and all freeradius project. Ldap.attrmap: [...] checkItem Cleartext-Password userPassword Users: DEFAULT ldaplabobe2-Ldap-Group == administrateur, User-Profile := "cn=administrateur,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Administrateur", Fall-Through = yes DEFAULT ldaplabobe2-Ldap-Group == stagiaire, User-Profile := "cn=stagiaire,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Stagiaire", Fall-Through = yes DEFAULT ldaplabobe1-Ldap-Group == administrateur, User-Profile := "cn=administrateur,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Administrateur", Fall-Through = yes DEFAULT ldaplabobe1-Ldap-Group == stagiaire, User-Profile := "cn=stagiaire,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Stagiaire", Fall-Through = yes Radiusd.conf: Instantiate { [...] ldaplabobe2 ldaplabobe1 } /site-available/default: Redundant { ldaplabobe2 ldaplabobe1} in section authorize and authenticate

1 0

Gianni Socionovo ti ha lasciato un nuovo messaggio su Badoo!
by Badoo 10 Jun '09

10 Jun '09

Hai ricevuto un nuovo messaggio su Badoo! Gianni Socionovo ti ha lasciato un nuovo messaggio Segui questo link per leggerlo: http://eu1.badoo.com/0144529629/in/NadgY0lc--o/?lang_id=8 Inoltre, altra gente ti ha cercato: Omar Lloper (Valencia, Spagna)Princess (Ancona, Italia)Katia Fava (Ancona, Italia) Se cliccando sul link nel messaggio questo non dovesse funzionare, copialo e incollalo nella barra degli indirizzi del tuo browser. Questo è solo un messaggio informativo generato automaticamente. Sei pregato di non rispondere direttamente a questa e-mail. Se non vuoi più ricevere messaggi, clicca qui: http://eu1.badoo.com/impersonation.phtml?lang_id=8&mail_code=21&email=freer…

1 0

Re: Cisco-avpair
by Ivan Kalik 10 Jun '09

10 Jun '09

> Anybody knows how to configure freeradius to send access list > configuration back to a cisco router applied to Dialer 0. Cisco avpair is just another attribute for radius server - zou send it like anz other. Read Cisco documentation to find out how it should look like. Ivan Kalik Kalik Informatika ISP

1 0