June 2009 - Freeradius-Users - lists.freeradius.org

User_Role configuration in freeRadius Users file
by kpani 03 Jul '09

03 Jul '09

Hi, I am using freeRadius for user authentication. I also want to assign roles (like type of user) for each user configured in /usr/local/etc/raddb/users file as like below. Then I will authorize the user in my radius client application based on radius returned role. dhandapani Cleartext-Password := "dhanda" Service-Type = Framed-User, Framed-Protocol = PPP, Reply-Message = "Hello Dhandapani", User-Role = Admin Is it possible. I have seen an attribute called 'Aruba-User-Role' but looks like vendor specific. Is there any way to configure the role? Or do I need to configure it somewhere else? Please suggest. Regards, Dhandapani -- View this message in context: http://www.nabble.com/User_Role-configuration-in-freeRadius-Users-file-tp24… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 7

Access Req from HA rejected
by Kiran Kumar 02 Jul '09

02 Jul '09

Hi All, I am using the Free Radius to test Proxy Authentication from H-AAA, the initial Authentication (proxied through H-AAA) goes through fine. But the HA then triggers an Access Request message (we are using PMIP), but this fails at the Free radius. I suspect this is because the HA root keys etc are not generated by Free radius but by the H-AAA. Can you please let me know what configuration needs to be done to get this scenario working. Sending Access-Accept of id 161 to 10.142.139.65 port 52687 MS-MPPE-Recv-Key = 0x6ef829271559b13ef642c20c60522275590132e27a5b64d744e77799f12508b0 MS-MPPE-Send-Key = 0x3b0dfc2d198cebbd3fe32e9b3a8e1fad36f26f1b8595ea5cd1698eb52d29d872 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user(a)isp2.wimaxlab.com" Finished request 7. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.142.139.65 port 52687, id=162, length=201 User-Name = "user(a)isp2.wimaxlab.com" NAS-IP-Address = 10.142.139.68 Service-Type = Framed-User Framed-IP-Address = 0.0.0.0 Vendor-Specific = 0x00001fe4180600000003 Vendor-Specific = 0x00001fe4a9060a8e8b46 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = 3 WiMAX-GMT-Timezone-offset = 3600 WiMAX-hHA-IP-MIP4 = 10.142.139.70 WiMAX-MN-hHA-MIP4-SPI = 512 WiMAX-HA-RK-SPI = 512 NAS-Identifier = "HA_ISP1" Event-Timestamp = "Jun 18 2009 09:36:50 GMT" Message-Authenticator = 0x7fc30b3f450c08556a469367efb2d166 Chargeable-User-Identity = "NUL" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "isp2.wimaxlab.com" for User-Name = "user(a)isp2.wimaxlab.com" [suffix] No such realm "isp2.wimaxlab.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry user(a)isp2.wimaxlab.com at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user(a)isp2.wimaxlab.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.1 seconds. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer Fujitsu Telecommunications Europe Solihull Parkway, Birmingham B37 7YU Work Phone: +44 (0) 121 717 6299 Mobile: +44 (0) 7549 203 655

4 3

ldap double bind (rebind) problem
by Joerg Spatschil 01 Jul '09

01 Jul '09

I run FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu and testing FreeRADIUS Version 2.1.3 both on gentoo systems, I want to peap authenticate, authorize and set VLANs on a Cisco Cat 4500 according to a ldap Attribute. * What does work already: I can authenticate peap using certificates from an XP machine store as well as from the user store. Adding the machine and user to users file DEFAULT Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6 # Tunnel-Private-Group-Id = 101 user@domain Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 101 sets the VLAN correctly on the Cisco; removing user uses DEFAULT and works as well when the Tunnel-Private-Group-Id is enabled. * What does not work: removing the users entry and setting up ldpa: sites-enabled/MySite authorize { preprocess mschap eap { ok = return } files Autz-Type LDAP1 { ldap_client1 } ldap_client1 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest pam unix Auth-Type LDAP1{ ldap_client1 } eap } modules/ldap ldap ldap_client1 { server = "ldapserver" identity = "cn=ldapuser,ou=users,...." password = "password" basedn = "dc=ad,..." dictionary_mapping = ${raddbdir}/ldap.attrmap filter = "(userPrincipalName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 ldap_debug = 0xFFFF } ldap.attrmap checkItem Tunnel-Private-Group-Id comment My VLAN is in the comment Attribute: ldapsearch -h ldaserver -b "dc=casedn" -D "ldapuser@ldaserver" -w "password" -x '(userPrincipalName=user@domain)' comment --> .... comment: 101 Major problem in the debug: new result: res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772>, res_matched: <> read1msg: ld 0x81c1068 0 new referrals In tcpdump from ldapsearch there is one bind + one searchRequest In tcpdump from radiusd there is one bind + one searchRequest with searchResDone ... vals 101 - This is perfect. But right thereafter is an anonymous bind which uses the searchResRef and issues the same query again and fails, as it is not allowed for anonymous bind. Is there any idea how to resolve this or how to use ldap differently. Thanks Joerg

2 2

Nortel Dictionary update
by David Hobley 01 Jul '09

01 Jul '09

Hello, Here is an updated dictionary.nortel file, it contains the Radius attributes to be able to authenticate against their BCM platform. I wasn't certain how to submit it formally, so thought I would send it here. -- Cheers, David

2 1

freeradius2 Proxy fail-over issues
by Emmett Culley 30 Jun '09

30 Jun '09

I just upgraded one of our CentOS 5 systems from FreeRadius 1.x to FreeRadius 2.1.6. It was all working before the upgrade and I have it working on the new version. That is, by using the deprecated authhost and accthost variables in the realm definition I can successfully authenticate and process accounting with the new version. However, as soon as I attempt to define a set of main and backup servers, then use the auth_pool and acct_pool variables I get the following error: "Ignoring spoofed proxy reply. Signature is invalid" Here is a status query that results in the error, like any other query: Sending Access-Request of id 136 to x.x.x.x port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. rad_recv: Access-Reject packet from host x.x.x.x port 1812, id=136, length=64 Ignoring spoofed proxy reply. Signature is invalid Of course, the main reason I upgraded at all was to be able to define a pool of servers. I've searched Google and cannot find any references to this issue. Here is the proxy.conf lines that matter: home_server my_rlm_auth { ipaddr = x.x.x.x port = 1812 type = "auth" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server my_rlm_acct { ipaddr = x.x.x.x port = 1813 type = "acct" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } server_pool my_rlm_auth_pool { type = fail-over home_server = my_rlm_auth # home_server = Primary_my_rlm_auth # home_server = Secondary_my_rlm_auth } server_pool my_rlm_acct_pool { type = fail-over home_server = my_rl_acct # home_server = Primary_my_rlm_acct # home_server = Secondary_my_rlm_acct } realm my_rlm { nostrip auth_pool = my_rlm_auth_pool acct_pool = my_rlm_acct_pool # authhost = x.x.x.x:1812 # accthost = x.x.x.x:1813 # secret = "bignewsecret" type = radius } Any ideas or pointers? Regards, Emmett

3 9

Accounting help please
by David Hobley 30 Jun '09

30 Jun '09

Hello, I have freeradius2 configured and authenticating properly. I would like to be able to get radwho and radlast working properly, but for some reason the files do not get created (permission are correct in that directory). I thought I have set up accounting correctly, but obviously haven't. I have attached the output from radiusd -X, any pointers anyone could give me, I would appreciate. The output I get from radwho and radlast is: [root@samba raddb]# radwho radwho: Error reading /var/log/radius/radutmp: No such file or directory [root@samba raddb]# radlast last: /var/log/radius/radwtmp: No such file or directory Thanks! -- Cheers, David

2 1

Where to place a client.p12 to use as a "computer certificate" under windows XP/sp2?
by john 30 Jun '09

30 Jun '09

Hi all, Hopefully an easy one. I want to use certificates for some of the computers on the domain. I want the cert to be available for any user of the computer. I am not sure where to put it though. I've successfully installed a client.p12 under an individual profile but I need this to be available to everybody. I opened the certificate management console using certmgr.msc and I am looking around trying to figure out where this thing should go. Any ideas? Thanks! John

1 0

First Session-Timeout response error
by Guillaume Brenaut 30 Jun '09

30 Jun '09

Hello, after looking for a solution in different forums and on this mailing list without any success I decide to post my problem here. I'm having trouble to get the good Session-Timeout at the first request. Example: one user with Max-All-Session:=900 try to connect: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 197 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=197, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 2537321 But the next request give the good answer: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 174 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=174, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 886 I heard about a conflict problem with authorize parameters but I haven't figured out how to fix it. Here is my config: sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = "Max-All-Session" sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } #############AUHTORIZE SECTION#################### instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec # # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # So the module needs to be instantiated, but CANNOT be # listed in any other section. See 'doc/rlm_expr' for expr noresetcounter expiration logintime } authorize { preprocess suffix chap mschap sql files noresetcounter hourlycounter dailycounter monthlycounter weeklycounter yearlycounter totaloctetyearlycounter totaloctetmonthlycounter totaloctethourlycounter totaloctetdaylycounter outputyearlycounter outputmonthlycounter outputhourlycounter outputdaylycounter inputyearlycounter inputmonthlycounter inputhourlycounter inputdaylycounter } Thanks for your help

2 2

Multiple Services - Single Login
by Nick Huanca 30 Jun '09

30 Jun '09

Hi, I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service? Thanks, -- Nick Huanca

4 7

set absolute lifetimes
by Sebastian Wieseler 30 Jun '09

30 Jun '09

Hello guys, I've got a problem with the accounting of freeradius. The counter and sqlcounter are made for scenarios where people'll get a number of hours and can take them where ever they want to... I would like to setup a scenario where people can login for 1/2/3/4/... days. Let's say somebody is allowed to login for one day...then he shouldn't be able to login half a day today and half a day tomorrow. I would like to make "one day" absolute - to end at the end of day1. Into "radcheck" I would like to write something like Current-Time <= a value you set while creating the "ticket". Let's suppose everything to be in Unix Time format... I tried to write in the radius config in the modules part: sqlcounter maxlifetimecouter { counter-name = Max-End-Lifetime-Counter check-name = Current-Time sqlmod-inst = sql key = User-Name reset = never query = "SELECT UNIX_TIMESTAMP();" } But it didn't work out. To have got a cron job that will delete expired accounts (like [1]) isn't an option either... Can you please help me? :-( [1] http://github.com/italpro/ChilliGrid/blob/2ef3cd1dd342468ed195fef8ba82d2244… Kind Regards, Sebastian Wieseler - IT - _________________________________________________________________________ undbitte entertainment GmbH, Medienproduktion Von-Hünefeld-Str. 81, 50829 Köln Phone: +49 221 801307-0 Fax: +49 221 801307-18 Internet: http://www.undbitte.tv E-Mail: s.wieseler(a)undbitte.tv undbitte entertainment GmbH, Geschäftsführung: Anke Tesdorpf Sitz der Gesellschaft: Köln, Handelsregister: HRB 34500, Amtsgericht Köln

2 1