June 2009 - Freeradius-Users - lists.freeradius.org

Re: attrs filtering - regex pattern matching
by Ivan Kalik 26 Jun '09

26 Jun '09

> I'd like our radius proxy server to allow an A/V pair, but, cannot find > any > examples where I can apply any regex type rules to allow a range of > values. > > For example, I received the following from a remote radius server : > > Cisco-AVPair = vpdn:ip-addresses=10.10.1.4 > > and would want to (using attrs) allow anything that matches: > > Cisco-AVPair = vpdn:ip-addresses=.* > Where ".*" would be anything following the "=" So that's not a "range of values". It's "allow anything that matches the bit before =". > How might I allow this using attrs? > > I'm running freeradius 1.0.5 > I can't upgrade to 2.x yet, so I'm looking for suggestions/feedback for > 1.x This has nothing to do with 1.x or 2.x or freeradius. If you need a regex tutorial there are plenty of them available. What you need is basic and can be found in any regex tutorial. Ivan Kalik Kalik Informatika ISP

1 0

freeradius and mobile number portability (MNP)
by Mauro Iorio - Smart Soft s.r.l. 26 Jun '09

26 Jun '09

Hi everybody, I have to configure freeradius server in order to respond to mobile number portability (MNP) query. The client which will query my server is an MVTS softswitch, but I can't interact with it until I develop at least a pseudo-running configuration because it's a legacy installation owned by one of our customers. I have read docs about MVTS but I got lost in the variety of attributes and I was wondering if someone has experience with this problem. Actually I'm looking for a sample query packet and a desired response, in order to configure everything in the right way. I will really appreciate any help, ideas, doc, sample code, whatever. Thanks, Mauro Iorio Smart Soft s.r.l.

1 0

Re: Re: Re : Re : Re : Re : Radius+Huwaei switch + auto VLan, Assignment issue
by Guk Victor 26 Jun '09

26 Jun '09

> so Vlan-assignment-mode is Integer. > > Where?are the tricks? Make attempt use Vlan-assignment-mode is string in tuning of switch.

2 2

SQL fet_row: error handling
by leopold 25 Jun '09

25 Jun '09

I noticed an unwanted behavior in rlm_sql.c In a while loop that fetches rows the return code of rlm_sql_fetch_row is not checked properly. If rlm_sql_fetch_row returns -1, then sql_get_grouplist should also fail, but it return 0 instead and in this case rlm_sql module returns "notfound" instead of "failed". Original code: int num_groups = 0; .. while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { ... } (inst->module->sql_finish_select_query)(sqlsocket, inst->config); return num_groups; -------------------------------- It would be nice if you could do something like while ((ret=rlm_sql_fetch_row(sqlsocket, inst)) == 0) { .. } if (ret < 0) { /* sql fetch failed */ num_groups = -1; } (inst->module->sql_finish_select_query)(sqlsocket, inst->config); return num_groups; -- View this message in context: http://www.nabble.com/SQL-fet_row%3A-error-handling-tp24211138p24211138.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Problems with radmin
by Sebastian Heil 25 Jun '09

25 Jun '09

Hello, I tested some things with radmin and freeradius 2.1.6 on SLES 10 SP2. I started the server, started radmin, added the following debug condition: debug condition '(User-Name == "test")' and then send an acces-request with this username to server. The server crashed with the following errormessages: Thu Jun 25 13:50:26 2009 : Error: ASSERT FAILED event.c[596]: debug_flag != 0 Any idea, what this means or by what this could be caused? Thanks. Sebastian -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 1

Disabling users
by DAve 25 Jun '09

25 Jun '09

Good afternoon all, We recently retired our old ICRadius servers and installed FreeRadius. We run two radius servers with a third server acting as master for the radius data and as the accounting server. All is working well. Billing has approached me with an issue where they need to disable a user for lack of payment. Previously we simply changed their password through our management system and they were then unable to reconnect. Client calls, pays, we enable them again. Currently we are noticing that because of DSL, and the fact we no longer impose any limits on dialup, it may take weeks before a client is disconnected and finds their password has changed. I have read through the docs, looked into Session-Timeout and SQL counters, but I do not see how to force a client to re authenticate. What am I missing? What config information do I need to provide? What information/manual/how to have I missed? Thanks, DAve -- "Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven that ever I took half the pains to preserve it." John Quincy Adams http://appleseedinfo.org

3 4

How to compile with custom modules in v1.1.7?
by Eric Geier 25 Jun '09

25 Jun '09

I'm trying to include rlm_raw (http://osdir.com/ml/freeradius.devel/2005-01/msg00027.html) in the installation of FR 1.1.7, but it's never included at usr/lib/freeradius after install. I've tried in Ubuntu and Debian. I'm not sure if it's a general module/compiling problem or something with rlm_raw. Here's what I do: 1. Copy rlm_raw to to src/modules. 2. Add rlm_raw to stable file. 3. Add --enable-rlm_raw to the configure section in debian/rules. 4. Build using the Debian steps (http://wiki.freeradius.org/Build) I haven't made any changes at all to the rlm_raw files; do I need to? What else might I check? The config.log file in the root shows no clues, at least from what I can see. I'm not sure what other log files to check. Thanks, Eric

1 0

Re: freeradius 2.1.6 ldap + mschapv2 to authenticate
by daverummel＠boothcreek.com 25 Jun '09

25 Jun '09

Chris, So funny you say that, I was just talking about that with a co worker. I almost find myself searching for his emails and thinking that poor person who is looking for help. I hope to post a link giving exact details on how to do auth with ldap using freeradius 2. I also plan to add how to do group auth with unlang. So tired of finding bits and pieces and no one quite giving a how to do in this mailing list. ------Original Message------ From: Christopher Sheldon Sender: freeradius-users-bounces+daverummel=boothcreek.com(a)lists.freeradius.org To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Subject: Re: freeradius 2.1.6 ldap + mschapv2 to authenticate Sent: Jun 24, 2009 5:36 PM Does anyone else who subscribes to the list specifically read every email Alan sends just to chuckle at him berating the poor, confused people seeking help? It's like reality TV. ;-) Chris. Alan DeKok wrote: > jpablorp wrote: > >> I replace eap.conf with the Default eap.conf file >> >> and this is my debug: >> > > Where you have *deleted* the real cause of the error. > > >> [peap] Had sent TLV failure. User was rejected earlier in this session. >> > > Look EARLIER in the debug log for the failure. It's really not hard. > Look for words like "reject", or "fail", or "error". > > The messages will tell you what is wrong, and why. All you need to do > is read them. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Sent on the Now Network� from my Sprint® BlackBerry

7 6

response_window and zombie_period problem
by Ana Gallardo 25 Jun '09

25 Jun '09

Hello, first of all, sorry for my english. I'm testing Freeradius 2.0.4+dfsg-6 in Debian. I want to configure proxy like this (proxy.conf): # radiusxx authentication home_server radiusxx_auth { type = auth ipaddr = 1.2.3.4 port = 1812 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusxx accounting home_server radiusxx_acct { type = acct ipaddr = 1.2.3.4 port = 1813 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusyy authentication home_server radiusyy_auth { type = auth ipaddr = 1.2.3.5 port = 1812 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } # radiusyy accounting home_server radiusyy_acct { type = acct ipaddr = 1.2.3.5 port = 1813 secret = secret response_window = 50 zombie_period = 20 status_check = request username = "user" password = "pass" check_interval = 30 num_answers_to_alive = 3 } #authentication pool home_server_pool my_auth { type = fail-over home_server = radiusxx_auth home_server = radiusyy_auth } #accounting pool home_server_pool my_acct { type = fail-over home_server = radiusxx_acct home_server = radiusyy_acct } realm myrealm.my { auth_pool = my_auth acct_pool = my_acct # nostrip } My problem is when I'm going to test failover: I stop Freeradius in xx server and I send a authentication request. Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Proxying request 0 to home server 1.2.3.4 port 1812 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Going to the next request Waking up in 0.9 seconds. Waking up in 28.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75 Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Waking up in 26.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75 Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143 Sending Access-Request of id 143 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x3238 Waking up in 23.9 seconds. . . . WARNING: Marking home server 1.2.3.4 port 1812 as zombie (it looks like it is dead). After 30 seconds I always get an accept_reject the first time. But if my zombie_period = 20, don't must mark radiusxx as zombie after 20 seconds and proxy my request to radiusyy. My response_window = 50 and Freeradius must wait 50 seconds before consider the request dead. Then, when I send another authentication request: Sending Access-Request of id 129 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Proxying request 1 to home server 1.2.3.4 port 1812 Sending Access-Request of id 129 to 1.2.3.4 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 28.9 seconds. rad_recv: Access-Request packet from host 1.2.2.2 port 59850, id=1, length=75 FAILURE: Marking home server 1.2.3.4 port 1812 as dead. Sending Access-Request of id 118 to 1.2.3.5 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Proxying request 1 to home server 1.2.3.5 port 1812 Sending Access-Request of id 118 to 1.2.3.5 port 1812 User-Name = "mmmm" User-Password = "111" Calling-Station-Id = "00:11:22:33:44:55" NAS-IP-Address = 1.2.2.2 Proxy-State = 0x31 Waking up in 26.9 seconds. rad_recv: Access-Accept packet from host 1.2.3.5 port 1812, id=118, length=23 Proxy-State = 0x31 I don't know why Freeradius doesn't send me an acces-accept, when I send the first request, after mark radiusxx (zombie_period = 20) as zombie and proxy the request to radiusyy. Thank you and sorry for my english.

3 4

Re: Old password 'grace period'
by Arran Cudbard-Bell 25 Jun '09

25 Jun '09

On 25/6/09 13:11, Ivan Kalik wrote: >>> I have tested something like this yesterday - it doesn't. You can't just >>> replace Cleartext-Password. NT-Password and LM-Passowrd were created for >>> the "new" password and mschap module will reuse them, completely >>> ignoring >>> "old" Cleartext-Password. They need to be removed or replaced before >>> mschap module is called again. >> Writes the NT-Password and LM-Password values back to the control list of >> the request. >> >> But seeing as the values are just being stored in the control list of the >> request, >> we can remove them using unlang. >> >> >> authenticate { >> mschap { > > Just for the readers of the list - the section is Auth-Type MS-CHAP not > mschap. Oops, yep Auth-Type MS-CHAP. > >> update control { >> Cleartext-Password := "%{sql_new:SELECT<cleartext password >> query...>}" >> } >> mschap { >> reject = 2 >> } > > Ah, so that's how you make if work. Yep. Otherwise reject has a priority/opcode of reject, and the request is rejected ;) > >> if(reject){ >> update control { >> NT-Password -= "%{control:NT-Password}" >> LM-Password -= "%{control:LM-Password}" > > Yes, I had that lined up, but couldn't get if to work. > >> Cleartext-Password := "%{sql_old:SELECT<cleartext >> password query...>}" >> } >> mschap >> } >> } >> } > > Ok, pap failover done this way now works. I can't test mschap from where I > am right now but I don't see a problem any more. My construction is > slightly different - I read only replacement password from sql assuming > that the usual one is pulled by regular sql queries (my scenario has > Cleartext-Password and custom attribute Old-Password both in same radcheck > table). That should work fine too. So you can just swap out the first update control { Cleartext-Password .... } bit for a call to the SQL module. Though you'd probably want to put it in the authorise section... So it'd be something like : instantiate { sql_old } authorize { # Retrieves credentials sql_new # Sets auth-type mschap mschap } authenticate { Auth-Type MS-CHAP { mschap { reject = 2 } if(reject){ # Remove stale password hashes created on first call to rlm_mschap update control { NT-Password -= "%{control:NT-Password}" LM-Password -= "%{control:LM-Password}" Cleartext-Password := "%{sql_old:SELECT<cleartext password query...>}" } mschap } } } Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2

1 0