July 2009 - Freeradius-Users - lists.freeradius.org

RE: rlm_perl problems]
by sigor＠blic.net 25 Jul '09

25 Jul '09

On Sat, 25 Jul 2009 00:01 , 'Garber, Neal' <Neal.Garber(a)energyeast.com> sent: >Igor: Can you rebuild FR and look at the output of rlm_perl on >your system to see if you see similar errors? I will setup testing 2.1.6 freeradius and try the same configuration on it. After that i will setup 2.1.7pre and try it again. Since it is a weekend i am not sure how soon is that going to be. I will post the results of my testing after i am done.

1 0

rlm_perl problems]
by Igor Smitran 25 Jul '09

25 Jul '09

I am using Freeradius 2.1.6. I have a working setup of freeradius with perl scripts inside authorize and accounting sections. Everything works great when i am using only one script. But. if i add another script to do some other stuff for example in post-auth section i get errors in log and freeradius dies. Error i get is: Error: rlm_perl: perl_embed:: module = /etc/raddb/config_dialup/perl_script_2.pl , func = post_auth exit status= Undefined subroutine &main::post_auth called. My perl setup is like this: perl perl_script_1 { module = ${confdir}/config_dialup/perl_script_1.pl func_authorize = authorize_check_username func_accounting = accounting_check_username } perl perl_script_2 { module = ${confdir}/config_dialup/perl_script_2.pl } If i put everything into one script, like this: perl perl_script_1 { module = ${confdir}/config_dialup/perl_script_1.pl func_authorize = authorize_check_username func_accounting = accounting_check_username } perl perl_script_2 { module = ${confdir}/config_dialup/perl_script_1.pl } then everything is ok. Did any of you had these problems? Thank you

3 12

Re: Alternate server certificate
by Ivan Kalik 24 Jul '09

24 Jul '09

> We have Access Points that contain multiple SSIDs. Some are for internal > use and some are for guest access. All are secured using WPA w/PEAP. I > would like FreeRadius to present a cert. from our internal CA for the > SSIDs that are internal and present a cert. from one of the CA's that > Windows trusts by default for guest access. I haven't found a way to > control this on the AP (i.e., to select a different RADIUS server address > or port based upon SSID). Is it possible to accomplish this in FreeRadius > given that I can determine the SSID by looking at a request attribute? Yes. > > Some ideas I have are: > > - Have two instances of the EAP module (one for internal SSIDs and one for > guest) and select which one to use with some unlang code (based upon the > value of 1 request attribute) That should work. > - Create a virtual server for guest access that uses an EAP module with > the cert. from the well-known CA That is insecure. Your clients will trust *any* server certificate signed by that public CA. Ivan Kalik Kalik Informatika ISP

3 5

RE: Alternate server certificate
by Garber, Neal 24 Jul '09

24 Jul '09

>> So, what causes the eap module to return "fail". There are no >> other messages indicating why it is failing (that I see). Here's >> output at startup showing that both were instantiated: > >You should replace eap in authenticate with those two instances as well. Thank you again for your help Ivan. I'm not sure if you saw my last msg which gives more info about the eap failure (it can't find the eap instance in the dictionary). I already tried adding the code to the authenticate section; but, I got errors when it tried to process the unlang. I figured since it was failing in authorize that I would worry about the authenticate section later. Anyway, here's the error I get: Fri Jul 24 17:51:07 2009 : Debug: Module: Checking authenticate {...} for more modules to load Fri Jul 24 17:51:07 2009 : Error: /usr/local/etc/raddb/sites-enabled/default[40]: Unknown Auth-Type "(Cisco-AVPair =~ /ssid=(.*)/)" in authenticate sub-section. And here's what's in my authenticate section: authenticate { if (Cisco-AVPair =~ /ssid=(.*)/) { update request { SSID-Name = "%{1}" } } files machine_UserName Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } if (SSID-Name) { if (SSID-Name == "XX-Barcode") { eap-internal } elsif (SSID-Name == "XX-Corp") { eap-internal } elsif (SSID-Name == "EE-Barcode") { eap-internal } else { eap-comodo } } else { eap-comodo } # eap-internal

1 0

trouble checking item value from ldap
by Tony P. 24 Jul '09

24 Jul '09

hi, have this problem now... i set into profile of users some items to check cn=dialup,ou=radius,ou=services,dc=domain,dc=org radiusCalledStationId 160110 radiusCalledStationId 60110 radiusCalledStationId 8314949 radiusFramedIpNetmask 255.255.255.255.255 radiusFramedProtocol PPP radiusHint userdefault radiusMaxMonthlySession 90000 radiusServiceType Framed-User radiusSimultaneousUse 1 and in my usertest exist this cn=emperor,ou=users,dc=domain,dc=org radiusCallingStationId 8380000 RadiusProfileDn cn=dialup,ou=radius,ou=services,dc=domain,dc=org userPassword xxxxxx and when freeradius start in debug mode i see when Access-Request to process authorize section in debug out this. in the freeradius -X debug mode show this when i try to authorized rlm_ldap: Adding radiusCalledStationId as Called-Station-Id, value 8314949 & op=21 rlm_ldap: Adding radiusCalledStationId as Called-Station-Id, value 60110 & op=21 rlm_ldap: Adding radiusCalledStationId as Called-Station-Id, value 160110 & op=21 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: Adding radiusFramedIPNetmask as Framed-IP-Netmask, value 255.255.255.255.255 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 so. when i make radclient authorize works fine and receive Access-Accept but in the freeradius not load radiusMaxMonthlySession 90000 as i wrote above either radiusHint userdefault why radiusMonthlySession and radiusHint not is loaded in debug mode when radiusd load all attributes from profile when Access-Request came.???? note: 1- radiusHint came in the scheme by default 2- radiusMaxMonthlySession was wrote by me because not exist in the freeradius.scheme, i added new attribute and including in the class of freeradius so is posible to setup into user profile.

1 1

same login pass pair, different behaviour.
by Rakotomandimby Mihamina 24 Jul '09

24 Jul '09

Hi all, I have these users in my PGSQL table username | pwd ----------+--------- u_3 | pwd_3 u_one | pwd_one u_two | pwd_two When testing with radtest: ======================================================== mihamina@rktmb:~$ radtest u_one pwd_one radius20 10 cot357 Sending Access-Request of id 240 to 41.204.103.216 port 1812 User-Name = "u_one" User-Password = "pwd_one" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 rad_recv: Access-Accept packet from host 41.204.103.216 port 1812, id=240, length=26 Session-Timeout = 320 ======================================================== and freeradius -X trace: ======================================================== [...] auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [u_one/pwd_one] (from client quarante_un_deux_cent_quatre port 10) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> u_one rlm_sql (sql): sql_set_user escaped user --> 'u_one' expand: SELECT * FROM f_prepaid_activate('%{SQL-User-Name}') -> SELECT * FROM f_prepaid_activate('u_one') rlm_sql (sql) in sql_postauth: query is SELECT * FROM f_prepaid_activate('u_one') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 128 to 41.204.104.9 port 60642 Session-Timeout = 320 Finished request 18. Going to the next request Waking up in 4.9 seconds. ======================================================= When trying through the coova web form, same login/pass: Failure. Attached is the output of "freeradius -X" My collegues tell me coova must use CHAP for this project. What last setup is missing? Thank you! -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 2

:=, == and =
by Rakotomandimby Mihamina 24 Jul '09

24 Jul '09

Hi all, In a users file, I have for example: # DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # [...] # steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP I have a few questions, and I am looking for the place they are documented. I dont have all the technical terms yet to make an efficient search. - what is the difference between ':=', '==' and '=' - when do/dont I put a comma - in the DEFAULT, I would like append 'Simultaneous-Use := 1' [1], but what is the syntax if i want multiple DEFAULTSs After that, I will switch to PG-SQL, and looking at: http://wiki.freeradius.org/SQL_HOWTO, must I have somthing like: +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ | 1 | fredf | Cleartext-Password | wilma | := | | 2 | barney | Cleartext-Password | betty | := | | 2 | dialrouter | Cleartext-Password | dialup | := | | | fredf | Simultaneous-Use | 1 | := | | | barney | Simultaneous-Use | 1 | := | | | dialrouter | Simultaneous-Use | 1 | := | +----+----------------+--------------------+------------------+------+ In the database? [1] In order to _help_ the Access controller to forbid simultneous login -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

3 4

Re: Freeradius With edirectory and Active directory
by jaswinder kaur 23 Jul '09

23 Jul '09

Hello Ivan, Yes, It is a Upcoming project. I would appreciate whatever help I get from you or any reference to where I can get more information from. We have our users on the aaaa.example.com domain and are in edirectory environment. But our users are going to share a big part of the building with another company who are a totally different domain controlled by active directory. Our management wants us to create a radius infrastructure so that a user irrespective of their company, plug their laptop in a available socket, and gets put into the right domain and all the other network services based on their login credentials. Many Thanks, Jas Message: 4 Date: Thu, 23 Jul 2009 10:14:59 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Freeradius With edirectory and Active directory To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <53179.194.176.105.44.1248340499.squirrel(a)webmail.kalik.net" href="http://in.mc89.mail.yahoo.com/mc/compose?to=53179.194.176.105.44.1248340499…">53179.194.176.105.44.1248340499.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Is it possible to have freeradius integrated in a environment with two > totally different domains, one controlled by edirectory and the other by > active directory? Yes. You will need to create two mschap instances (one with ntlm_auth and one without) and failover in Auth-Type MS-CHAP. Auth-Type MS-CHAP { mschap_default { reject = 2 } if(reject) { mschap_ad } } Where mschap_default is a copy of default mschap module while mschap_ad has ntlm_auth line enabled. This applies to AD + anything else (ldap, sql, users file stored passwords). If you are going to have pap requests as well you should add failover to ntlm_auth after pap: if(!Auth-Type) { update control { ntlm_auth } } Is there interest for this? I can write a guide how to combine authentication of AD stored accounts with those stored elsewhere (ldap, sql, users file). Ivan Kalik Kalik Informatika ISP Looking for local information? Find it on Yahoo! Local http://in.local.yahoo.com/

2 1

login / password
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

Hi, Our passwords are stored as clear text in a postgresql database. The attached file tends to show CHAP is looking for something I dont understand. Would you have any suggestion? What's that "no known good passwdord" that might fail authentication? testing with radtest give the correct auth answers. I am now testing with the final client (coova). -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

3 2

RE: Help About Peap
by Julio Villacis Guevara 23 Jul '09

23 Jul '09

Hi I have a problem with PEAP-RADIUS-AD. I follow the configuration that find in this link http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Samba configuration ok and test (wbinfo u) Kerberos ok and test (kinit user) Radius install and configuration in Solaris SPARC the version is 1.1.7 download of sunfreeware with all depences ( <http://sunfreeware.com/programlistsparc10.html#openssl098> openssl-0.9.8k, <http://sunfreeware.com/programlistsparc10.html#netsnmp> netsnmp, <http://sunfreeware.com/programlistsparc10.html#gdbm> gdbm, <http://sunfreeware.com/programlistsparc10.html#openldap> openldap, <http://sunfreeware.com/programlistsparc10.html#mysql> mysql, <http://sunfreeware.com/programlistsparc10.html#zlib> zlib, <http://sunfreeware.com/programlistsparc10.html#sasl> sasl, <http://sunfreeware.com/programlistsparc10.html#libtool> libtool, <http://sunfreeware.com/programlistsparc10.html#libgcc34> libgcc-3.4.6) installed Radius radtest ok When the XP try login respond radius login incorrect. Attach messages of the radius server files. Thanks in advance Ing. Julio Villacís G. Ingeniero de Servicios Comware S.A. (593 4) 2690170 Ext. 4500 www.comware.com.ec Guayaquil-Ecuador

2 2