August 2009 - Freeradius-Users - lists.freeradius.org

Simple username password text file
by Paul Blalock 05 Aug '09

05 Aug '09

Is it possible to have a simplistic username and password setup in freeradius? For example. user, pass user1, pass1 Or is it possible to have the users file point to a file that does this? If not, is it possible to have this type of format by using mysql? -- Paul Blalock

3 2

Service-type
by Bert Beaudin 05 Aug '09

05 Aug '09

Hello all I have freeradius authenticating off of Active Directory. This is working but I now need to pass Service-Type = 6 for all connections that sussfuly authencate. What file and section to I put this in? Let me know if you need mroe information. Thanks, bert

1 0

Version 2.1.0 has been released.
by Alan DeKok 05 Aug '09

05 Aug '09

We are happy to announce the release of Version 2.1.0 of the FreeRADIUS server, with some major new features. Highlights include improved SNMP support, dynamically-defined clients, much more flexible (and readable) debugging mode, WiMAX support, fast reauthentication for PEAP and TTLS, and a command-line tool to administer a running server. The administration tool can stop the server, HUP it, or in limited cases, change the configuration of a running server, and cause just one module to reload it's configuration. Alan DeKok. Detailed change log: FreeRADIUS 2.1.0 Fri Sep 5 13:20:01 CEST 2008; , urgency=medium Feature improvements * Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients. * SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README * SNMP statistics are available through Status-Server packets. See raddb/sites-available/status * Added more Microsoft attributes from bug #568. * The "linelog" module has more functionality and flexibility. See raddb/modules/linelog. * The debugging output has been sanitized. It should be much more readable. * Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the "log" section of radiusd.conf. * Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax * Added session resumption for PEAP and TTLS. See raddb/eap.conf, "cache" sub-section. * Added "radmin" command-line tool for administering a running server. See "man radmin" and raddb/sites-available/control-socket. Bug fixes * Double escaping of '\\' in the "users" (and some other) files has been fixed. If you have '\\' in the "users" file, your configuration WILL NEED TO BE CHECKED, AND FIXED! * Parse "security" section in radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566. * Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces. * Fix handling of giaddr in DHCP responses. * Corrected parsing of status_check in home_server so that it works. * Fix hints so that "Puser" works again. * Removed length restrictions on attribute names in the dictionaries. * Update socket code to avoid C compiler optimizations.

6 14

Buffered SQL for authentication failures?
by John Morrissey 05 Aug '09

05 Aug '09

I'm in the process of replacing OSG's Radiator with FreeRADIUS. I have our relatively complex configuration mostly ported, but a few things have left me stumped. I'd like to write authentication failures to an SQL database using a detail listener so they're buffered, as with accounting: detail detail.auth { detailfile = ${radacctdir}/detail-auth detailperm = 0600 header = "%t" } post-auth { Post-Auth-Type REJECT { detail.auth } } server buffered-sql-auth { listen { type = detail filename = ${radacctdir}/detail-auth load_factor = 100 } post-auth { sql } } Detail entries are picked up by the listener, but it never seems to do anything with them: Going to the next request Waking up in 0.7 seconds. Polling for detail file /var/log/freeradius/radacct/detail-acct Polling for detail file /var/log/freeradius/radacct/detail-auth detail_recv: Renaming /var/log/freeradius/radacct/detail-auth -> /var/log/freeradius/radacct/detail-auth.work detail_recv: Read packet from /var/log/freeradius/radacct/detail-auth.work Packet-Type = Access-Reject Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Acct-Delay-Time = 0 server buffered-sql-auth { } # server buffered-sql-auth Finished request 7. Cleaning up request 7 ID 41800 with timestamp +263 It looks like detail_recv() explicitly sets its RAD_REQUEST_FUNP to rad_accounting: *pfun = rad_accounting; I haven't looked much into the FreeRADIUS source yet; is it reasonably easy to determine/loop through the configured handlers for the detail listener to support a situation like this? Is there a better way of doing this? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

1 0

Freeradius and memory usage
by Roy Kartadinata 05 Aug '09

05 Aug '09

Hello, Our radius server is currently having some memory issue where its memory usage would increase by 1% every 30-45 minutes. Eventually the server will crash and restart because of out of memory. We've been using freeradius for a couple of years and this just started on Thursday so I upgraded our radius to the latest 2.1.6 from 2.1.5 but the problem still there. Has anyone ever experiencing this issue before? Cheers, Roy Kartadinata

4 17

unable to connection freeradius with mysql
by shivashankar 05 Aug '09

05 Aug '09

hi i am useing freeradius2.1.6 and mysql5.0 on solaris10. when ever i start the server radiusd -X . i am getting below problem. i think it is not connected to mysql.plz help me how to connect Note: i changed sql.conf site-available/defaults radiusd.conf ....... ......... Error showing below =============== Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "welcome" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Client does not support authentication protocol requested by server; consider upgrading MySQL client' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. -- View this message in context: http://www.nabble.com/unable-to-connection-freeradius-with-mysql-tp24820558… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

RE: Info regarding radius and tacacs
by Vamsi Krishna Valiveti 05 Aug '09

05 Aug '09

Hi, Can anyone let me know if there is a free downloadable Tacacs server with support for Ipv6 If yes then please provide the link or the freeware software itself Rgds, Vamsi ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 3

Fwd: Freeradius with Active_Directory
by Hari Novferdianto 05 Aug '09

05 Aug '09

Dear All... I was following http://deployingradius.com/documents/configuration/active_directory.html I was installed freeradius-1.1.7 and samba version 3 on my slackware 11 and also I was installed Windows Server 2003 for Active Directory. This is my smb.conf : [global] workgroup = RADIUS security = server password server = radius.satelite.net In this case I'm not using kerberos and I was successfully running my samba and join with my domain. This is about status from my server when I joined root@jadul: net join -U administrator Password: Joined domain RADIUS. And I was successfully to use ntlm_auth helper to authenticate user from my Active Directory. This is the message from my server. root@jadul:/# ntlm_auth --request-nt-key --domain=radius.satelite.net -- username=administrator password: NT_STATUS_OK: Success (0x0) and also I add in the module section on radiusd.conf exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } and also I add in the users file DEFAULT Auth-Type = ntlm_auth There is no problem when I check with radiusd -X and after I running radiusd. I was check account from my Active Directory using radtest <user_AD> <pass_AD> localhost 1812 testing123 And the result is.. radtest ferdi ferdi localhost 1812 testing123 Sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=86, length=20 Why Reject..? Please help me..

2 1

Client-IP-Address attribute in the request
by Adam Osuchowski 05 Aug '09

05 Aug '09

Hi, I can't obtain Client-IP-Address attribute in %RAD_REQUEST hash in rlm_perl. In default server config from version 2.1.6, I noticed such a fragment: # It also adds the %{Client-IP-Address} attribute to the request. preprocess I browse through the sources of FR version 2.1.6 and it seems that rlm_preprocess module set only NAS-IP-Address attribute (under some circumstances) but not Client-IP-Address. However, in FR 1.1.7 sources, in the same module I see that version do it: nas = paircreate(PW_CLIENT_IP_ADDRESS, PW_TYPE_IPADDR); if (!nas) { radlog(L_ERR, "No memory"); return -1; } nas->lvalue = request->packet->src_ipaddr; ip_hostname(nas->strvalue, sizeof(nas->strvalue), nas->lvalue); pairadd(&request->packet->vps, nas); Is it obsoleted or something like that? Is there any other method to add Client-IP-Address attribute to the request beside patching FR 2.1.6? Regards.

2 1

Freeradius with Active_Directory
by Hari Novferdianto 05 Aug '09

05 Aug '09

Dear All... I was following http://deployingradius.com/documents/configuration/active_directory.html I was installed freeradius-1.1.7 and samba version 3 on my slackware 11 and also I was installed Windows Server 2003 for Active Directory. This is my smb.conf : [global] workgroup = RADIUS security = server password server = radius.satelite.net In this case I'm not using kerberos and I was successfully running my samba and join with my domain. This is about status from my server when I joined root@jadul: net join -U administrator Password: Joined domain RADIUS. And I was successfully to use ntlm_auth helper to authenticate user from my Active Directory. This is the message from my server. root@jadul:/# ntlm_auth --request-nt-key --domain=radius.satelite.net -- username=administrator password: NT_STATUS_OK: Success (0x0) and also I add in the module section on radiusd.conf exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } and also I add in the users file DEFAULT Auth-Type = ntlm_auth There is no problem when I check with radiusd -X and after I running radiusd. I was check account from my Active Directory using radtest <user_AD> <pass_AD> localhost 1812 testing123 And the result is.. radtest ferdi ferdi localhost 1812 testing123 Sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=86, length=20 Why Reject..? Please help me.. I'm so confused..

1 0