August 2009 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 52, Issue 138
by wlanmac 29 Aug '09

29 Aug '09

There is also : http://www.coova.org/JRadius/Simulator > Don't forget radperf from http://networkradius.com/ > > Ivan Kalik wrote: > >> Hello ,some body know if exist a software platform for simulation of the > >> radius out of an production envairoment. > >> I configure radius in my first upon with pgsql an "freeradius -X" give me > >> freeradius listen 1813 1815 1817 ports for auth pass an proxy and waiting > >> request > >> seemingly ok. > >> But i need to prove it without a NAS ,for work reason i can not affect the > >> services with a prove > >> Some body know if i can use for a prove with radius a modem, a software or > >> some thing thus > >> > > > > radtest, radclient (included with rhe server) and eapol_test (from > > wpa_supplicant). > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > >

1 0

Re: BASIC question, but still having conceptual issues
by Gary Gatten 29 Aug '09

29 Aug '09

Seems like with FR this can be accomplished numerous ways. The virtual server sounds like what I'm looking for, ill read up on it. Thanks! Gary ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sat Aug 29 04:02:03 2009 Subject: Re: BASIC question, but still having conceptual issues Gary Gatten wrote: > I have several different type's of clients/NAS's that will be using FR > as the Front End to perform AAA - mostly Authentication, but the Author > and Acct are close behind. Use virtual servers. See raddb/sites-available/README > Anyway, each of these clients need to perform slightly different backend > queries to determine if Authenticate should pass or fail: > > So, how do I go about this? Configure completely different virtual servers, even if the contents of those servers are mostly the same. This lets you work like each type of NAS has it's own RADIUS server, with it's own policies. > I'm currently using NTLM_Auth and that's > all working fine, I'm just not sure how to say in FR config: if request > of type 1, run this NTLM_Auth command and check for this group; If > request of type 2 run this other NTLM_Auth command and check for this > other group. You'll also need to configure different instances of the MSCHAP module, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Some users getting duplicate "NULL" acctstoptime records in radacct
by Kanwar Ranbir Sandhu 29 Aug '09

29 Aug '09

Hi All, I have a weird problem with my freeradius 2.1.6 setup which I have not yet been able to fix. Actually, the problem is I don't understand what the hell is going on. I'm using mysql for storing auth and acct info. I'm also using sql based simultaneous use checking to prevent a user from logging in more than once. For the most part, things are working well. However, we see some people with an already active session (acctstoptime is set to NULL) get logged in again and then get a NEW row added to radacct with the acctstoptime set to NULL. So, effectively, freeradius shows TWO live sessions for the same user. When we check the NASes, we see two sessions for the same user there as well. I've run radius in debug mode, reviewed the logs, checked the configs, and I'm still lost on this. I do see people getting rejected when they try to log in more than once, which tells me the simultaneous checking is working. I don't understand why this is happening. What I'd expect to happen if accounting stop packets got lost would be the user getting rejected if he/she tried to log in again, but definitely would NOT expect seeing a NEW record in radacct with acctstoptime set to NULL. So, how could this happen? If it helps, I'm not using an ippool at the moment. I have IPs assigned to the user with entries in radreply (framed-ip-address). Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.29-170.2.78.fc10.x86_64 x86_64 GNU/Linux 19:43:28 up 3 days, 20:40, 3 users, load average: 0.21, 0.39, 0.76

4 8

VMPS Problem with similar requests
by Michael Bryant 29 Aug '09

29 Aug '09

Hi, If two vmps requests are sent in close succession (within cleanup_delay), with the same source port, from the same switch (which does in fact seem to be common, as the cisco switch I'm using for testing sends *all* requests with a source port picked on startup), they are detected as identical by freeradius as identical, even if they are for different mac addresses. This means the second request gets the same response as the first, even when they should be different. For example, testing with the vqpcli tool: Close together: server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bfe Vlan: BRIDGE MAC Address: 001641110bfe Status: ALLOW server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bff Vlan: BRIDGE MAC Address: 001641110bfe Status: ALLOW then a short time later (outside cleanup_delay) server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bff Vlan: MAC Address: Status: DENY Which is the correct response Cheers --Mike

2 1

Different reply items out of LDAP depending on the NAS
by Peter Lambrechtsen 28 Aug '09

28 Aug '09

I am trying to have a granular based reply items depending on the NAS they connected to all driven using attributes in LDAP without needing to use realms. IE User A passes just User&Password to NAS A. and gets reply attr "Service-Type=admin", and the admin comes from an LDAP Attribute "nasA" attribute in LDAP Same user logs into NAS B and gets back a "Service-Type=user" and the value user comes from an attribute "nasB". Looking through the ldap.attrmap it seems to be a static mapping for Service-Type to be staticly set to a single value from LDAP, but what happens if I want that value to be different depending on which NAS I have connected from. Have searched around and havn't found any documents talking about how to have this grainular level of configuration. Any suggestions?

2 4

add attribute to Access-Accept
by Gary Prosser 28 Aug '09

28 Aug '09

We have freeradius running successfully with 3 ldap instances (one for each of 3 different sets of user credentials, two of which are active directory). We want to provide to the calling nas in the Access-Accept reply some identifier of the ldap instance that authorizes a user. I have not been able to achieve this. Freeradius -X output shows rlm_ldap: - authorize rlm_ldap: performing user authorization for leesle expand: %{Stripped-User-Name} -> expand: %{User-Name} -> leesle expand: (samAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (samAccountName=leesle) expand: OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk -> OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk, with filter (samAccountName=leesle) rlm_ldap: checking if remote access for leesle is allowed by samAccountName rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = ldap1 rlm_ldap: user leesle authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok And then two further authorize sections ++[ldap2] returns notfound ++[ldap3] returns notfound Then users: Matched entry DEFAULT at line 159 users: Matched entry DEFAULT at line 163 users: Matched entry DEFAULT at line 167 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type ldap1 auth: type "ldap1" +- entering group authenticate rlm_ldap: - authenticate rlm_ldap: login attempt by "leesle" with password "xxxxx" rlm_ldap: user DN: CN=Seonghye Lee,OU=Students,DC=PUBLIC,DC=TRINITY-BRIS,DC=AC,DC=UK rlm_ldap: (re)connect to 192.168.4.250:389, authentication 1 rlm_ldap: bind as CN=Seonghye Lee,OU=Students,DC=PUBLIC,DC=TRINITY-BRIS,DC=AC,DC=UK/16763673 to 192.168.4.250:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user leesle authenticated succesfully ++[ldap1] returns ok Login OK: [leesle/xxxxx] (from client esther2-webserver port 0) Sending Access-Accept of id 91 to 192.168.2.1 port 1026 Callback-Id := "TCBStaff" I have tried to put a new attribute into the Access-Accept reply via users file 159 DEFAULT Auth-Type == "ldap1" 160 Callback-Id = "TCBStudents", 161 Fall-Through = Yes 162 # 163 DEFAULT Auth-Type == "ldap2" 164 Callback-Id := "BBCUsers", 165 Fall-Through = Yes 166 # 167 DEFAULT Auth-Type == "ldap3" 168 Callback-Id := "TCBStaff", 169 Fall-Through = Yes Since each line in users apparantly matches, the attribute Callback-Id acquires the value of the last DEFAULT. Meanwhile I was hoping that rlm_ldap: Setting Auth-Type = ldap1 would match only the first. Can I fix this by adjusting the syntax or do I need a different method ? Any comment appreciated ! Gary Prosser - IT Manager Trinity College, Bristol (http://www.trinity-bris.ac.uk) To ensure you receive email from Trinity College into your inbox, please add @trinity-bris.ac.uk to your email safe list (also known as whitelist).

1 1

rlm_ldap logs
by Sergio Belkin 28 Aug '09

28 Aug '09

Hi I am using Version 2.1.1 with openldap on Centos 5 I wonder if is feasible dumping to logs when user gets login incorrect if due to non-existance of that uid on Ldap. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Re: Setting FreeRadius and Ldap. - Getting Educated Now
by Steven Sprague 28 Aug '09

28 Aug '09

Ivan, Thanks for the url link to the missing documentation. Very helpful. Ldap is not going to work for EAP. Now I am facing a dilemma - deciding what WEP protocol to use based on my test setup. After reading the 'sites' and 'modules' files it seems that "some" WEP or EAP protocols are weaker than others, some not suggested for use. Here's what my test router and machines can handle. Router can provide - WEP 40/128 shared key, WEP Personal, WEP Enterprise Chiper: TKIP or AES Workstation:WEP 40/128 shared key, Leap, Dynamic WEP, WPA & WPA2 Personal & Enterprise Older Laptop: WEP 40/128 shared key, 802.1 Cisco LEAP or EAP FAST --this may be the limiting machine. I need to rely on list users experience for suggested paths to pursue? Steven -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 5

Re: more than one CA in PEAP
by Ivan Kalik 28 Aug '09

28 Aug '09

> Is this posible? > I need use a auto signed CA and certificate from FNMT (external agency) > How can it be do? Multiple eap instances - one for each certificate chain. Ivan Kalik Kalik Informatika ISP

2 1

unlang: matching for 'Access-Accept'
by Mike O'Connor 28 Aug '09

28 Aug '09

Hi Guys How would I match for the packet type ie 'Access-Accept' in unlang Mike

3 3