September 2009 - Freeradius-Users - lists.freeradius.org

need help for cisco vrf /ip address radius config
by Yagnesh Dave 28 Sep '09

28 Sep '09

Hi, I am trying to create a dynamic interface for the dail-up users assign it to a vrf and then configure the ip address. The config that I have done in the users file is as; tcl Cleartext-Password := "tcl" #tcl(a)cisco1.com Cleartext-Password := "tcl" Service-Type = Framed-User, Framed-Protocol = PPP, # Cisco-AVpair = "lcp:interface-config=ip vrf forwarding RWCustomer-A\n ip add 10.110.11.2 255.255.255.252", Cisco-AVpair += "lcp:interface-config=ip vrf forwarding \ RWCustomer-A", Framed-IP-Address = 10.110.11.1, Framed-IP-Netmask = 255.255.255.252, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP With this I am not able to see as expected from the radius server. I have also made an entry in proxy.conf file for realm cisco1.com Any inputs or guidance on this will be a appreciated. Thanks in Advance. Regards, Yagnesh Dave.

2 1

Setting up a virtual server to handle incoming proxied requests
by Patric 28 Sep '09

28 Sep '09

Hi again all :) I have a primary and secondary server, each of which receive accounting requests from multiple NAS servers. Both my servers proxy these requests to each other to stay in sync. I would like to setup a virtual server on my secondary to handle the incoming proxy requests from the primary. My secondary is running freeradius 2.1.3 I have read the sites-available/README documentation and have a few questions. First I include my current configuration for your consideration. radiusd.conf ------------ listen { ipaddr = * port = 0 # Use /etc/services for ports type = auth } listen { ipaddr = * port = 0 # Use /etc/services for ports type = acct } proxy_requests = yes $INCLUDE proxy.conf ... clients.conf ------------ Nothing proxy.conf ---------- home_server copy-acct-to-home-server { type = acct ipaddr = primary_server_ip port = 1813 secret = shared_key response_window = 20 zombie_period = 40 revive_interval = 120 } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } Currently my clients reside in the nas table in my database. With the above config I have listen sections for auth and acct. Do I understand the documentation correctly if I add this to the above existing config: client primary_server { ipaddr = primary_server_ip secret = shared_secret require_message_authenticator = no nastype = other virtual_server = requests_from_primary } server requests_from_primary { listen { ipaddr = * port = 0 type = acct } proxy_requests = no # Can this be done here? If not how would I disable proxying for this virtual server? # Do I just exclude my detail-radrelay in the accounting section? # Since this is just processing accounting requests do I still need to define the authorize, authenticate & other sections? preacct { preprocess acct_unique } accounting { detail sql # detail-radrelay - Exclude this so that these requests are not proxied? } } I *think* Im on the right track but would appreciate any pointers :) Many thanks Patric

3 8

freeradius problem
by matthew wyath 27 Sep '09

27 Sep '09

Hi All, I am trying to configure my freeradius to work with FortiMail antispam/antivir solution (so that people can automatically log into their webmail quarantine). Fortimail part is done and it was easy. Then I moved to freeradius and I came across problems. Just to clarify freeradius was installed on the same server where the postfix server resides and I want to authenticated my users through their linux credentials. clients.confs client 192.168.20.2 { secret = zgadnij123 shortname = FORTIMAIL nastype = other } users (default, nothing was changed) DEFAULT Auth-Type = System Fall-Through = 1 What I can see in the output from radiusd -X : ********************************* Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.2:33990, id=175, length=44 User-Name = "test" User-Password = "testtest" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 <------ HERE modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [test/testtest] (from client FORTIMAIL port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 175 to 192.168.20.2 port 33990 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 175 with timestamp 4abddee7 Nothing to do. Sleeping until we see a request. ******************************** All the password are stored in /etc/shadow. Can anybody help me why module "unix" returns reject ? regards, mw

4 5

descrition tables and atributes
by Nelson Acero Fino 27 Sep '09

27 Sep '09

Hi, Where can i found information and description about tables and atributes of radius database ?? Thanks :) !

3 2

Re:
by Thor Spruyt 27 Sep '09

27 Sep '09

>----- Oorspronkelijk bericht ----- >Van : wessam seleem [mailto:wessam.seleem@gmail.com] >Verzonden : zondag , september 27, 2009 02:34 PM >Aan : 'FreeRadius users mailing list' >Onderwerp : Re: > >Dear Thor and Ivan, > Thanks for your support. I would like to notice that I have the >same configuration in a server that has freeradius-1.1.7-1 installed and it >is working fine. I want to upgrade. That is why I am testing >freeradius-2.1.6-2. I want to ask is there is any difference between 1.1.7-1 >and 2.1.6-2 configuration files that I should put it in my consideration? > > >Thor, >I don't have the same output in the debug mode. I have what you can see >below: > > >++[ldap] returns ok >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Replacing User-Password in config items with Cleartext-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Please update your configuration so that the "known good" >!!! >!!! clear text password is in Cleartext-Password, and not in User-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >+- entering group PAP {...} >[pap] login attempt with password "password" >[pap] Using clear text password "$5@Hfgusllj%$#kasjs" >[pap] Passwords don't match >++[pap] returns reject >Failed to authenticate the user. >Using Post-Auth-Type Reject >+- entering group REJECT {...} >[attr_filter.access_reject] expand: %{User-Name} -> username > attr_filter: Matched entry DEFAULT at line 11 >++[attr_filter.access_reject] returns updated > >Dear Ivan and Thor, > >As you can see the problem that I am sending a clear text password and the >radius doesn't convert it to encrypted one. I want my radius to take a >clear >text password and encrypt it then compare it with the encrypted one in my >ldap. Please let me know if I should clarify more or if you need more info. > >Thanks again for your support. >Regards, > I'm not saying that how I got it working is *the* way to do it, I just got it working this way... I'm using 2.1.7, but I guess 2.1.6 has exactly the same behaviour. In your ldap module configuration, remove this: password_header = "{CRYPT}" Then the ldap module will not remove {CRYPT} from User-Password and the server will not complain about the attributes... The pap module configuration should only have the following line: auto_header = yes This will make the PAP authentication step recognize that the password retrieved from ldap is crypted and do the correct password comparison. Regards, Thor.

1 0

Accounting copying to specific systems
by Joe Maimon 27 Sep '09

27 Sep '09

Certain systems need copies of accounting data, but I only want to send a subset of accounting to the appropriate system. I dont want to change the way the server updates the sql accounting and local detail files. I want something like this acct.hints DEFAULT Client-IP-Address == "1.2.3.4", Hint := "FILTER-1" DEFAULT Client-IP-Address == "1.2.3.5", Hint := "FILTER-1" DEFAULT Client-IP-Address == "5.6.7.8", Hint := "FILTER-2" DEFAULT Client-IP-Address == "5.6.7.9", Hint := "FILTER-2" acct.users DEFAULT Hint == "FILTER-1", Copy-To := "filter-1-system" DEFAULT Hint == "FILTER-2", Copy-To := "filter-2-system" Where both filter-1-system and filter-2-system are defined in proxy.conf and obviously Copy-To is wishful thinking. Am I headed in the right direction or is there a better way to do this? Thanks, Joe

3 18

ASSERT FAILED event.c in 2.1.7
by Maja Wolniewicz 26 Sep '09

26 Sep '09

After the upgrade from 2.1.6 to 2.1.7 my two servers died 3-4 times daily with the following error: Thu Sep 24 19:07:13 2009 : Error: Received conflicting packet from client AP-8 port 32777 - ID: 240 due to unfinished request 2396. Giving up on old request. Thu Sep 24 19:07:13 2009 : Error: ASSERT FAILED event.c[2682]: request->ev != NULL I have to return to 2.1.6, which works smoothly. Greetings, Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl PGP key: http://www.home.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

3 3

account expiration attribute
by Rakotomandimby Mihamina 26 Sep '09

26 Sep '09

Hi all, What RADIUS attribute would suit to account expiration? the context: - prepaid users must regularily add credit to his account - big credit -> big validity extension - small credit -> small validity extension - no account removal, just auth reject if validity date passed Credit adding and account validity extension is not managed by the RADIUS stuff, it's about a manual external insert What we just need is the right RADIUS attribute to be checked during auth, in order to reject if the date is passed. Thanks for any help. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

3 7

(no subject)
by jon jon 25 Sep '09

25 Sep '09

hello, I am running slackware 12.1 as my OS. I am running freeradius version 2.1.4. I am also running Mysql as a backend server to freeradius. I made changed to the Msql database on what times the wireless internet will be available to clients. I wanted to test to see if the times that I set are working correctly, how would I do this? I thought about going to different sites and see if I could log in at the times I have set to not allow wireless clients not to be able to use it. Is there something I am missing here, how could I test this from one location? Thanks, jon

3 3

Re: Mimic lower_user in FR2
by Thor Spruyt 25 Sep '09

25 Sep '09

>----- Oorspronkelijk bericht ----- >Van : Alexander Clouter [mailto:alex@digriz.org.uk] >Verzonden : donderdag , september 24, 2009 05:24 PM >Aan : freeradius-users(a)lists.freeradius.org >Onderwerp : Re: Mimic lower_user in FR2 > >Thor Spruyt <thor.spruyt(a)telenet.be> wrote: >> >> Since lower_user doesn't exist anymore in FR2, I was thinking of doing >> the following in FR2 to mimic the behaviour, which seems to be working >> correctly: >> >> In "hints" file: >> >> DEFAULT User-Name !~ /^$/ >> User-Name := `%{exec:/opt/tolower %{User-Name}}`, >> Fall-Through = Yes >> >> DEFAULT Stripped-User-Name !~ /^$/ >> Stripped-User-Name := `%{exec:/opt/tolower %{Stripped-User-Name}}`, >> Fall-Through = Yes >> >> >> Content of "/opt/tolower": >> >> #!/bin/sh >> >> echo -n "$1" | tr '[A-Z]' '[a-z]' >> >> Is there any reason why I should not do this or why it's not recommended? >> The servers on which I want to do this is not heavily loaded (<1req/s). >> >Well although the load is not a problem, I mean you should feel *really* >dirty that every time a packet goes through your box, you system() out >twice. > >Hell I feel dirty enough when doing the following for the not-often >upstream proxying requests we do: >---- >update proxy-request { > NAS-IP-Address := `/bin/hostname -i` > NAS-Identifier := `/bin/hostname -f` >} >---- > >This however is just me being lazy until I patch FreeRADIUS to give me >some static runtime variable action :) > >You should do this with Perl if you really want or alternatively I'll >start sending your RADIUS server something like the following as you do >no validation at all (you get the idea, might work, probably won't, but >why risk it?): >---- >User-Name = '\"; rm -rf /; echo \"' >---- > >Cheers > >-- >Alexander Clouter >.sigmonster says: The best things in life go on sale sooner or later. > I would indeed tighten the script, but I was wondering if changing the 2 attributes in this way could cause problems in later processing. Or maybe there's a better way which I don't know about to get the same result... Regards, Thor.

2 1