January 2010 - Freeradius-Users - lists.freeradius.org

Session-timeout and expiration problem
by Fazal Ahmed Malik 22 Jan '10

22 Jan '10

Hi, I have installed Freeradius 2.0 along with mysql 5 and dialup_admin. I am having trouble with session-timeout ,expiration. On dialup_admin i have correct information for both attributes like user can login for 0 seconds and similarly for expiration like account expired. But users can still logon even after expiration date passed. For session timeout user get disconnected right after alocated quota but here again user can login. Both attribute are setup from dialupadmin with = operator for session timeout and := for expiration Please help if i am missing some thing in config. Best regards, Fazal Ahmed

2 1

IP delivery for any MAC addresses issues
by Sylvain De Muynck 22 Jan '10

22 Jan '10

Dear freeradius users, I am currently facing an issue on my network architecture. Before, I was using freeradius with a DHCP server running in order to attribute IPs addresses to my customers (I work for an ISP) This configuration is perfectly working however for security, maintenance and monitoring, I took the choice of delivering IP addresses through my radius server. In fact, our Base Station got 2 modes of working, one is Ethernet and the other is IP mode data, so I juste configured as IP mode data to get it working. WHAT IS THE PROBLEM : when I connect my computer it is perfectly working and I can get my IP and all network parameters to get an access to the Internet however, when I want to change of computer, it does not work anymore. We were thinking about record of the MAC address as a security level and would like to get to know more about it. The attributes we are using are : Framed-Netmask --> Netmask Filter-Id --> DNS in this attribute (that's vendor attribute Alvarion) Framed-route --> Routing to the gateway Framed-Ip-address --> the IP addresse If you don't know, could you please advice me on how to troubleshoot this issue. Thanks in advance for your help, Best regards Sylvain

1 0

new ntlm_auth?
by freeradius＠corwyn.net 21 Jan '10

21 Jan '10

Did the recent upgrade of freeradius2 add a ntlm_auth module? I'm now seeing Exec-Program output: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program: returned: 1 ++[ntlm_auth] returns reject Failed to authenticate the user. Login incorrect: [rsteeves] (from client 10.100.0.8 port 1 cli 10.20.31.17) I went and looked, and there's a ntlm_auth module now where I don't think there was one before. . . I had/have ntlm_auth defined in radiusd.conf exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=int.example.com --username=%{mschap:User-Name} --password=%{User-Password}" } Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 4

ldap machine accounts in good vlan
by cd 21 Jan '10

21 Jan '10

hello I have 2 samba domains (with ldap backend) Machine accounts are stored in ldap. I want to assign VLAN according to ldap server machine$ stored in ldap_server_1 must go in VLAN1 machine$ stored in ldap_server_2 must go in VLAN2 what is the method to assign VLAN on XP boot ?

1 0

RES: Re: Defining Reply-Message for Access-Reject Packets
by Luiz Gustavo de Villa Scandelari 21 Jan '10

21 Jan '10

>Thu, 21 Jan 2010 10:02:48 +0700 EasyHorpak.com wrote: > >An HTML attachment was scrubbed... >URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2010012 1/98ccb1d7/attachment.html> Thanks so much EasyHorpak, it works now perfectly! LUIZ GUSTAVO DE VILLA SCANDELARI Skype: luiz.gustavo.wni

2 1

Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Alain, > Also, the proxy isn't returning an IP address: >> Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. >> Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop That log is taken from test for static IP Here is the log for user who get IP address from pool : rad_recv: Access-Request packet from host 10.65.8.100 port 65401, id=2, length=56 User-Name = "tevfikceydeliler" User-Password = "172932808506" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry tevfikceydeliler at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Proxying request 1 to home server 10.1.1.51 port 1812 Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Going to the next request Waking up in 0.9 seconds. OK ############################> rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=236, length=23 Proxy-State = 0x32 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} OK ############################>++[main_pool] returns noop expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.8.100 OK ############################>[birmas] MD5 on 'key' directive maps to: b6201c0efddb958ed955eb3c8b0d920a [birmas] Searching for an entry for key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] Found a stale entry for ip: 172.30.64.95 [birmas] num: 0 rlm_ippool: Allocating ip to key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] num: 1 [birmas] Allocated ip 172.30.64.86 to client key: b6201c0efddb958ed955eb3c8b0d920a ++[birmas] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[exec] returns noop OK ############################>Sending Access-Accept of id 2 to 10.65.8.100 port 65401 OK ############################> Framed-IP-Address = 172.30.64.86 OK ############################> Framed-IP-Netmask = 255.255.240.0 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 2 with timestamp +44 Ready to process requests. There is no manual about how to set user for static ip address. Mostly configurations use password. But i use OTP (realm) as password. What is changed when user moved from pool so static ip? Tevfik Ceydeliler Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Re: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi again, Should The Framed Ip ( assigned to the user, framed IP) be in the main_pool in this case? Tevfik Ceydeliler wrote: > Hi Alain, > According your suggestion I delete " Packet-Type == Access-Request" -I wrote down to config according to SecOvid manual-, <shrug> The manual is wrong. > and,I dont think that problem is home server because home server accept requests when user IP comes from IP pool. Read the debug output: the home server is rejecting the user. Also, the proxy isn't returning an IP address: > Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. > Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop Go fix that. Alan DeKok. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

EAP Session resumption && reply attributes
by James J J Hooper 21 Jan '10

21 Jan '10

Hi All, When a client does session resumption: cache { enable = yes} in eap.conf The session User-Name (from previous access-accept) is restored from the cache e.g: [ttls] Skipping Phase2 due to session resumption [ttls] Adding cached attributes to the reply: User-Name = "ab1234" In order to also return e.g. VLAN IDs (that could be computed from the inner User-Name in a non-session-resumption enabled config), I can move the config that sets the VLAN to the outer tunnel post-auth && ensure the inner tunnel sets: reply:outer User-Name to request:inner User-Name and then key my VLAN computation (in outer post-auth) from reply:User-Name. I can see other possibilities to do this (e.g. cache Tunnel-Private-Group-Id in the TLS session cache), but the above seems ok to me. Can anyone on the list spot any problems, something that I've missed / gotchas with the above? Many thanks, James

4 9

Re: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Alain, According your suggestion I delete " Packet-Type == Access-Request" -I wrote down to config according to SecOvid manual-, and,I dont think that problem is home server because home server accept requests when user IP comes from IP pool.This problem happens for only user who wanna use static ip. All problem is, the user must static IP, cant connect. As you see the log below, radius asks sends request and home server accept in first request: ... ... Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. ##########HERE IS ACCESS ACCEPT >rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=107, length=24 Proxy-State = 0x3530 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = CHAP Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = Accept Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' >>>>>>>>>>>>>>>>>>>ERROR HERE Wed Jan 20 10:01:07 2010 : Info: Auth-Type = Accept, accepting the user Wed Jan 20 10:01:07 2010 : Info: +- entering group post-auth {...} Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop Wed Jan 20 10:01:07 2010 : Info: [birmas] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[birmas] returns noop Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 50 to 172.30.80.1 port 2005 Wed Jan 20 10:01:07 2010 : Info: Finished request 1. Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 4.9 seconds. ###########AGAIN ACCESS-REQUEST > rad_recv: Access-Request packet from host 172.30.80.1 port 1806, id=154, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Wed Jan 20 10:01:07 2010 : Info: +- entering group authorize {...} Wed Jan 20 10:01:07 2010 : Info: ++[preprocess] returns ok Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jan 20 10:01:07 2010 : Info: ++[chap] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[mschap] returns noop Wed Jan 20 10:01:07 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Wed Jan 20 10:01:07 2010 : Info: [suffix] No such realm "NULL" Wed Jan 20 10:01:07 2010 : Info: ++[suffix] returns noop Wed Jan 20 10:01:07 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[unix] returns notfound Wed Jan 20 10:01:07 2010 : Info: [files] users: Matched entry tevfikceydeliler at line 219 Wed Jan 20 10:01:07 2010 : Info: ++[files] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[expiration] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[logintime] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[pap] returns noop Wed Jan 20 10:01:07 2010 : Info: +- entering group pre-proxy {...} Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: Proxying request 2 to home server 10.1.1.51 port 1812 Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=115, length=25 Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Using Post-Auth-Type Reject Wed Jan 20 10:01:07 2010 : Info: +- entering group REJECT {...} ... ... Then I dont know why but access request comes again. And home server (OTP server) looks itself and sees that this password is used before for this userand then reject it. İt is very normal beahviour for Home server. Because it is One Time Password server. ------------------------------ Message: 3 Date: Wed, 20 Jan 2010 12:58:28 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Can't Assign IP address my users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4B56EFE4.1080900(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Tevfik Ceydeliler wrote: > Hi, > My problem is, If I try to assign a static I address to my user, I got error. > I have Secovid OTP server as realm. And my all users use token to create password. > In test case, when I try to connect to my radius server via gprs I see some error: > ... > .... > Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' > ... > ... > I did not edit DEFAULTS. > My users settings is here: > tevfikceydeliler Packet-Type == Access-Request , You don't need to check Packet-Type. Delete it. > Here is the my logs: > root@radiusII:/etc/freeradius# freeradius -Xxx Why "-Xxx" ? What's wrong with following the documentation? > rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=115, length=25 > Proxy-State = 0x313534 Well... the home server rejects the user. Go fix the home server. Alan DeKok. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

RE: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Michael, All I want is that to give correct IP address to user. I have to use "Proxy-To-Realm" because my user dont use static password. They use token. And My realm is a OTP server. I care those two things. IP address and realm. What should I do? I really cant undertstand while user who use IP frpm poool can connect successfully, static ip users cant connect. Is there a trick? Tevfik Ceydeliler ------------------------------ Message: 3 Date: Wed, 20 Jan 2010 10:35:16 -0500 From: "Michael J. Hartwick" <hartwick(a)hartwick.com> Subject: RE: Can't Assign IP address my users To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <061401ca99e6$2a96bc90$7fc435b0$@com> Content-Type: text/plain; charset="utf-8" > Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on > request for user 'tevfikceydeliler' > ... > ... > I did not edit DEFAULTS. > My users settings is here: > tevfikceydeliler Packet-Type == Access-Request , Proxy-To-Realm > := 10.1.1.51, Framed-IP-Address := 172.30.64.120 , Framed-IP-Netmask := > 255.255.255.255 Do you really want all of these as check items and no replies? Michael ---------------------------------------------------------------------- Michael J. Hartwick, VE3SLQ hartwick(a)hartwick.com Hartwick Communications Consulting (519) 396-7719 Kincardine, ON, CA http://www.hartwick.com ---------------------------------------------------------------------- Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0