November 2010 - Freeradius-Users - lists.freeradius.org

LDAP Frontend with Support for RADIUS Schema
by Holger Rauch 09 Nov '10

09 Nov '10

Hi, I would like to use FreeRADIUS on either Debian or FreeBSD stable for VPN user authentication. Authentication should be based on the following information: a) username+MIT Kerberos password b) MAC address of the machine c) OTP generated by e.g. a Yubikey device d) (possibly) a client certificate or a public/private key pair (either created by SSH or GPG) (The combination of b) and d) would uniquely identify the machine; the combination of a) and c) would uniquely identify the user). I would like to store this information in LDAP DIT (served by OpenLDAP). Up to now, I've only used OpenLDAP for POSIX+Samba account info und MIT Kerberos related data. My questions are: - Is there any current documentation for such a (or a quite similar) scenario? Up to now, one documentation I found was http://vuksan.com/linux/dot1x/802-1x-LDAP.html but this one is related to MAC authentication for WLAN setups - Are there any web frontends and/or GUI frontends offering support for the RADIUS schema? Thanks in advance for any info and kind regards, Holger

3 3

Re: Accounting Log
by Breuer Nicolas 09 Nov '10

09 Nov '10

Breuer Nicolas wrote: > > Accounting-01 thinks that stop packet with zero session length is an error > and tried to connect to Accounting-02 sql server. > > Is it the correct behaviour ? Yes. see doc/configurable_failover for how to change redundant groups. Alan DeKok. Alan, I know that this is the correct behaviour concerning redundant groups but for me a Stop with zero session length isn't a SQL issue that needs to go on secondary SQL servers. Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

redundant SQL / WARNING: Unknown module "sql" in string expansion
by Tom Teeuwen 09 Nov '10

09 Nov '10

Hello, I configured my freeradius with redundant SQL config: In sql.conf: Sql sql1 { .... ..... .... } Sql sql2 { ...... ..... ...... } Radiusd.conf: Redundant sql { Sql1 Sql2 } And in my default site config: Authorize { .... ... .... .... Sql ... ... } Now I want to do some extra SQL-queries within my authorize section. I used something like if ("%{sql:select ........ I receive the following error: WARNING: Unknown module "sql" in string expansion "%{sql:select Without the redundant module it works perfectly :) Kind regards, Tom

2 3

Setting group membership
by inetjunkmail 09 Nov '10

09 Nov '10

I know I'm missing something obvious but I'm stuck here so I apologize in advance for the silly question. I'm using freeradius 2.1.7. I'm using the "files" option for all processes but I want to use user groups so I can reference them in my huntgroups definitions as groups of users permitted to authentication to that group of devices. I tried modifying the etc_group module and the group is correctly determined but it takes place after the huntgroup decision making process done by "preprocessing" so the match condition for the huntgroup fails. I then inserted the module before "preprocessing" in my sites-available/default file and the group is correctly determined prior to preprocessing but it doesn't seem to match the test condition. Snippets of config are below. Any guidance would be appreciated. modules/My-Group-Name ----- passwd My-Group-Name { filename = /etc/raddb/group format = "=My-Group-Name:*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } ----- dictionary ----- ATTRIBUTE My-Group-Name 3000 string ----- group ----- telecom:test1 hg1admin:test2 huntgroups ----- hg1 NAS-IP-Address =~ "^10\.69\.1\..*" My-Group-Name == telecom, My-Group-Name == hg1admin, ----- users ----- test1 Cleartext-Password := "password1" test2 Cleartext-Password := "password2" ----- I've inserted the My-Group-Name module at various locations within sites-available/default with no luck. Again, ant guidance would be appreciated.

1 0

Authentication by domain of company
by zouzou 09 Nov '10

09 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

(Fwd) (Fwd) Re: Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

Hello Alexandre, Just in that case, if you not send the STOP in case Sess time =0 The Session will stay opened in the accounting table. and never be closed.... ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: (Fwd) Re: Accounting Log Send reply to: Nicolas.Breuer(a)BelCenter.biz Date sent: Mon, 08 Nov 2010 23:00:40 +0100 From: Alexandre Chapellon <alexandre.chapellon(a)mana.pf> I have the very same behaviour here on my FR2.1.6 setup with PGSQL accoutning. It produce noisy logs but nothing unacceptable. You can change this by not doing accouting for Stop Accounting packet that show up null session-time: in your acccouting section: if (Acct-Status-Type == Stop && Session-Time != 0) { sql_accounting_module_name } Maybe relying on Session-Time is not a good idea. Try finding out another relevant attribute. Cdt Nice idea, i will try :) Attachments: C:\Users\Nico\AppData\Local\Temp\WPM$2D83.PM$ ------- End of forwarded message ------- Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

Problems with the mailing list?????
by michel＠casa.co.cu 08 Nov '10

08 Nov '10

Hello Gentlemen, there are problems on the list and everyone is on vacation or just moved to see activity on the list? I repeat my previous message, only this time I'm more brief I created a group in mysql and I've assigned certain attributes, one of them and is giving me problems is Idle-Timeout, which has a value of 900 seconds and the user is disconnected before time indicated. Because I want the user to be disconnected if after spending 10 ~ 15 minutes does not show any activity. not before that time. mysql> SELECT * FROM `radgroupreply` ; +----+----------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+---------------------+ | 1 | Desarrollo | Service-Type | = | Framed-User | | 2 | Desarrollo | Framed-Protocol | = | PPP | | 3 | Desarrollo | Framed-MTU | = | 1500 | | 4 | Desarrollo | Framed-Compression | = | Van-Jacobsen-TCP-IP | | 5 | Desarrollo | Framed-IP-Netmask | = | 255.255.255.0 | | 6 | Desarrollo | Idle-Timeout | := | 900 | +----+----------------+--------------------+----+---------------------+ here you can see the user disconnected prematurely rad_recv: Accounting-Request packet from host 172.19.19.10 port 17979, id=197, length=170 NAS-IP-Address = 172.19.19.10 NAS-Identifier = "Access Server" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 10.71.53.214 User-Name = "carlos" NAS-Port = 447 NAS-Port-Type = Async Called-Station-Id = "60110" Calling-Station-Id = "78382547" Acct-Status-Type = Stop Acct-Session-Id = "0130000425" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Acct-Input-Octets = 47429 Acct-Output-Octets = 4377 Acct-Input-Packets = 66 Acct-Output-Packets = 57 Acct-Session-Time = 95 Acct-Terminate-Cause = Idle-Timeout Could be problems with the operator that I am implementing???? Thanks ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

4 3

(Fwd) Re: Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

From: Alexandre Chapellon <alexandre.chapellon(a)mana.pf> I have the very same behaviour here on my FR2.1.6 setup with PGSQL accoutning. It produce noisy logs but nothing unacceptable. You can change this by not doing accouting for Stop Accounting packet that show up null session-time: in your acccouting section: if (Acct-Status-Type == Stop && Session-Time != 0) { sql_accounting_module_name } Maybe relying on Session-Time is not a good idea. Try finding out another relevant attribute. Cdt Nice idea, i will try :) Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

1 0

Authentication by domain of company
by zouzou 08 Nov '10

08 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

Hello All, We used the Freeradius 2.X version. We use the accounting SQL module and i remark something. When a user is rejected (Wrong password), i always have this error in radius.log Mon Nov 8 18:07:40 2010 : Auth: Login incorrect: [BCgXXX] Mon Nov 8 18:07:41 2010 : Info: [ACCOUNTING-01] stop packet with zero session length. Mon Nov 8 18:07:41 2010 : Info: rlm_sql (ACCOUNTING-02): Attempting to connect rlm_sql_mysql #13 Mon Nov 8 18:07:41 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Nov 8 18:07:41 2010 : Info: rlm_sql (ACCOUNTING-02): Connected new DB handle, #13 Mon Nov 8 18:07:41 2010 : Info: [ACCOUNTING-02] stop packet with zero session length. Accounting-01 thinks that stop packet with zero session length is an error and tried to connect to Accounting-02 sql server. Is it the correct behaviour ? Is it possible to remove this "logging". Thanks Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

4 3