December 2010 - Freeradius-Users - lists.freeradius.org

(no subject)
by Zoet Omar Zepeda 02 Dec '10

02 Dec '10

HELLO!!!! COULD TELL ME TO syntax to add client in freeradius and could tell me to sintax to add user in freeradius

1 0

Informacio
by Horacio Andrade Zepeda FELIZZZZZZ 02 Dec '10

02 Dec '10

Hi I am newbie at this help please Description O. System Windos Vista With 1 application of Oracle VM VirtualBox Virtual Machine O. System Ubuntu 10.10 with a server radiusd aser nesesito mac filtering equipment through this server Well my question is if the users file I register users with their password to be linia file that I register the MAC addresses Well I hope and I can help because it is very important to me as it is for a practice School Thanks

1 1

Re: use existing sql table for user-password
by Brian Candler 02 Dec '10

02 Dec '10

> > But for radcheck, i need to add attribute and value fields as i see. > > How can i check just username and password from one table, and check other > > attributes (AuthType etc) from another?? > > Write an SQL function. Or use the group functionality. That is, use authorize_check_query authorize_reply_query to get the password, and group_membership_query authorize_group_check_query authorize_group_reply_query to get the attributes from another table. In group_membership_query you map the username to some other key, but you can just map it to the username again if you wish. But if this is MySQL, as Alan says it may be easier (and is certainly more flexible) to put your logic into stored procedures. Then use authorize_check_query = "call getCheck('%{User-Name}');" authorize_reply_query = "call getReply('%{User-Name}');" Regards, Brian.

2 1

redundant LDAP-Group
by Alexander Clouter 02 Dec '10

02 Dec '10

Hi, I know this has been covered in the archives, and the news is generally not good, but my users file currently looks like: ---- DEFAULT NAS-Identifier == switch, Huntgroup-Name == allied-telesis, ldap_login1-LDAP-Group == it-switch-admin Service-Type = Administrative-User DEFAULT NAS-Identifier == switch, Huntgroup-Name == allied-telesis, ldap_login2-LDAP-Group == it-switch-admin Service-Type = Administrative-User DEFAULT NAS-Identifier == switch, Huntgroup-Name == cisco, NAS-Port-Type == Virtual, ldap_login1-LDAP-Group == it-switch-admin Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT NAS-Identifier == switch, Huntgroup-Name == cisco, NAS-Port-Type == Virtual, ldap_login2-LDAP-Group == it-switch-admin Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT NAS-Identifier == switch, Auth-Type := Reject ---- In my global configuration I have: ---- instantiate { ldap_login1 ldap_login2 redundant-load-balance ldap-login { ldap_login1 ldap_login2 } ldap_lanwarden1 ldap_lanwarden2 redundant-load-balance ldap-lanwarden { ldap_lanwarden1 ldap_lanwarden2 } } ---- It would be really nice to fold those duplicate LDAP-Group lines into 'ldap_login-LDAP-Group', however alas FreeRADIUS does not love me: ---- /etc/freeradius/LOCAL/users-login[1]: Parse error (check) for entry DEFAULT: Invalid octet string "it-switch-admin" for attribute name "ldap_login-LDAP-Group" Errors reading /etc/freeradius/LOCAL/users-login /etc/freeradius/LOCAL/modules.conf[1]: Instantiation failed for module "files-login" /etc/freeradius/sites-enabled/login[72]: Failed to load module "files-login". /etc/freeradius/sites-enabled/login[35]: Errors parsing authorize section. ---- This 'redundant' LDAP-Group problem often crops up, unfortunately it is way above my head to resolve. Another "moon-on-a-stick" feature is that I have two sets of LDAP servers configured[1], in my authorise section I have: ---- authorize { ... ldap-login if (!ok) { reject } files ... } ---- If I instead simply use 'LDAP-Group' in the users file, 'ldap-lanwarden' is invoked (rather than me expecting a contination of the last used LDAP server)... Is this a bug or a 'feature'? Cheers [1] ldap_login[12] -> ldap_login, ldap_lanwarden[12] -> ldap_lanwarden -- Alexander Clouter .sigmonster says: An idea is not responsible for the people who believe in it.

3 6

Accounting and Acct-Delay-Time in MySQL
by Stefan Winter 02 Dec '10

02 Dec '10

Hello, the default queries for mysql log Acct-Delay-Time into the columns acctstartdelay and acctstopdelay, respectively. They leave the timestamps for acctstarttime and acctstoptime at %S. For a non-zero delay, this means that a database reader needs to do math to get the start and stop times. It is rather unintuitive that a database user needs to calculate the *actual* event times manually by substracting the values. This is something that MySQL can easily do on its own at INSERT or UPDATE. Is there a specific reason why the two are kept separate? If not, I'll merrily volunteer to update the default query set to do so; I'll do this for my deployment's custom queries anyway. This would also make the two columns for delay time obsolete. Any thoughts on this? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

SQL modul
by Miha Zoubek 02 Dec '10

02 Dec '10

Hello, at the end of this file I am getting massage Failed to load module"sql". Could you please help me what to do ? Thank you! miha[root@localhost sites-available]# /usr/local/sbin/radiusd -XFreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Dec 1 2010 at 14:25:01Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ...including configuration file /usr/local/etc/raddb/radiusd.confincluding configuration file /usr/local/etc/raddb/proxy.confincluding configuration file /usr/local/etc/raddb/clients.confincluding files in directory /usr/local/etc/raddb/modules/including configuration file /usr/local/etc/raddb/modules/checkvalincluding configuration file /usr/local/etc/raddb/modules/krb5including configuration file /usr/local/etc/raddb/modules/sql_logincluding configuration file /usr/local/etc/raddb/modules/linelogincluding configuration file /usr/local/etc/raddb/modules/execincluding configuration file /usr/local/etc/raddb/modules/ldapincluding configuration file /usr/local/etc/raddb/modules/sradutmpincluding configuration file /usr/local/etc/raddb/modules/chapincluding configuration file /usr/local/etc/raddb/modules/radutmpincluding configuration file /usr/local/etc/raddb/modules/inner-eapincluding configuration file /usr/local/etc/raddb/modules/unixincluding configuration file/usr/local/etc/raddb/modules/sqlcounter_expire_on_loginincluding configuration file /usr/local/etc/raddb/modules/dynamic_clientsincluding configuration file /usr/local/etc/raddb/modules/mac2ipincluding configuration file /usr/local/etc/raddb/modules/counterincluding configuration file /usr/local/etc/raddb/modules/smbpasswdincluding configuration file /usr/local/etc/raddb/modules/filesincluding configuration file /usr/local/etc/raddb/modules/realmincluding configuration file /usr/local/etc/raddb/modules/etc_groupincluding configuration file /usr/local/etc/raddb/modules/pamincluding configuration file /usr/local/etc/raddb/modules/acct_uniqueincluding configuration file /usr/local/etc/raddb/modules/detail.example.comincluding configuration file /usr/local/etc/raddb/modules/preprocessincluding configuration file /usr/local/etc/raddb/modules/digestincluding configuration file /usr/local/etc/raddb/modules/mac2vlanincluding configuration file /usr/local/etc/raddb/modules/opendirectoryincluding configuration file /usr/local/etc/raddb/modules/attr_rewriteincluding configuration file /usr/local/etc/raddb/modules/otpincluding configuration file /usr/local/etc/raddb/modules/policyincluding configuration file /usr/local/etc/raddb/modules/ippoolincluding configuration file /usr/local/etc/raddb/modules/logintimeincluding configuration file /usr/local/etc/raddb/modules/wimaxincluding configuration file /usr/local/etc/raddb/modules/expirationincluding configuration file /usr/local/etc/raddb/modules/attr_filterincluding configuration file /usr/local/etc/raddb/modules/smsotpincluding configuration file /usr/local/etc/raddb/modules/ntlm_authincluding configuration file /usr/local/etc/raddb/modules/detailincluding configuration file /usr/local/etc/raddb/modules/mschapincluding configuration file /usr/local/etc/raddb/modules/detail.logincluding configuration file /usr/local/etc/raddb/modules/papincluding configuration file /usr/local/etc/raddb/modules/alwaysincluding configuration file /usr/local/etc/raddb/modules/passwdincluding configuration file /usr/local/etc/raddb/modules/cuiincluding configuration file /usr/local/etc/raddb/modules/exprincluding configuration file /usr/local/etc/raddb/modules/echoincluding configuration file /usr/local/etc/raddb/modules/perlincluding configuration file /usr/local/etc/raddb/eap.confincluding configuration file /usr/local/etc/raddb/sql.confincluding configuration file /usr/local/etc/raddb/policy.confincluding files in directory /usr/local/etc/raddb/sites-enabled/including configuration file/usr/local/etc/raddb/sites-enabled/control-socketincluding configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnelincluding configuration file /usr/local/etc/raddb/sites-enabled/defaultmain {allow_core_dumps = no}including dictionary file /usr/local/etc/raddb/dictionarymain {prefix = "/usr/local"localstatedir = "/usr/local/var"logdir = "/usr/local/var/log/radius"libdir = "/usr/local/lib"radacctdir = "/usr/local/var/log/radius/radacct"hostname_lookups = nomax_request_time = 30cleanup_delay = 5max_requests = 1024pidfile = "/usr/local/var/run/radiusd/radiusd.pid"checkrad = "/usr/local/sbin/checkrad"debug_level = 0proxy_requests = yeslog {stripped_names = noauth = noauth_badpass = noauth_goodpass = no}security {max_attributes = 200reject_delay = 1status_server = yes}}radiusd: #### Loading Realms and Home Servers ####proxy server {retry_delay = 5retry_count = 3default_fallback = nodead_time = 120wake_all_if_all_dead = no}home_server localhost {ipaddr = 127.0.0.1port = 1812type = "auth"secret = "testing123"response_window = 20max_outstanding = 65536require_message_authenticator = yeszombie_period = 40status_check = "status-server"ping_interval = 30check_interval = 30num_answers_to_alive = 3num_pings_to_alive = 3revive_interval = 120status_check_timeout = 4irt = 2mrt = 16mrc = 5mrd = 30}home_server_pool my_auth_failover {type = fail-overhome_server = localhost}realm example.com {auth_pool = my_auth_failover}realm LOCAL {}radiusd: #### Loading Clients ####client localhost {ipaddr = 127.0.0.1require_message_authenticator = nosecret = "testing123"nastype = "cisco"}client xxx.xxx.xxx.xxx {require_message_authenticator = nosecret = "12345"shortname = "intraswitch"}radiusd: #### Instantiating modules ####instantiate {Module: Linked to module rlm_execModule: Instantiating module "exec" from file/usr/local/etc/raddb/modules/execexec {wait = noinput_pairs = "request"shell_escape = yes}Module: Linked to module rlm_exprModule: Instantiating module "expr" from file/usr/local/etc/raddb/modules/exprModule: Linked to module rlm_expirationModule: Instantiating module "expiration" from file/usr/local/etc/raddb/modules/expirationexpiration {reply-message = "Password Has Expired "}Module: Linked to module rlm_logintimeModule: Instantiating module "logintime" from file/usr/local/etc/raddb/modules/logintimelogintime {reply-message = "You are calling outside your allowed timespan "minimum-timeout = 60}}radiusd: #### Loading Virtual Servers ####server inner-tunnel { # from file/usr/local/etc/raddb/sites-enabled/inner-tunnelmodules {Module: Checking authenticate {...} for more modules to loadModule: Linked to module rlm_papModule: Instantiating module "pap" from file/usr/local/etc/raddb/modules/pappap {encryption_scheme = "auto"auto_header = no}Module: Linked to module rlm_chapModule: Instantiating module "chap" from file/usr/local/etc/raddb/modules/chapModule: Linked to module rlm_mschapModule: Instantiating module "mschap" from file/usr/local/etc/raddb/modules/mschapmschap {use_mppe = yesrequire_encryption = norequire_strong = nowith_ntdomain_hack = no}Module: Linked to module rlm_unixModule: Instantiating module "unix" from file/usr/local/etc/raddb/modules/unixunix {radwtmp = "/usr/local/var/log/radius/radwtmp"}Module: Linked to module rlm_eapModule: Instantiating module "eap" from file /usr/local/etc/raddb/eap.confeap {default_eap_type = "md5"timer_expire = 60ignore_unknown_eap_types = nocisco_accounting_username_bug = nomax_sessions = 4096}Module: Linked to sub-module rlm_eap_md5Module: Instantiating eap-md5Module: Linked to sub-module rlm_eap_leapModule: Instantiating eap-leapModule: Linked to sub-module rlm_eap_gtcModule: Instantiating eap-gtcgtc {challenge = "Password: "auth_type = "PAP"}Module: Linked to sub-module rlm_eap_tlsModule: Instantiating eap-tlstls {rsa_key_exchange = nodh_key_exchange = yesrsa_key_length = 512dh_key_length = 512verify_depth = 0CA_path = "/usr/local/etc/raddb/certs"pem_file_type = yesprivate_key_file = "/usr/local/etc/raddb/certs/server.pem"certificate_file = "/usr/local/etc/raddb/certs/server.pem"CA_file = "/usr/local/etc/raddb/certs/ca.pem"private_key_password = "whatever"dh_file = "/usr/local/etc/raddb/certs/dh"random_file = "/usr/local/etc/raddb/certs/random"fragment_size = 1024include_length = yescheck_crl = nocipher_list = "DEFAULT"make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"cache {enable = nolifetime = 24max_entries = 255}verify {}}Module: Linked to sub-module rlm_eap_ttlsModule: Instantiating eap-ttlsttls {default_eap_type = "md5"copy_request_to_tunnel = nouse_tunneled_reply = novirtual_server = "inner-tunnel"include_length = yes}Module: Linked to sub-module rlm_eap_peapModule: Instantiating eap-peappeap {default_eap_type = "mschapv2"copy_request_to_tunnel = nouse_tunneled_reply = noproxy_tunneled_request_as_eap = yesvirtual_server = "inner-tunnel"}Module: Linked to sub-module rlm_eap_mschapv2Module: Instantiating eap-mschapv2mschapv2 {with_ntdomain_hack = no}Module: Checking authorize {...} for more modules to loadModule: Linked to module rlm_realmModule: Instantiating module "suffix" from file/usr/local/etc/raddb/modules/realmrealm suffix {format = "suffix"delimiter = "@"ignore_default = noignore_null = no}Module: Linked to module rlm_filesModule: Instantiating module "files" from file/usr/local/etc/raddb/modules/filesfiles {usersfile = "/usr/local/etc/raddb/users"acctusersfile = "/usr/local/etc/raddb/acct_users"preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"compat = "no"}Module: Checking session {...} for more modules to loadModule: Linked to module rlm_radutmpModule: Instantiating module "radutmp" from file/usr/local/etc/raddb/modules/radutmpradutmp {filename = "/usr/local/var/log/radius/radutmp"username = "%{User-Name}"case_sensitive = yescheck_with_nas = yesperm = 384callerid = yes}Module: Checking post-proxy {...} for more modules to loadModule: Checking post-auth {...} for more modules to loadModule: Linked to module rlm_attr_filterModule: Instantiating module "attr_filter.access_reject" from file/usr/local/etc/raddb/modules/attr_filterattr_filter attr_filter.access_reject {attrsfile = "/usr/local/etc/raddb/attrs.access_reject"key = "%{User-Name}"}} # modules} # serverserver { # from file /usr/local/etc/raddb/radiusd.confmodules {Module: Checking authenticate {...} for more modules to loadModule: Linked to module rlm_digestModule: Instantiating module "digest" from file/usr/local/etc/raddb/modules/digestModule: Checking authorize {...} for more modules to loadModule: Linked to module rlm_preprocessModule: Instantiating module "preprocess" from file/usr/local/etc/raddb/modules/preprocesspreprocess {huntgroups = "/usr/local/etc/raddb/huntgroups"hints = "/usr/local/etc/raddb/hints"with_ascend_hack = noascend_channels_per_line = 23with_ntdomain_hack = nowith_specialix_jetstream_hack = nowith_cisco_vsa_hack = nowith_alvarion_vsa_hack = no}/usr/local/etc/raddb/sites-enabled/default[159]: Failed to load module"sql"./usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorizesection.

2 1

use existing sql table for user-password
by Oguzhan Kayhan 02 Dec '10

02 Dec '10

Hello, I want to use freeradius for wireless authentication. I got an already installed mysql server, and some tables including usernames and passwords. I want to use this user/passwords with freeradius. How can it be possible? I will create a radius table to keep logs etc, but just to use user/passwd field..can i use another table?

2 3

Mikrotik-Xmit-Limit - Not enforced on first logon but is on subsequent logons...
by Shane Hart 02 Dec '10

02 Dec '10

Hi all, Doing some trials with freeradius 2.x with the intention of moving from 1.1.7 I have an odd problem with mikrotik nas. An account with download limit will not enforce the limit on the first logon but will on subsequent logons. On the first logon, no limit is imposed in mikrotik and the account can use unlimited traffic. If I log off then log on again, the limit is enforced... (I have checked in winbox and the "limit bytes in" column is not populated on first logon). It is taking me a while to get use to v2 of freeradius. Tks Setup details below: User account has attribute Mikrotik-Xmit-Limit := 10471200 in radcheck Do I need to have something in radreply as this is where the shaping is done? In: sql/mysql/counter.conf sqlcounter downloadbytecounter { counter-name = Mikrotik-Xmit-Limit check-name = Mikrotik-Xmit-Limit reply-name = Mikrotik-Xmit-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(acctoutputoctets) FROM radacct WHERE username='%{%k}'" } In sites-available/default authorize { downloadbytecounter

2 1

In what file are enlisted to users?
by Jess Tafo11a 02 Dec '10

02 Dec '10

Hello friends my name´s Jesus I have a problem, I am using freeradius on my virual machine to the ubuntu version 9.10 and want to add clients for my freeradius detect the mac address that I enter. The question is: Is there any easy way to add clients? Yo I have installed: The virtualbox version 3.2.10 Ubuntu version 9.10 Freeradius version 1.2.1910

1 0

Re: dynamically selecting, which attribute to evaluate
by Alan DeKok 01 Dec '10

01 Dec '10

Stefan A. wrote: > :-( but thanks, Alan, > > Unfortunately, I've never have been able to build FR with perl on my x86 > Solaris 10 boxes... but we well keep trying ;-) It should be possible. > > For the meantime, would it be feasable to > > update control { > temp_attribute := "reply:%{control:TicketType}-trigger-reactivation" > } > > and later > > if ("%{control:temp_attribute}" != ""){ > do the rest > } <sigh> I said: >> You can't really do two levels of expansion like that, sorry. >> >>> Why does it not expand the %{control:TicketType} to Ticket245 in this >>> situation? >> You can't really do two levels of expansion like that, sorry. I suggest reading the messages on this list. Alan DeKok.

2 1