June 2010 - Freeradius-Users - lists.freeradius.org

authentication != authorization
by Erik Norgaard 15 Jun '10

15 Jun '10

Hi: I currently use freeradius 2.1.6 for authentication on my Wlan with WPA2-EAP-TLS. Now, I'd like to deploy multiple policies and authentication methods. As I use freeradius now, an authenticated user is authorized to whatever. I'd like to be able to differenciate this authorization such that, i.e. some users have full access, while other users have restricted access and others have no access even if authenticated successfully. Is there some way of having freeradius call a script or connect to some service, submitting the user authentication details and ip/mac address such that access can be granted according to the user privileges? More precisely, I'd like to deploy the following policies: a. If a user authenticates with a certificate I issued, I trust them with full access. b. If the user authenticates with a foreign trusted certificate I will grant web/mail access c. If the user authenticates with a temporal password, time limited access is granted to web/mail access d. If the user fails to authenticate, any web access is redirected to a web page explaining how to configure the system or request access So, even failure to authenticate should result in some sort of guest authentication without privileges. Regarding c, how can I manage temporal accounts? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818/+34.915211157 http://www.locolomo.org

1 0

Re: Send Accounting from any point in configuration
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I mean *create* an Accounting Packet, if an Access Request comes in. Use "radclient". > This is will be used to provision a HTTP Proxy Platform about the upcoming > isage of an IP address. Oh... that. The HTTP proxy is completely and totally broken. Using accounting packet to provision data is wrong. I'll go update the RADIUS specs to say that. > I will have to check any Accounting Packet for some Attributes/Values. > If a packet matches, it has to be proxied to a destination RADIUS Server. > > For instance: > if > NAS-IP-Address = 10.10.19.173 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.1.1 > > if > NAS-IP-Address = 10.10.18.120 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.100.100 > > else > do not proxy > > In that case, I have to check the attributes to decide, to which RADISU > Server I have to send the packets. See "man unlang". You can write rules that look pretty much like what you have above. > I found the section in the proxy.conf: > > # rlm_realm"). To manually proxy the request put this entry in the > # "users" file: > # > # > #DEFAULT Proxy-To-Realm := "realm_name" > # > > > Does it mean, that the lines un users file will do the work? Well... yes. That's the intent of the documentation. > DEFAULT NAS-IP-Address = 10.10.19.173, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination1" > DEFAULT NAS-IP-Address = 10.10.18.120, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination2" Except see "man users". You need to use the *correct* comparison operators. And doing this is pointless: Acct-Status-Type =* "". Just delete that check. > Is manual proxying in unlang possible, using sites-available/default ? Yes. Anything you can do in the "users" file you can do in "unlang". Alan DeKok.

1 0

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 14 Jun '10

14 Jun '10

Hi, > what version of OpenSSL have your got. what is the configuration of > eap.cofn regarding random option and does the file/link have read access > (or even exist!?)#> openssl version OpenSSL 0.9.8h 28 May 2008 The eap.conf is the default directly from the original freeradius-server-2.1.9, and all *.conf files have read access. Thanks for your help. Cheers, Henry _________________________________________________________________ Find a way to cure that travel bug MSN NZ Travel http://travel.msn.co.nz/

2 1

accounting without auth
by Omer Faruk Sen 14 Jun '10

14 Jun '10

Hi , Is it possible to configure freeradius for accounting only without authorization/authentication? Maybe by granting access to every auth request can be done but I want to hear your opinion before proceeding any further. Regards.

3 2

Re: Proxy to two RADIUS Servers
by Arran Cudbard-Bell 14 Jun '10

14 Jun '10

Use copy-acct-to-home-server, it's what it's there for. Delay is usually sub second, but it depends on the throttling values you set in the detail reader server. On 14/06/2010, Stefan A. <a.freeradius(a)premit.de> wrote: > I checked, whether I am able to manually proxy from sites-available/default, > using unlang. > It works fine, using the following commands. > > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > } > } > } > > > But I do not get it to work, if I try to proxy the same packet to two > servers: > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > Replicate-To-Realm += "DEST2" > } > } > } > > I only uses the first 'Replicate-To-Realm' entry DEST1 and does not seem to > cycle through a list or destination RADIUS Servers... > > > Is this the intended behavior? Should I go for 'copy-acct-to-home-server' ? > How much delay would this add between writing the file and sending the > packet to the home server? > > > Thank you > Stefan > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

FR 2.1.9 - segfault using status server
by John Horne 14 Jun '10

14 Jun '10

Hello, We are running FR 2.1.9 on CentOS 5, and are proxying requests to MS IAS 2003 servers. However, it seems the IAS servers do not support 'status-server' requests until a slightly later version. As such, I have configured FR to send a dummy userid/pwd instead. FR seems to receive a reply, but then segfaults. Running 'radiusd -X' shows: ============================================= Marking home server 141.163.66.101 port 1812 as zombie (it looks like it is dead). Sending Access-Request of id 168 to 141.163.66.101 port 1812 User-Name := "xxxxxx" User-Password := "xxxxxx" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.2 seconds. rad_recv: Access-Reject packet from host 141.163.66.101 port 1812, id=168, length=20 ============================================= So a reply was received, but radiusd has now died. Getting radiusd to dump a core file shows: ============================================= # gdb /usr/sbin/radiusd core.8509 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.1) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/radiusd...(no debugging symbols found)...done. Reading symbols from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /usr/lib/libltdl.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libltdl.so.3 Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/libssl.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.2 Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5.so.3 Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libcom_err.so.2 Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libk5crypto.so.3 Reading symbols from /usr/lib/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5support.so.0 Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libkeyutils.so.1 Reading symbols from /lib/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libselinux.so.1 Reading symbols from /lib/libsepol.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libsepol.so.1 Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /lib/libnss_dns.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_dns.so.2 Reading symbols from /usr/lib/freeradius/rlm_exec.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_exec.so Reading symbols from /usr/lib/freeradius/rlm_expr.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expr.so Reading symbols from /usr/lib/freeradius/rlm_expiration.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expiration.so Reading symbols from /usr/lib/freeradius/rlm_logintime.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_logintime.so Reading symbols from /usr/lib/freeradius/rlm_pap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_pap.so Reading symbols from /usr/lib/freeradius/rlm_mschap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_mschap.so Reading symbols from /usr/lib/freeradius/rlm_eap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap.so Reading symbols from /usr/lib/freeradius/libfreeradius-eap-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-eap-2.1.9.so Reading symbols from /usr/lib/freeradius/rlm_eap_tls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_tls.so Reading symbols from /usr/lib/freeradius/rlm_eap_ttls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_ttls.so Reading symbols from /usr/lib/freeradius/rlm_eap_peap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_peap.so Reading symbols from /usr/lib/freeradius/rlm_eap_mschapv2.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_mschapv2.so Reading symbols from /usr/lib/freeradius/rlm_realm.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_realm.so Reading symbols from /usr/lib/freeradius/rlm_files.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_files.so Reading symbols from /usr/lib/freeradius/rlm_radutmp.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_radutmp.so Reading symbols from /usr/lib/freeradius/rlm_attr_filter.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_attr_filter.so Reading symbols from /usr/lib/freeradius/rlm_preprocess.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_preprocess.so Reading symbols from /usr/lib/freeradius/rlm_acct_unique.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_acct_unique.so Reading symbols from /usr/lib/freeradius/rlm_detail.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_detail.so Core was generated by `/usr/sbin/radiusd -X'. Program terminated with signal 11, Segmentation fault. #0 0x0806c936 in received_proxy_response () (gdb) bt #0 0x0806c936 in received_proxy_response () #1 0x0805a041 in ?? () #2 0x0806b110 in ?? () #3 0x00ac1f0d in fr_event_loop () from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so #4 0x0806bd26 in radius_event_process () #5 0x08063f6a in main () (gdb) q ============================================= The proxy.conf part just has: ============================================= status_check = request username = xxxxxx password = xxxxxx ============================================= Has anyone else seen this problem? At the moment we are running FR with the 'status_check = status-server' enabled, since it seems better to receive no reply at all rather than having radiusd segfaulting. Thanks, John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

3 3

Re: Send Accounting from any point in configuration
by Alan DeKok 14 Jun '10

14 Jun '10

Stefan A. wrote: > I want to send RADIUS Accounting Messages to another RADIUS Server, > depending on some contents of a Packet. > > 'a Packet' in this context might be an Access or an Accounting Packet. The Access-Request && Accounting-Request packets are handled independently. If you want to change accounting behavior based on authentication packets, you will need to store information in database. > The intended Flow: > > Packet comes in ... > - for Access type, check if user might be authenticated > - if OK, try to decide to send an Accounting packet to a Server on some > attributes (in my case, VSA from downstream RADIUS Proxy Server) Do you mean *create* an accounting packet, or forward *later* accounting packets for that session? > - (possibly) don't care about the answer > - for Access type: accept/reject to Client > - for Accounting type: ACK to Client > > > As far as I understood, the proxy module does > - (only) proxy based on realm > - in proxy module, normal local Logfiles won't be used That's not true. You can proxy based on anything you want. See raddb/proxy.conf for documentation. You can proxy *and* log to detail files. Alan DeKok.

2 1

Some questions about freeradius for WiMAX
by WWF 14 Jun '10

14 Jun '10

Hi,all! I have several questions about fr 2.19 for WiMAX systems. 1. My network is a private network and does not need accounting.Then if I reply access accept with "Accounting-capabilities = 0", whether the ms can know about it and won't send accounting packets to my freeradius? 2. How to set values for these attributes: WiMAX-AAA-Session-ID = ? WiMAX-HA-RK-SPI = ? WiMAX-HA-RK-Lifetime = ? 3. How to add support for the "Error-Cause" attribute defined in rfc 3576. It seems no code for it in current implementation of 2.1.9 fr. 4. What the "disconnect request message" for? (for accounting?) I found in wiki that current implementation does not support this message. Thanks for your relpy. 2010-06-08

3 2

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 14 Jun '10

14 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help ----------------

2 1

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 13 Jun '10

13 Jun '10

Hi, >>> I have a problem running the 'radiusd -X'. The error messages are as the following: >>default new install from source? the EAP part needs some certs being made.....see >>this bit: >>> make_cert_command = "/etc/raddb/certs/bootstrap" >>this runs /etc/raddb/certs/bootstrap script to make some temporary basic/fake >>certs for testing. perhaps the user/group that radiusd is being run as cannot >>run the script. >>run the script manually and see what happens I have manually run the script, looks better. But when I run the 'radiusd -X' again, other errors appear: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Can you please advise me again what's the problem? Cheers, Henry _________________________________________________________________ Want to be a Space Travel Agent? If it exists, you'll find it on SEEK http://clk.atdmt.com/NMN/go/157639089/direct/01/

2 1