June 2010 - Freeradius-Users - lists.freeradius.org

FreeRadius + AD + Realms
by Matthew P 30 Jun '10

30 Jun '10

Hello everyone! I'm new to FreeRadius, so please bear with me. :) Goal: Make FreeRadius look-up a user in ActiveDirectory if he has "mydomain.com" domain. Used method: EAP/TTLS (PAP in the tunnel) This is how I've done it, but it doesn't give the wanted results, so please explain a bit. :) (it doesn't seem to load the local_ad virtual server configuration, which is I placed in the sites-enabled directory, it seems to just carry on executing the default server) parts from proxy.conf: proxy server { default_fallback = no } home_server localhost_ad { type = auth virtual_server = local_ad } home_server_pool active_directory { type = fail-over virtual_server = local_ad home_server = localhost_ad } realm mydomain.com { auth_pool = active_directory } And the output: rad_recv: Access-Request packet from host 192.168.0.101 port 1812, id=8, length=138 NAS-IP-Address = 192.168.0.101 NAS-Port-Type = Async User-Name = "user(a)mydomain.com" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-11-22-33-44-55" EAP-Message = 0x0200001d016a73691d756e646363406c73732d6e65542e6c73732e6872 Message-Authenticator = 0x10017179767a5ab6718168e8399c8993 +- entering group authorize ++[preprocess] returns ok rlm_realm: Looking up realm "mydomain.com" for User-Name = "user(a)mydomain.com" rlm_realm: Found realm "mydomain.com" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "mydomain.com" rlm_realm: Proxying request from user user to realm mydomain.com rlm_realm: Preparing to proxy authentication request to realm "mydomain.com" ++[suffix] returns updated rlm_eap: Request is supposed to be proxied to Realm mydomain.com. Not doing EAP. ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop There was no response configured: rejecting request 0 Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> user(a)mydomain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Thanks in advance! _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

Netmask HowTo
by loki 30 Jun '10

30 Jun '10

Greets, I have the following setup: freeradius 2.0.5 with sqlippool. Now my question: How can I setup radius to get it's netmask from sqlippool based on the pool name. For instance. I have two pools named pool1 and pool2 in mysql. Now on pool1 I want to have the netmask 255.255.255.128 and on pool2 I want to have netmask 255.255.255.0. How do I achieve that? I have tried the net and some trial and error runs, but got mostly errors. :-) THX in advance... __________ Information from ESET Mail Security, version of virus signature database 5238 (20100629) __________ The message was checked by ESET Mail Security. http://www.eset.com

1 0

Re: Expanding Suffix or Realm attributes
by Rob Turner 30 Jun '10

30 Jun '10

----- Original Message ----- > From: "Rob Turner" <rob(a)crosscut.org> > To: freeradius-users(a)lists.freeradius.org > Sent: Tuesday, June 29, 2010 9:55:57 PM > Subject: Expanding Suffix or Realm attributes > Problem: Cannot expand %{Realm} or %{Suffix} control attributes for > use unless realm is explicitly defined in proxy.conf > > I'm using freeradius2-2.1.7-7.el5 with ldap module. I would like to > perform an ldap dip to get the radiusProxyToRealm attribute for each > request based on Suffix as configured in modules/ldap: > > filter = "(radiusRealm=%{Suffix})" > > NOTE: If using <filter = "(radiusRealm=domain.com)"> in modules/ldap, > radiusProxyToRealm is returned successfully and things work as > expected. In this case the Proxy-To-Realm (which is mapped in > ldap.attrmap) is set in ldap to proxy.com and proxy.com is defined in > proxy.conf. > > Output from radiusd -X: > ... [suffix] Looking up realm "domain.com" for User-Name = > "test(a)domain.com" [suffix] No such realm "domain.com" > ++[suffix] returns noop > ++[files] returns noop > [ldap] performing user authorization for test(a)domain.com > [ldap] expand: (radiusRealm=%{Suffix}) -> (radiusRealm=) > ... > > After reading man unlang, I have also attempted (without success) to > expand using the following in ldap filter: > > %{control:Realm} > %{control:Suffix} %{suffix:User-Name} > %{realm:User-Name} > > Finally, after revisiting man rlm_realm, I read the following which is > of concern as I don't see any other way to utilize the > radiusProxyToRealm attribute in ldap: > > "In either case, a Realm attribute is created and added to the packet > on a match, which can be used by other modules." > > Is there currently anyway to always match (regardless if the realm is > defined in proxy.conf) in order to create a Stripped-User-Name and > Realm run-time variable with every request? > > Regards, > > Rob > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Also, I've tried to use a regex realm such as realm "~.*\\.*\\.*$" { ignore_default = yes nostrip } Output from radiusd -X: ... [suffix] Looking up realm "domain.com" for User-Name = "test(a)domain.com" [suffix] Found realm "~.*\.*\.*$" [suffix] Adding Realm = "~.*\.*\.*$" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[files] returns noop [ldap] performing user authorization for test(a)domain.com [ldap] expand: (radiusRealm=%{Realm}) -> (radiusRealm=~.\2a\5c.\2a\5c.\2a$) ... The regex realm would work if I could use the Suffix or Realm attribute from something like the check or control list rather than "~.\2a\5c.\2a\5c.\2a$" Thanks, Rob

2 1

Expanding Suffix or Realm attributes
by Rob Turner 30 Jun '10

30 Jun '10

Problem: Cannot expand %{Realm} or %{Suffix} control attributes for use unless realm is explicitly defined in proxy.conf I'm using freeradius2-2.1.7-7.el5 with ldap module. I would like to perform an ldap dip to get the radiusProxyToRealm attribute for each request based on Suffix as configured in modules/ldap: filter = "(radiusRealm=%{Suffix})" NOTE: If using <filter = "(radiusRealm=domain.com)"> in modules/ldap, radiusProxyToRealm is returned successfully and things work as expected. In this case the Proxy-To-Realm (which is mapped in ldap.attrmap) is set in ldap to proxy.com and proxy.com is defined in proxy.conf. Output from radiusd -X: ... [suffix] Looking up realm "domain.com" for User-Name = "test(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for test(a)domain.com [ldap] expand: (radiusRealm=%{Suffix}) -> (radiusRealm=) ... After reading man unlang, I have also attempted (without success) to expand using the following in ldap filter: %{control:Realm} %{control:Suffix} %{suffix:User-Name} %{realm:User-Name} Finally, after revisiting man rlm_realm, I read the following which is of concern as I don't see any other way to utilize the radiusProxyToRealm attribute in ldap: "In either case, a Realm attribute is created and added to the packet on a match, which can be used by other modules." Is there currently anyway to always match (regardless if the realm is defined in proxy.conf) in order to create a Stripped-User-Name and Realm run-time variable with every request? Regards, Rob

2 1

"Fast reconnect"
by Bob Franklin 29 Jun '10

29 Jun '10

Hello, I'm a bit hazy on "fast reconnect" -- from what I've ready in the list archives and found on various other sites, it uses cached information about the state of the TLS dialogue with the server terminating the EAP connection to reduce the number of messages which must be exchanged as a supplicant authenticates when moving (say) wireless access point. Looking at the FreeRADIUS changes, history it seems support for this was added in 2.1.1 for EAP-TLS (which I assume affects EAP-PEAP and EAP-TTLS, both of which we're using). Would I be right in thinking that, if the cached state is NOT found on the backend RADIUS server (there may be one or more proxies in the way, especially if the user is logging in over eduroam, but I assume that that doesn't matter, as they just proxy things through) that the device authenticating will just start the TLS negotiation from scratch and the user won't notice anything, except maybe a slightly longer time to roam between wireless access points (but, in practice, probably so quick, they won't)? This would also presumably be the case if the next authentication happened to take place against a different backend server at our eduroam 'home' site as there is no way to synchronise these caches. In other words, the only reason to untick the 'Fast reconnect' box on (for example) a Windows machine would be if there was a suspicion that this was either broken, or you wanted to force the full TLS negotiation to restart, as the user moved access points. [Does anyone know of a broken wireless NAS which complains if the full TLS conversation doesn't start from scratch, as you move around.] I'm just trying to see if there's a reason why anyone should NOT tick this box on a supplicant device. We're running FreeRADIUS >2.1.1. Thanks in advance, - Bob -- Bob Franklin <rcf34(a)cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service

2 1

FR 2.1.8 Issue - Unjustified(?) Access-Rejects.
by Palmer J.D.F. 29 Jun '10

29 Jun '10

Hi, We migrated to 2.1.8 (from 2.1.7) last week while things were quiet, as the users have re-appeared after the holiday we've started to receive a few reports from users stating that they have been getting lots of prompts for credentials. Two users in particular, both Ubuntu users, have been having big problems. I had a look at the radpostauth table and sure enough at least 50% of their auth attempts have resulted in access-rejects. I rolled back to 2.1.7 this afternoon and the problem has gone away. Should anyone be interested I have attached an radmin output for one of the users, it shows some accepts and lots of rejects. Is this likely to be a configuration error (no changes were made to the 2.1.7 config), or a bug? Thanks, Jezz Palmer.

7 16

How to use Freeradius with traffic limit?
by RaidenII 29 Jun '10

29 Jun '10

Hi, I'm running Freeradius 2.1+Postgresql 8.4.4+OpenVPN on Ubuntu 9.10 x86. It runs smoothly now, however, I want to know that if there is any way to limit per user's traffic, like 10G/month, and disconnect/reject their connection when the limitation has reached. It seems the the column AcctInputOctets and AcctOutputOctets is responsible for traffic calculation, how should I limit user's traffic by using these two? Thanks in advance. -- View this message in context: http://old.nabble.com/How-to-use-Freeradius-with-traffic-limit--tp28809968p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 11

users rights seperations
by Ömer Tuğrul 29 Jun '10

29 Jun '10

Hi, my freeradius version is 2.1.4 I have network devices that I authenticate the network managers to console these devices with radius server based on users file. Now I need to use 802.1x authentication for wireless APs based on ldap authentication. My question is; How can I seperate network management authentication and internet access authentication rights? I mean, I don't want that some ldap users to console my network devices. I just want to allow them to authenticate internet access and some ldap users may console to devices. firstly, I heard that i could use clients.conf file with virtual-server parameter (and sites-enabled/virtual_server_ name...); but then I could only use the authenticator-device for one method if I got it right. I am confused there. I am sorry if i am not clear, please let me know...

2 1

Regular expression in postauth section
by JOE 29 Jun '10

29 Jun '10

Hi all Is possible to add a regular expression to the postauth section as follows?: Post-Auth-Type REJECT { if(%{User-Name}=="test") { ok } else { attr_filter.access_reject sql } } Regards!

3 3

Wimax TLV definitions
by Ricardo Larrañaga 29 Jun '10

29 Jun '10

Hello everyone. I have a question about TLV definitions on Freeradius dictionaries. From what i understand from the standard, the Type field for TLV can be up to two bytes. But when i tried to define a tlv bigger than 255 i get an error when Freeradius tries to read the dictionary: Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary.wimax[190]: sub-tlv's cannot have value > 255 Is this a non supported length or am i misinterpreting the standard? if it is just unsupported, is there any plan to support tlv>255? Thanks

2 3