July 2010 - Freeradius-Users - lists.freeradius.org

Failed disabling Core Dumps on RHEL - SELinux Updates
by Ben Wiechman 02 Jul '10

02 Jul '10

A note for those that may run into this as well. When updating FR to 2.1.9 on RHEL/CentOS with SELinux enabled FreeRADIUS would log the following when it was started: Wed Jun 2 16:19:57 2010 : Error: Failed disabling core dumps: Permission denied To resolve I had to install the following modifications to the default SELinux policy # cat freeradius2.te module freeradius2 1.0; require { type radiusd_t; class process setrlimit; } #============= radiusd_t ============== allow radiusd_t self:process setrlimit; This allowed the daemon to properly disable core dumps. Ben Wiechman Wisper High Speed Internet

4 7

Authentication delegation
by Maria Sanchez 02 Jul '10

02 Jul '10

In the operational environment there is a RADIUS server that is already configured to handle authentication and has all the corresponding accounts. I would like to make use of the Authorization part of RADIUS and install my own server for this purpose. However I need to configure it to pass the authentication messages to the "main" RADIUS server. Is there a way to do this? A secondary radius server configured to pass authentication onto another server? The authorization rules are defined in the secondary server. Thanks for any help.....

1 0

Starent NAS dictionary
by JOE 02 Jul '10

02 Jul '10

Hi all Freeradius can't parse this dictionary. Fails with ' invalid keyword "MACRO"': ############################################################################## # Starent Networks Dictionary for ST16 ############################################################################## # # Use the Radius specification attributes in lieu of the starent ones # #(a)radius.dct # # Define additional starent parameters # (add starent specific attributes below) MACRO SN-VSA(t,v) 26 [vid=8164 type2=%t% len2=+4 data=%v%] ATTRIBUTE SN-VPN-ID SN-VSA(1, integer) r ATTRIBUTE SN-VPN-Name SN-VSA(2, string) r ATTRIBUTE SN-Disconnect-Reason SN-VSA(3, integer) VALUE SN-Disconnect-Reason Not-Defined 0 VALUE SN-Disconnect-Reason Admin-Disconnect 1 VALUE SN-Disconnect-Reason Remote-Disconnect 2 VALUE SN-Disconnect-Reason Local-Disconnect 3 VALUE SN-Disconnect-Reason Disc-No-Resource 4 VALUE SN-Disconnect-Reason Disc-Excd-Service-Limit 5 VALUE SN-Disconnect-Reason PPP-LCP-Neg-Failed 6 VALUE SN-Disconnect-Reason PPP-LCP-No-Response 7 VALUE SN-Disconnect-Reason PPP-LCP-Loopback 8 VALUE SN-Disconnect-Reason PPP-LCP-Max-Retry 9 VALUE SN-Disconnect-Reason PPP-Echo-Failed 10 VALUE SN-Disconnect-Reason PPP-Auth-Failed 11 VALUE SN-Disconnect-Reason PPP-Auth-Failed-No-AAA-Resp 12 VALUE SN-Disconnect-Reason PPP-Auth-No-Response 13 VALUE SN-Disconnect-Reason PPP-Auth-Max-Retry 14 VALUE SN-Disconnect-Reason Invalid-AAA-Attr 15 VALUE SN-Disconnect-Reason Failed-User-Filter 16 VALUE SN-Disconnect-Reason Failed-Provide-Service 17 VALUE SN-Disconnect-Reason Invalid-IP-Address-AAA 18 VALUE SN-Disconnect-Reason Invalid-IP-Pool-AAA 19 VALUE SN-Disconnect-Reason PPP-IPCP-Neg-Failed 20 VALUE SN-Disconnect-Reason PPP-IPCP-No-Response 21 VALUE SN-Disconnect-Reason PPP-IPCP-Max-Retry 22 VALUE SN-Disconnect-Reason PPP-No-Rem-IP-Address 23 VALUE SN-Disconnect-Reason Inactivity-Timeout 24 VALUE SN-Disconnect-Reason Session-Timeout 25 VALUE SN-Disconnect-Reason Max-Data-Excd 26 VALUE SN-Disconnect-Reason Invalid-IP-Source-Address 27 VALUE SN-Disconnect-Reason MSID-Auth-Failed 28 VALUE SN-Disconnect-Reason MSID-Auth-Fauiled-No-AAA-Resp 29 VALUE SN-Disconnect-Reason A11-Max-Retry 30 VALUE SN-Disconnect-Reason A11-Lifetime-Expired 31 VALUE SN-Disconnect-Reason A11-Message-Integrity-Failure 32 VALUE SN-Disconnect-Reason PPP-lcp-remote-disc 33 VALUE SN-Disconnect-Reason Session-setup-timeout 34 VALUE SN-Disconnect-Reason PPP-keepalive-failure 35 VALUE SN-Disconnect-Reason Flow-add-failed 36 VALUE SN-Disconnect-Reason Call-type-detection-failed 37 VALUE SN-Disconnect-Reason Wrong-ipcp-params 38 VALUE SN-Disconnect-Reason MIP-remote-dereg 39 VALUE SN-Disconnect-Reason MIP-lifetime-expiry 40 VALUE SN-Disconnect-Reason MIP-proto-error 41 VALUE SN-Disconnect-Reason MIP-auth-failure 42 VALUE SN-Disconnect-Reason MIP-reg-timeout 43 VALUE SN-Disconnect-Reason Invalid-dest-context 44 VALUE SN-Disconnect-Reason Source-context-removed 45 VALUE SN-Disconnect-Reason Destination-context-removed 46 VALUE SN-Disconnect-Reason Req-service-addr-unavailable 47 VALUE SN-Disconnect-Reason Demux-mgr-failed 48 VALUE SN-Disconnect-Reason Internal-error 49 ATTRIBUTE SN-PPP-Progress-Code SN-VSA(4, integer) VALUE SN-PPP-Progress-Code Not-Defined 0 VALUE SN-PPP-Progress-Code Call-Lcp-Down 1 VALUE SN-PPP-Progress-Code Call-Disconnecting 2 VALUE SN-PPP-Progress-Code Call-Ppp-Renegotiating 3 VALUE SN-PPP-Progress-Code Call-Arrived 11 VALUE SN-PPP-Progress-Code Call-Lcp-Up 12 VALUE SN-PPP-Progress-Code Call-Authenticating 13 VALUE SN-PPP-Progress-Code Call-Authenticated 14 VALUE SN-PPP-Progress-Code Call-Ipcp-Up 15 VALUE SN-PPP-Progress-Code Call-Simple-IP-Connected 16 VALUE SN-PPP-Progress-Code Call-Mobile-IP-Connected 17 ATTRIBUTE SN-Primary-DNS-Server SN-VSA(5, ipaddr) r ATTRIBUTE SN-Secondary-DNS-Server SN-VSA(6, ipaddr) r ATTRIBUTE SN-Re-CHAP-Interval SN-VSA(7, integer) r ATTRIBUTE SN-IP-Pool-Name SN-VSA(8, string) R ATTRIBUTE SN-PPP-Data-Compression SN-VSA(9, integer) r VALUE SN-PPP-Data-Compression None 0 VALUE SN-PPP-Data-Compression Stac-LZS 1 VALUE SN-PPP-Data-Compression MPPC 2 VALUE SN-PPP-Data-Compression MPCC-Stac-LZS 3 VALUE SN-PPP-Data-Compression Deflate 4 VALUE SN-PPP-Data-Compression Deflate-Stac-LZS 5 VALUE SN-PPP-Data-Compression Deflate-MPCC 6 VALUE SN-PPP-Data-Compression Deflate-MPCC-Stac-LZS 7 ATTRIBUTE SN-IP-Filter-In SN-VSA(10, stringnz) RO ATTRIBUTE SN-IP-Filter-Out SN-VSA(11, string) R ATTRIBUTE SN-Local-IP-Address SN-VSA(13, ipaddr) cr ATTRIBUTE SN-IP-Source-Validation SN-VSA(14, integer) r VALUE SN-IP-Source-Validation No 0 VALUE SN-IP-Source-Validation Yes 1 ATTRIBUTE SN-PPP-Outbound-Password SN-VSA(15, string) r ATTRIBUTE SN-PPP-Keepalive SN-VSA(16, integer) r ATTRIBUTE SN-IP-In-ACL SN-VSA(17, stringnz) CR ATTRIBUTE SN-IP-Out-ACL SN-VSA(18, stringnz) CR ATTRIBUTE SN-PPP-Data-Compression-Mode SN-VSA(19, integer) r ATTRIBUTE SN-Subscriber-Permission SN-VSA(20, integer) r VALUE SN-Subscriber-Permission None 0 VALUE SN-Subscriber-Permission Simple-IP 1 VALUE SN-Subscriber-Permission Mobile-IP 2 VALUE SN-Subscriber-Permission Simple-IP-Mobile-IP 3 VALUE SN-Subscriber-Permission HA-Mobile-IP 4 VALUE SN-Subscriber-Permission Simple-IP-HA-Mobile-IP 5 VALUE SN-Subscriber-Permission Mobile-IP-HA-Mobile-IP 6 VALUE SN-Subscriber-Permission All 7 ATTRIBUTE SN-Admin-Permission SN-VSA(21, integer) r VALUE SN-Admin-Permission None 0 VALUE SN-Admin-Permission CLI 1 VALUE SN-Admin-Permission FTP 2 ATTRIBUTE SN-Simultaneous-SIP-MIP SN-VSA(22, integer) r VALUE SN-Simultaneous-SIP-MIP Disabled 0 VALUE SN-Simultaneous-SIP-MIP Enabled 1 ATTRIBUTE SN-Min-Compress-Size SN-VSA(23, integer) r VALUE SN-PPP-Data-Compression-Mode Normal 0 VALUE SN-PPP-Data-Compression-Mode Stateless 1 ATTRIBUTE SN-Tunnel-Load-Balancing SN-VSA(27, integer) rt VALUE SN-Tunnel-Load-Balancing random 1 VALUE SN-Tunnel-Load-Balancing balanced 2 VALUE SN-Tunnel-Load-Balancing prioritized 3 ATTRIBUTE SN-Rad-APN-Name SN-VSA(162, stringnz) Cr ATTRIBUTE SNA-PPP-Unfr-data-In-Oct SN-VSA(200, integer) ATTRIBUTE SNA-PPP-Unfr-data-Out-Oct SN-VSA(201, integer) ATTRIBUTE SNA-PPP-Ctrl-Input-Octets SN-VSA(1001, integer) ATTRIBUTE SNA-PPP-Ctrl-Output-Octets SN-VSA(1002, integer) ATTRIBUTE SNA-PPP-Ctrl-Input-Packets SN-VSA(1003, integer) ATTRIBUTE SNA-PPP-Ctrl-Output-Packets SN-VSA(1004, integer) ATTRIBUTE SNA-PPP-Framed-Input-Octets SN-VSA(1005, integer) ATTRIBUTE SNA-PPP-Framed-Output-Octets SN-VSA(1006, integer) ATTRIBUTE SNA-PPP-Discards-Input SN-VSA(1007, integer) ATTRIBUTE SNA-PPP-Discards-Output SN-VSA(1008, integer) ATTRIBUTE SNA-PPP-Errors-Input SN-VSA(1009, integer) ATTRIBUTE SNA-PPP-Errors-Output SN-VSA(1010, integer) ATTRIBUTE SNA-PPP-Bad-Addr SN-VSA(1011, integer) ATTRIBUTE SNA-PPP-Bad-Ctrl SN-VSA(1012, integer) ATTRIBUTE SNA-PPP-Packet-Too-Long SN-VSA(1013, integer) ATTRIBUTE SNA-PPP-Bad-FCS SN-VSA(1014, integer) ATTRIBUTE SNA-PPP-Echo-Req-Input SN-VSA(1015, integer) ATTRIBUTE SNA-PPP-Echo-Req-Output SN-VSA(1016, integer) ATTRIBUTE SNA-PPP-Echo-Rsp-Input SN-VSA(1017, integer) ATTRIBUTE SNA-PPP-Echo-Rsp-Output SN-VSA(1018, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Total SN-VSA(1019, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Acc-Reg SN-VSA(1020, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Acc-Dereg SN-VSA(1021, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Msg-Auth-Fail SN-VSA(1022, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Mis-ID SN-VSA(1023, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Badly-Formed SN-VSA(1024, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-VID-Unsupported SN-VSA(1025, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-T-Bit-Not-Set SN-VSA(1026, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Total SN-VSA(1027, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Acc-Ack SN-VSA(1028, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Msg-Auth-Fail SN-VSA(1029, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Mis-ID SN-VSA(1030, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Total SN-VSA(1031, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Acc-Reg SN-VSA(1032, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Acc-Dereg SN-VSA(1033, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Bad-Req SN-VSA(1034, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Denied SN-VSA(1035, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Mis-ID SN-VSA(1036, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Send-Err SN-VSA(1037, integer) ATTRIBUTE SNA-RP-Reg-Upd-Sent SN-VSA(1038, integer) ATTRIBUTE SNA-RP-Reg-Upd-Re-Sent SN-VSA(1039, integer) ATTRIBUTE SNA-RP-Reg-Upd-Send-Err SN-VSA(1040, integer) ATTRIBUTE SN-Rulebase SN-VSA(250,stringnz) RO I will try to replace the macro with the actual value Regards

2 3

radius proxy authentication problem with realm stripping for EAP
by Alex Myself 01 Jul '10

01 Jul '10

Hi, I'm trying to configure free radius server as a proxy radius server with realm defined and strip option enabled. Authentication fails on external radius server when EAP is used. Without EAP authentication is fine. Any configuration option required for EAP to work (with realm stripping)? Thanks, Alex

2 2

Re: Detail accounting by REalm
by BELLIERE Eric 01 Jul '10

01 Jul '10

Message: 3 Date: Wed, 30 Jun 2010 16:47:45 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Detail accounting by REalm To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C2B5911.8060607(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 BELLIERE Eric wrote: > Now I am trying to make a file by realm proxyied. You can use the Realm name in the detail filename. That's why the filename is configurable in the "detail" module. > I have try this and works but I need to specify the exact realm. > > Is it a way to configure a expression here? $ man unlang > I would like to make an expression to replace abc.be and abcnet.be so > only one line is nacessary (like realm == "~abc$") ? See the above "man" page. You can use a regex. Alan DeKok. Ok thanks It is working with REGEX. But what you do you mean by " You can use the Realm name in the detail filename. That's why the filename is configurable in the "detail" module."? Thanks Eric Bellière

2 1