September 2010 - Freeradius-Users - lists.freeradius.org

dictionary vendor options
by PENZ Robert 20 Sep '10

20 Sep '10

Hi! I'm running # rpm -qa | grep radius freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-utils-2.1.7-7.el5 and I copied following into the /etc/raddb/dictionary VENDOR Extreme 1916 ATTRIBUTE Extreme-CLI-Authorization 201 integer Extreme ATTRIBUTE Extreme-Shell-Command 202 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan 203 string Extreme ATTRIBUTE Extreme-Netlogin-Url 204 string Extreme ATTRIBUTE Extreme-Netlogin-Url-Desc 205 string Extreme ATTRIBUTE Extreme-Netlogin-Only 206 integer Extreme ATTRIBUTE Extreme-User-Location 208 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan-Tag 209 integer Extreme ATTRIBUTE Extreme-Netlogin-Extended-Vlan 211 string Extreme ATTRIBUTE Extreme-Security-Profile 212 string Extreme VALUE Extreme-CLI-Authorization Disabled 0 VALUE Extreme-CLI-Authorization Enabled 1 VALUE Extreme-Netlogin-Only Disabled 0 VALUE Extreme-Netlogin-Only Enabled 1 which seems ok for me but the freeradius thinks otherwise as I get including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[37]: unknown option "Extreme" Does anyone know the problem with my config? thx! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

2 2

2 Called-Station-Id authorize unlang filtering question
by tmihalicek 20 Sep '10

20 Sep '10

Hi everyone ... I need to put up a certain scenario for radius. I have 2 Called-Station-Id numbers 111111 an 122222, first number should always be accepted for auth users, the second one should be accessed after the user hits 10 hours quota on first number. I was wonder if this configuration is the right way. server dialup { authorize { preprocess expiration logintime if (Called-Station-Id == "111111") { sql_dialup pap } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) < 36000}") { sql_dialup pap update control { Auth-Type := Reject } update replay { Reply-Message := "10 hour quota still not reached" } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) >= 36000}") { sql_dialup pap update control { Auth-Type := Accept } update replay { Reply-Message := "10 hour quota reached, access accepted" } else { reject } } ... post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject update reply { Reply-Message := "Access denied" } } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/2-Called-Station-Id-authorize-unlan… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

How to access proxy-reply:Packet-Type in if condition
by Chidanand 20 Sep '10

20 Sep '10

Hi, I am using freeRadius 2.1.9 version. I am trying to update proxy-reply message with additional attributes, I want to do it only if proxy-reply is Access-Accept. I see %{proxy-reply:Packet-Type} returns "Access-Accept" but I am not able to form a if condition, I see following error: Thu Sep 16 12:20:24 2010 : Info: +- entering group post-proxy {...} Thu Sep 16 12:20:24 2010 : Info: expand: %{proxy-reply:Packet-Type} -> Access-Accept Thu Sep 16 12:20:24 2010 : Info: ++[proxy-reply] returns noop Thu Sep 16 12:20:24 2010 : Info: ++? if (proxy-reply:Packet-Type == "Access-Accept") Thu Sep 16 12:20:24 2010 : Info: (Attribute proxy-reply:Packet-Type was not found) Thu Sep 16 12:20:24 2010 : Info: [eap] No pre-existing handler found Thu Sep 16 12:20:24 2010 : Info: ++[eap] returns noop Thu Sep 16 12:20:24 2010 : Info: Found Auth-Type = Accept Thu Sep 16 12:20:24 2010 : Info: Auth-Type = Accept, accepting the user Thu Sep 16 12:20:24 2010 : Info: +- entering group post-auth {...} Thu Sep 16 12:20:24 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 11 to 192.168.6.181 port 32771 Framed-Protocol = PPP Service-Type = Framed-User EAP-Message = 0x030c0004 Class = 0x482404d3000001370001c0a8073f01cb53194e942c94000000000000020f MS-CHAP-Domain = "\001TESTAD" MS-CHAP2-Success = 0x01533d33374341363935353838313541433741463032344131333733453832463730424238413846433033 MS-MPPE-Send-Key = 0x6690415a2581f6721c2bd5b7248693f972bd3c750929bb4ab85eccba612b34ee MS-MPPE-Recv-Key = 0x2a32a3e3f8e828d049c41b18dc8ef342720afe4de007074eb3c880de24a51ba3 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Access-Accept" Thu Sep 16 12:20:24 2010 : Info: Finished request 11. Thu Sep 16 12:20:24 2010 : Debug: Going to the next request Thu Sep 16 12:20:24 2010 : Debug: Waking up in 4.8 seconds. Can we really access proxy-reply:Packet-Type using unlang? Please help me solving this problem. Thanks,Chidanand

3 4

Two or more freeradius server
by Spacelee 20 Sep '10

20 Sep '10

# RADIUS server to use for authentication requests. this config # item can appear more then one time. if multiple servers are # defined they are tried in a round robin fashion if one # server is not answering. # optionally you can specify a the port number on which is remote # RADIUS listens separated by a colon from the hostname. if # no port is specified /etc/services is consulted of the radius # service. if this fails also a compiled in default is used. authserver ip1:1812 authserver ip2:1812 I use pptp+ppp+freeradius+mysql and in the radiusclient.conf, it set two authsever server, so that it's round robin. but in fact, when I stop ip1, ip2 is up, it's ok, and then i stop ip2, ip1 is up, it's not ok what's the problem, have you met before ? -- *Space Lee*

1 1

Pushing group attribute from OpenDirectory to Cisco
by Sander van Loosbroek 20 Sep '10

20 Sep '10

Hello, I have successfully set up Freeradius that comes with Mac OS X Server 10.6 to authenticate WebVPN users on a Cisco IOS router. Now I'm trying to parse the webvpn:user-vpn-group attribute to the Cisco so I can set up different WebVPN policies. I run into 2 problems: 1) There doesn't seem to be a dictionary for Cisco's Webvpn. There are some for the VPN concentrator series but this are not compatible with Cisco's IOS. Does that mean I have to build my own? The attribute value-pairs are listed here: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6657/pr… 2) I can't find out how to connect the group name value from OpenDirectory to an attribute. The rlm_opendirectory module does check for a group (to see if it's allowed to use the Radius service) but it's unclear to me how to grab that value and use it as an attribute. Any thoughts are appreciated. Regards, Sander

3 2

HOWTO:Centralised LDAP Authentication
by Peter Lambrechtsen 19 Sep '10

19 Sep '10

FreeRADIUS Network Element LDAP based authentication In this post I hope to explain how I have done Network Element (Switches, Routers, AP's etc) based NAS devices to have PAP authentication for centralised administration of those devices using FreeRADIUS to authenticate against your centralised LDAP Directory. It does not deal with EAP or 802.1x, it is only focused on PAP Username & Cleartext Password authentication and authorization to network elements. Please search for other documents which detail how to implement EAP/802.1x There were a number of business requirements when I setup this environment: 1) Centralised users. All users would only exist in the LDAP directory and their profiles are driven out of the directory. 2) Supporting different makes and models and use cases of Network Elements (NAS) 3) Grouping NAS's together so that a single role could gain access to multiple devices. IE Switches in Building A, Routers in DMZ, LAB Switches etc. This is done using FreeRADIUS Huntgroups. 4) Multiple Roles per NAS Group. So that you can have a Read-Only, Read-Write, Administrator role for a group of NAS's and that a person could be a member of a role per NAS Group. IE Read-Write LAB Switches, Read-Only Switches in Building A. And last but most importantly. It's easy to manage, not require LDAP Schema Extensions and where possible not require building new tools to manage it. LDAP Design: I used Novell eDirectory as that is what we run, however the LDAP directory being used doesn't matter since no Radius Schema extensions are required, only "User" objects and "Group" objects will be used in new Organizational Units (OU) to be created. I will however use Active Directory based naming to try and be as generic as possible. First create a OU called Radius somewhere in your LDAP Structure to hold all the Radius objects that need to be created. In the following examples I will use the AD Domain of ACME.COM, DC=ACME,DC=COM Start with: OU=Radius,DC=ACME,DC=COM Then create two OU's under Radius. Elements and Roles OU=Elements,OU=Radius,DC=ACME,DC=COM Elements will hold a record of every NAS in your Network. You will create Group objects based on the IP Address of the NAS and set the "Location" or "l" attribute to the NAS Huntgroup the NAS belongs to allow them to be centrally managed in LDAP. IE CN=10.1.2.3,OU=Elements,OU=Radius,DC=ACME,DC=COM With a "l" value of "CiscoRTR" for a Cisco Router that has a NAS-IP-Address or Source-IP-Address of 10.1.2.3. This will make more sense further on. OU=Roles,OU=Radius,DC=ACME,DC=COM Roles will hold Group objects of the LDAP roles that users will be put into to grant them access to the NASs Now that you have your basic LDAP structure we will move onto the FreeRADIUS configuration files that need to be modified. Configuration Files: Following standard practice from the freeradius-users mailing list: ** DOWNLOAD THE LATEST VERSION OF FREERADIUS, TAKE THE DEFAULT CONFIGURATION AND ONLY MODIFY THE SETTINGS IN THE CONFIGURATION YOU NEED TO ** With that in mind I will go through the files I have modified to make the LDAP Authentication work: FILE:/etc/raddb/modules/ldap This is the main LDAP Module configuration file that needs to be modified, I've added comments above each line detailing what it's needed for: ldap { # The Server IP Address or DNS name, preferably run FreeRADIUS on the same server as the LDAP directory so then you can use Cleartext non-SSL connections from FreeRADIUS to the LDAP directory. Using SSL slows down the authentication slightly due to needing to setup SSL Connection for the LDAP Bind for the user. server = "ldap.acme.com" # This is a proxy username with enough read rights to find the user and check they have a valid role. Needs to be able to search users and Groups, and group "member" and "l" values. identity = "cn=Proxy,ou=Users,DC=ACME,DC=COM" # The identity's password. password = mypass # The top level of the LDAP Tree to search for users. Set this as high as practically possible. basedn = "DC=ACME,DC=COM" # I normally set the search to be cn=username, rather than uid=username. filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" #** Leave other default's alone ** # Allow searching of LDAP Groups. groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # Need to support XLAT for HuntGroups do_xlat = yes # Leave other defaults alone } FILE:/etc/raddb/clients.conf Standard clients.conf where you specify the shared secret password. Since I am lazy just specify "password" for the whole 10.x.x.x network: client 10.0.0.0/8 { secret = password shortname = 10Network } FILE:/etc/raddb/users This file is where a Huntgroup (Group of NASs) and a LDAP Group (that the user needs to be a member of) is checked, if they both match then the NAS VSA attributes below the Huntgroup/LDAP Group match are returned. It's also important to have the last line of this file saying "DEFAULT Auth-Type := Reject" since this means that no matches were found, so access should be rejected. Below is a few examples of how it could be configured, this file will be the only file you need to modify when adding a new role or NAS Group. -----BEGIN # Below if you are coming from the CiscoRTR NAS Huntgroup, and you are a member of the "Guest" group, you get the below access. DEFAULT Huntgroup-Name == CiscoRTR, Ldap-Group == "cn=CiscoGuest,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "NAS-Prompt-User", Idle-Timeout = 600, Cisco-AVPair = "shell:priv-lvl=1" # DEFAULT Huntgroup-Name == CiscoRTR, Ldap-Group == "cn=CiscoAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "NAS-Prompt-User", Idle-Timeout = 600, Cisco-AVPair = "shell:priv-lvl=15" # DEFAULT Huntgroup-Name == Junipers, Ldap-Group == "cn=JuniperAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "Login-User", Idle-Timeout = 600, Juniper-Local-User-Name = "admin" # DEFAULT Auth-Type := Reject -----END As you can see for each Role, or Group of NAS's you need a entry. This file will grow to cater for as many roles as you need. And to get FreeRADIUS to re-read this file you need to "kill -HUP" the radiusd. FILE:/etc/raddb/sites-enabled/default This is the main site configuration file with the Authorize and Authenticate of the user occurs. Below are the exact versions of both the Authorize and Authenticate sections, since I commented out all services apart from the ones I need: I left all other sections alone, just update these two. -----BEGIN authorize { # First we need to lookup the NAS IP Address based off the Packet-Src-IP-Address. # I used this rather than %{NAS-IP-Address} as per: http://wiki.freeradius.org/Run-time_variables # Since a few NAS devices I have used send bogus NAS-IP-Addresses, and no NAT translations occur within our network so we can trust the Src-IP # So what this is doing is looking up in LDAP using the CN=IPAddress, and looking up the "l" attribute against that object, and updating the "Huntgroup-Name" with that value # This way if you setup the LDAP object correctly you can easily move the NAS from one Huntgroup to another by only updating the "l" attribute in LDAP. update request { Huntgroup-Name := "%{ldap:ldap:///ou=Elements,ou=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" } # Now lookup LDAP to find the user's full DN to see if they really do exist in LDAP. ldap # Lastly using the user you just found above, lookup to see if the Huntgroup they are coming from, matches any of the LDAP group they need to belong to as per the above "users" file to assign the relevant role and update the response with the VSA's specified in the "users" file. files } authenticate { # All you need in the authenticate section is "ldap" so that FreeRADIUS checks the password the user specified is correct. If they get it wrong they get all the VSA's returned for the role they have access to, but get an Access-Reject. ldap } -----END Once you have done this, all the administration is done in the LDAP directory by adding or removing users from the relevant LDAP Group. When a new NAS Group, or Role is required all that is needed is to update the "users" file, and kill -HUP radiusd. I hope someone finds this useful. And that it gets turned into a Wiki Entry. Cheers Peter Lambrechtsen plambrechtsen at gmail dot com

2 1

queue radius message when resource is in use
by kabilius smith 18 Sep '10

18 Sep '10

Hi all, Happy Friday! Radius version: 1.1.7-r0.0.2 Here is my problem: I have configured the FreeRadius server to write to a file c:\test.log, and one of our programs reads contents from c:\ test.log as well. When our program is reading c:\ test.log, we open it with “deny write” permission, so the I saw the error message “Error: rlm_detail: Couldn't open file c:/test.log: Device or resource busy” in Radius.log. My question is: Can FreeRadius be configured to “delay write”? meaning, if it is unable to access c:\test.log, could it queue the message, and write to the file at a later time? My 2nd question: When FreeRadius receive a radius message, can it redirect the message to another TCP or UDP link? If it is possible, then we will just setup a TCP or UDP link to listen for the message from the FreeRadius server. Thank you, Alex

2 2

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

> Why are you trying to change the configuration on the server? > > You were already told where the problem was. It's not the server. > > If you're not going to read the answers on this list, there's no > reason to post questions. Sorry , i didn't understood you. Where i said the answer? Why it's not server problem. If it can't read normal user info means that something wrong in its config and i didn't find any problem (coz i'm not guru at all). I know how use and search such lists and forums. but nothing helped me to solve the problem. Already three i'm tring to male this EAP-TLS to work but nothing works. maybe someone can structurize my knowledge or give me some basic hints hot build this EAP-TLS server-client structure ? I don't know. what to do. I don't know why but i'm sure problem is in server configuration. I'm just asking for help.

2 3

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

forgot to mention that my try to make: heck_cert_cn = %{User-Name} => entered in users db username same as CN is in certificate with password supplied during client-cert generation with OpenSSL (A challenge password []:whatever) didn't work. As well as placing my real cert data in this filed: check_cert_issuer = "/C=ZZ/ST=Yyyyy/L=yyyyy/O=Xxx" No luck! Also i've mentioned this comments in eap.conf: # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate What is DN? maybe this one should be configured and work properly ?

2 1

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

setup is. Mikrotik WDS AP + Mikrotik WDS Station....so suplicant is Mikrotik Station.... Mikrotik has only EAP-TLS .1x method for authentication and as i got EAP-TLS is using only certificates for auth. i'm sure that i have problem configuring eap TLS module. radius can't retrieve UserIdentity from certificate. I have found some kind of solution (but it didn't work) uncommented one by one strings in eap.conf check_cert_issuer = "/C=ZZ/ST=Yyyyy/L=yyyyy/O=Xxx" or check_cert_cn = %{User-Name} Also i tried next from this string: check_cert_cn = %{User-Name} => entered in users db username same as CN is in certificate with password supplied during client-cert generation with OpenSSL (A challenge password []:whatever) how radius should read user cert. whats wrong ? One more time, right now, TTLS working on same server using same tls module but with Ubiquiti equipment. P.S.: here is my discussion thread on mikrotik forum, but they don't have glue about freeradius setups (most of them) http://forum.mikrotik.com/viewtopic.php?f=7&t=45124&p=227563#p227563

1 0