December 2011 - Freeradius-Users - lists.freeradius.org

Cannot control attribute ordering via "rlm_perl"
by Claude Brown 30 Jan '12

30 Jan '12

Hi, First, the version I'm using: # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, [...] I'm trying to control the attribute-ordering when using "rlm_perl". Thus far my experience is that this is not possible. My theory is that this is due to the hash-tables used as the interface between the C and Perl worlds. Here is a small example that demonstrates the problem. I've turned on the "users" and "perl" modules in the authorize section (in that order). These are the important bits from the "users" file and the "example.pl" file. (from the "users" file) steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, WiMAX-Packet-Data-Flow-Id = 1, WiMAX-Service-Data-Flow-Id = 1, WiMAX-Service-Profile-Id = 2 (from the "example.pl") sub authorize { return RLM_MODULE_NOOP; } The debug log of the server is below. The interesting bits are (a) the "rlm_perl: Added pair" and (b) the attribute-order in the packet that the server sends in reply - the order is changed. The ordering is important to for me as I want those three WiMAX attributes packed inside a parent attribute "WiMAX-Packet-Flow-Descriptor". If I turn off the "perl" module (or place it before the "files" module) the packing works as expected. I put all this down to the attribute-list being rebuilt (by rlm_perl) from the %RAD_REPLY table. The hash-table has no concept of ordering, so it ends up randomised. The above is a contrived example - what I really want to do is add those three WiMAX attributes in my perl script. But due to the ordering problems I think I am wasting my time and need to come up with another solution. Can anyone see how I can control the ordering of attributes coming out of the perl script? Thanks, Claude Brown. Vividwireless. rad_recv: Access-Request packet from host 127.0.0.1 port 50265, id=2, length=63 User-Name = "steve" User-Password = "testing" Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok GOT CLONE -1588651264 0x1a0e160 rlm_perl: Added pair User-Name = steve rlm_perl: Added pair User-Password = testing rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 rlm_perl: Added pair WiMAX-Service-Data-Flow-Id = 1 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair WiMAX-Packet-Data-Flow-Id = 1 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair WiMAX-Service-Profile-Id = 2 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Cleartext-Password = testing ++[perl] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok Login OK: [steve] (from client localhost port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 2 to 127.0.0.1 port 50265 WiMAX-Service-Data-Flow-Id = 1 Service-Type = Framed-User Framed-Routing = Broadcast-Listen WiMAX-Packet-Data-Flow-Id = 1 Framed-Protocol = PPP Framed-Filter-Id = "std.ppp" Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP WiMAX-Service-Profile-Id = 2 Framed-MTU = 1500 Finished request 0.

6 13

Freeradius + MySQL + WiFi PEAP authorisation only to a group of users
by Lumir Lindovsky 22 Jan '12

22 Jan '12

Hello, I would like to help with this: I have Freeradius version 2.1.6 I have it running with SQL and DialupAdmin. How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users? I mean that authorised would be only users from group WIFI and not other users belonging to other group like OpenVPN. Now it authorises everybody from the radcheck table. I am very new to radius and even if I was searching the net for some time I cannot find the answer which would fir my needs. Thank you for help! Lumir

4 5

no calling-station-id received
by S Adrian 09 Jan '12

09 Jan '12

Hey everybody .... I don't seem to get a calling-station-id packet when a username is trying to connect. I'm running gentoo and have the following package versions: net-dialup/ppp-2.4.5-r1 USE="activefilter atm dhcp eap-tls pam radius -gtk -ipv6" 0 kB net-dialup/rp-pppoe-3.10-r1 USE="-X" 0 kB net-dialup/freeradius-2.1.7 USE="mysql pam ssl threads udpfromto -bindist -debug -edirectory (-firebird) -frascend -frxp -kerberos -ldap -postgres -snmp" 0 kB Another problem I seem to have is people using the same pool_key in my radippool table :/ Where should I start digging ? Thanks in advance.

4 8

Re: Freeradius with EAP-SIM
by Alan Buxey 05 Jan '12

05 Jan '12

Ready to process requests. ...and that's it. Where's the incoming query to be dealt with? alan -- Message may be brief as it has been sent from my mobile

3 3

Radius with Java
by Jeisson Fabian Perez Rodriguez 03 Jan '12

03 Jan '12

Hi, again, I've been trying to connect FreeRadius with an application on Java, but I don't find the correct way. Could somebody tell me something about it?, please!

5 6

LDAP - dynamic membership checking
by Christian Kölpin 01 Jan '12

01 Jan '12

Hello I'am stuck while testing with LDAP an Radius. I'am get Radius to work with user authorisation against LDAP and authentication against kerberos. Even if i set a "simple" membership checking in ./modules/ldap it works fine. My problem is, I have several NAS (Some APs, Switches, VPN-Servers). Depending on the NAS another group-Membership should be checked . For example a user with memberships in "wireless" and "office-vpn" should get access if the request comes from the APs or a specific VPN-Server. Can someone give me a hint, how to setup such a szenario? greetings Raptor 2101

2 2

How to configure redundant radius?
by Christ Schlacta 30 Dec '11

30 Dec '11

I've got a number of devices all of which only have the option for one radius IP address (not hostname!) to be configured. How can I configure this type of device for failover (and optionally balance)? is there some PROPER way to do this? or am I limited to only being able to have one fr server configured for these particular devices?

3 4

Proxy Radius - Deny user based on username preproxy
by Nathan M 30 Dec '11

30 Dec '11

To any freeradius guru, I operate a proxy radius server which proxies requests downstream. A few particular usernames are repeating far more frequently than they should and I have no way to eliminate this upstream. I do need to authenticate the users though and not deny them. The goal would be to authenticate them at the proxy level so it does not send the request downstream at all. Ideally an entry something to the tune of: userx Cleartext-Password := "xxx" Session-Timeout = 604800, Idle-Timeout = 604800, Acct-Interim-Interval = 4084, Fall-Through = No I've reviewed and done dozens of attempts using the preproxy_users, and users file (by trying with files above and below the suffix line in authorize{}); however, none of my attempts have been successful. The lines match when viewing debug; however, by entering anything other than Auth-Type := Reject within the users file, the authentication proceeds on it's merry way to the proxy process downstream. Any advice on a config which will accomplish this? Thanks, N

2 1

Rlm_ippool provides invalid IP
by Arlindo F. Neto 30 Dec '11

30 Dec '11

Hi, When I use a range of addresses greater than one network /24, the ippool provides IP to the client with zero end (eg 192.168.10.0). The IP Pool configuration on radiusd.conf ippool pool1 { range-start = xxx.xxx.36.1 range-stop = xxx.xxx.39.152 netmask = 255.255.255.255 cache-size = 922 session-db = ${raddbdir}/ippool/db.pool1 ip-index = ${raddbdir}/ippool/db.pool1index override = no maximum-timeout = 30 } Nesta configuração, frequentemente o freeradius fornece endereços IPs inválidos, exemplo: xxx.xxx.37.0 xxx.xxx.38.0 xxx.xxx.39.0 Is there any configuration to be done to solve this problem? Regards,

3 4

Error Reading Certificate file
by McSparin, Joe 30 Dec '11

30 Dec '11

Get this error when running radiusd -X I checked my passwords in eap.cnf, ca.cnf, server.cnf and client.cnf rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file /usr/local/etc/raddb/certs/server.pem rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[314]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 2