December 2011 - Freeradius-Users - lists.freeradius.org

VSA's and local dictionary
by Andrew Long 20 Dec '11

20 Dec '11

Greetings, I am running freeradius-server-2.1.8-0 on CentOS 5.6 and am setting up some new NAS, Nomadix AG3100. Every so often, when running in debug, the server reports "Invalid packet code 4 sent to authentication port from client AG3100 port 1032 : IGNORED". After searching past threads, I understand there is no way to know what is being sent short of sniffing the packets. As I'm not doing much with accounting, I'm not terribly concerned, but it did prompt me to take a look at the dictionaries in /usr/share/freeradius. Sure enough, there is a Nomadix dictionary file, but it lists only 13 attributes (content below), while the vendor supplied list includes 6 additional VSA's. I read in the dictionary man page that "The dictionaries in /usr/local/share SHOULD NOT be edited", while "If you need to add new attributes, please edit the /etc/raddb/dictionary file". So, the question is, will the following entry in /etc/raddb/dictionary correctly add the "new" attributes? I have not entered the types yet, waiting on the OEM for some clarification. #ATTRIBUTE name number type [vendor|options] ATTRIBUTE Nomadix-Qos-Policy 14 [type] Nomadix ATTRIBUTE Nomadix-SMTP-Redirect 17 [type] Nomadix ATTRIBUTE Nomadix-Centralized-Mgmt 18 [type] Nomadix ATTRIBUTE Nomadix-Group-Bw-Policy-ID 19 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-up 20 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-Down 21 [type] Nomadix Thank you for any help. - Andrew Long Here is the existing dictionary... # FILE: /usr/share/freeradius/dictionary.nomadix # -*- text -*- # # Version: $Id$ # VENDOR Nomadix 3309 # BEGIN-VENDOR Nomadix ATTRIBUTE Nomadix-Bw-Up 1 integer ATTRIBUTE Nomadix-Bw-Down 2 integer ATTRIBUTE Nomadix-URL-Redirection 3 string ATTRIBUTE Nomadix-IP-Upsell 4 integer ATTRIBUTE Nomadix-Expiration 5 string ATTRIBUTE Nomadix-Subnet 6 string ATTRIBUTE Nomadix-MaxBytesUp 7 integer ATTRIBUTE Nomadix-MaxBytesDown 8 integer ATTRIBUTE Nomadix-EndofSession 9 integer ATTRIBUTE Nomadix-Logoff-URL 10 string ATTRIBUTE Nomadix-Net-VLAN 11 integer ATTRIBUTE Nomadix-Config-URL 12 string ATTRIBUTE Nomadix-Goodbye-URL 13 string VALUE Nomadix-IP-Upsell PrivatePool 0 VALUE Nomadix-IP-Upsell PublicPool 1 END-VENDOR Nomadix ############# END FILE #############

2 2

VLAN attribution in an eduroam setting - proxied users
by Rui Ribeiro 20 Dec '11

20 Dec '11

Good morning list, I´ve been setting up a freeradius to operate in the eduroam environment. At the moment my problem is the VLAN attribution that is done depending on the Windows domain of the user, or if it is in roaming from another institution. I´ve solved the VLAN based in the Windows domain, using in the /etc/freeradius/users file the following directives. DEFAULT Ldap-Group == "ISCTE" Service-Type = "Framed-User", Reply-Message = "Eduroam ISCTE", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "211" DEFAULT Ldap-Group == "Alunos" Service-Type = "Framed-User", Reply-Message = "Eduroam Alunos", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "212" As for the VLAN attribution wether the user is a roaming user (i.e. goes to a proxy to be authenticated), I have done several tries, without sucess. Haven't managed to do it through the users file above;my last attemp was trying to setting them up in the /etc/freeradius/attrs file with attr_filter.post-proxy, however it seems to interfere with the AEP/password negotiation. The setup is as follows, and I would like to ask for an alternative of where to insert the roaming VLAN. post-proxy { post_proxy_log attr_filter.post-proxy # here <--------------------------- Post-Proxy-Type Fail { detail } } and then the attrs file: DEFAULT EAP-Message =* ANY, User-NAme =* ANY, MS-MPPE-Send-Key =* ANY, MS-MPPE-Recv-Key =* ANY, Message-Authenticator =* ANY, State =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY, MS-CHAP-MPPE-Keys =* ANY, Service-Type := "Framed-User", Reply-Message := "Eduroam Roaming", Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-Id := "216", Framed-MTU := 1300, Framed-Filter-ID =* ANY Regards, Rui Ribeiro

2 1

sqlippool IP conflict problem
by Коньков Евгений 20 Dec '11

20 Dec '11

Hi, FreeRadius. while frame IP address to user there are three stage in sqlippool clear find update clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired. This will cause IP conflict. does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 6

PATCH: fixing log messages in rlm_sqlippool
by Коньков Евгений 20 Dec '11

20 Dec '11

rlm_sqlippool.c if ((data->allocate_find == NULL) ||. (strlen(data->allocate_find) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_find' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-find' statement must be set."); sqlippool_detach(data); return -1; } if ((data->allocate_update == NULL) || (strlen(data->allocate_update) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_update' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-update' statement must be set."); sqlippool_detach(data); return -1; }

1 0

Hi
by Jeisson Fabian Perez Rodriguez 19 Dec '11

19 Dec '11

Hi, I have a problem with freeradius! I installed it, and the server is running nice but when I try to connect to this server from another terminal, the server stop suddenly and in the window appears segment fault somebody can help me, please!

3 8

FreeRadius Authentication using Active Directory
by McSparin, Joe 19 Dec '11

19 Dec '11

I have followed several tutorials for setting up Active Directory with FreeRadius. When I run the ntlm_auth from the command line I get a success message however when I run the radtest with the username and password I get a Access-Reject. I am using FreeRadius 1.8 and I have included the message I get from radiusd -X. Any input would be greatly appreciated. rad_recv: Access-Request packet from host 10.1.174.126:3421, id=26, length=49 User-Name = "testuser" User-Password = "testpassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "jmcsparin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

Cisco WLC + freeradius
by LEONARDO FELL 19 Dec '11

19 Dec '11

I'm trying to configure dynamics wlans using Cisco WLC + freeradius, but I have some issues. I modified the ldap.attrmap, including the attributes: replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId However, when a try to connect, the freeradius replies a "0" (ex: Tunnel-Private-Group-Id:0) after the attribute, as you can see below: Sending Access-Accept of id 146 to 10.1.0.161 port 32768 Tunnel-Private-Group-Id:0 = "85" Tunnel-Medium-Type:0 = 802 Tunnel-Type:0 = VLAN Filter-Id = "Enterasys:version=1:policy=Aluno" MS-MPPE-Recv-Key = 0xcfcf3c464de734110cda4f22dc1ed36c2e7e5c629861059036e61fb5e98d104b MS-MPPE-Send-Key = 0x8115583c24b0c533eca2417e1a82e092bd908417dee2cecdeb3b89d857f4634f EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "leofell" I think it may the problem and I'd like to know why it happens.. Thanks! -- Leonardo Fell Setor de Redes - NTI Centro Universitário UNIVATES Fundação Vale do Taquari de Educação e Desenvolvimento Social - FUVATES Telefone: (51)37147000 Ramal 5809 www.univates.br

3 5

port 1813
by Selcuk Yazar 19 Dec '11

19 Dec '11

Hi, we have FreeRADIUS Version 2.1.12 on freebsd, in proxy.conf we have settings ; home_server localhost { type = auth+acct port = 1812 ... } but when i looked up with netstat- n freeradius doen't listen port 1813 . what is the problem ? thanks in advance. -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 1

Re: Referencing LDAP attributes in post-auth
by Adam Track 19 Dec '11

19 Dec '11

>Full debug please. > >Broadly speaking the approach you're trying should work. Most likely >there's some subtlety which the partial debug doesn't show. > >One obvious question: you have defined "Person-Type" in a dictionary >somewhere, haven't you? e.g. in raddb/dictionary: > >ATTRIBUTEPerson-Type3099string > >Also, the usual "upgrade 2.1.8 is a bit old" note goes here ;o) I recently saw another question along the same lines as this, so decided to give this another go... Am now running 2.1.10, and yes, Person-Type is defined in dictionary and ldap.attrmap. I've also defined in dictionary the following in hopes of passing on the value of Person-Type to this attribute: ATTRIBUTE Person-Group 3001 string For the (outer) virtual server, in the authorize block I have the following: ... ldap update control { Person-Group = "%{reply:Person-Type}" } ... In post-auth: ... update reply { Reply-Message := "You are %{control:Person-Group}." } ... I still cannot figure out how to pass this value from authorize to post-auth. BTW, this is a multi-valued attribute, so what I'm really trying to do is to call a perl script in post-auth to iterate through all possible values, and set vlan based on whether a particular value exists, thus shouldn't be done within authroize. Debug attached (I hope).. can't seem to post with it on here due to 100KB limit. A.

3 8

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 19 Dec '11

19 Dec '11

Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Mon, 19 Dec 2011 18:26:06 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: RV: Reading winbind reply failed! ------Mensaje original------ Para: freeradius-users(a)lists.freeradius.org Asunto: RV: Reading winbind reply failed! Enviado: 16 de dic, 2011 11:53 AM ------Mensaje original------ Para: freeradius-users(a)lists.freeradius.org Asunto: Reading winbind reply failed! Enviado: 16 de dic, 2011 10:15 AM I have configured freeradius 2.1.10 with eap-tls and certificates openssl, mschap response is incorrect why? I don't know what the problem with winbind.. HELP ME PLEASE! Thanks.. [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel[mschapv2] +- entering group MS-CHAP {...}[mschap] Creating challenge hash with username: USER[mschap] Told to do MS-CHAPv2 for USER with NT-Password[mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USER[mschap] expand: %{mschap:NT-Domain} -> DOMAIN[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN} -> --domain=DOMAIN[mschap] mschap2: 38[mschap] Creating challenge hash with username: USER[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8e5d0057de5cde20[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ad08d60b1e6160fb877d4e678622dfc732af9bcc883716a8Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] FAILED: MS-CHAP2-Response is incorrect Enviado desde mi dispositivo movil BlackBerry® de Digitel.

1 0