March 2011 - Freeradius-Users - lists.freeradius.org

Needed Freeradius 2.x + MySQL + Dynamic DHCP.. its possible?
by Rogelio Sevilla Fernandez 22 Mar '11

22 Mar '11

Hi.. Im working with Freeradius 2.1.8 + Mysql Support. The Auth system works well. The only thing to do its add DHCP support. This is the Scenario: Client Connects to AP1. AP1 do the request/replies from/to FreeRadius Server.. Client get Authenticated and asking IP from DHCP.. I dont want use the DHCP Server like ISC because i dont want send IPs to my Wired LAN, only for Wireless. So, If the clients auths from AP1, i need freeradius send DHCP data to my client using one dinamic IP Pool like 192.168.1.0/24 with DefaultGateway, NetworkMask and DNS server. If the same client auths from AP2, send DHCP data to the client using another dinamic IP pool like 192.168.2.0/24 with DefaultGW, Netmask and DNS server. Is it possible to that? Im working with DaloRadius... -- Ing. Rogelio C. Sevilla Fernandez Direccion de Desarrollo Telematico / Secretaria de Administracion Gobierno del Estado de Colima Tel (312)3162062 / (312)3162000 ext 2360

6 9

RE: $75.00 USD Bounty
by Craig Smith 22 Mar '11

22 Mar '11

I'm trying to recreate the functionality of a product call PhoneFactor (www. phonefactor.com) In the script, I want to make a call using Asterisk, get a code, compare that to an entry in a database, and accepting or rejecting the request. OpenVPN has increased their timeout from a RADIUS server to 30 or 40 seconds to accommodate this.

3 2

Behaviour of multiple sequenced authorization modules ?
by Robert Roll 22 Mar '11

22 Mar '11

I would like to have multiple authorization modules invoked and then reject if ANY do NOT authorize ? For instance.. authorize { ldap1 ldap2 } It appears if just one returns OK, then the subsequent authentication works. BTW.. The subsequent authentication is actually a PEAP/MSCHAPV2... Therefore, the ldap modules are ONLY used for authorization... Is there somewhere that discusses the various options on how to control the behaviour when multiple authorization modules are involved ? Thanks, Robert Robert Roll Computer Professiona University of Utah Robert.Roll(a)utah.edu

2 2

authenticate via etc/shadow intead of users
by Raheel Itrat 22 Mar '11

22 Mar '11

Hi, I am a newbie to free radius, I need to know what changes are required in radiusd.conf or any other file in order to authenticate clients requests through local machine users(etc/passwd or etc/shadow) instead of making users in the raddb/users file. Cheers

3 5

Re: $75.00 USD Bounty
by Craig Smith 21 Mar '11

21 Mar '11

Alan, I am also finding the documentation semi helpful. So I put: exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } In /etc/freeradius/modules/exec. Now how do make my authentication request use exec? Thanks, Craig

5 7

Freeradiusd 2.1.8
by Brian Carpio 21 Mar '11

21 Mar '11

I have a production environment which is running freeradiusd 2.1.8 and last night in the logs I see the following message Sat Jan 1 20:11:24 2011 : Error: Mon Jan 10 17:04:58 2011 : Info: Exiting normally. No one was on the box doing anything... I was looking into this issue with google and came across a thread back in Nov 2009 about an issue a user was experiencing with radiusd 2.1.8, and this user send some gdb dumps to the development team... I can't seem to recreate the issue as quickly as he does (plus my server is in production) but I didn't see any follow up if this is a known bug? Is this fixed in 2.1.10? Thanks, Brian

5 6

Counter info while proxying
by Rajkumar R 21 Mar '11

21 Mar '11

Hi All, I would like to know if there's a counter associated with the radius server to keeptrack of the incoming messages arrived. As I'm using a proxy setup with 5 homeservers connected, this info is needed to show on the statistics of loadbalancing activity. Appreciate all your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Please help me with sqlcounter
by frankfang 21 Mar '11

21 Mar '11

I want to use sqlcounter to control the user's traffic usage, and I have these needs: 1. I have read http://wiki.freeradius.org/Rlm_sqlcounter the wiki about the sqlcounter, and I get %b as the unix time value of beginning of reset period.... but how can I set this value? I want to sqlcounter begin count at a specific time such as the register time.. Is it possible? 2. When user's traffic usage over a value, I hope the server will disconnect the connected user immediately, Is it possible for doing this? I have read some article about sqlcounter, but I'm still confused about these questions, can anyone help me? I'm very appreciate for your help -- View this message in context: http://freeradius.1045715.n5.nabble.com/Please-help-me-with-sqlcounter-tp41… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: Freeradius 2
by Usuário do Sistema 19 Mar '11

19 Mar '11

Hello everyone, I've Installed by yum freeradius2-2.1.7-7.el5 but I'm can't found the ldap dirctory under /etc/raddb/.. I have creta it or install more any package ?? thank! 2011/3/5 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (Phil Mayers) > 2. Re: Freeraidus 2 (Gary Gatten) > 3. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (James J J Hooper) > 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) > 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) > 6. Re: Hopefully quick question: conditional processing sneaking > in and setting Auth-Type (Alan DeKok) > 7. Re: Freeraidus 2 (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 05 Mar 2011 00:45:43 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4D7187B7.5000402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 03/05/2011 12:21 AM, Gary Gatten wrote: > > I kinda like your caching idea, but not sure of any security > > implications. > > It's not a workable idea. MSCHAP responses are specific to the 8-byte > random challenge, which is different every time. You can't cache them. > > > > > I have (2) FR servers (each pointing to different DC) and my NAS's > > are configured to use both. But, iirc if AD is down on the backend > > FR still replies (with something) so the NAS never rolls over to the > > other FR server. > > Yes, this is a bad idea. > > Just configure samba to autodiscover the AD controllers. Winbind will > cache connections and open new ones when the old ones go away. > > > > > So, I thought about some script that would use ntlm_auth every...n > > seconds, if it fails kill FR process (or use FR policy to act dead). > > When it starts working again, restart FR. This should make the NAS > > roll to the next FR server. > > That might work, but it seems like a sledgehammer to crack a nut. > > > > > What about OpenLDAP on the FR server that's "refreshed" / sync'd to > > the winblows/AD? I've never tried this but assume it's doable. > > It's not possible. AD controllers will only sync to other AD controllers. > > At some point in the future, Samba 4 might be able to slave the LDAP > database of an AD controller, but it's purely theoretical at the moment > I think. > > > ------------------------------ > > Message: 2 > Date: Fri, 4 Mar 2011 18:54:44 -0600 > From: Gary Gatten <Ggatten(a)waddell.com> > Subject: Re: Freeraidus 2 > To: "'freeradius-users(a)lists.freeradius.org'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55(a)WADPMBXV0.waddell.com > > > > Content-Type: text/plain; charset="utf-8" > > Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, > - I think... > > From: Paulo Maia [mailto:phc.maia@gmail.com] > Sent: Friday, March 04, 2011 06:43 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeraidus 2 > > Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap > > Abs, > > > 2011/3/4 Usu?rio do Sistema <maiconlp(a)ig.com.br<mailto:maiconlp@ig.com.br > >> > Hello everyone, I'm Maicon from Brazil. > > I'm in a project with Freeradius. I want to deployment authentication with > certificate from my wireless users EAP-TLS but I'm finding some difficult. > there is a good how to for version 2 ?? I've started with version 1.x but > decided to change for version 2 and I'm not finding where I set the LDAP > conection. at the older version it was inside radiusd.conf. anybody help me > ?? > > > thank! > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > >

5 6

Freeradius 2 + MySQL + MD5 hash don't work
by joaocdc＠gmail.com 18 Mar '11

18 Mar '11

Hello, Someone already has implemented two freeradius with mysql I'm using version 2.1.10 of freeradius on a debian 6 If I try a plaintext based authentication, everything works. But if I try to do an authentication with an MD5 password, I get the message seguite: *[pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!* Below is my debug and table structures of authentication. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.25.3.0 port 1814, id=40, length=143 User-Name = "usql2@visitantes" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000015017573716c32407669736974616e746573 Message-Authenticator = 0x026cbd100d0b63cacb106f91006b21f2 Proxy-State = 0x30 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "visitantes" for User-Name = "usql2@visitantes" [suffix] Found realm "visitantes" [suffix] Adding Stripped-User-Name = "usql2" [suffix] Adding Realm = "visitantes" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++? if (Realm == "visitantes" ) ? Evaluating (Realm == "visitantes" ) -> TRUE ++? if (Realm == "visitantes" ) -> TRUE ++- entering if (Realm == "visitantes" ) {...} [sql_visitantes] expand: %{Stripped-User-Name} -> usql2 [sql_visitantes] sql_set_user escaped user --> 'usql2' rlm_sql (sql_visitantes): Reserving sql socket id: 4 [sql_visitantes] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usql2' ORDER BY id [sql_visitantes] User found in radcheck table [sql_visitantes] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'usql2' ORDER BY id [sql_visitantes] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'usql2' ORDER BY priority [sql_visitantes] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'visitantes' ORDER BY id [sql_visitantes] User found in group visitantes [sql_visitantes] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'visitantes' ORDER BY id rlm_sql (sql_visitantes): Released sql socket id: 4 +++[sql_visitantes] returns ok ++- if (Realm == "visitantes" ) returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} *[pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!* ++[pap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} ++? if (Realm == "visitantes" ) ? Evaluating (Realm == "visitantes" ) -> TRUE ++? if (Realm == "visitantes" ) -> TRUE ++- entering if (Realm == "visitantes" ) {...} [sql_visitantes] expand: %{Stripped-User-Name} -> usql2 [sql_visitantes] sql_set_user escaped user --> 'usql2' [sql_visitantes] expand: %{User-Password} -> [sql_visitantes] ... expanding second conditional [sql_visitantes] expand: %{Chap-Password} -> [sql_visitantes] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usql2@visitantes', '', 'Access-Reject', '2011-03-17 16:54:17') rlm_sql (sql_visitantes) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usql2@visitantes', '', 'Access-Reject', '2011-03-17 16:54:17') rlm_sql (sql_visitantes): Reserving sql socket id: 3 rlm_sql (sql_visitantes): Released sql socket id: 3 +++[sql_visitantes] returns ok ++- if (Realm == "visitantes" ) returns ok [attr_filter.access_reject] expand: %{User-Name} -> usql2@visitantes attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 40 to 172.25.3.0 port 1814 Proxy-State = 0x30 Waking up in 4.9 seconds. Cleaning up request 0 ID 40 with timestamp +12 Ready to process requests. mysql> select * from radcheck; +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 1 | usql1 | Cleartext-Password | := | usql1 | | 2 | usql2 | MD5-Password | := | 18f3e5d08056778649949b6872a0d4ff | +----+----------+--------------------+----+----------------------------------+ 2 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+------------+-----------+----+-------+ | id | groupname | attribute | op | value | +----+------------+-----------+----+-------+ | 1 | visitantes | Auth-Type | := | PAP | +----+------------+-----------+----+-------+ 1 row in set (0.00 sec) mysql> select * from radusergroup;; +----------+------------+----------+ | username | groupname | priority | +----------+------------+----------+ | usql1 | visitantes | 1 | | usql2 | visitantes | 1 | +----------+------------+----------+ 2 rows in set (0.00 sec) -- João Paulo de Lima Barbosa

3 5