May 2011 - Freeradius-Users - lists.freeradius.org

LDAP: More than one searchfilter
by Alexandros Gougousoudis 16 May '11

16 May '11

Hi, just one other question, how is it possible to have (or control) more than one filter in the ldap module? I use our LDAP to have access via PEAP or EAP-TLS, this works, thanks to this list. The problem now is, that workstations are stored as WORKSTATIONNAME$ (with a $ ath the end, thanks to Samba) and the user is stored with it's username. Unfortunately, the workstations come in their Radius-Request without the "$" sign, just the name. So if I want to lookup a workstationname I have to add a "$" sigh to every request, or LDAP won't find it. Otherwise the $ shouldn't be added while looking for a username. Is there an idea how to control the ldap filter for this? TIA Alex

2 1

Re: Renaming during Machine Authentication
by Mark Jones 16 May '11

16 May '11

Thanks Phil. I am out of the office until Thursday but on my first message I posted the debug from bootup where it fails..is there more output I need to post later this week? Mark Sent from my Blackberry® wireless device -----Original Message----- From: Phil Mayers <p.mayers(a)imperial.ac.uk> To: <freeradius-users(a)lists.freeradius.org> Sent: 5/16/2011 3:01:35 AM Subject: Re: Renaming during Machine Authentication On 05/16/2011 01:03 AM, Mark Jones wrote: > Hi Phil thanks for answering. I am trying to authenticate the > machines on bootup. I have an edir backend and am following this cool > solutions article which is fairly old: > http://www.novell.com/coolsolutions/feature/17044.html In it they > talk about atrrib-rewrite but use it in the radiusd.conf file which > in my limited knowledge of freeradius I think is an older way of > doing it. Yeah, don't do it that way. Aside from the config in the article being subtly wrong (regexp in the 2nd rewrite module isn't right), there are easier ways to accomplish mutating the username if you need to do that, which you don't because you can just use %{mschap:User-Name} and it'll do it for you (as well as being more obvious IMHO) > > Right now if i join a machine to the samba domain I have created, it > automatically is imported into edirectory and named "machinename$". > The article is not complete so I am really not sure if the machine is I'm not familiar with eDir so can't say. Is it working for you now? If not, post a debug and someone can probably suggest what needs changing. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

1 0

Failed to build FR 2.1.10 (64-bit) on Solaris 10 x86
by Chris Howley 16 May '11

16 May '11

Alan, I'm unable to build a 64-bit version of FreeRADIUS 2.1.10 on Solaris 10 9/10 s10x_u9wos_14a X86 owing to the following problem. I'm using the latest software from the 2.1.x git repository and gcc version 3.4.3. I've noticed that the 'FNM_FILE_NAME' flag is not declared in the fnmatch.h file on my system if this helps. Thanks in advance, Chris gcc -m64 -O -g -I/opt/local/include -I/opt/webstack/mysql/include/mysql -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/export/home/ecl6ch/freeradius-server/src -I/export/home/ecl6ch/freeradius-server/libltdl -c rlm_detail.c -fPIC -DPIC -o .libs/rlm_detail.o rlm_detail.c: In function `do_detail': rlm_detail.c:276: warning: comparison between pointer and integer rlm_detail.c:278: error: `FNM_FILE_NAME' undeclared (first use in this function) rlm_detail.c:278: error: (Each undeclared identifier is reported only once rlm_detail.c:278: error: for each function it appears in.) gmake[6]: *** [rlm_detail.lo] Error 1 gmake[6]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules/rlm_detail' gmake[5]: *** [rlm_detail] Error 2 gmake[5]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/export/home/ecl6ch/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/ecl6ch/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/export/home/ecl6ch/freeradius-server' gmake: *** [all] Error 2

2 1

RE: Alvarion BreezeMAX & 4Motion Service Profiles
by Ryan Williams 15 May '11

15 May '11

I have a working solution. For Alvarion to assign service profiles to subscribers through FreeRADIUS the Filter-Id attribute must be provided in the Access-Accept in the following format. Filter-Id = "SP=sp1:MSF=msf1;" Where sp1 is the name of the pre-configured service profile and msf1 is the name of the pre-configured multiple service flow profile. I can confirm that this format works with both the 4Motion and the BreezeMAX extreme product lines from Alvarion. Thanks to everyone for your assistance. -----Original Message----- From: Ryan Williams [mailto:ryan@integritynet.com.au] Sent: Friday, 13 May 2011 11:40 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Alvarion BreezeMAX & 4Motion Service Profiles Has anyone been able to get the Alvarion BreezeMAX to apply a service profile for a subscriber through radius? or has anyone been able to get debug logging out of the BreezeMAX perhaps via syslog? I believe I've got the service interfaces, service groups etc configured the same in both products. The BreezeMAX works if I disable RADIUS but doesn't work with the following radius reply. The following access accept works with the Alvarion 4Motion product but not with the BreezeMAX. Sending Access-Accept of id 13 to 10.12.15.50 port 49154 Session-Timeout = 3600 Termination-Action = RADIUS-Request Filter-Id = "SP1" EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}test(a)test.com.au" WiMAX-MSK = 0x18bffebb46ac2e95ee730b7ecc0eaa5eb4b586fe29e5113f97f1ab794b4405f9d77aaa432c bb91eb9e4d3ea7e65dded2bb765e18491c62530cf3edee80c644a1

1 0

freeradius availability
by Student University 15 May '11

15 May '11

Hi , for multiple POP deployment (NAS1 , NAS2 ... NASn spread over different geographical location) NAS = Cisco LNS Routers , users are arbitrary connect to NAS1,NAS2,NAS3 ,,,, for this Scenario i need to keep identical copy of AAA (freeradius) server on each POP-NAS Location ,,,, anyone already have like experience ,,,, Thanks in Advance ,,,

1 0

Reply-message stripped from access-reject response
by sbcsgjmbbz＠snkmail.com 15 May '11

15 May '11

Hi, Using freeradius 1.1.3. Im trying to get freeradius to return a helpful reply-message in access-rejects to the NAS but the reply-message seems to get stripped from the access-reject packet. Ive configured the reply-message as below in /etc/raddb/sites-enabled/default post-auth { sql exec Post-Auth-Type REJECT { # Login failed update reply { Reply-Message = "Login Failure" } sql attr_filter.access_reject } } Using wireshark on the radius server, I can see the correct reply-message AVP as below Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 35 Authenticator: a6208196777dac6e68b45f647a46bc44 [This is a response to a request in frame 1] [Time from request: 1.000227000 seconds] Attribute Value Pairs AVP: l=15 t=Reply-Message(18): Login Failure Reply-Message: Login Failure However, on the receiving NAS, using wireshark, there is no reply-message AVP! Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 20 Authenticator: 30636716e333da33ac25c8253097b608 [This is a response to a request in frame 1] [Time from request: 1.107899000 seconds] Any ideas on what I could be doing wrong, It would be much appreciated!

3 6

Radius proxy implementation
by doqb＠hotmail.com 14 May '11

14 May '11

Hello... I am new to freeradius and I am hoping someone can give me some help with a little project. The architecture is as follows: RADIUS SERVER -----------------freeRadius-----------------Radius client The radius client is sending Authentications and accounting requests to freeRadius. For Authentication, the freeRadius must receive the access_requests, add a couple of AVPs to it, and then send it to the RADIUS SERVER, this server will respond with either accept/reject and the freeRadius must forward that to the client. Once authentication is done, the Radius client will start sending accounting messages to freeRadius. The freeRadius must count the number of octets sent and received (information which is inside the accounting message) and once a certain number of packets are reached it should trigger and access_reject to the Radius client. I this possible with freeRadius? I would appreciate some help on this. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp43662… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

ldap
by Maurice James 14 May '11

14 May '11

How do I deny access based on the ldap attribute nsAccountLock = true? <http://g.bfbcs.com/175/pc_Lt%20Loooootz.png> Description: pc_Lt Loooootz

1 0

Compiling from source
by Tim McNabb 14 May '11

14 May '11

Has anyone been successful in installing FreeRADIUS 2.1.10 from src on CentOS or RHEL? I'd prefer not to use the package manager for installation as I'm attempting to install a custom module and the directory tree from the repo install doesn't match the source module setup. I know this is normal for using Yum, just wondering if anyone has been successful installing from src on CentOS and what worked and what didn't. Chkconfig doesn't seem to working on a src install either and I want radiusd to run as a service. Thanks in advance, Timothy McNabb Network Administrator Velociter Wireless, Inc (209)838-1221

5 7

Authentication issues from Apple devices
by stentofon 14 May '11

14 May '11

Hello. I have configured a Wireless Hotspot using the EasyHotSpot system, that uses FreeRadius for authentication. I am having problems only when Apple devices (iphone, ipad, macbooks) attempt to connect to the hotspot. This is confusing, as all other devices and software (Winxp, Vista, 7, Symbian, Blackberry, Android etc) authenticate perfectly. As a test case, and while running debugging, I attempted to connect with my Blackberry and an Iphone using the same username and password. I have attached the results. As you will see, using the same username and password, the blackberry authenticates while the iphone fails. I cannot see any reason for this in the log. Can anyone please assist? Failed log: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 60277, id=0, length=216 User-Name = "sandra" CHAP-Challenge = 0x0571777ec7661c411af641e8952291b9 CHAP-Password = 0x00120c16a8ff125a7a348459a0f40a86a9 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.10 Calling-Station-Id = "DC-2B-61-9C-92-E6" Called-Station-Id = "00-0D-56-9C-AC-F6" NAS-Identifier = "nas01" Acct-Session-Id = "4dcde5a500000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x35f8e8bc299636c4cd468b533de65f78 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "sandra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sandra' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sandra' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sandra' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[max_all_mb] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: 'September 11 2011 24:00:00' ++[expiration] returns ok ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "sandra" with CHAP password [chap] Using clear text password "sandra" for user sandra authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> sandra attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 60277 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +36 Ready to process requests. Sucessful Log: rad_recv: Access-Request packet from host 127.0.0.1 port 44107, id=0, length=216 User-Name = "sandra" CHAP-Challenge = 0x97824e8524637118ae2cf716a0362b97 CHAP-Password = 0x00f729a50979c25ef7d9d9e5e4cc1b2907 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "CC-55-AD-93-77-E6" Called-Station-Id = "00-0D-56-9C-AC-F6" NAS-Identifier = "nas01" Acct-Session-Id = "4dcde8c300000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0xf30387317dabf479ce7642e776e0295e WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "sandra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sandra' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sandra' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sandra' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[max_all_mb] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: 'September 11 2011 24:00:00' ++[expiration] returns ok ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "sandra" with CHAP password [chap] Using clear text password "sandra" for user sandra authentication. [chap] chap user sandra authenticated succesfully ++[chap] returns ok +- entering group session {...} expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> sandra ++[radutmp] returns ok +- entering group post-auth {...} expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' expand: %{User-Password} -> expand: %{Chap-Password} -> 0x00f729a50979c25ef7d9d9e5e4cc1b2907 expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'sandra', '0x00f729a50979c25ef7d9d9e5e4cc1b2907', 'Access-Accept', '2011-05-14 12:28:43') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'sandra', '0x00f729a50979c25ef7d9d9e5e4cc1b2907', 'Access-Accept', '2011-05-14 12:28:43') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 127.0.0.1 port 44107 WISPr-Bandwidth-Max-Down := 256000 Idle-Timeout := 600 WISPr-Session-Terminate-Time := "2011-9-11T24:00:00" Acct-Interim-Interval := 120 Session-Timeout = 10409477 Finished request 1. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-issues-from-Apple-de… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6