May 2011 - Freeradius-Users - lists.freeradius.org

Re: using freeRadius to authentic a user to access different sources with different configuration
by Abbas Yazdanpanah 17 May '11

17 May '11

ok, I just wanted to get your suggestions if there is any (It seems there is no) and start to implement it. Thanks for your attention. I'll soon ask my specific questions here. Sorry for any disturbance. > On Tue, May 17, 2011 at 4:22 PM, Alan DeKok <aland(a)deployingradius.com> wrote: >> Abbas Yazdanpanah wrote: >>> I've read all the documents(it toke about 2 month for me to read and >>> learn them) and I also implemented freeRadius 2.1 and daloradius using >>> mysql configuration for an ISP(the mentioned system). I'm just an IT >>> guy so my boss who don't have good technical standpoint decided to >>> migrate and I'm in the research phase of migration. That's it. >> >> The issue is that your post was content-free. "Hi, I'm trying to do >> something. Can you help me?" >> >> What do *you* expect us to be able to do with that question? >> >> Decide what you want to do. Use specific words, not vague ones like >> "resources". Use words relevant to RADIUS. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >

1 0

using freeRadius to authentic a user to access different sources with different configuration
by Abbas Yazdanpanah 17 May '11

17 May '11

Dear all, There is a NAS and I want to authenticate users. I have two resources, the first one the is Internet and the second is an intranet. I've two access policies regarding to each source. for example a policy is "users have different bandwidth for accessing each source". I've a proprietary radius server and have used its scripting abilities to set the second resource policy. It must be said that the second resource policy is identical for all users. It has been decided to migrate our system to freeRadius (due to the expenses) and also there is a change in policies so the second resource policy is not identical for all users any more. Due to my lack deep experience in freeRadius, I was wondering if there is any suggestion that would help me about this scenario. Regards, Abbas.

3 4

attrs.pre-proxy in V2
by Steve Brown 17 May '11

17 May '11

Hi chaps, I'm slightly confused with the different V2 semantics. I'm trying to truncate the Framed-IP-Address to the first three quads for a particular realm (somerealm below) when a particular attribute contains particular text: In pre V2, something like this would do the trick: somerealm Some-Attribute == "Some,text" Framed-IP-Address =~ "^([0-9]+\.[0-9]+\.[0-9]+)\.[0-9]+", Framed-IP-Address := `%{1}`, Fall-Through = Yes What would the equivalent rule for V2 be? The above doesn't appear to do what I want. Steve

2 5

Using LDAP with EAP-TLS
by Alexandros Gougousoudis 17 May '11

17 May '11

Hi, I'am trying to make FR 2.1.10 on Squeeze work with my LDAP installation. What I want to do is: A host-based authentification for my workstations. All the names of the workstations are in LDAP, the authentification itself should be done with EAP-TLS. I would like to have a hint, how to start EAP when the LDAP-Query was successfull. The LDAP-Query works I think, FR says: [ldap] user scit-beerchen authorized to use remote access, but then it tries to make some kind of password authentification (I have no password for workstations in LDAP), and is not starting EAP-TLS. The asking host "scit-beerchen" is in the WLAN-User Group. What could I do? Please have a look on my Debug-Output: rad_recv: Access-Request packet from host 10.48.244.28 port 3079, id=0, length=139 User-Name = "scit-beerchen" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "002268c63ff2" NAS-Identifier = "0016b64f44cc" NAS-Port = 11 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001201736369742d626565726368656e Message-Authenticator = 0x12969f7ffa42f57be53a54474c1274be # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "scit-beerchen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "scit-beerchen", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for scit-beerchen [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> scit-beerchen [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=scit-beerchen) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to physalis:389, authentication 0 [ldap] bind as / to physalis:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (uid=scit-beerchen) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user scit-beerchen authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=scit-beerchen [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> scit-beerchen attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.48.244.28 port 3079, id=0, length=139 Cleaning up request 0 ID 0 with timestamp +1034 User-Name = "scit-beerchen" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "002268c63ff2" NAS-Identifier = "0016b64f44cc" NAS-Port = 11 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001201736369742d626565726368656e Message-Authenticator = 0x11c70e19e2f1150428f5cc12d535e57b # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "scit-beerchen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "scit-beerchen", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for scit-beerchen [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> scit-beerchen [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=scit-beerchen) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (uid=scit-beerchen) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user scit-beerchen authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=scit-beerchen [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> scit-beerchen attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.48.244.28 port 3079, id=0, length=139 Cleaning up request 1 ID 0 with timestamp +1034 User-Name = "scit-beerchen" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "002268c63ff2" NAS-Identifier = "0016b64f44cc" NAS-Port = 11 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001201736369742d626565726368656e Message-Authenticator = 0x781aba777bfd1eee9fb99135f368597f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "scit-beerchen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "scit-beerchen", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for scit-beerchen [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> scit-beerchen [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=scit-beerchen) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (uid=scit-beerchen) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user scit-beerchen authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=scit-beerchen [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> scit-beerchen attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 0 to 10.48.244.28 port 3079 Waking up in 4.9 seconds. Cleaning up request 2 ID 0 with timestamp +1034 Ready to process requests. This is my "default" site: authorize { preprocess chap mschap digest suffix ntdomain eap { ok = return } files ldap if (notfound) { reject } expiration logintime pap ntlm_auth } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap Auth-Type LDAP { ldap if (LDAP-Group == "WLAN-User") { noop } else { reject } } ntlm_auth } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } TIA Alex

7 20

Re: unlang Question about evaluating unavailable attributes to FALSE
by Alan DeKok 17 May '11

17 May '11

Stefan A. wrote: > if I'm using an expression like > > if (control:VSA1=~/something/ || control:VSA2 =~/something_else/) > {...} > > I do get the information "(Attribute control:VSA1 was not found)" in case > the VSA is not in the control context. > As the condition is '||', I would expect, that FR tries the next option, but > it does not. It sets the hole Expression to FALSE. I think that's fixed in the v2.1.x branch in git. The fix will be in 2.1.11. Alan DeKok.

1 0

Help: rancid+radius+cisco getting error
by zulfadli 17 May '11

17 May '11

Hi, I'm using rancid-2.3.3 and freeradius-1.1.3-1.6.el5. Both installed at different machines. My problem is whenever I test rancid it gave error below.. [rancid@mycompany bin]$ clogin clientA ClientA spawn telnet clientA Trying x.x.x.34... telnet: connect to address x.x.x.34: Connection refused telnet: Unable to connect to remote host: Connection refused spawn ssh -c 3des -x -l rancid clientA rancid@ clientA 's password: Permission denied, please try again. Error: Check your passwd for clientA I've checked in my radius that the password is correct.in fact if I try ssh to clientA from my rancid machine everything is ok.. [rancid@mycompany bin]$ ssh rancid@ clientA rancid@ clientA 's password: clientA -PE01> Here are some rancid files for your reference. Router.db clientA:cisco:up clientB:cisco:up .cloginrc # clientA # these routers ask for a username and password. we automatically get # enable access after successful authentication. add user clientA rancid add password clientA mypassword #add autoenable clientA 1 # clientB # these routers ask for a username and password. we automatically get # enable access after successful authentication. add user clientB rancid add password clientB mypassword #add autoenable clientB 1 Log Trying to get all of the configs. clientA clogin error: Error: Check your passwd for clientA clientA: missed cmd(s): admin show diag,dir /all slavedisk2:,show rsp chassis-info,dir /all sec-slot2:,show diag,dir /all disk1:,show gsr chassis,dir /all sec-nvram:,show diag chassis-info,dir /all disk2:,dir /all sec-bootflash:,show spe version,dir /all slaveslot2:,dir /all disk0:,show install active,show bootvar,dir /all slaveslot0:,dir /all sec-slot1:,dir /all harddiska:,dir /all slavenvram:,show flash,dir /all sec-disk2:,dir /all slavesup-bootflash:,dir /all sec-disk0:,dir /all harddiskb:,show variables boot,show boot,show inventory raw,dir /all slavedisk1:,show env all,show module,admin show env all,show controllers,admin show version,show diagbus,more system:running-config,dir /all slavedisk0:,show debug,show idprom backplane,dir /all bootflash:,dir /all sec-slot0:,dir /all sec-disk1:,write term,show vtp status,dir /all sup-bootflash:,dir /all slot2:,dir /all harddisk:,dir /all slot0:,dir /all sup-microcode:,show vlan,dir /all slavebootflash:,show controllers cbus,dir /all slaveslot1:,dir /all nvram:,show version,show vlan-switch,admin show variables boot,show redundancy secondary,show running-config,show c7200,dir /all slot1: clientA: End of run not found Some radius file for your checking.. rancid Auth-Type := System Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" client x.x.x.x { secret = secret_pass shortname = clientA-PE01 nastype = cisco What could possibly cause the problem here?can anyone help me on this? Thank you and with regards Zulfadli Syazwan Bin Razali MYREN Application Engineer Malaysian Research & Education Network (MYREN) HP : 013 - 921 1482 Fax : 03 - 8318 5034 Ym! : bighorn5971(a)yahoo.com Skype: zulfadlisyazwan http://www.myren.net.my

3 2

HUAWEI MA5200G and Vendor Specific Attributes
by Ali Majdzadeh 17 May '11

17 May '11

Hello All I’m using freeradius 1.1.8 with a C external program for auth/acct. I’m sending attributes to RAS by printf . RAS type is HUAWEI MA5200G And I send attributes as follows: printf("Session-Timeout=%d",session_time); printf(",\nInput-Peak-Rate=%d",(int)rx_burst); printf (",\nInput-Average-Rate=%d",(int)rx_rate); printf(",\nOutput-Peak-Rate=%d",(int)tx_burst); printf(",\nOutput-Average-Rate=%d",(int)tx_burst); the last 4 lines are HUAWEI vendor specific attributes. MA5200G RAS Debug does not show any attributes inside of auth request. I remove the HUAWEI vendor specific attributes (the last 4 lines), RAS shows the standard attributes correctly. What is the problem? HUAWEI says it support only radius 1.1, So does freeradius support 1.1 when sending attributes by printf via external program or not?

2 1

variable string replace (i presume using UNLANG?)
by Steve Staples 16 May '11

16 May '11

Hi all, I am looking to replace a string, before sending the query off to sql... right now, it is %{SQL-User-Name} (sql_user_name = "%{User-Name}" ), but the value is going to be like: mppp%sstaples(a)domain.com and i want to remove the mppp% (which will always be prefixed, or not exist) so that the variable only is sstaples(a)domain.com Is that easy to do? I have searched the docs, but came up empty (sorry if it has been discussed already... just didnt find it) I could always write it in the query to replace the string: SELECT REPLACE('mppps%sstaples(a)domain.com', 'mppp%', ''); but not sure if that is the most efficient way to do it? Thanks in advance. Steve.

2 1

unlang conditionals
by doqb＠hotmail.com 16 May '11

16 May '11

Hello... This is probably a very silly issue. I have the following on my default file: update control { Tmp-String-0 = "%{sql:select a from paq where CallingStationId='%{Calling-Station-Id}'" Tmp-String-5 = "%{sql:select b from paq where CallingStationId='%{Calling-Station-Id}'" } if (control:Tmp-String-0 > control:Tmp-String-5) { .... } On the radius logs I see the following: expand: %{sql:select a from paq where CallingStationId='%{Calling-Station-Id}'} -> 693492 expand: %{sql:select b from paq where CallingStationId='%{Calling-Station-Id}'}' -> 174080 ++[control] returns ok ++? if (control:Tmp-String-0 > control:Tmp-String-5) ? Evaluating (control:Tmp-String-0 > control:Tmp-String-5) -> FALSE ++? if (control:Tmp-String-0 > control:Tmp-String-5) -> FALSE why is the condition giving FALSE even though is already met? -- View this message in context: http://freeradius.1045715.n5.nabble.com/unlang-conditionals-tp4400590p44005… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

pam_auth_radius
by Marc Phillips 16 May '11

16 May '11

Not sure if this is the appropriate forum for this, but I'll type it anyway. I have a need to add centralized auth and accounting to unix boxes (specifically a linux based "appliance." It's not really an actual appliance, just a standard linux box that a vendor provides). For my normal unix* boxes I have an identity management system. For appliances and network devices I use Radius, mostly. For this new appliance, I'd like to use Radius, but I don't want to manage users or what groups they belong to on the device itself. I'd like to have the users auth against Radius and then apply a group based on an attribute recieved. I've done a little looking and I see no group support for pam_auth_radius. One thought I had was to add some sort of auto provision function to the pam module to add the user and associate that user with a group via the supplied attribute from radius, then remove the user on logout. Any thoughts on this? Is there some other method that would be more appropriate? I have use for this for other psuedo-appliances. I've tried using LDAP for those, but the chatter with vendor supplied ldap modules was unmanagable. R. Marc

4 7