June 2011 - Freeradius-Users - lists.freeradius.org

how to output that attribute value as raw data?
by ichiro tanaka 07 Jun '11

07 Jun '11

Hi. I was using freeradus-2.1.10 as radius home server. I want to output log file that attribute value as raw data. For example, NOT "%{Acct-Terminate-Cause} -> User-Request" BUT "%{Acct-Terminate -Cause} -> 1". Then, I edited dictionary.rfc2866 like this. ---edited #VALUE Acct-Terminate-Cause User-Request 1 --------------------------------------------- The output became "%{Acct-Terminate-Cause} -> 1", and it became a hoped output. However, default setting has become illegal. ---illegal thing if(Acct-Terminate-Cause == User-Request){ sql } --------------------------------------------- Please teach the way of the setting. Thanks for your help. ichiro tanaka

2 3

Freeradius not releasing IPs from pool
by Angel L. Mateo 07 Jun '11

07 Jun '11

Hello, I have a problem with my pools in freeradius. The problems is that it is not releasing IPs from the pools. At least, not all of them, so after a while my users can't connect because the pool is full. I check that it is not releasing IPs because I get (I have replaced usernames with XXXX): root@vulpes21:/usr/share/doc/freeradius# radwho | grep 155.54.194 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:28 155.54.213.20 155.54.194.128 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:36 155.54.213.20 155.54.194.51 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:42 155.54.213.20 155.54.194.8 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:33 155.54.213.20 155.54.194.115 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:37 155.54.213.20 155.54.194.101 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:40 155.54.213.20 155.54.194.62 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:06 155.54.213.20 155.54.194.92 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:11 155.54.213.20 155.54.194.48 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:24 155.54.213.20 155.54.194.78 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:27 155.54.213.20 155.54.194.112 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:28 155.54.213.20 155.54.194.59 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:29 155.54.213.20 155.54.194.134 but rlm_ippol_tool shows a lot of IP addresses in use: root@vulpes21:/etc/freeradius# rlm_ippool_tool -a pool_vpn.ippool pool_vpn.ipindex | wc -l 122 In my configuration I have: authorize { vpn_log vpn_syslog suffix files_vpn pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap-email } } preacct { suffix files_vpn } accounting { vpn_log unix pool_vpn pool_vpn_alu pool_vpn_ryt radutmp vpn_acc_syslog sql_log_um } session { } post-auth { pool_vpn pool_vpn_alu pool_vpn_ryt vpn_log vpn_syslog } pre-proxy { } post-proxy { } Any idea? Ah... I'm running 2.1.8 from ubuntu 10.04. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 3

Unable to authenticate locally when remote proxy server is unavailable
by jch2006＠verizon.net 07 Jun '11

07 Jun '11

3 3

Setting Cached-Session-Policy
by Gerald Vogt 06 Jun '11

06 Jun '11

Hi! I am trying to get fast session resumption with VLAN assignments to work. I have tried the suggestion in this message: http://lists.freeradius.org/pipermail/freeradius-users/2011-April/msg00381.… However, it seems to me as if the post-auth section is too late to set the Cached-Session-Policy. I have added the following to the beginning of the post-auth section in the default site: post-auth { if ( reply:Cached-Session-Policy ) { if ( reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update reply { Reply-Message += "Cached policy: %{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 } } } elsif ( reply:Tunnel-Private_group-ID ) { update reply { Cached-Session-Policy := "vlan=%{reply:Tunnel-Private-Group-ID}" } } I can see in the logs that this correctly sets Cached-Session-Policy, e.g. to vlan=10. However, during session resumption it will only add User-Name and Stripped-User-Name. During the initial session setup I can see that attributes are saved into the cache: [peap] Success [peap] Using saved attributes from the original Access-Accept Tunnel-Private-Group-Id:0 = "18" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "vogt" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++? if (reply:Cached-Session-Policy ) ? Evaluating (reply:Cached-Session-Policy ) -> FALSE ++? if (reply:Cached-Session-Policy ) -> FALSE ++? elsif (reply:Tunnel-Private_group-ID ) ? Evaluating (reply:Tunnel-Private_group-ID ) -> TRUE ++? elsif (reply:Tunnel-Private_group-ID ) -> TRUE ++- entering elsif (reply:Tunnel-Private_group-ID ) {...} expand: vlan=%{reply:Tunnel-Private-Group-ID} -> vlan=18 +++[reply] returns noop ++- elsif (reply:Tunnel-Private_group-ID ) returns noop Now, if I understand the source code correctly, attributes are saved when freeradius logs "Saving response in the cache". I think this means that setting Cached-Session-Policy in post-auth is too late because at point the caching already happened and modifying Cached-Session-Policy won't affect what is stored in the cache. This is what is logged during session resumption: [peap] Adding cached attributes to the reply: User-Name = "vogt" Stripped-User-Name = "vogt" [eap] Freeing handler ++[eap] returns ok Should setting Cached-Session-Policy in post-auth have an effect on cached attributes or not? Cheers, Gerald

2 2

Freeradius + Alvarion 4Motion specify filter-id value inaccess-accept from value in user conf file ?
by Hahusseau, Thomas 06 Jun '11

06 Jun '11

Hello, I'm running latest version form Master Branch of Freeradius. I managed to connect an Alvarion CPE to an Alvarion 4M BS with Freeradius server as authenticator. Everything works well except that I directly specified in my /site-enable/default configuration file the value of "Filter-Id" attribute required by the base station. ----------- /site-enabled/default post-auth { exec update request { WiMAX-MN-NAI = "%{User-Name}" } update reply { WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = "%{reply:EAP-MSK}" Filter-Id = "Profile1" } wimax Post-Auth-Type REJECT { # log failed authentications in SQL, too. # sql attr_filter.access_reject } } ----------- I would like to use different value of attribute "Filter-Id" for different users (specific QoS setting in Alvarion ASN-GW for each Filter-Id). I would like to use the "Filter-ID"'s value specified in my users conf file : ----------- users #standard customer cpe1(a)eads.com Cleartext-Password := "cpe1" Session-Timeout = 3600, Termination-Action = Radius-Request, Filter-Id = "Profile1" #VIP customer cpe2(a)eads.com Cleartext-Password := "cpe2" Session-Timeout = 3600, Termination-Action = Radius-Request, Filter-Id = "Profile2" ----------- I tried to use the same syntax as for WiMAX-MSK attribute: Filter-ID ="%{Filter-Id}" but it doesn't work (Filter-ID value in access-accept is empty). I googled "Filter-Id freeradius" and found nothing relevant. Is it possible to use Filter-ID value form users conf file in access-accept ? Here is an example on access-accept message with filter-id specified directly in site-enable/default conf file. ----------- radiusd -X (7) Found Auth-Type = ? (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) group authenticate { (7) - entering group authenticate {...} (7) eap : Request found, released from the list (7) eap : EAP/ttls (7) eap : processing type ttls (7) ttls : Authenticate (7) ttls : processing EAP-TLS (7) ttls : Received TLS ACK (7) ttls : Received TLS ACK (7) ttls : ACK handshake is finished (7) ttls : eaptls_verify returned 3 (7) ttls : eaptls_process returned 3 (7) ttls : Using saved attributes from the original Access-Accept (7) eap : Freeing handler (7) [eap] = ok (7) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (7) group post-auth { (7) - entering group post-auth {...} (7) [exec] = noop (7) update request { (7) expand: %{User-Name} -> {am=1}791d05915a25400ca9d1a3cb1a2c7ffa(a)eads.com (7) } # update request = noop (7) update reply { (7) expand: %{reply:EAP-MSK} -> 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528cb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 (7) } # update reply = noop (7) wimax : MIP-RK = 0x9ec871a65c3033e03c0d77ed55a1517d4b7dbbbeb2d782bcf369635861e64925c5db13c36286e2032c789ad6fe2c09cd21eda782a9a4758e9ce73f8f384c46b6 (7) wimax : MIP-SPI = bb9d949a (7) wimax : WARNING: WiMAX-IP-Technology not found in reply. (7) wimax : WARNING: Not calculating MN-HA keys (7) [wimax] = updated Sending Access-Accept of id 246 to 192.168.100.10 port 1812 MS-MPPE-Recv-Key = 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528 MS-MPPE-Send-Key = 0xcb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}791d05915a25400ca9d1a3cb1a2c7ffa(a)eads.com" WiMAX-FA-RK-Key = 0xb37b0b5832687e02c31b94319b2ba3077479411f WiMAX-MSK = 0x0473dcd65638bc4ef089945467f25e24f252b53f34e4d2f220d157c3d1192528cb185a0437d0a641fd5434d28738eae8f013d4b0308662a0e1b365d8ad542ce0 Filter-Id = "Profile1" WiMAX-FA-RK-SPI = 2593430971 (7) Finished request 7. ----------- Regards, Mr Thomas Hahusseau, Ingénieur réseau Cassidian (EADS)

2 5

Can't get checkrad to be called
by Dan Brisson 06 Jun '11

06 Jun '11

I was wondering if someone could help me determine why checkrad isn't being called. I've followed the directions in the doc/Simultaneous-Use but still cannot get checkrad to fire off when I login. It will check radutmp, but never reaches out to my NAS with checkrad, as evidenced here from radiusd -X: +- entering group session {...} [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> testuser ++[radutmp] returns ok Using Post-Auth-Type Reject In this case, testuser was already logged in as verified by radwho, but why didn't it go out and check my NAS? I'm using a Nomadix HSG for a NAS, which doesn't have a definition in clients.conf, but I've been able to get /usr/sbin/checkrad to return the following by modifying the "pr3000" definition: [root@hologram radius]# more checkrad.log Wed Jun 1 22:11:34 2011 checkrad pr3000 10.1.10.20 1 testuser 1 snpwalk: /usr/bin/snmpwalk -r 1 -t 5 -v2c -c 'public' 10.1.10.20 .1.3.6.1.4.1.3309.1.2.2.18.1.1.5 Returning 1 (double detected) So it would seem if I could get FR to perform checkrad, I'd be in good shape. Can I provide any other data? I'm using SQL for authorization and accounting. I'm on version 2.1.7-7.el5 of FreeRadius. TIA, -dan

3 10

Log NAS IP rather than Shortname - PLEASE
by Jason Frawley 04 Jun '11

04 Jun '11

I have about 50 routers that are accessing my radius server and I setup the clients.conf with CIDR and left shortnames blank so now it logs the ip address and cidr. What I really need it to do is just report the ip in which the requests came from rather than the shortname... thoughts? Jason Frawley

4 11

how apply policy on my ldap users
by motaibi 03 Jun '11

03 Jun '11

Dear guys i have server i installed on it : 1) freeradius 2.1.7 2) chillispot 1.1.0 3) mysql 5.0.77 5) apache 2.2.3 i already configure my server to make it as hotspot wifi system , configured chillispot and freeradius for mysql DB and apache web server to authenticate wifi users which they login through captive portal then AAA through freeradius + mysql for DB users after that i applied some policy = attribute like - limited users download traffice - limited users login time . everything working fine finally i configured my freeradius to connect Active Directory for users authentication through rlm_ldap and successful . NOW i want apply the previous policy to active directory users how i can do that ???? Is there a way can make the authenticate through active directory and authorization throguh mysql ?? then make replication between active directory and mysql users is it possible ?? i attach debug mode user in active directory http://freeradius.1045715.n5.nabble.com/file/n4449095/radiusd_debug.txt radiusd_debug.txt please help me guys !!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/how-apply-policy-on-my-ldap-users-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

RE: Error: User-Name is not the same as MS-CHAP name
by Paul Harris 03 Jun '11

03 Jun '11

On 02/06/11 14:47, Francois Gaudreault wrote: >>> >> Did you have a chance to look at it? >Ironically I'm having trouble finding a windows XP install CD... I have a link to a torrent, just send me a email at paulh3(a)mail.com

4 4

Mac authenticaion failure
by pcunha 03 Jun '11

03 Jun '11

Hi Everyone, I tried to set up Mac Authentication per the the doc at freeradius.org. The client connects but the users don't. The folowing is the output from the debug mode in freeradius. Thanks for your help. eady to process requests. rad_recv: Access-Request packet from host 10.41.0.254 port 32768, id=107, length=135 User-Name = "d8-a2-5e-c4-a4-58" Called-Station-Id = "00-3a-98-8e-ad-d0:USDOD" Calling-Station-Id = "d8-a2-5e-c4-a4-58" NAS-Port = 1 NAS-IP-Address = 10.41.0.254 NAS-Identifier = "NCPSWIFI" Airespace-Wlan-Id = 1 Service-Type = Call-Check Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "d8-a2-5e-c4-a4-58", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry d8-a2-5e-c4-a4-58 at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> d8-a2-5e-c4-a4-58 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 107 to 10.41.0.254 port 32768 Waking up in 4.9 seconds. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mac-authenticaion-failure-tp4428847… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2