July 2011 - Freeradius-Users - lists.freeradius.org

pre-check OTP token
by Cor Bosman 05 Jul '11

05 Jul '11

Hi all, im setting up an OTP authentication service for our customer base. They should be able to authenticate with both their login/pass or an OTP. Ive got this working just fine by using PAM/radius where each pam services checks 2 radius servers. First the one doing the login/pass (this is a bit of a black box I cant modify too easily), and if that fails it checks the OATH/TOTP/HOTP radius daemon. The second radius server is a Freeradius installation, where the OTP checks are (currently) done using exec. The idea is that customers could be in an insecure environment like an internet cafe and use their OTP token to login through their regular websites or even with their IMAP client. Since we have a pretty large userbase of a few hundred thousand customers, and are regularly bombarded with brute force attacks in some form, i expect a lot of hits on the OTP radius server. Would their be some way, in either the PAM stage, or in the FreeRadius stage before Exec to pre-validate if ive got a token-reponse? They're always 10 digit numbers. Regards, Cor Freeradius: 2.1.10

4 4

how to use groups within freeradius
by Ken Felix 04 Jul '11

04 Jul '11

Can anybody post a simple howto with regards to using groups within freeradius? What we would like todo is restricted some user from logging into various firewalls. I've created usergroups and defined mysql> select * from usergroup ; +------------------+-------------+----------+ | UserName | GroupName | priority | +------------------+-------------+----------+ | | login users | 1 | | asa1.test | adminasa | 1 | | test.user | Login users | 1 | +------------------+-------------+----------+ and mysql> select * from radgroupcheck ; +----+-----------+----------------+----+----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+----------------+ | 1 | adminasa | NAS-IP-Address | == | 10.252.128.11 | | 2 | adminasa | NAS-IP-Address | == | 10.252.253.199 | | 3 | adminasa | NAS-IP-Address | == | 10.250.32.68 | | 4 | adminasa | NAS-IP-Address | == | 10.250.32.69 | | 5 | adminasa | NAS-IP-Address | == | 10.254.32.68 | | 6 | adminasa | NAS-Identifier | == | 10.252.128.11 | +----+-----------+----------------+----+----------------+ 6 rows in set (0.00 sec) debug shows the following; Sending Access-Reject of id 10 to 10.159.103.154 port 1812 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.252.128.11:1025, id=40, length=67 User-Name = "asa1.test" User-Password = "33333333333330" NAS-IP-Address = 10.252.128.11 NAS-Port = 43 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "chap" returns noop for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "asa1.test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 18 modcall[authorize]: module "files" returns notfound for request 18 radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 18 modcall: leaving group authorize (returns ok) for request 18 auth: type Crypt Login OK: [asa1.test] (from client SBBC port 43) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 18 rlm_sql (sql): Processing sql_postauth radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 18 modcall: leaving group post-auth (returns ok) for request 18 Sending Access-Accept of id 40 to 10.252.128.11 port 1025 Service-Type = Dialout-Framed-User Finished request 18 Going to the next request So I need some starting point of what/where to look at. Thanks

3 3

Help debugging unstable server
by Carlos Eduardo Tavares Terra 04 Jul '11

04 Jul '11

Today I have 2 freeradius servers running... Both of them in a CentOS 5.6. The first is stable, without problems running freeradius 1.1.3. The second is running freeradius 2.1.7 and in the last 3 months became very unstable. After some time running the threads just shutdown... Reading the /var/log/radius/radius.log, the only message in the moment of the problem is: Sun Jul 3 06:53:41 2011 : Info: Exiting normally. When I check the running processes, the radiusd is running... the 'service radiusd status' command displays the pid of the runnind daemon... but radiusd is not listening the network ports anymore. I tried to keep the radius in debug mode (radiusd -XXXX) for a week, but in this case the problem didn't happen. Is there some way to force the radiusd print why it is exiting 'normally' ?? Thanks -- Carlos Eduardo Tavares Terra Red Hat Certified Engineer Consultor em Infraestrutura de TI GNU/Linux #413291 [http://counter.li.org]

2 2

Patch for radiusclient: new program radlistdictionary and fixes to PPTP/CHAP problem
by freeradius developer/user identity 04 Jul '11

04 Jul '11

I have posted at http://www.cardiothink.com/downloads/ a set of patches which, when applied to the latest stable freeradius-client (version 1.1.6) and to the CVS version, fixes the problem with PPTP and radiusclient that results in failure of CHAP authentication with the syslog errors: rc_avpair_new: unknown attribute 11 rc_avpair_new: unknown attribute 25 (The problem, for me, turned out to be blanks at the start of every line in dictionary.microsoft. The patches, among other things, skip the blanks.) Included in the patches is a new program in the src subdirectory that I have named radlistdictionary (you can change it if you like). It is a simple program that uses the installed freeradius-client library to read dictionaries, and it displays the loading and parsing steps explicitly so that you can see where errors are occurring. (This program requires that the library itself be patched to show the parsing.) Fixing problems with the dictionaries is easy once you can see what is going on! Please see the above web site for more details, and let me know of any problems.

1 0

Include directive for separate ippool configs not working
by Tom De Vylder 04 Jul '11

04 Jul '11

Hi all, I'd like to integrate freeradius into a config management framework. In order for this to work with multiple ippool instances I've decided to create a ippool.d/ directory containing several config files. Loading the config files itself is not a problem, however placement of the include statement is. I've tried to put the following line in several places: $INCLUDE /etc/freeradius/ippool.d/ E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ... Nothing seems to work. Freeradius -X starts the service correctly. I can see my configs are loaded. However anything that's defined inside them just doesn't show up. I'm running the current Debian stable package (2.1.10). > FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including configuration file /etc/freeradius/snmp.conf > including configuration file /etc/freeradius/eap.conf > including configuration file /etc/freeradius/sql.conf > including files in directory /etc/freeradius/ippool.d/ > including configuration file /etc/freeradius/ippool.d/foobar.conf > > main { > allow_core_dumps = no > } > including dictionary file /etc/freeradius/dictionary > main { > > [ ... ] > > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on proxy address * port 1814 > Ready to process requests. Kind regards, Tom De Vylder

3 6

Windows IIS authentication with FREERADIUS !
by aacable 04 Jul '11

04 Jul '11

Hello All, I am stuck in a situation and need help. I have a ISP type local network, I am using Mikrotik router as PPPOE server and FREERADIUS (ubuntu) as a radius server for about 2000+ users. I Have 5 Terabyte of Media sharing server, (hosted on IIS FTP) , Is there any way that IIS can get authentication from FREERADIUS ? so that only those users can access ftp media sharing server who have account on radius server. Can you please give me some hints on how I can configure IIS to use authentication from FREERADIUS server ? Help plz :) Regards, SYED JAHANZAIB -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-IIS-authentication-with-FRE… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Windows IIS authentication with FREERADIUS !
by aacable 04 Jul '11

04 Jul '11

Hello All, I am stuck in a situation and need help. I have a ISP type local network, I am using Mikrotik router as PPPOE server and FREERADIUS (ubuntu) as a radius server for about 2000+ users. I Have 5 Terabyte of Media sharing server, (hosted on IIS FTP) , Is there any way that IIS can get authentication from FREERADIUS ? so that only those users can access ftp media sharing server who have account on radius server. Can you please give me some hints on how I can configure IIS to use authentication from FREERADIUS server ? Help plz :) Regards, SYED JAHANZAIB -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-IIS-authentication-with-FRE… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Invitation to connect on LinkedIn
by Sergio Belkin via LinkedIn 03 Jul '11

03 Jul '11

LinkedIn ------------ Sergio Belkin requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Sergio Accept invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… View invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… ------------------------------------------ Why might connecting with Sergio Belkin be a good idea? Sergio Belkin's connections could be useful to you: After accepting Sergio Belkin's invitation, check Sergio Belkin's connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future. -- (c) 2011, LinkedIn Corporation

1 0