July 2011 - Freeradius-Users - lists.freeradius.org

Re: Accounting - limits
by Rizky Marunda Dinata 25 Jul '11

25 Jul '11

Dear Evgeny, Yes, freeradius is able to monitor and limit usage, for example will reject login after 1 GB of sum ( download+upload), please read info about sql-counter (http://wiki.freeradius.org/Rlm_sqlcounter) On Mon, Jul 25, 2011 at 3:53 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius Ldap mosule is authenticating with wrong > password also (Alan Buxey) > 2. Please help me ASAP (Its Me) > 3. Re: Please help me ASAP (Harry Hoffman) > 4. Accounting - limits (Evgeny Yurchenko) > 5. How to allow a user login in a certain time? (Lingfeng Xiong) > 6. RE: Accounting - limits (Ryan Williams) > 7. Download/Upload Calculation (radiusus) > 8. counter daily (Angus JIANG Jian) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 24 Jul 2011 12:48:34 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Freeradius Ldap mosule is authenticating with wrong > password also > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20110724114834.GA5422(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > DEFAULT LDAP-Group == "CiscoRWL2Lr", Auth-Type := Accept > > Reply-Message = "Welcome! You have administrative access.", > > Service-Type = NAS-Prompt-User, > > cisco-avpair = "shell:priv-lvl=15" > > as already said, you've configured your RADIUS server to accept > ANYONE who is in the CiscoRW2Lr group - even if their password > is 100% wrong. Auth-Type := Accept opens your box to basically not > caring about authentication.... only authorization. > > remove the auth-type and ensure your authentication is working - > which will need some work for AD > > alan > > > ------------------------------ > > Message: 2 > Date: Sun, 24 Jul 2011 06:29:56 -0700 (PDT) > From: Its Me <ktscse(a)yahoo.com> > Subject: Please help me ASAP > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <1311514196.43660.YahooMailNeo(a)web110116.mail.gq1.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > I am new user in Linux,I have install freeradius2 rpm in my Linux > machine(RHEL-5.5 Server),I m facing problem below detail ,please help me how > can i install and setup my radiusd -X output below problem. > > radiusd: #### Opening IP addresses and Ports #### > listen { > ??????? type = "auth" > ??????? ipaddr = * > ??????? port = 0 > Failed binding to authentication address * port 1812: Address already in > use > /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 >

1 0

Please help me ASAP
by Its Me 25 Jul '11

25 Jul '11

Hi, I am new user in Linux,I have install freeradius2 rpm in my Linux machine(RHEL-5.5 Server),I m facing problem below detail ,please help me how can i install and setup my radiusd -X output below problem. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812

3 2

Download/Upload Calculation
by radiusus 25 Jul '11

25 Jul '11

Hello, I am new to radius server and I need some information if possible. Can anybody help with any documentation regarding the calculation of input/output octets on user/daily basis? I am interested only in reporting and analyzing the traffic of download/upload. I have been trying to use some Analytical functions and get somewhere but still can't be sure as I do not need how to use the Gigawords condition etc. My cdr's are stored in Oracle DB. Some information would be really appreciated. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Download-Upload-Calculation-tp46300… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

How to allow a user login in a certain time?
by Lingfeng Xiong 24 Jul '11

24 Jul '11

hi there, I am writing a authentication system for a public Cisco System laboratory of a university. This system allow user to subscribe a cisco device in a certain time and during that time, the subscriber should be able to login that device. I have already build a FreeRadius server and configure my Cisco device to authenticate user via Radius. But I have no idea how to configure FreeRadius to control the login time. For example, a user subscribe a device named 'Test1' for 'July 30, 2011' from '10:00 a.m.' to '12:00 p.m.'. He should be able to login 'test1' during that time, but not before or after. I know there existed a module named 'rlm_logintime', but it seems like that module can only supply me with scheduled login plan, not a certain time period. So could you give me some advice? Thanks. BTW: I am runing FreeRadius 2.1.11 on a FreeBSD 8.2-RELEASE system. A MySQL database is also running for FreeRadius.

1 0

How to run a perl script
by Tyller D 21 Jul '11

21 Jul '11

Hi I would like to run a perl script, using rlm_perl, at specific times. For example, when a Stop request comes in run stop.pl, when an interim-update comes in run update.pl. Can someone tell me where to do this. I am sorry if my question seems vague but I am fairly lost. I can write the script I just don't know how to call it. Any assistance would be appreciated. Thanks

3 2

regex does not honour escaped characters?
by Oliver Schröder 21 Jul '11

21 Jul '11

Hello List, I'm trying to match a User-Name attribute against a regex in the hints file. I'm now stumbling over a regex which does not work as expected. It looks like this: DEFAULT User-Name =~ "(.*\.de\.de$)" Hint := "Blacklist" It is aimed to match User-Names like "x(a)whatever.de.de". To my astonishment, it also matches usernames like "x(a)ende.de" (note the missing dot). I'm unsing a self-compiled freeradius from git-sources: FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu Looking at the config.log, I assume that the local posix regex functions are used: $ grep regex config.log configure:23003: checking regex.h usability configure:23044: checking regex.h presence configure:23107: checking for regex.h ac_cv_header_regex_h=yes From my observations, it seems that backslashes are removed from the regex string before the regex gets compiled, but I might be wrong. Am I missing something or is this a (known) bug?

2 2

clients.conf with MAC-address .
by Andy Zarzycki 21 Jul '11

21 Jul '11

Greetings, We are trying to authenticate user request coming from many APs. The plan is to authenticate the APs as well as the users centrally using freeradius. We were hoping if we could configure clients.conf with MAC-address instead of IP address for every AP. This will ensure MAC-address with shared secret to be unique and thus APs will be authenticated. Is this possible ? Any help or direction is appreciated. Thanking you, Andy.

2 1

Trying to wrap my head around FreeRadius config
by Moe, John 21 Jul '11

21 Jul '11

Hello, all Apologies in advance if this isn't the right forum for this, or if it's already been answered somewhere, and my Google-fu just isn't up to the task. Please point me in the right direction if either is the case. I've managed to get a FreeRadius instance up that will authenticate a user's logon into a HP ProCurve switch against our Active Directory using PAP. I'm now trying to get PCs to authenticate to that switch using 802.1x/PEAP-MSCHAPv2. In trying to get this step working, I'm trying to understand how all the various config files and modules all fit together, so that I can understand how to properly setup FreeRadius. I've read through the config files and the Wiki pages, but I'm still not entirely clear that I understand it all, so I'm hoping someone can correct me if I'm on the wrong track. The process below is based on the default install that came with my distro (Gentoo), in case it differs from other distros. The config I'm currently using has been modified from this, of course, but as I'm more interested right now in how it fits together, I figured I'd start with the default config. 1) When a RADIUS request gets received by the server, it first looks up the device in the clients.conf file. If it doesn't exist there, it ignores the request (with a message being logged saying it ignored the request). 2) If it has the client listed in clients.conf, it then runs the request through the sites-enabled/default file. That file seems to say, starting with the authorize section, run it through the preprocess module, then chap, mschap, suffix, eap, unix, files, expiration, logintime and finally, pap. This is where things start to get a bit blurry for me. I understand that the preprocess module is rlm_preprocess, and that the config lives in modules/preprocess, where I can read a description of that module and what it does. Likewise for chap and mschap. However, suffix doesn't appear to be a module; where'd this come from, and what does it do? There also appear to be some modules in /usr/lib64/rlm_* that appear to have neither a man page, nor a config file in the modules directory, nor any sort of description in the Configuration Files section of the Wiki page. 3) The chap, mschap and eap modules seem to all look at the request and decide if the request is using any of these. If so, they add "Auth-Type := <one of them>" to the config item list. The eap module isn't configured under the modules directory, but in the root directory in eap.conf, the others in their respective file in the modules directory. 4) Given the information in the config items, it tries match the request against the unix and files modules, and add/modify config items appropriately. The "files" module is configured by default to read in the entries from the users file, where I should add "DEFAULT" entries to match the various types of authentication and authorization I'm trying to configure. In there, if it matches against any ruleset, it adds the reply items to the request. 5) It then runs the config items against the expiration and logintime modules, which checks the Expiration attribute and some Time attributes for authorization limitations. 6) It finally runs it through the PAP module to see if it's a PAP request, and adds "Auth-Type := PAP" to the config items. Where do the rest of the attributes that get sent with the packet get added to the config item list? Does that happen first? Does that happen later? Or is the incoming request with all its attributes immediately turned into a list of config items? None of the modules listed seem to say they parse the request and add the request's attributes to the config items. After all this, it then runs through the authenticate section of the sites-enable/default file, where it does the user/password checking: 1) It checks to see if the Auth-Type is PAP, CHAP, or MS-CHAP, and then runs them through the appropriate module. 2) It runs the request through the unix module 3) It runs it through the eap module (again, configured in eap.conf) At some point, (I believe in both the authorize and authentication sections, in the eap module), if it finds that a request is using PEAP, it does much the same thing again, but runs the inner "data/packet/encryption/not sure what to call it here" through the sites-enabled/inner-tunnel file, with sections set up similarly to the sites-enabled/default file. Then there are the session and post-auth sections, that I haven't even begun to look into yet; I hope to shortly. I'm skipping the accounting and proxy sections as for the moment, I'm just trying to get RADIUS authentication and authorization working, no accounting or proxying happening. Any assistance would be appreciated. John H. Moe Network Support - Hatch IT HATCH Tel: +61 (7) 3166 7777 Direct: +61 (7) 3166 7684 Fax: +61 (7) 3368 3754 Mobile: +61 438 772 425 61 Petrie Terrace, Brisbane, Queensland Australia 4011 ***************************** NOTICE - This message from Hatch is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential or proprietary. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. By communicating with us via e-mail, you accept such risks.� When addressed to our clients, any information, drawings, opinions or advice (collectively, "information") contained in this e-mail is subject to the terms and conditions expressed in the governing agreements.� Where no such agreement exists, the recipient shall neither rely upon nor disclose to others, such information without our written consent.� Unless otherwise agreed, we do not assume any liability with respect to the accuracy or completeness of the information set out in this e-mail.� If you have received this message in error, please notify us immediately by return e-mail and destroy and delete the message from your computer.

6 15

FreeRadius - LDAP
by m4xmr 20 Jul '11

20 Jul '11

Hello, I'm trying to make working LDAP as authentication backend for RADIUS. I verified that the data are right and the query to LDAP is properly working if I use ldapsearch. I experience this "rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=78, length=20" when I try from radtest ... This is the output of radiusd in debug-mode: rad_recv: Access-Request packet from host 127.0.0.1:59221, id=78, length=60 User-Name = "ldapuser" User-Password = "121212" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser radius_xlat: '(uid=ldapuser)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=ldapuser) rlm_ldap: Added password 121212 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "ldapuser" with password "121212" rlm_ldap: user DN: uid=ldapuser,ou=People,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=ldapuser,ou=People,dc=example,dc=com/121212 to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 2 modcall: leaving group LDAP (returns reject) for request 2 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [ldapuser] (from client localhost port 2) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... I hope, someone could help me... I'm totally in stuck. Regards, Max -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-LDAP-tp4615085p4615085.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

TTLS use_tunneled_reply and Mac OSX
by Scott Armitage 20 Jul '11

20 Jul '11

Hi, I have noticed that when authenticating using TTLS/MSCHAPv2 that the outer-identity is used in the RADIUS reply packet even if the use_tunneled_reply is set to yes for TTLS in eap.conf Does anyone know the reason for this? Thanks Scott Armitage

3 6