August 2011 - Freeradius-Users - lists.freeradius.org

Realm parsing and \r => =0D
by Rich Graves 29 Aug '11

29 Aug '11

I've got freeradius-2.1.10-5.el6.x86_64 on fully patched RHEL6.1. PEAP+MSCHAPv2 for wireless 802.1x, intending to federate with eduroam. Within a day, I had the configuration I wanted, or so I thought. Empty stanzas for realms user(a)carleton.edu, ADS\user, and bare username get authenticated with mschapv2. Otherwise, regex realm *(a)*.* gets routed to the eduroam upstream radius hierarchy. I configured bufffered-sql for logging. It all "works." Except... I noticed that my entries appeared in SQL-land as ADS=0Dgraves. So, it seems that the ADS\ realm is recognized (successfully authenticated locally, not sent to eduroam), but not stripped. Worse, the \r in ADS\rgraves is interpreted as a carriage return by the time it gets to SQL-User-Name. I guess my conclusion is that I am very confused about where realms get configured, and which entries in the example config files are examples and which are metareferences to other code. Is the "realm ntdomain" that appears in modules/realm, with a commented-out reference in sites-available/default, an example of handling an example NT Domain named "ntdomain," or is it a directive analogous to format = suffix? I was sure of the former, but am less sure now. "suffix" is overloaded as both a format type and as a example realm that happens to be of type suffix, right? I'm pretty sure that I need ADS, carleton.edu, and null to be recognized in proxy.conf, to distinguish what goes to inner-tunnel from what does to eduroam upstream; and I am pretty sure that I need carleton.edu stripped in or before inner-tunnel. MSCHAPv2 will accept both ADS\username and username, so it's not critical to strip the former. However, it seems critical that ADS\ be stripped or more thoroughly escaped before or during transformation of sql_user_name to SQL-User-Name, because rendering ADS\rgraves as ADS=0Dgraves is just wrong. I am also very confused about whether and where I want "ignore-null = yes." It's mentioned in the shipped modules/realms but not in proxy.conf. The realm stanzas I have thus far are below. inner-tunnel, default, and buffered-sql are pretty much as shipped, except for the obvious DB configuration. realm ADS { format = prefix delimiter = '\\' accthost = LOCAL authhost = LOCAL } realm carleton.edu { format = suffix delimiter = "@" accthost = LOCAL authhost = LOCAL } realm "~.*\\..*" { { format = suffix delimiter = "@" accthost = eduroam1.ns.utk.edu authhost = eduroam1.ns.utk.edu secret = notpostedhere nostrip } # This could probably just be realm NULL realm DEFAULT { type = radius accthost = LOCAL authhost = LOCAL } At the point where I realized I was turning things on and off just to see if radiusd -X would run, I decided that I should stick with clear, simple things like sendmail.cf, and ask for pointers. -- Rich Graves http://claimid.com/rcgraves Carleton.edu Sr UNIX and Security Admin CMC135: 507-222-7079 Cell: 952-292-6529

3 4

Access-Reject in freeradius
by saeed1803 29 Aug '11

29 Aug '11

I hope you can help. I am having some problems running with Radius Authentication. The radius server is running on a debian server. I have added some users: test Cleartext-Password := "test" i can do radtest and ntrping test and it is successful but my user cannot connect with vpn connection and receive error 691. Is this the problem and if so how might i fix it? Any help is greatly appreciated saeed FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "testnet" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 36827, id=186, length=66 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" Calling-Station-Id = "192.168.56.101" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 186 to 127.0.0.1 port 36827 Waking up in 4.9 seconds. Cleaning up request 0 ID 186 with timestamp +182 Ready to process requests.

4 6

Freeradius proxy - Fortigate - Cisco ACS
by Ole Bobakke 29 Aug '11

29 Aug '11

Hi. We have this setup today. Fortigate FW - running SSL vpn portal, users are authenticated towards a Cisco ACS radius server. We only use one vdom ( virtual firewall) but we have a plan to create a portal to every co companies. So I created two new vdom on the fortigate called, : ompa and tampa and gave them ssl portal. - https://ompa.corp.com and https://tampa.corp.com Both of them use the Cisco ACS to authenticate users, so at this point the same username can login to both SSL portals, this is no good :-( Then I tried to add a fortigate VSA to the Cisco ACS server, so when user pet(a)ompa.corp.com login to https://tampa.corp.com , ACS server retun "Fortinet-Vdom-Name = ompa" to the fortigate, and I was looking forward to see the ompa portal but i got tampa. So Fortigate just ignore the VSA from the ACS . Fortigate radius impementation seems to be braindead :-( I did some sniffing, and it seems that *fortigate* return Fortinet-Vdom-Name= ompa when you use https://ompa.corp.com, and Fortinet-Vdom-Name= tampa when you use https://tampa.corp.com. So we need to have some checking on the radiusserver, to verify user realm vs what fortigate retuns. Cisco ACS server doesn't support this type of checking. Now I have installed a freeradius and it does proxy towards the ACS from Fortigate FW, but I need some help to configure this checking, could rlm do this stuff? if user pet(a)ompa.corp.com login to tampa, and Fortigate return Fortinet-Vdom-Name= tampa it should *not* get access, but if it retun Fortinet-Vdom-Name= ompa it should get access. Ole

2 3

Re: Delivery Delayed: Access-Reject in freeradius
by saeed1803 29 Aug '11

29 Aug '11

Alan DeKok wrote: > Where? In which part of the "users" file. yes > Read the debug log you posted. The answer is there. I'm amateur, so I can not understand debug log. Please explain to me. thanks a lot On Mon, Aug 29, 2011 at 4:07 PM, <postmaster(a)eci.local> wrote: > *Delivery is delayed to these recipients or distribution lists:* > > tim(a)velociter.net > > Subject: Access-Reject in freeradius > > This message has not yet been delivered. Microsoft Exchange will continue > to try delivering the message on your behalf. > > Delivery of this message will be attempted until 8/31/2011 12:32:15 AM > (GMT-08:00) Pacific Time (US & Canada). Microsoft Exchange will notify you > if the message can't be delivered by that time. > ------------------------------ > Sent by Microsoft Exchange Server 2007 > > Original-Recipient: rfc822;tim(a)eci.local > Final-Recipient: rfc822;tim(a)velociter.net > Action: delayed > Status: 4.4.7 > Diagnostic-Code: smtp;400 4.4.7 Message delayed > Will-Retry-Until: Wed, 31 Aug 2011 00:32:15 -0700 > > >

1 0

Mac OXS Server version of FreeRadius Error
by DavidS 29 Aug '11

29 Aug '11

Hi All I hope you can help. I am having some problems running with Radius Authentication. The radius server is running on a Mac OSX server (ie a version of Freeradius I believe). I have a cisco Acess Point (1250 series) and want to use the Radius server to Authenticate EAP for WiFI users. I have added some users dsaw Cleartext-Password := "XXXXX" test Cleartext-Password := "test" And Clients (as shown in full listing below) However while users can Authenticate with LEAP no other EAP version Authenticates The Mac OSX Server terminal output to radiusd -s -X ends with Failed binding to socket: Address already in use /private/etc/raddb/radiusd.conf[242]: Error binding to port for 0.0.0.0 port 1812 Is this the problem and if so how might i fix it? Any help is greatly appreciated David server10:~ root# radiusd -s -X FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Apr 11 2011 at 17:19:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /private/etc/raddb/radiusd.conf including configuration file /private/etc/raddb/proxy.conf including configuration file /private/etc/raddb/clients.conf including files in directory /private/etc/raddb/modules/ including configuration file /private/etc/raddb/modules/acct_unique including configuration file /private/etc/raddb/modules/always including configuration file /private/etc/raddb/modules/attr_filter including configuration file /private/etc/raddb/modules/attr_rewrite including configuration file /private/etc/raddb/modules/chap including configuration file /private/etc/raddb/modules/checkval including configuration file /private/etc/raddb/modules/counter including configuration file /private/etc/raddb/modules/detail including configuration file /private/etc/raddb/modules/detail.example.com including configuration file /private/etc/raddb/modules/detail.log including configuration file /private/etc/raddb/modules/digest including configuration file /private/etc/raddb/modules/echo including configuration file /private/etc/raddb/modules/etc_group including configuration file /private/etc/raddb/modules/exec including configuration file /private/etc/raddb/modules/expiration including configuration file /private/etc/raddb/modules/expr including configuration file /private/etc/raddb/modules/files including configuration file /private/etc/raddb/modules/inner-eap including configuration file /private/etc/raddb/modules/ippool including configuration file /private/etc/raddb/modules/krb5 including configuration file /private/etc/raddb/modules/ldap including configuration file /private/etc/raddb/modules/linelog including configuration file /private/etc/raddb/modules/logintime including configuration file /private/etc/raddb/modules/mac2ip including configuration file /private/etc/raddb/modules/mac2vlan including configuration file /private/etc/raddb/modules/mschap including configuration file /private/etc/raddb/modules/opendirectory including configuration file /private/etc/raddb/modules/pam including configuration file /private/etc/raddb/modules/pap including configuration file /private/etc/raddb/modules/passwd including configuration file /private/etc/raddb/modules/perl including configuration file /private/etc/raddb/modules/policy including configuration file /private/etc/raddb/modules/preprocess including configuration file /private/etc/raddb/modules/radutmp including configuration file /private/etc/raddb/modules/realm including configuration file /private/etc/raddb/modules/smbpasswd including configuration file /private/etc/raddb/modules/sql_log including configuration file /private/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /private/etc/raddb/modules/sradutmp including configuration file /private/etc/raddb/modules/unix including configuration file /private/etc/raddb/modules/wimax including configuration file /private/etc/raddb/eap.conf including configuration file /private/etc/raddb/sql.conf including configuration file /private/etc/raddb/sql/sqlite/dialup.conf including configuration file /private/etc/raddb/sql/mysql/counter.conf including configuration file /private/etc/raddb/policy.conf including files in directory /private/etc/raddb/sites-enabled/ including configuration file /private/etc/raddb/sites-enabled/default including configuration file /private/etc/raddb/sites-enabled/inner-tunnel including dictionary file /private/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/private/var" logdir = "/private/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/private/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client ap1250 { ipaddr = 192.168.0.98 netmask = 32 require_message_authenticator = no secret = "TEST" shortname = "ap1250" nastype = "cisco" } client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localtest" login = "test" password = "test" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" use_open_directory = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/private/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.key.pem" certificate_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.cert.pem" CA_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.chain.pem" private_key_password = "Apple:UseCertAdmin" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/private/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } rlm_eap: Getting private key passphrase using command "/usr/sbin/certadmin --get-private-key-passphrase "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.key.pem"" rlm_eap: Password from command = "DD562BC8-164C-4A2F-86F4-8F9AC4EBCB16" Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/private/etc/raddb/users" acctusersfile = "/private/etc/raddb/acct_users" preproxy_usersfile = "/private/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/private/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/private/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_opendirectory Module: Instantiating opendirectory Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/private/etc/raddb/huntgroups" hints = "/private/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/private/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/private/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to socket: Address already in use /private/etc/raddb/radiusd.conf[242]: Error binding to port for 0.0.0.0 port 1812 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mac-OXS-Server-version-of-FreeRadiu… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

radmin del client error
by tohaikmeng 28 Aug '11

28 Aug '11

Hello, I tried using radmin to delete a client that was added dynamically via "add client file alex.conf". alex.conf contains the following content. client 192.168.168.111 { secret = secret } however, i experience the following error. Can you show me the correct del command for this? radmin> show client list 192.168.169.86 192.168.169.74 192.168.169.123 192.168.168.111 radmin> del client ipaddr 192.168.168.111 ERROR: Must specify <ipaddr> radmin> del client ipaddr <ipaddr> 192.168.168.111 ERROR: Client 192.168.168.111 was not dynamically defined. Your help is greatly appreciated. -- View this message in context: http://freeradius.1045715.n5.nabble.com/radmin-del-client-error-tp4725176p4… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 38

Delegated-IPv6-Prefix
by Dmitry Kozlov 28 Aug '11

28 Aug '11

Hello. I'm trying to include Delegated-IPv6-Prefix attribute to reply, here is contents of radreply table: id | username | attribute | op | value ----+----------+-----------------------+----+------------------------------------------------------------------------------------------------------------------------ 19 | test | Delegated-IPv6-Prefix | = | fc00:1:2:2::/64 But it rejects Access-Request and writes to log: rlm_sql: Failed to create the pair: Invalid octet string "fc00:1:2:2::/64" for attribute name "Delegated-IPv6-Prefix" By the way it successfully replies with Framed-IPv6-Prefix which is ipv6prefix type too. So how can I pass Delegated-IPv6-Prefix ?

2 2

Re: Time and traffic limits
by Dmitry Kozlov 28 Aug '11

28 Aug '11

Hi! >rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" freeradius doesn't now such attribute, if you want to limit maximum session time use Session-Timeout attribute for it.

1 0

Time and traffic limits
by Mobin Yazarlou 28 Aug '11

28 Aug '11

Hello, I have the following user in the database: mysql> SELECT * FROM radcheck; +----+----------+--------------------+----+---------+ | id | username | attribute | op | value | +----+----------+--------------------+----+---------+ | 1 | sqltest | Cleartext-Password | := | testpwd | | 2 | sqltest | Max-All-Session | := | 600 | +----+----------+--------------------+----+---------+ 2 rows in set (0.00 sec) Well, freeRADIUS should allow this user to connect and stay online for 10 minutes but I can't even connect. Here is the freeRADIUS debug log: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host xx.xx.72.127 port 33451, id=15, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0xd237c3a9ecf61e669d362193cfb6b33b MS-CHAP2-Response = 0x6600d5135b141fa0f0fb3671adef9107716a000000000000000061a6f1db763fb3554c35008e7dec3f57936ca9ca1d2375b7 NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 15 to xx.xx.72.127 port 33451 Waking up in 4.9 seconds. Cleaning up request 0 ID 15 with timestamp +25 Ready to process requests. rlm_sql: Failed to create the pair: Invalid octet stringrad_recv: Access-Request packet from host xx.xx.72.127 port 40062, id=16, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0x6214c3aad82e064f6e9118c3aa9751d2 MS-CHAP2-Response = 0x280073eab0bdcb6b149e34b5d5a3be5dd7dc0000000000000000c9652cb77bbd8cf74273f9aa924c7dbe8b6a53968ffb7c6a NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 16 to xx.xx.72.127 port 40062 Waking up in 4.9 seconds. Cleaning up request 1 ID 16 with timestamp +93 Ready to process requests. rad_recv: Access-Request packet from host xx.xx.72.127 port 40203, id=17, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0x470c8b8089c5b8a4a322d16b51ab1a91 MS-CHAP2-Response = 0x3300c3bac8e9819c7a7e962f3611fad2cda20000000000000000c8e0d842bdff8a8183104ac176bb16835ea6626028a146da NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 1 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 17 to xx.xx.72.127 port 40203 Waking up in 4.9 seconds. Cleaning up request 2 ID 17 with timestamp +469 Ready to process requests. I was so happy that I could install freeRADIUS last week! I can't disconnect users using freeRADIUS cause there is no NAS in my network and if I can't get time and traffic limits to work I would have to code a script to do it myself maybe. I would be thankful if someone helps to work it out. PS: I have just noticed that radacct table is empty. I had the session logs in this table when pptpd and freeRADIUS servers where on the same machine but I can't see anything in this table now. Do I have to setup something on the pptpd server to have to session logs in freeRADIUS database?

1 0

authenticate realm no matter what username is
by Barry Murphy 27 Aug '11

27 Aug '11

Hey guys, We're an ISP providing ADSL services ourselves and on behalf of our wholesalers. I have a bunch of realms that are LOCAL and proxied which work with no issues. I'm trying to add realms of competitors to our radius so when customers are migrated from our competitors to our network they get authenticated and I drop them into a VRF displaying to them they need to change their login details. I've already got the VRF working, the forwarder page etc, I just can't seem to get users to authenticate with a wildcard *(a)dsl.competitor.co.nz I have tried the following varies in users file… DEFAULT User-Name =~ "~*\\.xnet\\.co\\.nz$" Auth-Type := Accept, Pool-Name := un-auth, Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-Avpair += "ip:vrf-id=Suspended", Cisco-Avpair += "ip:ip-unnumbered=Loopback 1000", Cisco-Avpair += "ip:dns-servers=14.1.33.1 120.136.0.25" DEFAULT Realm == "ihug.co.nz", Auth-Type := Accept None work and all look for a username. So in the above scenarios I want anything(a)dsl.xnet.co.nz or whatever(a)ihug.co.nz to authenticate and be assigned an IP address from the pool and dropped into the vrf Suspended where I do my tricks based on their IP address to display a splash page advising the customer its time to modify their username & password on their router. I've found many examples based on MAC authentication but none that work unfortunately. Any help would be much appreciated Thanks Barry

2 2