August 2011 - Freeradius-Users - lists.freeradius.org

sql and xlat in authorize section
by Sébastien Barbereau 26 Aug '11

26 Aug '11

Hi, I am trying to do mac authorization as per http://wiki.freeradius.org/Mac-Auth#Mac-Auth+authorisation+by+SSID+SQL In fact my attempt is much simpler as I just have a very simple table containing the mac address of system to accept. My conf looks like that: authorize { ... # newer authorized macs if("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0){ update control { Auth-Type := Accept } ok = return } ... } But when doing an authentication attemp I get the following in the debug logs : ... Thu Aug 25 16:52:56 2011 : Info: ++? if (ok) -> FALSE Thu Aug 25 16:52:56 2011 : Info: ++? if ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) Thu Aug 25 16:52:56 2011 : Info: WARNING: Unknown module "sql_local" in string expansion "%" Thu Aug 25 16:52:56 2011 : Info: ? Evaluating ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) -> FALSE Thu Aug 25 16:52:56 2011 : Info: ++? if ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) -> FALSE ... As far as I can understand the documentation this should be working ( http://wiki.freeradius.org/Rlm_sql#SQL+xlat) Any helpful hand which can bring some light to the darkness of my intellect? Cheers, seb.

2 4

A trick for configuring freerad to authenticate multiple NAS with dynamic IPs
by Grace M. 26 Aug '11

26 Aug '11

Guyz, I have FreeRADIUS Version 2.1.10 working with mysql to authenticate uses connected to a number of NAS(s). Now, I would like to authenticate NAS(s) which should connect to my freerad from other networks (outside my lan) which have dynamic IPs. Anyone with a trick on how to configure clients.conf for that? Regards Grace

3 5

Packet Fence web interface and freeradius users
by Marlon Bastida 26 Aug '11

26 Aug '11

Hi, I have 3 radius users working on freeradius. I will give one sample: On /etc/raddb/users test Cleartext-Password:="test" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "2" When I enter with this user credentials on Xp client 802.1X auth they give to the proper VLAN assigned. For example I have VLAN-ID = 2 - registration, 3 - isolation, 5 - guests, 10 - normal. So with the statement Tunnel-Private-Group-ID = VLAN-ID, I can't get succesfully put a user on the proper VLAN, in this case above entered on registration VLAN. If anyone has acknowledge with Packet Fence solution I would like some help to integrate these users with web interface of Packet Fence 2.1.0. So I can get on the Violation Tab (isolation VLAN) an user or Node Tab (guests VLAN). Tks in advance, Marlon

2 2

Authentication probation for VLAN
by joaocdc＠gmail.com 26 Aug '11

26 Aug '11

Hello, I am using freeradius to authenticate to multiple databases, some in other LDAP in SQL. I am doing authentication and wireless networks, where I have multiple SSIDs for wireless networks, and each one logs in a database. All these databases are in the same Radius server, which differentiate based authentication used by the users of the Realm, running as follows: authorize { ... if (Realm == "fpti") { ldap_fpti } if ( Realm == "pti") { ldap_pti } if ( Realm == "visitantes") { sql_visitantes } ... } This model is funcionaç, however have a problem (very serious), Radius does not know from which SSID the client is trying to authenticate, or whether it decides the basis solely of the Realm authentication of the client. I need to make the Radius check the VLAN that is associated with the request for user authentication. Check through the debug radius that an Access-Request packet has the following information: ... rad_recv: Access-Request packet from host 192.168.254.48 port 32769, id=204, length=184 User-Name = "joao@fpti" Calling-Station-Id = "68-a3-c4-85-c5-89" Called-Station-Id = "00-26-cb-94-65-60:FPTI" NAS-Port = 29 NAS-IP-Address = 192.168.254.48 NAS-Identifier = "WLC-PTI" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 * Tunnel-Private-Group-Id:0 = "5"* EAP-Message = 0x020500061500 State = 0xfd87ee8cfe82fb655b300470157cca59 Message-Authenticator = 0xb9a2c29a193593e8f1165dc71ab487c1 # Executing section authorize from file /etc/freeradius/sites-enabled/default ... Once the session authorization, I tried to check the VLAN required before releasing the basis for authorization, did it as follows: authorize { ... if (Tunnel-Private-Group-Id:0 == 5){ # Base de dados LDAP da FPTI if (Realm == "fpti") { ldap_fpti } } if (Tunnel-Private-Group-Id:0 == 30){ # Todos os Hbitantes do PTI atraves do numero do cracha if ( Realm == "pti") { ldap_pti } # Base de dados SQL de Visitantes if ( Realm == "visitantes") { sql_visitantes } } ... } But unfortunately this is not working (as shown in the log below): [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++? if (Tunnel-Private-Group-Id:0 == 5) ? Evaluating (Tunnel-Private-Group-Id:0 == 5) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 5) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 30) ? Evaluating (Tunnel-Private-Group-Id:0 == 30) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 30) -> FALSE ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: joao@fpti [mschap] Told to do MS-CHAPv2 for joao@fpti with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [joao@fpti] (from client controladora-wlan-1 port 0 via TLS tunnel) Note that all conditional "IF" fails. Also said that if I try to use the Tunnel-Private-Group-Id without the ":0" at the end, appears in the logs that the attribute was not found, I mention this because in several instances I saw on the internet was used only "Tunnel- Private -Group-Id" (with :0 at the end) I ask, how can I make this check? Thank you for listening; -- João Paulo de Lima Barbosa

3 6

How to connect FreeRADIUS uding JAVA
by Rajkumar Balaji 26 Aug '11

26 Aug '11

Hi, If anyone knows how to connect FreeRADIUS using JAVA Please help me to solve this Thanks Regards Rajkumar

2 1

How to store group ID into radius and retrieve it back
by Rajkumar Balaji 26 Aug '11

26 Aug '11

Hi everyone, I am new to FreeRADIUS. I have a requirement to store and retrieve it back to java to Authorize the user Please help me to resolve this. Thanks

1 0

Radius user Packet Fence 2.1.0
by Marlon Bastida 25 Aug '11

25 Aug '11

Hi, I have 3 radius users working fine on freeradius. I will give one sample: On /etc/raddb/users test Cleartext-Password:="teste"

1 0

Re: problem with perl...
by Tyller D 25 Aug '11

25 Aug '11

> Hi > > Im trying to run freeradius, using rlm_perl, and centos 6. > > after installing ( yum install freeradius freeradius-mysql freeradius-perl > freeradius-utils ). when I and start free radius I fails with this error > > Can't load '/usr/local/lib64/perl5/auto/DBI/DBI.so' for module DBI: > /usr/local/lib64/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at > /usr/lib64/perl5/DynaLoader.pm line 200. > at /usr/local/lib64/perl5/DBI.pm line 268 > BEGIN failed--compilation aborted at /usr/local/lib64/perl5/DBI.pm line > 268. > Compilation failed in require at /etc/raddb/perl3.pl line 6. > BEGIN failed--compilation aborted at /etc/raddb/perl3.pl line 6. > > > here is the output of radius -X > > > [root@crystaltowers raddb]# radiusd -X > FreeRADIUS Version 2.1.9, for host x86_64-unknown-linux-gnu, built on Nov > 12 2010 at 09:55:25 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including configuration file /etc/raddb/sites-available/dynamic-clients > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/mac2vlan > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/mschap > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/ldap > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/ntlm_auth > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/krb5 > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/unix > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/sql.conf > including configuration file /etc/raddb/sql/mysql/dialup.conf > including configuration file /etc/raddb/sql/mysql/counter.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/default > including configuration file /etc/raddb/sites-enabled/control-socket > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/radius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1650065408 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = yes > auth_badpass = yes > auth_goodpass = yes > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client dynamic { > ipaddr = 192.168.0.0 > netmask = 16 > require_message_authenticator = no > dynamic_clients = "dynamic_client_server" > lifetime = 86400 > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server dynamic_client_server { > modules { > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_always > Module: Instantiating ok > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > } # modules > } # server > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > random_file = "/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_realm > Module: Instantiating suffix > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_attr_filter > Module: Instantiating attr_filter.access_reject > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > } > } # modules > } # server > server { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_perl > Module: Instantiating perl > perl { > module = "/etc/raddb/perl3.pl" > func_authorize = "authorize" > func_authenticate = "authenticate" > func_accounting = "accounting" > func_preacct = "preacct" > func_checksimul = "checksimul" > func_detach = "detach" > func_xlat = "xlat" > func_pre_proxy = "pre_proxy" > func_post_proxy = "post_proxy" > func_post_auth = "post_auth" > func_recv_coa = "recv_coa" > func_send_coa = "send_coa" > } > Can't load '/usr/local/lib64/perl5/auto/DBI/DBI.so' for module DBI: > /usr/local/lib64/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at > /usr/lib64/perl5/DynaLoader.pm line 200. > at /usr/local/lib64/perl5/DBI.pm line 268 > BEGIN failed--compilation aborted at /usr/local/lib64/perl5/DBI.pm line > 268. > Compilation failed in require at /etc/raddb/perl3.pl line 6. > BEGIN failed--compilation aborted at /etc/raddb/perl3.pl line 6. > rlm_perl: perl_parse failed: /etc/raddb/perl3.pl not found or has syntax > errors. > /etc/raddb/modules/perl[7]: Instantiation failed for module "perl" > /etc/raddb/sites-enabled/default[247]: Failed to load module "perl". > /etc/raddb/sites-enabled/default[247]: Failed to parse "perl" entry. > > > What could cause this? I have perl-DBD and perl-DBI installed and running > the script manually works fine. > > >

3 4

Documentation about Freeradius + Openldap
by Alejandro Gandara 25 Aug '11

25 Aug '11

Hi list, Im new in this list and implementig Freeradius. Im installing and configuring Freeradius 2.1.10 over Linux Debian Squeeze. We have designed a quite difficult architecture to authenticate users. I've been looking for many hours for advance and specific documentation to manage freeradius, such as "Roles", "Access", "List access" "Profiles" , how merge everything with ldap. I didnt get the expected results in google, so ill be very gratefull if someone could give me some link or doc or even name of books to buy. Thanks list for the help and your patience. Regards, Alejandro Gándara Álvarez Junior System Administrator

2 4

Fwd: Auth configuration help
by Dom 24 Aug '11

24 Aug '11

-------- Original Message -------- Subject: Auth configuration help Date: Wed, 24 Aug 2011 21:53:46 -0400 From: Dom <dversace(a)tekcorner.ca> To: freeradius-users(a)lists.freeradius.org I was hoping someone could help. We have a cisco 3825 with radius server pointed to our freeradius installation. When I test radius authentication using NTRadping using CHAP authentication everything works fine. However when we try to connect via a standard dsl connection we get these failures. I was hoping someone could help point me in the right direction to fix the issue. Thanks rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=26, length=134 Framed-Protocol = PPP User-Name = "aewais(a)domain.ca" User-Password = "password" Calling-Station-Id = "bas105300000096" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 26 NAS-Port-Id = "Uniq-Sess-ID26" Service-Type = Framed-User NAS-IP-Address = 64.34.xxxx.xxxx # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "tekcorner.ca" for User-Name = "aewais(a)domain.ca" [suffix] No such realm "domain.ca" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.ca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 26 to 64.34.xxx.xxx port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 26 with timestamp +97 Ready to process requests.

3 2