September 2011 - Freeradius-Users - lists.freeradius.org

run more than one radius on single machine
by waq 05 Sep '11

05 Sep '11

Dear, Its my requirement to run more than one radius on a single machine can anybody help me how to achieve this I am using CentOS 5.5 64bit, Oracle 10.2.0 , Freeradius 2.1.10 -- View this message in context: http://freeradius.1045715.n5.nabble.com/run-more-than-one-radius-on-single-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: which one to use - Radgroupcheck or Radgroupreply
by Lucio Godoy 04 Sep '11

04 Sep '11

Thank you very much My biggest wish is make sure of the Acct-Interim-Interval feature Thanks Lucio -----Original Message----- From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Date: Sun, 4 Sep 2011 12:45:02 To: <freeradius-users(a)lists.freeradius.org> Subject: Re: which one to use - Radgroupcheck or Radgroupreply On 4 Sep 2011, at 14:28, Lucio Godoy wrote: Hi All; I am using chillispor on a router with dd-wrt and I wanted to use the follwoing parameters, but dont know where to load them in my Freeradius Mysql config, pls: Session-Timeout = 3600 Idle-Timeout = 600 Acct-Interim-Interval = 60 WISPr-Redirection-URL = http://www.google.com/ WISPr-Bandwidth-Max-Up = 12800 WISPr-Bandwidth-Max-Down = 25600 And also if i should use = or any other opertator pls? radreply, and either = or := operators. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org <mailto:a.cudbardb@freeradius.org> RADIUS - Half the complexity of Diameter

1 0

which one to use - Radgroupcheck or Radgroupreply
by Lucio Godoy 04 Sep '11

04 Sep '11

Hi All; I am using chillispor on a router with dd-wrt and I wanted to use the follwoing parameters, but dont know where to load them in my Freeradius Mysql config, pls: Session-Timeout = 3600Idle-Timeout = 600 Acct-Interim-Interval = 60WISPr-Redirection-URL = http://www.google.com/ WISPr-Bandwidth-Max-Up = 12800WISPr-Bandwidth-Max-Down = 25600 And also if i should use = or any other opertator pls? Thanks lucio =========================================================== The Home CCTV Security System made easy! http://www.kaduco.com/our-list-products-services/cctv-security-camera-syste…

2 1

RE: How to update a MySql table after successfully WIFI
by 2394263740 04 Sep '11

04 Sep '11

Arran, </:includetail> Thanks a lot again.</:includetail> </:includetail> It works.</:includetail> </:includetail> As what you advised,</:includetail> </:includetail> 1. edit </:includetail>/usr/local/etc/raddb/sites-available/default, uncomment below sql line.</:includetail> post-auth {</:includetail> ...... #sql ......</:includetail> }</:includetail> 2. edit </:includetail>/usr/local/etc/raddb/sql/mysql/dialup.conf</:includetail> updae postauth_query defination.</:includetail> </:includetail> Very busy these days. So reply late.</:includetail> </:includetail> Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Fri, Sep 2, 2011 06:11 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 5 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. How to update a MySql table after successfully WIFI authentication? ( 2394263740 ) 2. Re: How to update a MySql table after successfully WIFI authentication? (Arran Cudbard-Bell) 3. Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server (Jacob Dawson) 4. Using encrypted passwords in users file (sundoo) 5. cisco 3825 authentication error (Dom) 6. Re: Using encrypted passwords in users file (Paul Bartell) 7. Re: Pre release of 2.1.12 (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Thu, 1 Sep 2011 22:29:11 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: How to update a MySql table after successfully WIFI authentication? To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_3B36E2AF6F7D0370683C1EB1(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql I got a WIFI network, using one radius server. The whole thing works fine. I got a requirement, which is, after each successful WIFI connection, one record need be added into connectionlog table. CREATE TABLE connectionlog ( radacctid bigint(21) NOT NULL auto_increment, acctsessionid varchar(64) NOT NULL default '', acctuniqueid varchar(32) NOT NULL default '', username varchar(64) NOT NULL default '', groupname varchar(64) NOT NULL default '', realm varchar(64) default '', nasipaddress varchar(15) NOT NULL default '', nasportid varchar(15) default NULL, nasporttype varchar(32) default NULL, acctstarttime datetime NULL default NULL, acctstoptime datetime NULL default NULL, acctsessiontime int(12) default NULL, acctauthentic varchar(32) default NULL, connectinfo_start varchar(50) default NULL, connectinfo_stop varchar(50) default NULL, acctinputoctets bigint(20) default NULL, acctoutputoctets bigint(20) default NULL, calledstationid varchar(50) NOT NULL default '', callingstationid varchar(50) NOT NULL default '', acctterminatecause varchar(32) NOT NULL default '', servicetype varchar(32) default NULL, framedprotocol varchar(32) default NULL, framedipaddress varchar(15) NOT NULL default '', acctstartdelay int(12) default NULL, acctstopdelay int(12) default NULL, xascendsessionsvrkey varchar(10) default NULL, PRIMARY KEY (radacctid), KEY username (username), KEY framedipaddress (framedipaddress), KEY acctsessionid (acctsessionid), KEY acctsessiontime (acctsessiontime), KEY acctuniqueid (acctuniqueid), KEY acctstarttime (acctstarttime), KEY acctstoptime (acctstoptime), KEY nasipaddress (nasipaddress) ) ; Can you please kindly advise how to do this? Which file should be edited? Where is the context to put in the script? What is the script? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011090…> ------------------------------ Message: 2 Date: Thu, 1 Sep 2011 16:36:40 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: How to update a MySql table after successfully WIFI authentication? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <C781BD59-4F30-48C4-B6CC-FF4790379DE1(a)freeradius.org> Content-Type: text/plain; charset=iso-8859-1 Look in raddb/sql/mysql/dialup.conf The postauth query is the one you need to edit. Then uncomment the 'sql' module in raddb/sites-available/default post-auth { } -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter ------------------------------ Message: 3 Date: Thu, 1 Sep 2011 10:40:18 -0400 From: Jacob Dawson <dawson(a)vt.edu> Subject: Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <14B9C69C-CB59-4CA7-9F5B-39CD6C81404C(a)vt.edu> Content-Type: text/plain; charset=us-ascii It's largely successful, but as I mentioned in my note to this group from the 29th, I've run into problems with Windows clients having a disagreement with FreeRADIUS about the final stages of the PEAP-MSCHAPv2 conversation, after IAS has authenticated them successfully. - Jacob On 31 Aug 2011, at 16:32, Alan DeKok wrote: > > It really should work... it works for my tests. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Thu, 1 Sep 2011 08:57:14 -0700 (PDT) From: sundoo <sandu_nastas(a)yahoo.com> Subject: Using encrypted passwords in users file To: freeradius-users(a)lists.freeradius.org Message-ID: <1314892634927-4758890.post(a)n5.nabble.com> Content-Type: text/plain; charset=us-ascii Hello, I'm new to FreeRadius and to linux. Maybe this question will sound stupid, but I really need you help. I have a server running freeradius. These are some outputs of the configuration: *etc/freeradius/radiusd.conf* # passwd = /etc/passwd shadow = /etc/shadow # group = /etc/group */etc/freeradius/users* test1 Auth-Type := Crypt-Local, User-Password := "$1$NzW2iwkn$ygDcJgb4WhAEqQYfySFkj/" Service-Type = Administrative-User, Cajun-Service-Type := 3, */etc/shadow* test1:$1$cnEh49V6$Q.68mw.3P5rgmsfhbo/iC1:15217:0:99999:7::: I would like to change the password for the user test1. But in the users file I see only the encrypted password. Where is the original password stored ? How do I change it ? Thanks a lot for your help. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-encrypted-passwords-in-users-… Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ Message: 5 Date: Thu, 01 Sep 2011 15:45:02 -0400 From: Dom <dversace(a)tekcorner.ca> Subject: cisco 3825 authentication error To: freeradius-users(a)lists.freeradius.org Message-ID: <4E5FE0BE.8010800(a)tekcorner.ca> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I am trying to terminate vpdn sessions through our cisco 3825 using freeradius. I am new to this whole process and I was hoping to get some assistance with the missing configuration. Below is the error message I am receiving when trying to authenticate via the router. rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=19, length=135 Framed-Protocol = PPP User-Name = "aewais(a)domain.com" User-Password = "password" Calling-Station-Id = "bas203300000455" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 532 NAS-Port-Id = "Uniq-Sess-ID532" Service-Type = Framed-User NAS-IP-Address = 64.34.66.5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "domain.com" for User-Name = "aewais(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 19 to 64.34.66.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 19 with timestamp +381 Ready to process requests. ------------------------------ Message: 6 Date: Thu, 1 Sep 2011 14:54:29 -0700 From: Paul Bartell <paul.bartell(a)gmail.com> Subject: Re: Using encrypted passwords in users file To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAHXqhmh49eNKABTpwmv0Rb1+UX7WPMaN4UB0RQKiiGVSuGoDzg(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 that is the hashed password. You can change it by generating a hash of your new password... you would probably use crypt(3) to do that... The original password was never stored in cleartext form. You could store a cleartext password if you really wanted to, but that is less than secure. On Thu, Sep 1, 2011 at 8:57 AM, sundoo <sandu_nastas(a)yahoo.com> wrote: > > Hello, I'm new to FreeRadius and to linux. Maybe this question will sound > stupid, but I really need you help. > I have a server running freeradius. > These are some outputs of the configuration: > > *etc/freeradius/radiusd.conf* > # passwd = /etc/passwd > ?shadow = /etc/shadow > # group = /etc/group > > > */etc/freeradius/users* > test1 Auth-Type := Crypt-Local, User-Password := > "$1$NzW2iwkn$ygDcJgb4WhAEqQYfySFkj/" > ? ? ? ?Service-Type = Administrative-User, > ? ? ? ?Cajun-Service-Type := 3, > > */etc/shadow* > test1:$1$cnEh49V6$Q.68mw.3P5rgmsfhbo/iC1:15217:0:99999:7::: > > > I would like to change the password for the user test1. But in the users > file I see only the encrypted password. Where is the original password > stored ? > > How do I change it ? > > Thanks a lot for your help. > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Using-encrypted-passwords-in-users-… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Random quote of the week/month/whenever i get to updating it: "Quis custodiet ipsos custodes?": "who shall watch the watchers themselves?" - Juvenal ------------------------------ Message: 7 Date: Thu, 1 Sep 2011 23:11:23 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Pre release of 2.1.12 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20110901221123.GF16795(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > it's now running on our most busy server. Both -X and > background-multithreaded do their usual job. I do not see any problems > so far. its on one of our production servers and on a couple of other systems. alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 5 *********************************************** </:includetail>

1 0

rlm_eap: SSL error
by Chad Rebuck 02 Sep '11

02 Sep '11

Can someone point me in the right direction on figuring this out? I'm running Arch linux and I installed via "pacman -S freeradius". I didn't edit any config files yet. [root@pogo /]# uname -a Linux pogo 2.6.39-ARCH #2 PREEMPT Mon Jul 11 14:08:22 MDT 2011 armv5tel Feroceon 88FR131 rev 1 (v5l) Marvell SheevaPlug Reference Board GNU/Linux [root@pogo raddb]# radiusd -X FreeRADIUS Version 2.1.11, for host armv5tel-unknown-linux-gnu, built on Jul 15 2011 at 23:45:34 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[299]: Failed to load module "eap". /etc/raddb/sites-enabled/default[241]: Errors parsing authenticate section.

2 2

Question regarding multivalued attributes in control list.
by Olivier Beytrison 02 Sep '11

02 Sep '11

Hello, I'm trying since two week to do some multi-valued attribute checking on my radius infrastructure. I've been looking to checkval, using the "users" file and such but with no luck. I'm running two FR 2.1.10 on ubuntu for the eduroam project. The local authentication is made against an Novell eDirectory ldap server. I'm fetching a multi-valued attribute from the ldap into the control list, and based on its content, I set the correct Airespace-Interface-Name value. At the beginning I was using unlang to match the value, and it works perfectly since 90% of the people only have one attribute. But some people have multiple attributes. So far, that's what I've been using : In virtual server, at the end of authorize {} if (NAS-IP-Address =~ /160\.98\.156\..*/) { $INCLUDE ${confdir}/secure-hefr.policy } secure-hefr.policy content : if ( control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) { update reply { Airespace-Interface-Name := "wifi_eia-etu" } } elsif ( control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) { update reply { Airespace-Interface-Name := "wifi_eia-col" } } elsif { } [ ... ] Some debug from a user who is multi-valued : server eduroam-inner-tunnel-peap { # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam-inner-tunnel-peap +- entering group authorize {...} ++[mschap] returns noop [suffix] Looking up realm "hefr.ch" for User-Name = "didier.perroud(a)hefr.ch" [suffix] Found realm "hefr.ch" [suffix] Adding Realm = "hefr.ch" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 11 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/160.98.156.6/auth-detail-20110902 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/160.98.156.6/auth-detail-20110902 [auth_log] expand: %t -> Fri Sep 2 15:45:08 2011 ++[auth_log] returns ok [linelog] expand: %{Packet-Type} -> Access-Request [linelog] expand: %{%{Packet-Type}:-format} -> Access-Request [linelog] expand: /var/log/freeradius/linelog -> /var/log/freeradius/linelog [linelog] expand: Requested access: %{User-Name} -> Requested access: didier.perroud(a)hefr.ch ++[linelog] returns ok ++? if (User-Name =~ /(.*)@.*hefr.ch$/) ? Evaluating (User-Name =~ /(.*)@.*hefr.ch$/) -> TRUE ++? if (User-Name =~ /(.*)@.*hefr.ch$/) -> TRUE ++- entering if (User-Name =~ /(.*)@.*hefr.ch$/) {...} expand: %{1} -> didier.perroud +++[request] returns ok ++- if (User-Name =~ /(.*)@.*hefr.ch$/) returns ok ++[files] returns noop [ldap] performing user authorization for didier.perroud [ldap] expand: (uid=%{Stripped-User-Name}) -> (uid=didier.perroud) [ldap] expand: ou=courant,ou=people,o=hefr -> ou=courant,ou=people,o=hefr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=courant,ou=people,o=hefr, with filter (uid=didier.perroud) [ldap] Added the eDirectory password ******* in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RORG-HEFR-EIFR-TICO-TLCO-$-RSM" [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RORG-MASO-$-RCA" [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RACA-TICO-MSEI-MTIC-$-RCA" [ldap] looking for reply items in directory... [ldap] hessoRoleMemberKey -> Class = 0x524f52472d484546522d454946522d5449434f2d544c434f2d242d52534d [ldap] hessoRoleMemberKey -> Class = 0x524f52472d4d41534f2d242d524341 [ldap] hessoRoleMemberKey -> Class = 0x524143412d5449434f2d4d5345492d4d5449432d242d524341 [ldap] user didier.perroud authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop ++? if (NAS-IP-Address =~ /160\.98\.156\..*/) ? Evaluating (NAS-IP-Address =~ /160\.98\.156\..*/) -> TRUE ++? if (NAS-IP-Address =~ /160\.98\.156\..*/) -> TRUE ++- entering if (NAS-IP-Address =~ /160\.98\.156\..*/) {...} +++? if (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/) -> FALSE +++? if (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/ ) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/) -> TRUE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) -> TRUE +++- entering elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) {...} We can see that it didn't match control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ while it has the correct value in the control list. How can I match this multi-valued attribute ? Regards, Olivier B. -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg

3 5

Re: Segfaulting with rlm_perl
by Norman Elton 02 Sep '11

02 Sep '11

On Friday, September 2, 2011, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: > I meant that if you use eg monit then you can have a service recovery rather than a corner case killing off your radius daemon in middle of night > Oh, definitely. We'd do that as a failsafe anyway. My main question is whether this is failing by design? If so, is there a best practice to avoid the crash (or something like monit to recover from a crash)? And, if not, is it a resolvable bug? Thanks, Norman

2 1

Re: Segfaulting with rlm_perl
by Norman Elton 02 Sep '11

02 Sep '11

> Use a wrapper around the demon, eg 'monit' ? Around the radiusd daemon? Nope. Running it from bash, or in this case, from within gdb. Norman

1 0

Segfaulting with rlm_perl
by Norman Elton 02 Sep '11

02 Sep '11

I'm beginning the process of replacing a home-grown RADIUS server with freeradius, a good idea on many many fronts. The server will interact with our backend databases in order to determine attributes to inject into the access-accept messages. For initial development, I've begun work on a perl script that is interacting with freeradius 2.1.10. I'm a little alarmed that a malfunctioning perl script can segfault the entire server. I was hoping that freeradius could compartmentalize a failing script, restarting it as necessary. Admittedly, during development, my scripts are not production-ready, and there are lots of safety checks that simply aren't there. But I'm worried that, going into production, we'll discover an unexpected corner-case that crashes our entire radius infrastructure (not a good thing). Is the best practice simply to make sure you're scripts are bullet-proof? Or is there a more stable method of interacting with an external resource? I chosen rlm_perl because the script didn't need to be instantiated every time (as with rlm_exec), but perhaps we'd be better off relying on rlm_exec if it is more tolerant of corner-case failures. Thanks, Norman

5 7

cisco 3825 authentication error
by Dom 02 Sep '11

02 Sep '11

That is why I am so confused. I do have this user in the users file and even tested authentication using NTradping and it works fine going directly from the Internet to the radius server. However when I try to authenticate via the LNS I see this error. any idea's. Message: 4 Date: Fri, 02 Sep 2011 09:54:50 +0200 From: Bj?rn Mork<bjorn(a)mork.no> Subject: Re: cisco 3825 authentication error To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID:<87r53zjs51.fsf(a)nemi.mork.no> Content-Type: text/plain; charset=utf-8 Dom<dversace(a)tekcorner.ca> writes: > [pap] WARNING! No "known good" password found for the user. Looks good so far, but you need to tell freeradius the password for this user... E.g. by adding something like this to the "users" file: aewais(a)domain.com Cleartext-Password := "password" or configure some database backend or whatever. It's all in the docs Bj?rn * /To/:freeradius-users@lists.freeradius.org <mailto:freeradius-users%40lists.freeradius.org> * /Subject/: cisco 3825 authentication error * /From/: Dom <dversace(a)tekcorner.ca <mailto:dversace%40tekcorner.ca>> * /Date/: Thu, 01 Sep 2011 15:45:02 -0400 * /Reply-to/: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org <mailto:freeradius-users%40lists.freeradius.org>> * /User-agent/: Mozilla/5.0 (Windows NT 6.1; rv:6.0.1) Gecko/20110830 Thunderbird/6.0.1 ------------------------------------------------------------------------ I am trying to terminate vpdn sessions through our cisco 3825 usingfreeradius. I am new to this whole process and I was hoping to get someassistance with the missing configuration.Below is the error message I am receiving when trying to authenticatevia the router.rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=19,length=135 Framed-Protocol = PPP User-Name = "aewais(a)domain.com" User-Password = "password" Calling-Station-Id = "bas203300000455" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 532 NAS-Port-Id = "Uniq-Sess-ID532" Service-Type = Framed-User NAS-IP-Address = 64.34.66.5 # Executing section authorize from file/etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "domain.com" for User-Name = "aewais(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user.Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request:Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 19 to 64.34.66.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 19 with timestamp +381 Ready to process requests.

2 1