January 2012 - Freeradius-Users - lists.freeradius.org

Setting Acct-Interim-Interval for all users
by Nataniel Klug 31 Jan '12

31 Jan '12

Hello all, I recently went through a problem concerning Acct-Interim-Interval that, for some reason, was not been set for some of my clients. The result was catastrophic inside my network. Hopefully and been helped by Fajar A. Nugraha (which I thank for the time spent) I was able to identify the problem but I am not been able to solve the problem for good. Sometimes my Freeradius send information about a client from radgroupreply and sometimes, for the same client, it send from radreply. The problem is in this trick when it send from radreply it was not sending Acct-Interim-Interval because it was not there. I am changing my software (not freeradius) to update my SQL tables correctly but, to solve this problem, I wish I could set a DEFAULT value for Acct-Interim-Update that would work as a backup plan in cases like this. Is it possible to setup this parameter as a default for all clients using my Radius? -- Regards, Nataniel Klug

2 2

Question about WARNING in rlm_sql_mysql
by Krzysztof Grobelak 31 Jan '12

31 Jan '12

Hello all, Can somebody shed some light what the 'You probably need to lower "min"' means. I just installed fresh freeradius from git. All my settings are the same as in the last version but apart from the radiusd -X not working (but the radiusd -lxx -l stdout is) radius.log displays this warning about lowering number of sql connections. Can anybody give some advice?? Regards, Krzysztof

3 4

Mixed Environment Question
by Paul Stewart 31 Jan '12

31 Jan '12

Hi there. Thank you to those folks to helped me recently understanding the Juniper attributes etc - much appreciated. What is the practical issues with a users file entry that is mixing vendor attributes? Ie. pstewart-stat Auth-Type = System Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = xxx.xxx.xxx.73, Cisco-AVPair = "lcp:interface-config#2=rate-limit output 512000 375000 512000 conform-action transmit exceed-action drop", Cisco-AVPair = "lcp:interface-config#1=rate-limit input 512000 375000 512000 conform-action transmit exceed-action drop", ERX-Ingress-Policy-Name = lite, ERX-Egress-Policy-Name = lite So far I have tested this on a Juniper ERX and it simply ignores the Cisco attributes, which was what I'm hoping for. I plan to float some Juniper attributes towards some Cisco gear at some point to see how it handles it. Anyone have much practical experience with this? Is it expected to always ignore additional VSA's or is it a 'crap shoot' depending on the vendor? We have customers that sometimes will connect to Cisco for example, but could also connect that same username to a Juniper (not at the same time, but within minutes of one another). I am trying to come up with a users file entry that keeps all vendor specific attributes in intact - am I playing with fire? ;) Paul

3 8

Decoding complex CableLabs-Event-Message
by Laurent Debacker 31 Jan '12

31 Jan '12

Hi, We would like to use FreeRadius to decode Cablelabs accounting messages, as specified in http://www.cablelabs.com/packetcable/downloads/specs/PKT-SP-EM-I12-05812.pdf . FreeRadius has a CableLabs dictionary, which works fine, but... The value of one of the AVP, CableLabs-Event-Message, is actually an HEX value containing additional fields. For example: CableLabs-Event-Message = 0x0001d2d2026d30310000000000003030313030303000 0e812333000100033031000000000000303031303030300000000006323031323031333130363032 32312e3633390000000081000500 The FreeRadius does not decode that value to get all details. For example, bytes 4 to 28 (d2d2026d303100000000000030303130303030000e812333) is actually the BCID (Billing Correlation ID) field. The BCID itself contains 4 "sub" fields: NTP time reference (4 first bytes), Element ID (next 8 bytes), Time Zone (next 8 bytes), and Event counter (ast 4 bytes). See the packet cable specifications for more details. I understood the only way would be to write a perl module to decode those values. Before I start writing, does anyone know of any implementation of such a perl module? I would not like spending my time rewriting something that already exists. Thanks in advance for any help anyone could provide on this topic. Laurent.

2 2

How to Restrict All Users from Certain APs
by White III, Joe 31 Jan '12

31 Jan '12

I'm running Freeradius 1.0.1 using MySQL as the database backend. I need to configure the server so that all users are restricted from using certain access points (i.e. guest network). It appears I need to use a DEFAULT user definition in the users file, but I can't find any examples to work from. Has someone else done this? If so, I'd give anything to see how you did it. Thanks. Joe White System Administrator @ Arvato Digital Services @ 108 Monticello Rd, Weaverville, NC 28787 @ 828-423-0269

4 5

Setting Acct-Interim-Interval for all users
by Nataniel Klug 30 Jan '12

30 Jan '12

Hello all, I recently went through a problem concerning Acct-Interim-Interval that, for some reason, was not been set for some of my clients. The result was catastrophic inside my network. Hopefully and been helped by Fajar A. Nugraha (which I thank for the time spent) I was able to identify the problem but I am not been able to solve the problem for good. Sometimes my Freeradius send information about a client from radgroupreply and sometimes, for the same client, it send from radreply. The problem is in this trick when it send from radreply it was not sending Acct-Interim-Interval because it was not there. I am changing my software (not freeradius) to update my SQL tables correctly but, to solve this problem, I wish I could set a DEFAULT value for Acct-Interim-Update that would work as a backup plan in cases like this. Is it possible to setup this parameter as a default for all clients using my Radius? -- Descrição: 111027-nata_at_cnett

1 0

Problems using SQL IP Pool
by Nataniel Klug 30 Jan '12

30 Jan '12

Hello all, Ive been using Freeradius for a long time and about 5 months ago I made a change in my default layout so I could use Freeradius SQL-IPPool running over PostgreSQL. This is working almost fine but for some reason I cant figure out its giving the same IP address to two different clients. So, my network layout is something like this: [ freeradius ] -- [ external* mysql ] -- [ external* postgresql ] * external I mean as the databases are running in separate hardware but in the same physical network My customers are authenticating over PPPoE interfaces on two parallel servers that work as a backup for each other but they are running simultaneously. This would be layout for my clients: (internet) [ auth01/auth02 ] (clients) Auth01 and Auth02 can both communicate with Freeradius in the same physical network and they are getting there with no more than 1 ms (its a gigabit network that fairly is using 50 mbit). I am using MySQL and PostgreSQL for a reason: somehow the software I use to bill my customers can only work with MySQL radacct table and it was not able to read the radacct from PostgreSQL. So I am running accounting over MySQL and Authentication/Authorization over PostgreSQL (I will post the configuration files in the end of this message). So, returning to the problem, this is what is happening: http://www.cnett.com.br/nata/imagens/Capturar.JPG There is two clients using the SAME IP which is a problem. Looking into my Freeradius log file I could not find when cjunior got the IP I have JUST taise allocation: Fri Jan 27 12:20:03 2012 : Auth: Login OK: [cjunior] (from client LJS.AUTH.02 port 69822 cli 74:EA:3A:D1:FD:17) Fri Jan 27 12:20:03 2012 : Info: Allocated IP: 186.251.148.216 from main_pool (did cnett_pppoe cli 74:EA:3A:D1:FD:17 port 69822 user cjunior) Fri Jan 27 14:41:38 2012 : Info: Released IP 186.251.148.216 (did cnett_pppoe cli 74:EA:3A:D1:FD:17 user cjunior) Fri Jan 27 14:45:47 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.02 port 69530 cli 00:02:72:89:34:C5) Fri Jan 27 14:45:47 2012 : Info: Allocated IP: 186.251.150.130 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69530 user taise) Fri Jan 27 15:18:01 2012 : Auth: Login OK: [cjunior] (from client LJS.AUTH.02 port 69668 cli 74:EA:3A:D1:FD:17) Fri Jan 27 15:18:01 2012 : Info: Allocated IP: 186.251.150.226 from main_pool (did cnett_pppoe cli 74:EA:3A:D1:FD:17 port 69668 user cjunior) Fri Jan 27 12:19:14 2012 : Info: Allocated IP: 186.251.150.136 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69799 user taise) Fri Jan 27 23:22:04 2012 : Info: Released IP 186.251.150.130 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:19:05 2012 : Info: Released IP 186.251.150.5 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:20:23 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.02 port 69525 cli 00:02:72:89:34:C5) Mon Jan 30 08:20:23 2012 : Info: Allocated IP: 186.251.151.65 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69525 user taise) Mon Jan 30 08:23:54 2012 : Info: Released IP 186.251.151.65 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:24:05 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.01 port 350112 cli 00:02:72:89:34:C5) Mon Jan 30 08:24:05 2012 : Info: Allocated IP: 186.251.150.118 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 350112 user taise) This is really strange. Bellow I am showing my PostgreSQL radippool table and there is just the taise record (ok, I know, it could not have both). http://www.cnett.com.br/nata/imagens/Capturar1.JPG Looking for problems I also checked the usage of CPU and RAM on PostgreSQL box and MySQL box but there is nothing I could use. For those who ask I change the pool_key because I was having duplicated pool_key from my NAS (Auth01 and Auth02) so I just made a change where the name of the server is showing. The problem with the duplicate IPs is older than the change so the pool_key is discarded. http://www.cnett.com.br/nata/imagens/cpu_usage_postgres-mysql.JPG Is it possible to someone help me finding a solution? -- Descrição: Descrição: 111027-nata_at_cnett

2 5

self-signed root CA
by McNutt, Justin M. 30 Jan '12

30 Jan '12

So I'm getting some pushback in my organization against using a self-signed CA for signing my RADIUS server certs. To make a long story short, I was asked to find out what other people were doing. For my own reasons, I'd like to know slightly more than that. If you AREN'T using a self-signed CA for your RADIUS server, what made you use another CA, and what CA did you use? And just to be clear, is the concensus still that a self-signed CA is the way to go, assuming that you have a decent way to distribute the CA cert (which we do) to the clients who need to trust it? I've read /etc/raddb/certs/README and I've done some Googling and everything I find pretty much assumes that you're using a self-signed CA. The README explains briefly why, but my management wants more assurance than that, so here I am. Looking forward to your responses, and thanks in advance. --J

7 11

Access-Accept if user exists in database
by Mika 30 Jan '12

30 Jan '12

Hello. Running 2.1.10 with virtual-servers configured with many port configurations, sql modules loaded and working. The idea for this new port is: Users authenticating with smartcards that get checked outside the FreeRadius and we want to permit/deny access if the user-name does or does not exist in a SQL database. This means no User-Password checking. We have the NAS configured so it will send user-name and an empty or a bogus password in the Access-Request for each User-Name I would like to add a port configuration that checks the above. My unlang skill are limited so i am hoping for some good pointers here. Something like: authorize { update request { TmpString := "%{sql:select User FROM table where.... }" if User-Name == %{TmpString} send Access-Accept else send Access-Reject There are probably easier ways of doing this? Is this possible or is the User-Password required for every authentication? Any help appreciated. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/Access-Accept-if-user-exists-in-dat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Cannot control attribute ordering via "rlm_perl"
by Claude Brown 30 Jan '12

30 Jan '12

Hi, First, the version I'm using: # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, [...] I'm trying to control the attribute-ordering when using "rlm_perl". Thus far my experience is that this is not possible. My theory is that this is due to the hash-tables used as the interface between the C and Perl worlds. Here is a small example that demonstrates the problem. I've turned on the "users" and "perl" modules in the authorize section (in that order). These are the important bits from the "users" file and the "example.pl" file. (from the "users" file) steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, WiMAX-Packet-Data-Flow-Id = 1, WiMAX-Service-Data-Flow-Id = 1, WiMAX-Service-Profile-Id = 2 (from the "example.pl") sub authorize { return RLM_MODULE_NOOP; } The debug log of the server is below. The interesting bits are (a) the "rlm_perl: Added pair" and (b) the attribute-order in the packet that the server sends in reply - the order is changed. The ordering is important to for me as I want those three WiMAX attributes packed inside a parent attribute "WiMAX-Packet-Flow-Descriptor". If I turn off the "perl" module (or place it before the "files" module) the packing works as expected. I put all this down to the attribute-list being rebuilt (by rlm_perl) from the %RAD_REPLY table. The hash-table has no concept of ordering, so it ends up randomised. The above is a contrived example - what I really want to do is add those three WiMAX attributes in my perl script. But due to the ordering problems I think I am wasting my time and need to come up with another solution. Can anyone see how I can control the ordering of attributes coming out of the perl script? Thanks, Claude Brown. Vividwireless. rad_recv: Access-Request packet from host 127.0.0.1 port 50265, id=2, length=63 User-Name = "steve" User-Password = "testing" Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok GOT CLONE -1588651264 0x1a0e160 rlm_perl: Added pair User-Name = steve rlm_perl: Added pair User-Password = testing rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 rlm_perl: Added pair WiMAX-Service-Data-Flow-Id = 1 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair WiMAX-Packet-Data-Flow-Id = 1 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair WiMAX-Service-Profile-Id = 2 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Cleartext-Password = testing ++[perl] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok Login OK: [steve] (from client localhost port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 2 to 127.0.0.1 port 50265 WiMAX-Service-Data-Flow-Id = 1 Service-Type = Framed-User Framed-Routing = Broadcast-Listen WiMAX-Packet-Data-Flow-Id = 1 Framed-Protocol = PPP Framed-Filter-Id = "std.ppp" Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP WiMAX-Service-Profile-Id = 2 Framed-MTU = 1500 Finished request 0.

6 13