October 2012 - Freeradius-Users - lists.freeradius.org

rlm_sql: can I avoid queries on radcheck?
by Stefano Zanmarchi 12 Oct '12

12 Oct '12

Hi, we're using rlm_sql to perform authorization based on a couple of sql tables ('eduroam_diritto_uso' and 'eduroam_mac_registrati') , it's working fine. Now mysql logs show that radiusd is still performing queries on radcheck, radgroupcheck. Can I avoid this (since these tables are empty so we're not using them)? I know this is nothing vital, but if it's easy done... I've managed to avoid queries on radgroupcheck commenting out the "group_membership_query" in dalup.conf. I thought that I could now comment out the "authorize_check_query" to avoid queries radchek, but no, I get an error: [sql] expand: -> [sql] Error generating query; rejecting user Thanks a lot in advance, Stefano authorize { preprocess rewrite.calling_station_id sql if ("%{sql:SELECT count(*) FROM eduroam_mac_registrati AS m, eduroam_diritto_uso AS d WHERE m.username = d.username AND m.mac='%{Calling-Station-Id}' and d.diritto='S'}" == 1){ ok update control { Auth-Type := Accept } } else { reject } auth_log eap openldap mschap }

3 3

Re: customized format of log file
by Alan Buxey 12 Oct '12

12 Oct '12

Look at the linelog module and be thankful for having the ability to do such things with Freeradius...what would you do if you only had eg NPS? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

Privileges cisco-avpair = "shell:priv-lvl=10" doesn't work
by Ruben Blendeman 12 Oct '12

12 Oct '12

Hi, I want assign different privileges to users, these are my users: admin Cleartext-Password := "admin" cisco-avpair = "shell:priv-lvl=15" user1 Cleartext-Password := "user1" cisco-avpair = "shell:priv-lvl=10" user2 Cleartext-Password := "user2" cisco-avpair = "shell:priv-lvl=11" But if I configure a privilege on my cisco switch on level 10, all my users have the same rights. If I debug on my switch, my user1 is not in priv lvl 10.. Any idea how to fix it? Grtz, Ruben

2 1

How to configure unlang to add user attributes found in users file to a reply
by Gianni Costanzi 12 Oct '12

12 Oct '12

Hi, I have the following setup: (A) CLIENT ROUTER <---> (B) Freeradius 2.2.0 <--> (C) Other radius server I configured a realm on (B) to proxy requests toward radius server (C). For example, the realm is XYZ and the user is USER, so when on router (A) USER at XYZ tries to authenticate, (B) proxies the request sending user USER with the given password to (C). Then (C) replies to (B), which forwards the reply back to (A), WITHOUT looking at the users file, where I've defined the following: USER Auth-Type = System Service-Type = Administrative-User How can I configure the unlang module on (B) in order to tell freeradius to parse its own users file before sending the proxied reply to (A), appending the attributes specified for USER to the reply? >From one of your answers I've understood that unlang should be the way to accomplish this task, even if I thought there was a configuration flag to tell radius to always parse its own users file before replying to a client (but maybe this was something related to GNU Radius and not freeradius). Thank you in advance for any help Gianni -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi(a)gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------

1 0

FW: customized format of log file
by Chuang Okis 12 Oct '12

12 Oct '12

Hi all, I'm deploying a WiFi proxy center with FreeRadius now, therefore I need detailed auth/acct log records for statistical purpose. While default format of detail log cannot satisfy my goal there, so is there any way to define my own customized format of auth/acct log file? for example, for auth, I can write "AA" value while receiving "Access-Accept" and "AJ" for "Access-Reject" into log file. Another question, how to use "tab" as delimiter of logging instead of default ":" ? In general, my question is: Can anyone of modules process any content of packets without replacing and updating original attribute value by regex, unlang before output of logging? just for logging purpose. Or it's necessary to use Perl? Thanks in advance!

2 1

Restricting users to AD domain computers
by Bryce Mackintosh 11 Oct '12

11 Oct '12

Hi, I'm currently using FreeRadius to control access to our wifi network with PEAP-TLS, and authenticating users against their AD accounts. I now need to somehow additionally restrict the users wifi access to only the machines that are joined to the Windows domain, and not phones, ipads, etc, and do this in a reasonably secure fashion. There are a couple of hundred laptops involved, so I'd like to avoid having to do much in the way of client-side configuration, but I suspect that client certificates may be the only answer. I've been searching for a number of weeks, and I haven't found any other real solution. Thanks in advance, Bryce

3 5

EAP-PEAP with NT-Password stored in mysql database
by Hocine M 11 Oct '12

11 Oct '12

Hi, First apologize my english, j'm french. So, i'm trying to use EAP-PEAP with freeradius 2.1 and i have some questions. I didn't create any certificat.....can i use the certificate of freeradius? (i have a warning "Unable to set DH parameters") My passwords are encrypted with NT-hashes, is it ok to use eap-peap for? Is it normal the message : "[eap] No EAP-Message, not doing EA" ? i don't use the default virtual server, i only use one file....l3_wifi_peap (where i use sql_auth for auth and sql_acct for accounting) here are my files: _radiusd.conf :_ prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap-peap.conf $INCLUDE sql-peap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "l3_wifi.peap" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "l3_wifi.peap" } mschapv2 { } } virtual server l3_wifi_peap: authorize { preprocess eap { ok = return } sql_auth } authenticate { Auth-Type MS-CHAP { mschap } } preacct { preprocess acct_unique suffixUnable to set DH parameters files } accounting { detail radutmp sql_acct attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } _here are the queries to mysql database__:_ authorize_check_query = "SELECT uid, mail, 'NT-Password' AS attribute, NTPassword, '==' AS op \ FROM ${authcheck_table} \ WHERE mail = '%{SQL-User-Name}' \ ORDER BY uid" authorize_reply_query = "SELECT uid, mail, 'Trapeze-SSID' AS attribute, 'WIFI' AS radiusTunnelPrivateGroupId, '=' AS op \ FROM ${authreply_table} \ WHERE mail = '%{SQL-User-Name}' \ ORDER BY uid authcheck_table =_authreply_table +---------+--------------------------------+----------------------------------+ | uid | mail | NTPassword | +---------+--------------------------------+----------------------------------+ | E999999 | alan.cox(a)test.fr | 18500da21668b63e900cc555c092e020 | +---------+--------------------------------+----------------------------------+ _and finaly the freeradiux -X output :_ FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Sep 11 2012 at 17:47:58 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/eap-peap.conf including configuration file /etc/freeradius/sql-peap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/l3_wifi.peap main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.58.10 { require_message_authenticator = no secret = "*******" shortname = "192.168.58.10" nastype = "trapeze" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap-peap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "l3_wifi.peap" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "l3_wifi.peap" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql_auth" from file /etc/freeradius/sql-peap.conf sql sql_auth { driver = "rlm_sql_mysql" server = "********************" port = "" login = "********" password = "*************" radius_db = "**********" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = no num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT uid, mail, 'NT-Password' AS attribute, NTPassword, '==' AS op FROM dsi_radius WHERE mail = '%{SQL-User-Name}' ORDER BY uid" authorize_reply_query = "SELECT uid, mail, 'Trapeze-SSID' AS attribute, 'WIFI' AS radiusTunnelPrivateGroupId, '=' AS op FROM dsi_radius WHERE mail = '%{SQL-User-Name}' ORDER BY uid" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql_auth-SQL-Group rlm_sql (sql_auth): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_auth): Attempting to connect to *************************************** rlm_sql (sql_auth): starting 0 rlm_sql (sql_auth): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_auth): Connected new DB handle, #0 rlm_sql (sql_auth): starting 1 rlm_sql (sql_auth): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_auth): Connected new DB handle, #1 rlm_sql (sql_auth): starting 2 rlm_sql (sql_auth): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_auth): Connected new DB handle, #2 rlm_sql (sql_auth): starting 3 rlm_sql (sql_auth): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_auth): Connected new DB handle, #3 rlm_sql (sql_auth): starting 4 rlm_sql (sql_auth): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_auth): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Instantiating module "sql_acct" from file /etc/freeradius/sql-peap.conf sql sql_acct { driver = "rlm_sql_mysql" server = "**********************" port = "" login = "****************" password = "***************" radius_db = "****************" read_groups = yes sqltrace = yes sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql_acct-SQL-Group rlm_sql (sql_acct): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_acct): Attempting to connect to ************************************ rlm_sql (sql_acct): starting 0 rlm_sql (sql_acct): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_acct): Connected new DB handle, #0 rlm_sql (sql_acct): starting 1 rlm_sql (sql_acct): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_acct): Connected new DB handle, #1 rlm_sql (sql_acct): starting 2 rlm_sql (sql_acct): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_acct): Connected new DB handle, #2 rlm_sql (sql_acct): starting 3 rlm_sql (sql_acct): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_acct): Connected new DB handle, #3 rlm_sql (sql_acct): starting 4 rlm_sql (sql_acct): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_acct): Connected new DB handle, #4 Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } ... adding new socket proxy address * port 58995 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.58.10 port 20000, id=83, length=136 User-Name = "alan.cox(a)test.fr" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-AA-36-00:WIFI" NAS-Port = 82 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.10 NAS-Identifier = "Trapeze" User-Password = "pass" # Executing section authorize from file /etc/freeradius/sites-enabled/l3_wifi.peap +- entering group authorize {...} ++[preprocess] returns ok [eap] No EAP-Message, not doing EA ++[eap] returns noop [sql_auth] expand: %{User-Name} -> alan.cox(a)test.fr [sql_auth] sql_set_user escaped user --> 'alan.cox(a)test.fr' rlm_sql (sql_auth): Reserving sql socket id: 4 [sql_auth] expand: SELECT uid, mail, 'NT-Password' AS attribute, NTPassword, '==' AS op FROM dsi_radius WHERE mail = '%{SQL-User-Name}' ORDER BY uid -> SELECT uid, mail, 'NT-Password' AS attribute, NTPassword, '==' AS op FROM dsi_radius WHERE mail = 'alan.cox(a)test.fr' ORDER BY uid rlm_sql (sql_auth): Released sql socket id: 4 [sql_auth] User alan.cox(a)test.fr not found ++[sql_auth] returns notfound ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/l3_wifi.peap +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> alan.cox(a)test.fr attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 83 to 192.168.58.10 port 20000 Waking up in 4.9 seconds. Cleaning up request 0 ID 83 with timestamp +65 Ready to process requests. Thank(s for your help!!

2 1

EXEC Access-challenge
by Thomas Raabo - Zitcom A/S 11 Oct '12

11 Oct '12

I´am trying to create a php OTP script with challenge reponse. echo "Reply-Message += \"Enter SMS\",\n"; echo "State += \"$random\",\n"; echo "Response-Packet-Type = \"Access-Challenge\",\n"; exit(4); Reply and State gets sent to the client. But I can´t seem to get challenge response to work. Has anyone done this time off stuff before and is it even possible? Found Auth-Type = otp # Executing group from file /etc/raddb/sites-enabled/default +- entering group otp {...} [OTP] expand: %{User-Name} -> test2 [OTP] expand: %{User-Password} -> test2 [OTP] expand: %{reply:Secret} -> 891a79d80c9f1cd2 [OTP] expand: %{reply:Pin} -> 0201 [OTP] expand: %{reply:Offset} -> 1 Exec-Program output: Reply-Message += "Enter SMS", State += "21427", Response-Packet-Type = "Access-Challenge", Exec-Program-Wait: value-pairs: Reply-Message += "Enter SMS", State += "21427", Response-Packet-Type = "Access-Challenge", Exec-Program: returned: 4 ++[OTP] returns handled There was no response configured: rejecting request 15 Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 15 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 15 Sending Access-Reject of id 66 to 172.31.2.20 port 42617 Reply-Message += "Enter SMS" State += 0x3231343237 My sites-enabled authorize { preprocess chap mschap suffix eap { ok = return } unix files sql expiration logintime pap update control { Auth-Type := otp } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type otp { OTP pap } unix eap } My exec module exec OTP { wait = yes program = "/etc/raddb/otp.php %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}"" input_pairs = request output_pairs = reply } Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 [Beskrivelse: Beskrivelse: cid:image001.jpg@01CB9163.2FCD3AC0] _____________________________________________ tr(a)zitcom.dk<mailto:tr@zitcom.dk> | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

3 9

NAS features info
by Koenraad Lelong 11 Oct '12

11 Oct '12

Hi, Is there a document that I consult so I know what to look for if I want more than just authentication with radius ? I would like to buy a wireless accesspoint where I can "time" user-access, meaning my users are restricted in time when they can use the wireless accesspoint, and force them off-line when their time-window closes. Because I don't know how this is managed, I can't decide which accesspoint will do what I would like to do. All such stuff, is that read/managed via snmp ? Regards, Koenraad Lelong

2 3

Re: Authentification Problem with Cisco AP, freeradius and LDAP
by Alan Buxey 11 Oct '12

11 Oct '12

1 there is no such word as authentification, its just 'authentication' 2 your client is trying to do EAP-TLS 3 check FreeRADIUS compatability matrix because when you do use eg PEAP (and have the CA cert on the client, the MSCHAPv2 will only work with passwords from LDAP in certain formats alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0