November 2012 - Freeradius-Users - lists.freeradius.org

Re: accounting data
by Dirk van der Walt 15 Nov '12

15 Nov '12

Hi, I've done the same exercise on my side and have the following observations based on the debug output. 1.)The rlm_counter is only interested in Accounting Stop packets. 2.)If I send two subsequent Accounting Stop requests using the radclient and the file with the Accounting Stop AVP bundles, only the first one is used and the second one is ignored due to the fact that the packet with the unique ID is already recorded in the database and thus ignored: rlm_counter: Packet Unique ID = '9c5a417fc48a9b9e' rlm_counter: Searching the database for key 'aclice' rlm_counter: Key found. rlm_counter: Counter Unique ID = '8d3af3931deff832' rlm_counter: Unique IDs for user match. Droping the request. The Packet Unique ID is created by the acct_unique module in the preacct section: [acct_unique] WARNING: Attribute NAS-Identifier was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing 'NAS-Port = 0,,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4D2BB8AC-00000099",User-Name = "alice"' [acct_unique] Acct-Unique-Session-ID = "9c5a417fc48a9b9e". ++[acct_unique] returns ok This is covered in the pre-accounting section on page 133. Since this is a simulation, in the real world the next packet will have a different value for Acct-Session-Id. So by simply changing the value of Acct-Session-Id to 4D2BB8AC-00000099 in these files containing the AVP bundles and running the session simulation again you can see the following: rlm_counter: Packet Unique ID = '56a4675037d8b965' rlm_counter: Searching the database for key 'aclice' rlm_counter: Key found. rlm_counter: Counter Unique ID = '8d3af3931deff832' rlm_counter: User=aclice, Counter=30. rlm_counter: User=aclice, New Counter=60. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. ++[daily] returns ok So the important thing to remember if you want simulate a user's session is that the value of Acc-Session-Id needs to be unique for every simulated session. A session simulation will consist of an Accounting Start and Stop request (and also may include optional Accounting Interim-Update requests). With that in mind, refer again to the description of Acct-Session-Id on page 131. Although rlm_counter is primarily used as an introduction here to better understand the counter modules, the next section covers the rlm_sqlcounter module. This module is more flexible and preferred. Hope this helps you.

3 2

Re: Complex eduroam radius design
by Alan Buxey 14 Nov '12

14 Nov '12

Hi, >Radsec can run over TCP. Another good >reason to go for Freeradius3 and >use radsec. Btw if I want to test FR3, I >guess that it's available on >git. But I didn't find where and how to >get it. any hint ? It's clearly linked from the downloads page...if you can't get past that small hurdle I really wouldn't advise running FR3 on your architecture ... ...but yes, you are correct with the certificate assertion. Just one needed. :) alan

1 0

Freeradius Installaion error
by QASIM RAO 12 Nov '12

12 Nov '12

hi, i am installing freeradius and configuring with ./configure --disable-libltdl-install --with-system-libtool while running make command giving following error gcc: md5.lo: No such file or directorygcc: print.lo: No such file or directorygcc: radius.lo: No such file or directorygcc: rbtree.lo: No such file or directorygcc: sha1.lo: No such file or directorygcc: snprintf.lo: No such file or directorygcc: token.lo: No such file or directorygcc: udpfromto.lo: No such file or directorygcc: valuepair.lo: No such file or directorygcc: unrecognized option '-release'gcc: unrecognized option '-rpath'gmake[4]: [libradius.la] Error 1 (ignored)gmake[4]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/lib'Making all in modules...gmake[4]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[5]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'Making all in rlm_acct_unique...gmake[6]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules/rlm_acct_unique'mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/radiusd/Radius/iptv-radius/radius-iptv/src/include -c rlm_acct_unique.cmode=link gcc -release 1.1.6 \ -module -export-dynamic -o rlm_acct_unique.la \ -rpath /usr/local/lib rlm_acct_unique.lo rlm_acct_unique.c /root/radiusd/Radius/iptv-radius/radius-iptv/src/lib/libradius.la \ -lnsl -lresolv -lpthreadgcc: 1.1.6: No such file or directorygcc: rlm_acct_unique.lo: No such file or directorygcc: /root/radiusd/Radius/iptv-radius/radius-iptv/src/lib/libradius.la: No such file or directorygcc: unrecognized option '-release'gcc: unrecognized option '-rpath'cc1: error: unrecognized command line option "-module"gmake[6]: [rlm_acct_unique.la] Error 1 (ignored)gmake[6]: *** [build-module] Error 1gmake[6]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules/rlm_acct_unique'gmake[5]: *** [common] Error 2gmake[5]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[4]: *** [all] Error 2gmake[4]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[3]: *** [common] Error 2gmake[3]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src'gmake[1]: *** [common] Error 2gmake[1]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv'make: *** [all] Error 2 is this configure error or any other error in radius Regards Qasim Rao

3 2

Best way to capture RADIUS passwords
by Chris Taylor 12 Nov '12

12 Nov '12

I am migrating from one RADIUS setup that checks against a flat file with usernames and passwords inside it . Over to a RADIUS server with and LDAP backend. I have used JTR to crack most of the passwords but I still have some left over that JTR cant crack. I was thinking of trying to run a packet capture to get the remaining usernames and passwords. What would be the best way to do this? Run RADIUS in debug mode Radius -X? Or try to use tcpdump and pick it up that way or is it even possible to do? I have been trolling the internet for a few days and have not come up with a good way to do it. I setup tcpdump to dump to a file (tcpdump -i eth0 -n -s0 port radius -w rad-capture.lpc) , but when I check it out with wireshark I am unable to see the password (just the username). Am I going about this the wrong way? Thanks, Chris

5 5

help with DHCP server functionality
by Duane Cox 11 Nov '12

11 Nov '12

List: Hello. I have been working on this for a few days and have turned here for help. The server is listening on port 67 and when a DHCP packet comes in the server processes it, but in debug mode it give an error "No Pool-Name defined". I have done some reading and I have added the following to the users file (for testing purposes). DEFAULT Pool-Name := main_pool Fall-Through = Yes This doesn't seem to define the Pool-Name nor do I see where the server is processing any sql queries to determine the Pool-Name either. Am I mistaken? I thought that I could get a DHCP packet to be received/processed by the server and hand out a response. Thanks in advance, Duane Cox debug: Received DHCP-Discover of id 9daef956 from 10.11.156.70:68 to 10.12.100.90:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 2645490006 DHCP-Number-of-Seconds = 56 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.11.152.62 DHCP-Client-Hardware-Address = 00:d0:b7:c0:f6:8a DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Hostname server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.11.152.1' to reply_items ++[mac2ip] returns ok ++- entering policy dhcp_sqlippool.post-auth {...} expand: DHCP-%{DHCP-Client-Hardware-Address} -> DHCP-00:d0:b7:c0:f6:8a expand: %{DHCP-Client-Hardware-Address} -> 00:d0:b7:c0:f6:8a expand: %{DHCP-Gateway-IP-Address} -> 10.11.152.62 expand: %{%{DHCP-Gateway-IP-Address}:-127.0.0.1} -> 10.11.152.62 +++[request] returns ok [dhcp_sqlippool] No Pool-Name defined. [dhcp_sqlippool] expand: DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) +++[dhcp_sqlippool] returns noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE ++- policy dhcp_sqlippool.post-auth returns noop ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.192 DHCP-Router-Address = 10.11.152.62 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.12.100.90 Sending DHCP-Offer of id 9daef956 to 10.11.152.62:68 Finished request 6. Cleaning up request 6 ID -1649477290 with timestamp +219 Going to the next request Ready to process requests.

2 4

Dialup admin lingering sessions
by Serge Paquin 11 Nov '12

11 Nov '12

Hello, I'm having an issue from time to time where a PPPoE session will drop and relogin which is fine but the "Online Users" doesn't seem to clear the old session. I check on the NAS and there is only the 1 session active. Not sure how to properly clear stale sessions. Serge.

1 0

accounting data
by Periko Support 11 Nov '12

11 Nov '12

Hi. Centos 5.x FreeRadius 2.1.1. I'm reading the book freeradius beginners Guide chapter 6: accounting. Page 139. Amount of Time. I have follow the book, would like to setup my freeradius and be able to manage users time per day. Following the book, it say that to test we better setup 3 files: start session stop session Make some changes to freeradius config files. Now, with this things ready, I follow the steps to see how it works: step 7) auth user. step 8)

2 5

Debian 6.0.6 amd64 freeradius + xl2tpd + strongswan ipsec
by Dmitry Korzhevin 11 Nov '12

11 Nov '12

Hello guys, Can you please advice good howto/guide to configure l2tp with radius server? I am already have configured pptp (poptop) and ipsec (strongSwan) on server, getting user logins and passwords from file. Now planning to use freeradius for auth. Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 1

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user
by Shravan S G 10 Nov '12

10 Nov '12

Hi all, I am trying to configure FreeRadius 2.2.0. I am trying to test with the radtest utility. However, when I run radtest, on my radiusd server, I get the following error - "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user". I know this is some issue with the authentication part. However, I have not been able to pinpoint the problem. Also, I haven't been able to find any relevant solutions on the web. I have just untarred the 2.2.0 tarball, and added just one line the users file: gokul Cleartext-Password:="abcde" Below is the output on the server and the client side: Server: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47080, id=238, length=75 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0xf92ae1fda2ea8f435d95c4a7294e1e55 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "gokul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> gokul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 238 to 127.0.0.1 port 47080 Waking up in 4.9 seconds. Cleaning up request 0 ID 238 with timestamp +19 Ready to process requests. Client: shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ sudo radtest gokul abcde localhost 0 testing123 [sudo] password for shravan: Sending Access-Request of id 238 to 127.0.0.1 port 1812 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=238, length=20 shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ This is m first attempt at using FreeRadius, so please let me know if I have made any rookie mistakes. :) Thanks in advance. Shravan

3 3

Concatenating/inserting strings with backslashes
by Brian Candler 10 Nov '12

10 Nov '12

Here's something weird. I'm trying to concatenate some strings which contain <backslash> <n> (i.e. not a newline). In a normal string literal, I have to enter four backslashes: update reply { Reply-Message := "a\\\\nb" } ("\\n" gives a newline, "\\\n" gives backslash followed by newline) But when I try to insert one string into another it goes completely haywire. update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\nbaz" } This gives me "foo" <newline> "bar" <newline> "baz". That is, even the second \\\\n is being collapsed into a newline! Some more test cases: update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "qux\\\\nbaz" } correctly gives me "qux" <backslash> <n> "baz" update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{Wibble:-qux}\\\\nbaz" } gives me <newline> "baz". In fact, I need *eight* backslashes to get a literal backslash here: Reply-Message := "%{Wibble:-qux}\\\\\\\\nbaz" So somehow, the presence of a string expansion within a string affects the interpretation of subsequent backslashes within that string. Now, this works: update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } But then if I do another layer of string insertion they get translated to newlines again. update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } update reply { Reply-Message := "%{reply:Reply-Message}" } This seems pretty broken to me, but if someone would care to explain how to deal with it, please do. Or is there another way I can concatenate strings, which doesn't involve expanding them into another string? Thanks, Brian.

4 5