December 2012 - Freeradius-Users - lists.freeradius.org

Re: Freeradius Attribute For HotSpot Users
by Alan Buxey 30 Dec '12

30 Dec '12

Use expiration . Once a user has logged in for the first time then set the expiration for that account to the required value....or set it when the counter is reached. Et voila, next time they try to login they can't (then you can do fancy extra stuff like telling them that their account has expired on the login window etc....) alan

1 0

Re: freeradius down every Sun Dec 30 06:50:40 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY)
by Alan Buxey 30 Dec '12

30 Dec '12

This fails without fail every Sunday? In that case check what happens... eg if that HUP'ING of the freeradius is a weekly crontab then investigate what else is going on at that time ...eg there appear to be mysql errors - ate you using mysql? If so, its not good having errors with that module (and can be the cause if the problem...) I wouldn't say just stop that job....it has a purpose...but see if you are also eg dealing with mysql logrotating at the same time and if you are, don't. I would advise doing a restart of the daemon rather than a HUP and contact your distro maintainers to get latest version. 2.1.10 is really really old. alan

1 0

Freeradius Attribute For HotSpot Users
by Prabhpal S. Mavi 30 Dec '12

30 Dec '12

Dear List Members, i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) including "rlm_sqlcounter" (Max-Daily-Session). User are logged off alright when "Max Session Timeout" is reached. But users can re login to gain access. The username and passwords are for hotspot. We do not want the username and password to work again once it has been used. For example: prepaid voucher (MySQL username & password) has 1 hour access. User should be able to use sum of one hour, either continuously once they are logged in or in parts (30min today & 30min tomorrow so on) username & password must never work for more than 1 hour to access our network. i am bit confuse attribute to use, i would grateful if someone can advice the correct attribute to use for the purpose. Thanks

1 0

getting additional functionality, snmp or external program
by Duane Cox 29 Dec '12

29 Dec '12

I think this is possible, but wanted to make sure and ask what would be the best way to do this... ie. Execute an external program or create a module. I'm authenticating cable modems using freeradius with a sql database backend. What I want to do, is after the authentication process, query the cable modem using snmp (retrieving data) and store this data back into the already connected database. Is anyone doing such a thing? Thanks, Duane

2 1

HELP !! Access Period Attribute FreeRadius
by Prabhpal S. Mavi 29 Dec '12

29 Dec '12

Dear List Members, i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) including "rlm_sqlcounter" (Max-Daily-Session). User are logged off alright when "Max Session Timeout" is reached. But users can re login to gain access. The username and passwords are for hotspot. We do not want the username and password to work again once it has been used. For example: prepaid voucher (MySQL username & password) has 1 hour access. User should be able to use sum of one hour, either continuously once they are logged in or in parts (30min today & 30min tomorrow so on) username & password must never work for more than 1 hour to access our network. After the research i configured "Access Period" attribute using rlm_sqlcounter. According to the logs accessperiod counter is configured correctly and it returns OK. But users can still re use the one hour voucher (username/password). Is there any entry required in "/etc/raddb/dictionary" file for it to work? Something is still missing or i am not using correct attribute for the purpose. i would very grateful if someone can identify what is missing in my configuration or advice the correct attribute to use. I have tried the following: STEP A: Created rlm_sqlcounter and query. sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='${key}' ORDER BY AcctStartTime LIMIT 1;" } LOGS FOR ACCESS PERIOD COUNTER USING radiusx -X: rlm_sqlcounter: Sent Reply-Item for user prabhpal, Type=Session-Timeout, value=3600 ++[accessperiod] returns ok STEP B: "radiusd.conf" instantiate { exec expr daily noresetcounter dailycounter monthlycounter accessperiod expiration logintime } STEP C: authorize { some other entries ... daily noresetcounter dailycounter monthlycounter accessperiod expiration STEP D: assign the access period attribute to user or group STEP E: Restart radiusd & Testing Thanks

1 0

RE: AP> FR> LDAP authentication reject
by Phil Mayers 28 Dec '12

28 Dec '12

Sigh. No. There are no packets in that debug. How do you expect people to read a debug unless it contains an authentication attempt? > ... adding new socket proxy address * port 51195 >Listening on authentication address * port 1812 >Listening on accounting address * port 1813 >Listening on command file /var/run/radiusd/radiusd.sock >Listening on authentication address 127.0.0.1 port 18120 as server >inner-tunnel >Listening on proxy address * port 1814 >Ready to process requests. >. >. >. -- Sent from my mobile device, please excuse brevity and typos.

1 0

Regular expresion problem
by BALSIANOK, Peter 28 Dec '12

28 Dec '12

Hi, I want to use regular expression in acct_users file DEFAULT Called-Station-Id =~ /orangewap/i, Proxy-To-Realm := realm_orangewap Called-Station-Id = "%{Called-Station-Id}.%{3GPP-SGSN-Address}" Debug output: reading pairlist file /app/radius/raddb/ggsn//users reading pairlist file /app/radius/raddb/ggsn//acct_users /app/radius/raddb/ggsn//acct_users[25]: Parse error (check) for entry DEFAULT: No regular expression found in Called-Station-Id Errors reading /app/radius/raddb/ggsn//acct_users /app/radius/raddb/ggsn//modules/files[7]: Instantiation failed for module "files" /app/radius/raddb/ggsn//sites-enabled/default[170]: Failed to find "files" in the "modules" section. /app/radius/raddb/ggsn//sites-enabled/default[69]: Errors parsing authorize section. Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 3

Kerberos - Radius does not get password
by Jörg Herzinger 28 Dec '12

28 Dec '12

Hi, Radius has been bugging me now for over a week and I just can't get it working with Kerberos over WLan. I have been trying around a lot but in the end I purged the freeradius packages and restarted from scratch with default config (on Debian squeeze). All I did was adding a client in clients.conf client 192.168.0.0/16 { secret = averysecretsecret } adding two entries in users.conf testing Cleartext-Password := "pass" DEFAULT Auth-Type = Kerberos and adding Kerberos to authenticate in default and inner-tunnel right after PAP: Auth-Type Kerberos { krb5 } and I configured the Kerberos module. Now when testing with radtest both (kerberos and testing from files) work fine root@donauauen42 ~ # radtest testing pass radius 1 averysecretsecret Sending Access-Request of id 166 to 192.168.43.118 port 1812 User-Name = "testing" User-Password = "pass" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=166, length=20 root@donauauen42 ~ # radtest pink.funk-greene XXXXX radius 1 averysecretsecret Sending Access-Request of id 60 to 192.168.43.118 port 1812 User-Name = "pink.funk-greene" User-Password = "XXXXX" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=60, length=20 But when testing via WiFi just my testing user works, while my Kerberos users won't work. Not working Kerberos debug log: http://pastie.org/3890159 Vs. working plain users file log: http://pastie.org/3890167 Any help is appreceated. Thanks a lot... -- Jörg Herzinger - EDV Team GLOBAL 2000 - Friends of the Earth Austria Neustiftgasse 36, A-1070 Wien tel +43-699-14200030 Dieses Mail wurde mit Oekostrom und Opensource Software erstellt.

4 3

Re: AP> FR> LDAP authentication reject
by Alan DeKok 28 Dec '12

28 Dec '12

Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test. No, it doesn't. Or, it's not available. Or the user isn't found. Read the debug log. Look for anything related to LDAP. It isn't hard: [ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Does that mean anything to you? For the latest release, also read raddb/sites-available/inner-tunnel. It gives DETAILED instructions for debugging PEAP. Follow those instructions. Read the debug output. Alan DeKok.

1 0

Issue with Kerberos
by Khapare Joshi 28 Dec '12

28 Dec '12

I am testing Freeradius with kerberos. seems it is returning accept accept Fri Dec 21 15:05:46 2012 : Info: [suffix] No '@' in User-Name = "test66", looking up realm NULL Fri Dec 21 15:05:46 2012 : Info: [suffix] No such realm "NULL" Fri Dec 21 15:05:46 2012 : Info: ++[suffix] returns noop Fri Dec 21 15:05:46 2012 : Info: [eap] No EAP-Message, not doing EAP Fri Dec 21 15:05:46 2012 : Info: ++[eap] returns noop Fri Dec 21 15:05:46 2012 : Info: [files] users: Matched entry DEFAULT at line 1 Fri Dec 21 15:05:46 2012 : Info: ++[files] returns ok Fri Dec 21 15:05:46 2012 : Info: ++[expiration] returns noop Fri Dec 21 15:05:46 2012 : Info: ++[logintime] returns noop Fri Dec 21 15:05:46 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Dec 21 15:05:46 2012 : Info: ++[pap] returns noop Fri Dec 21 15:05:46 2012 : Info: Found Auth-Type = Kerberos Fri Dec 21 15:05:46 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group kerberos {...} Fri Dec 21 15:05:46 2012 : Debug: rlm_krb5: verify_krb_v5_tgt: host key not found : Permission denied Fri Dec 21 15:05:46 2012 : Info: ++[krb5] returns ok Fri Dec 21 15:05:46 2012 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group post-auth {...} Fri Dec 21 15:05:46 2012 : Info: ++[exec] returns noop Sending Access-Accept of id 219 to 192.168.1.1 port 33193 It always says permission denied then returns krb5 ok, What permission denied it is saying ? I generated service and host principal and exported keytab file in my radius server then added /etc/raddb/modules/krb5 file. But I always get permission denied debug output. another this is why PAP saying authentication may fail and then process the kerberos part - is this normal ? Thanks Merry Xmas, KH

2 3