December 2012 - Freeradius-Users - lists.freeradius.org

Return Access-Accept/-Reject depending on other active sessions during post-authentication
by Matthias Nagel 18 Dec '12

18 Dec '12

Hello together, my NAS supports used-based authentication, this means it is possible to have multiple sessions on the same ethernet port (same user multiple times and/or different users). Each attached supplicant must authenticate itsself. The switch prohibits a supplicant to use piggy-backing on top of some other already authenticated supplicant. Moreover I use RADIUS-assigned VLANs. If the same user or different users that are assigned to the same VLAN are authenticated on the same port, everything is fine. The trouble starts, if an additional user with a different VLAN than the VLAN that is already assigned to the port is sucessfully authenticated. In the past an additional user was denied access by the switch, if such a VLAN mismatch occured. This means is was impossible to have serveral different untagged VLANs on the same port. But my current NAS also grants access to the addtional user and assignes this user's VLAN to the port, too. This means there are more than one untagged VLAN on the same port at the same time and the result is some kind of "short-circuit fault" between the affected VLANs. Now, I would like to write some kind of RADIUS policy to prevent this behaviour. This policy is supposed to do the following during the post-authentication phase: 1) If there is no active session on the NAS port, just return Access-Accept 2) If there is at least one active session on the NAS port and the 'Tunnel-Private-Group-ID' of that session equals the 'Tunnel-Private-Group-ID' of the new request, return Access-Accept. 3) If there is at least one active session on the NAS port and the 'Tunnel-Private-Group-ID' of that session DOES NOT equal the 'Tunnel-Private-Group-ID' of the new request, return Access-Reject. Is this possible to do? I have the accounting information in a SQL database, hence I know, if there are active sessions on some port. But I do not know, which would be the correct RADIUS configuration section and I do not know if "unlang" or some other configuration directive can perform such a check. Best regards, Matthias ---------------------------------------------------------------------- Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

2 2

freeradius+mysql
by nanthitha shanmugam 18 Dec '12

18 Dec '12

Hi, I am using mysql with free radius for user authorization and accounting with assignment of ip pools from iptables in mysql. These all are working. But, I would like to know if we can bypass the authorization phase with mysql and use only ip pool assignment. Can you help in this part. Like even if the user is not authenticate, I wanted to send always access accept message with a framed ip from the ip pool table. Thanks, Nanthitha

1 0

Problem in xlat.c code
by BALSIANOK, Peter 18 Dec '12

18 Dec '12

Hi all, i have found problem in xlat.c code. Original code doesn`t work when i want to use in acct_users: DEFAULT Called-Station-Id == "orangewap" Called-Station-Id := "%{Called-Station-Id}.%{3GPP-SGSN-Address}" I have changed xlat.c [radiusd@tdrad1 main]$ diff xlat.c xlat.c.backup 1043a1044,1046 > if (isdigit(*p)) { > module_name = xlat_str = p; > } else { 1045a1049 > } Now everythink works correct. Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 5

Xlat iterate over sql result
by Stanislav Lorenc 16 Dec '12

16 Dec '12

Hi, is there some way how to iterate over xlat sql query result ? For example: I need send for user multiple ipv6 prefixes and they are stored in sql table and each prefix is represented by record in table. Query return for example 4 rows. update reply { Framed-IPv6-Prefix := "%{sql:SELECT network FROM ipv6_prefixes WHERE service = "user_service" }" } I am not able to find solution how to add all this records into reply. Best Regards Stanislav Lorenc

4 6

Simultaneous Proxy of Acct Messages to two External Radius Servers Using Replicate-To-Realm
by Jason Everard 15 Dec '12

15 Dec '12

We have been trying to get freeradius to work to do something I know works because I have seen it posted to this list on a few occasions. We have a Radius NAS (Cisco WLC) that is sending auth data to multiple Radius servers (not freeradius rather MS NPS and Cisco ACS and Cisco ISE) Problem is that we have several Radius receivers that need to see all of the accounting records from the WLC to make decisions re: the 802.11i session. So the sole function of the freeradius deployment is to proxy all received accounting packets to multiple Radius receivers simultaneously. We have been trying to get it to work with "Replicate-To-Realm := ISE" in the corresponding virtual-server configuration, however it doesn't work. The only way we can get the freeradius installation to send accounting packets to another external radius box is to use "Proxy-To-Realm" which requires a response from the server and does not seem to send the radius accounting packets to more than the first realm listed, i.e. preacct { preprocess update control { Replicate-To-Realm := ISE Replicate-To-Realm += BlueCoat } Doesn't work at all. However, the following will send the accounting packets to the ISE realm and NOT to the BlueCoat realm until the ISE realm is marked dead. preacct { preprocess update control { Proxy-To-Realm := ISE Proxy-To-Realm += BlueCoat } We want the Replicate-To-Realm functionality where the behaviour is to "send-and-forget" and to NOT require an accounting response from either server and where all packets are sent to ALL realms listed. We are running 2.1.12 currently. Is this maybe a bug that is fixed in 2.2.0? Regards, Jason

2 1

Need Help to Troubleshoot MySQL Auth FreeRadius 2.1.X
by Prabhpal S. Mavi 15 Dec '12

15 Dec '12

Dear Freeradius Hackers, This is new implementation. Can someone help me to troubleshoot why freeradius mysql authentication is failing. i have cross check every expect but still seem that something is not in place. What is i have done: installed Freeradius + MySQL Databases Configured Freeradius & Created MySQL Database. configured the following files: "sql.conf" "radiusd.conf" "default" enabled in radiusd.conf to "$INCLUDE = sql.conf" Radius is up and running without authentication even from localhost. Radius database is setup properly, no problem to start/stop "radiusd" radios_log are shown in section below. Results: tail -f "/var/log/radius/radius.log - Output Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server <default> Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server inner-tunnel Sat Dec 15 11:20:34 2012 : Info: ... adding new socket proxy address * port 32959 Sat Dec 15 11:20:34 2012 : Info: Ready to process requests. ========================================================================= Output of "radiusd -X" ... adding new socket proxy address * port 51412 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ======================================================================== Command to Check the radius Authentication: radtest mark mypassword localhost 1812 99THi49UGotool Output: Sending Access-Request of id 48 to 41.171.71.61 port 1812 User-Name = "mark" User-Password = "radmin" NAS-IP-Address = 192.168.3.106 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 ====================================================================== Two MySQL Radius Users PAY attention to the field "OP" (:= & ==) But auth is not working for any user. mysql> select * from radcheck where UserName='mark'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 3 | mark | radmin | := | 99THi49UGotool | +----+----------+-----------+----+-----------------+ 1 row in set (0.00 sec) mysql> select * from radcheck where UserName='dany'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 1 | dany | badmin | == | 99THi49UGotool | +----+----------+-----------+----+-----------------+ radius is up and running without authentication "== or :=" make no difference none of the user can authenticate. ============================================ selinux off freeradius is up mysql db is up there are two database users why auth would be failing? Any tip or clue would be greatly appreciated Thanks / Regards

2 1

Auth-Type already set?
by Lorenzo Milesi 15 Dec '12

15 Dec '12

I'm having a problem with FR2.1.10 and MD5 Passwords with MySQL. When I try to enable PAP I get the following: # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "F0073402", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> F0073402 [...] rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop the sites-enabled/default is: authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap noresetcounter dailycounter monthlycounter } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix sql exec attr_filter.accounting_response } session { sql } post-auth { sql exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } What's wrong? :( thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

3 3

EAP
by David Peterson 13 Dec '12

13 Dec '12

I wanted to ping the Eduroam people about EAP over WAN links. Are there considerations that can cause connectivity issues that I should be examining? David

3 6

refowarding the radius request when authentication fails
by laurent.feron＠free.fr 13 Dec '12

13 Dec '12

Hello, in the authentication step, i try several authentication against otp server, but if all are failed if the user is not know, i would like to re forward the radius request to another radius server. except the suffix mechanism in authorize section that i know a little bit, i don't see how to do that easily in the authentication section. The only solution i see, but not very nice, is to build a radius client in perl (define in the authentication function (rlm_perl)). If someone has an idea ??? Regards, Laurent

2 2

share information between authorize and authenticate sections (rlm_perl & rlm_python)
by laurent.feron＠free.fr 13 Dec '12

13 Dec '12

Hello, If someone can advise me... How to share information between the authorize() function and the authenticate() function within a perl or python script ? For example, i get some information from a database in authorize() that will reuse it in authenticate()? I could resubmit the sql request again, but it is clearly not efficient. in perl, i could write some new attributes in RAD_CHECK ??, then authenticate() will access them. in python, attributes are read only, so i cannot use them to pass information to authenticate(). A simple database, like redis, could be a solution by adding info with the id of the request (with Message-Authenticator as key)? If someone has an idea, it is very welcome... Regards, Laurent

3 3