February 2012 - Freeradius-Users - lists.freeradius.org

Fwd: rlm_counter: res is greater than zero
by pamela pomary 19 Feb '12

19 Feb '12

Hello Fellow Freeradius-Users, I have freeRadius installed on Cent OS and I have Cisco C2960 switch as my NAS. I have a task to allocate browsing time 2hrs per day to students in our computer labs. Logs from radius in debug mode says "res is greater than zero" users are not signed out after Max-Daily-Session is reached. I want to be able to disconnect a user logged in after they have reached their maximum daily session. Kindly find below config files which indicate maximum daily session of 120 seconds for testing purposes. I have searched through Freeradius's mailing-List but have not found solution yet. I will be grateful for help to resolve the problem. Thank you for help. ###################################################################### /etc/raddb/radius.conf ###################################################################### counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } instantiate { exec expr daily } authorize { preprocess mschap suffix eap files sql daily } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } ####################################################################### /etc/raddb/users ####################################################################### clare Max-Daily-Session:=120, User-Password := "password" ######################################################################### Dubug output ######################################################################### rlm_counter: Check item = 120, Count = 0 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user clare, check_item=120, counter=0 rlm_counter: Sent Reply-Item for user clare, Type=Session-Timeout, value=120 modcall[authorize]: module "daily" returns ok for request 8

1 0

Enc: Freeradius doesn't record acct-stop-time.
by Rodrigo Yoshioka 17 Feb '12

17 Feb '12

Hi Fajar, I Couldn't solve the problem yet... but I ran the Radius in debug mode, and I tried to disconnect my connection to see what are happening, as I couldn't find, I'll post it here. Thanks for the help. rad_recv: Accounting-Request packet from host XXX.XX.X.XXX:37121, id=232, length=268 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 115296 NAS-Port-Type = Ethernet User-Name = "email(a)domain.com.br" Calling-Station-Id = "00:15:6D:E6:94:DB" Called-Station-Id = "pppoe-wip2" NAS-Port-Id = "WIP2" MS-CHAP-Domain = "domain.com.br" Acct-Session-Id = "81514b64" Framed-IP-Address = xxx.xx.X.XX Acct-Authentic = RADIUS Event-Timestamp = "Feb 17 2012 13:44:23 BRST" Acct-Session-Time = 79376 Acct-Input-Octets = 158226957 Acct-Input-Gigawords = 0 Acct-Input-Packets = 1112930 Acct-Output-Octets = 854637707 Acct-Output-Gigawords = 0 Acct-Output-Packets = 1115931 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Request NAS-Identifier = "PPPoE-AND WIP2" Acct-Delay-Time = 0 Mikrotik-Realm = "domain.com.br" NAS-IP-Address = xxx.xx.x.xx Processing the preacct section of radiusd.conf modcall: entering group preacct for request 43 modcall[preacct]: module "preprocess" returns noop for request 43 rlm_acct_unique: Hashing 'NAS-Port = 115296,Client-IP-Address = xxx.xx.x.xx,NAS-IP-Address = xxx.xx.x.xxx,Acct-Session-Id = "81514b64",User-Name = "email(a)domain.com.br"' rlm_acct_unique: Acct-Unique-Session-ID = "4bc00ddcf558a324". modcall[preacct]: module "acct_unique" returns ok for request 43 rlm_realm: Looking up realm "domain.com.br" for User-Name = "email(a)domain.com.br" rlm_realm: No such realm "domain.com.br" modcall[preacct]: module "suffix" returns noop for request 43 modcall[preacct]: module "files" returns noop for request 43 modcall: leaving group preacct (returns ok) for request 43 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 43 radius_xlat: '/var/log/radacct/xxx.xx.x.xx/detail-20120217' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/xxx.xx.x.xx/detail-20120217 modcall[accounting]: module "detail" returns ok for request 43 modcall[accounting]: module "unix" returns fail for request 43 modcall: leaving group accounting (returns fail) for request 43 Finished request 43 Going to the next request And the sqltrace, the only information with acct-stop-time is this: UPDATE radacct SET AcctStopTime='2012-02-10 17:43:19', AcctSessionTime=unix_timestamp('2012-02-10 17:43:19') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '0' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= 'xxx.xx.x.xx' AND AcctStartTime <= '2012-02-10 17:43:19'; both were not collected from the same time. ________________________________ De: Fajar A. Nugraha <list(a)fajar.net> Para: Rodrigo Yoshioka <ro_yoshioka2002(a)yahoo.com.br>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Terça-feira, 7 de Fevereiro de 2012 14:00 Assunto: Re: Freeradius doesn't record acct-stop-time. On Tue, Feb 7, 2012 at 10:48 PM, Rodrigo Yoshioka <ro_yoshioka2002(a)yahoo.com.br> wrote: > Hi... > > My freeradius are recording in mysql all sessions about start connection, > but it didn´t finish it. when a device is logged out it remain connected at > mysql, doing my proprietary CRM mistake to return connection data. > > Checking detailed log, its registering start connection and stop connection, > the problem is just in mysql... It is probably a configuration that I should > enable, but I don´t know wich. Can anyone help me.? Did it suddenly stopped working, or did it never worked at all? Enabling sql in accounting section should handle accounting packets. If you're having problems, running it in debug mode (or enabling sqltrace) might help you find out what queries are being executed, and why they fail (if that's indeed the cause). -- Fajar

3 2

WISPr-Redirection-URL with Cisco 3550 switch
by Morris, Andi 17 Feb '12

17 Feb '12

Hi all, I would like to have the ability to redirect a user's start page when they are first authenticated via radius if possible, or at least each time the user's computer is turned on. I do want them to be able to access other sites, it is just the homepage I'd like to intercept, so it is not really a captive portal situation. Is this something that is achievable using Freeradius? I've seen lots of talk about using WISPr-Redirection-URL as an attribute in the Access_Accept but I'm unsure whether this is an attribute specific to a certain NAS. I'm using Cisco switches, so would I need to use a specific dictionary for those, or is there a generic attribute that will give me the result I need? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

2 2

RE: Freeradius-Users Digest, Vol 82, Issue 52
by Peter Moreton 17 Feb '12

17 Feb '12

Matthew, thanks for your replies, I think you are right inasmuch as I should create a web portal as you described: 1/ Users visit site, enter username (e-mail address), current pin & new pin to change their pin number. System emails confirmation of PIN change. 2/ If they can't remember their pin, or it's never been set before, they go to site, click on "remind me of my pin", and the system e-mails it to them. If they have not got one, it generates it, and then sends it. Perfect! - that's the spec I'll work to... now I've just gotta learn a whole heap of linuxy-stuff! (*So* much more interesting to work with than Windows tho, and reminds me somehow, of the fun days of OpenVMS) Peter Moreton *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

1 0

Freeradius and DWL-3500AP's
by John Corps 17 Feb '12

17 Feb '12

Hey All, Has anyone has any experience using freeradius with the dlink dws-3026 switch and dwl-3500aps? I can't see a way to configure anything on them...no matter what i do the request shows up as the following. rad_recv: Access-Request packet from host 192.170.140.6 port 1032, id=0, length=160 User-Name = "00-1F-F3-BD-A4-4F" User-Password = "NOPASSWORD" NAS-IP-Address = 10.90.90.91 Called-Station-Id = "00-20-B0-EF-BA-F6:TEST" Calling-Station-Id = "00-1F-F3-BD-A4-4F" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0xfab0de5e78156ea21d1b56e3537472ff # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok Side note, no matter what, the AP has a dhcp assigned IP and most AP's always show as that 10.90.90.x ip... That's all i ever get from a wireless client...even when on a mac using wpa2 and freeradius setup for ldap, username always shows as mac address...is this a limitation of the dlink equipment or am i doing something wrong? I am going with this is flakey dlink equipment and making me want to go to cisco even more... Any help would be appreciated, thanks.

3 2

Re: Freeradius and DWL-3500AP's
by Alan Buxey 17 Feb '12

17 Feb '12

What settings have you applied to the kit? Looks like some MAC-auth or captive portal method on the SSID you are using. You need to uncover the bits that talk about 802.1X and/or WPS/wpa2 enterprise alan

1 0

EAP-SIM on freeradius-server-2.1.12
by GNUbie 17 Feb '12

17 Feb '12

Hello all, I configured manually ($ ./configure --with-modules="rlm_sim" --with-modules="rlm_sim_files" && make) and installed (# make install) the freeradius-server-2.1.12 from the upstream on the CentOS 5.7 x86_64 machine. Then I configured the following configuration files: - /usr/local/etc/raddb/radiusd.conf - /usr/local/etc/raddb/clients.conf - /usr/local/etc/raddb/eap.conf - /usr/local/etc/raddb/sites-enabled/default And lastly, I created the /usr/local/etc/raddb/simtriplets.dat with six (6) triplets (just to make sure though AFAIK 3 is enough) for a single IMSI. Then, I executed the command "# /usr/local/sbin/radiusd -X -d /usr/local/etc/raddb" and tried testing directly from my iPhone4, I got the below snippet of the stdout logs: - - - < s n i p > - - - rad_recv: Access-Request packet from host 172.17.1.110 port 2048, id=120, length=249 User-Name = "3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org" NAS-IP-Address = 172.17.1.110 NAS-Port = 0 Called-Station-Id = "0E-19-BE-80-71-00:eap-sim" Calling-Station-Id = "5C-59-48-67-C7-A5" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200003901336265383535616537613836303763376640776c616e2e6d6e633030312e6d63633532352e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xdef1645477a2ba0f9a9371f0a9eea8b7 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/172.17.1.110/auth-detail-20120213 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/172.17.1.110/auth-detail-20120213 [auth_log] expand: %t -> Mon Feb 13 23:48:18 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc001.mcc525.3gppnetwork.org" for User-Name = "3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc525.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi 3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 57 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org] (from client eap-sim port 0 cli 5C-59-48-67-C7-A5) Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 120 to 172.17.1.110 port 2048 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 0 ID 120 with timestamp +13 Ready to process requests. - - - < s n i p > - - - Based on the above logs, below are the (3) lines that I'm not sure how to address them: [suffix] No such realm "wlan.mnc001.mcc525.3gppnetwork.org" rlm_sim_files: insufficient number of challenges for imsi 3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org: 0 ++[sim_files] returns notfound [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [3be855ae7a8607c7f(a)wlan.mnc001.mcc525.3gppnetwork.org] (from client eap-sim port 0 cli 5C-59-48-67-C7-A5) Please advice on how am I going to proceed from here. Thank you in advance. Regards, GNUbie

4 7

Re: Acct-Interim-Interval session time not working
by dulan 16 Feb '12

16 Feb '12

please check chillispot configurations.i think you can configure interim updates from it. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Acct-Interim-Interval-session-time-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: Freeradius-Users Digest, Vol 82, Issue 50
by Peter Moreton 16 Feb '12

16 Feb '12

But why not simply create a simple web page, possibly even as a captive portal? It's much easier that way, plus it's real-time and you have no risk of email missing (e.g. due to spam filters, etc). >> if I build a webpage, then I also have to authenticate users who present themselves requesting self service Since I don't know Linux terribly well, I'm asking the group if my proposal is a sensible approach? Am I re-inventing any wheels? Should I consider an alternative method? It's not really linux-specific. >> I want to keep the entire radius PIN authentication system on Linux, to keep it independent of Windows, a security "island" perhaps, so in this case, it is Linux specific. Thanks ----------------------------------------------------------- My brief spec: RADIUS01 would be extended to use SENDMAIL and some Perl or similar processing to monitor a predefined email account such as <mailto:PIN@foobar.org.uk> PIN(a)foobar.org.uk<mailto:PIN@foobar.org.uk> Why? When will you want radius to send email? During a failed auth? IMHO that's a terrible design, and could easily lead to mail floods. Again, it's easier to just use webpage. You seem to have a perception that the DB can only be modified by radius. It's not. You can have whatever process you want managing the db, and have FR simply reads from it. >> Nope, I said "radius01 would be extended" that's a hostname not the radius software. Perhaps I should have made this more clear. In my implementation, RADIUS01 replaces another security island, RSA01. The Sendmail/Perl script would make calls such as: ?Mysql -u root -p That line REALLY show your newbie-ness. >> cheers. helpful. ?<MySQL Password> ?Use radsql ?INSERT INTO radcheck (username, attribute, op, value) VALUES ('janedoe','Cleartext-Password',':=','password'); ?INSERT INTO radusergroup VALUES ('janedoe','dynamic',1); ?QUIT Ever heard of sql functions in scripts? e.g. <http://www.php.net/manual/en/book.mysqli.php>http://www.php.net/manual/en/book.mysqli.php or <http://search.cpan.org/dist/DBD-mysql/lib/DBD/mysql.pm>http://search.cpan.org/dist/DBD-mysql/lib/DBD/mysql.pm ? >> of course I have. My post tries to explain what I'm trying to achieve using simple language. Implementation detail isn't required. Looking at your post, I REALLY suggest you hire an expert instead. Either that, or spend lots of time (e.g. several weeks) to learn and have some trial-and-error. >> no, radius, mysql, php - these are all just tools to be learned. I'd rather spend a couple of weeks and build a solution that I know and trust. I'm sure we are all experts in our fields, and as such its much better to expand personal horizons than give in an hire someone. >> anyhow, no one responded to say, "it exists, use the xyz-addon" so I'm guessing that I'm not reinventing anything, so I'll crack on. Thanks everyone. *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

2 1

Radius Self Service
by Peter Moreton 16 Feb '12

16 Feb '12

DISCLAIMER: We are a Windows-shop, and this is our first Linux server deployment, so I'm having to ask newbie questions, sorry about that! I have a working RADIUS server, "RADIUS01" running Centos/Freeradius. Freeradius is configured to store username and PIN-style passwords in MySQL. To go live with our RADIUS implementation, I have been tasked with making the selection of PIN's a self-service process. I'm considering an email-based approach where user(a)foobar.org.uk can email PIN(a)foobar.org.uk in order to achieve PIN maintenance. (I understand the risk of email header spoofing). Since I don't know Linux terribly well, I'm asking the group if my proposal is a sensible approach? Am I re-inventing any wheels? Should I consider an alternative method? Thanks ----------------------------------------------------------- My brief spec: RADIUS01 would be extended to use SENDMAIL and some Perl or similar processing to monitor a predefined email account such as PIN(a)foobar.org.uk Sending a blank email to PIN(a)foobar.org.uk will respond with: Reply with a Subject line of : SENDPIN - To send your current PIN to your email address NEWPIN xxxx - To set you pin to the value xxxx and confirm by email HELP - To receive an email with extensive guidance The Sendmail/Perl script would make calls such as: Mysql -u root -p <MySQL Password> Use radsql INSERT INTO radcheck (username, attribute, op, value) VALUES ('janedoe','Cleartext-Password',':=','password'); INSERT INTO radusergroup VALUES ('janedoe','dynamic',1); QUIT *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

3 2