February 2012 - Freeradius-Users - lists.freeradius.org

Authenticate users only depending on the result of a perl script
by Lorenzo J. Cubero 16 Feb '12

16 Feb '12

Dear Freeradius experts, I would like to redirect all the incoming requests to a rlm_perl script. And then authenticate the user only depending on the result of the script. I already have the script, my doubt is how to configure Freeradius to treat the incoming requests only over a perl script. Thanks in advance. -- ......................................................................... __ / / Lorenzo J. Cubero C E / S / C A Unitat d'Operacions i Seguretat /_/ Centre de Serveis Científics i Acadèmics de Catalunya Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona T. 93 551 6214 · F. 93 205 6979 · ljcubero(a)cesca.cat Facebook (http://on.fb.me/vPv3oN) · Twitter @CE5CA · Linkedin Subscriu-te al butlletí (www.cesca.cat/butlleti) .........................................................................

2 1

Re: Acct-Interim-Interval session time not working
by dulan 16 Feb '12

16 Feb '12

use like follows *Acct-Interim-Interval := 60* if you use Database you should insert this data to *radraply *table On Thu, Feb 16, 2012 at 12:59 PM, oportino [via FreeRadius] < ml-node+s1045715n5488744h83(a)n5.nabble.com> wrote: > Hello all, > > I am using freeradius 2.1.0 on Ubuntu 10.10 and using rp-pppoe server and > chillispot server for user login authentication method on same machine and > set up radius attribute for end user such as > #------------------------------------------------------------------------------------- > > *radtest abc abc123 127.0.0.1 0 SecretKey* > Sending Access-Request of id 185 to 127.0.0.1 port 1812 > User-Name = "abc" > User-Password = "abc123" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=185, > length=80 > Idle-Timeout = 600 > WISPr-Bandwidth-Max-Down = 100000000 > WISPr-Bandwidth-Max-Up = 100000000 > *Acct-Interim-Interval = 60* > Acct-Status-Type = Interim-Update > *Session-Timeout = 300* > > ( All user can login all of session is 5mins ) > #------------------------------------------------------------------------------------- > > > 1.After first use logged in ( with pppoe or chillispot) the user "abc" > use the network times 200secs (left time=100secs) and logged off later. > > 2.The user "abc" logged in again with radius message > User-Name = "abc" > User-Password = "abc123" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=185, > length=80 > Idle-Timeout = 600 > WISPr-Bandwidth-Max-Down = 100000000 > WISPr-Bandwidth-Max-Up = 100000000 > *Acct-Interim-Interval = 60* > Acct-Status-Type = Interim-Update > *Session-Timeout = 100* > > During live logged in session , In the radius database and radacct table > has 2 record insert (first record is first login and *secondary record is > now login*) > > I delete the first database record (use time= 200secs) so that the > attribute Acct-Interim-Interval it is updating all sessiontime count to 0 > and "abc" can use the network 300secs. But it is not updating session and > the user "abc" was terminate after 100 secs normally by AcctTerminateCause > is "Session-Timeout" . > > What does debug or how? > > Thanking for every thing. > > > > ------------------------------ > If you reply to this email, your message will be added to the discussion > below: > > http://freeradius.1045715.n5.nabble.com/Acct-Interim-Interval-session-time-… > To unsubscribe from FreeRadius, click here<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsu…> > . > NAML<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macr…> > -- Best Regards.. Achintha Udukumbura -- View this message in context: http://freeradius.1045715.n5.nabble.com/Acct-Interim-Interval-session-time-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Possibility to create a counter for "traffic volume" WITHOUT sql ?
by Nachtfalke 16 Feb '12

16 Feb '12

Hi, I am using freeradius 2.1.12 and the rlm_counter module for counting amount of time. So an user has got only 60min per day, week, month or forever. As far as I can see that this is working as it should. User cannot reconnect if he used more time than allowed. This is how my counter module looks like: ------------------------------------------- counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout cache-size = 5000 } ------------------------------------------- The corresponding "users" file looks like that. Limit is 3600 seconds. ------------------------------------------- "username" Cleartext-Password := "password", Max-Daily-Session := 3600 ------------------------------------------- Then I thought I could just simple make a traffic counter with this module and I did that: ------------------------------------------- counter maxdailydownload { filename = ${raddbdir}/db.maxdailydownload key = User-Name count-attribute = Acct-Output-Octets reset = daily counter-name = Daily-Output-Octets check-name = Max-Daily-Output reply-name = Acct-Output-Octets cache-size = 5000 } ------------------------------------------- The corresponding "users" file looks like that. Limit is 1000000000 which should be ~1GB ------------------------------------------- "username" Cleartext-Password := "password", Max-Daily-Output := 1000000000 ------------------------------------------- But as I know now this isn't working. The main problem is - as far as I understand this - that the module counts time and replies "Session-Timeout" and this makes problem when counter should reset daily. Unfortunately I didn't understand it completly. Somewhere on the mailing-list I found I thread where they discussed about that problem and that it should work when using "reset = forever". I tried that but it seems not to work. The user only can download much less than 1GB. Perhaps this could be a problem of my NAS (pfSense Captive Portal which perhaps sends wrong "Acct-Output-Octets" values). The other problem is that if the check-item value of "Max-Daily-Output" is too hight - probably 32bit limit - it doesn't work, too. Then I bought a book about freeRadius "FreeRADIUS - Beginners Guide by Dirk van der Walt" and he is describing the same problem with the rlm_counter and counting traffic. He wrote a perl script which counts traffic but the "problem" is that he is using an SQL database. The NAS I am using for this is - I mentioned it above - pfSense CaptivePortal. It sends Acct-Input-Octets, Acct-Input-Octets, Acct-Input-Gigawords, Acct-Output-Gigawords. My question is now: 1. Is it possible in general to create a data counter without using any external database but just with tools freeradius2 comes with ? 2. Has somebody coded such a module, script oder something als and could post this here ? 3. Will there be an (easier) way on freeradius3 or a module which covers this feature ? Thank you very much in advance for your help and answers! Alexander

2 1

Password-Retry attribute
by Morris, Andi 16 Feb '12

16 Feb '12

Hi all, I'm trying to configure my freeradius server to prompt the user to retype their credentials if they mistype the username or password so that they can be authenticated via dot1x. I've checked my virtual server post-auth and found: post-auth { exec packetfence Post-Auth-Type REJECT { attr_filter.access_reject } } So then looked inside attr_filter.access_reject and added the Password-Retry attribute as below: DEFAULT EAP-Message =* ANY, State =* ANY, Message-Authenticator =* ANY, Reply-Message =* ANY, MS-CHAP-Error =* ANY, Proxy-State =* ANY, Password-Retry :=3 However when I force my test Windows 7 client to fail using a bad password I'm not reprompted to enter a new password at all. When running a debug I see the Password-Retry attribute being sent in the Access-Reject section. The following results are the debug output: . rad_recv: Access-Request packet from host 10.1.1.21 port 1645, id=169, length=308 User-Name = "sm18818" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" EAP-Message = 0x0208006b19001703010060f87a45874abccfef74c9674f4dcc93d9f804ecc7db489bfa2205e4a5c2f691543d9de8c31c0c84fb2da83121280190827555f2e2cb16784fabf62a775b6caca028e7a56405a8c7e64d0e3855a75615e2275ce7a40ace04929dbbf623562650c3 Message-Authenticator = 0xd7a475900d0efb6a752d8c59da3f6dc6 Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" State = 0xd8956e82de9d77cd0f3a27e6f3c50521 NAS-IP-Address = 10.1.1.21 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 8 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800421a0208003d31375d05e236695687a5bd102f646c02450000000000000000ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad00736d3138383138 server packetfence { [peap] Setting User-Name to sm18818 Sending tunneled request EAP-Message = 0x020800421a0208003d31375d05e236695687a5bd102f646c02450000000000000000ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad00736d3138383138 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sm18818" State = 0x7642bbe8764aa17935847ca964c2e70f Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" NAS-IP-Address = 10.1.1.21 server packetfence-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: sm18818 [mschap] Told to do MS-CHAPv2 for sm18818 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> sm18818 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=sm18818 [mschap] mschap2: c7 [mschap] Creating challenge hash with username: sm18818 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=e8c9f13e6c1cd2a3 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server packetfence-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 169 to 10.1.1.21 port 1645 EAP-Message = 0x0109002b1900170301002046a93765d835a4d9441c538ef7abcb1ef20e14d69d31cd9afbf8bd34f017fb64 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd8956e82df9c77cd0f3a27e6f3c50521 Finished request 7. Going to the next request Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 10.1.1.21 port 1645, id=170, length=244 User-Name = "sm18818" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" EAP-Message = 0x0209002b19001703010020d6f77af2663bc82ac052d9afb815c2b900be28fa33360b6f6ce08326d867b3cc Message-Authenticator = 0xa004edde5ec362abceec91909403265a Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" State = 0xd8956e82df9c77cd0f3a27e6f3c50521 NAS-IP-Address = 10.1.1.21 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server packetfence Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sm18818 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 170 to 10.1.1.21 port 1645 Password-Retry := 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.9 seconds. Is there somewhere else I need to enable this attribute? Does it need adding to the dictionary on the client? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

2 2

Re: Freeradius with Caller-station-id
by Alan Buxey 16 Feb '12

16 Feb '12

This can be done for plain auth...one way would be to put a check in the auth section, if the normal auth has failed then fail through to eg perl and have some perl script that checks what you want to check and send back the accept alan

5 15

duplicate radacct entries
by Ski Mountain 15 Feb '12

15 Feb '12

I am using pptp with radiusclient, and a mysql backend. The problem is that the radiusclient puts in too many entries into the database. Below is a copy of one client connecting and disconnecting. The problem appears to be that for the second entry there is never a acctstoptime entered into the databse, or is there a way to make it so only entry is entered into the database. where is just says 0000-00-00 00:00:00. mysql> select * from radacct; +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | LastUpdate | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | 1 | 4F3C72A5117D00 | 4fed5006f373739c | user(a)domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 0000-00-00 00:00:00 | 0 | RADIUS | | | 0 | 0 | | 22.11.45.88 | | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:13 | | 2 | 4F3C72A5117D01 | 19f60e897a312d37 | user(a)domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 2012-02-16 04:06:16 | 3 | RADIUS | | | 792 | 0 | | 22.11.45.88 | User-Request | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:16 | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ 2 rows in set (0.00 sec) Thanks

2 5

Freeradius with Caller-station-id
by Richard J Palmer 15 Feb '12

15 Feb '12

Hi we have several FreeRadius servers talking in our case to SM SQL and these work fine for all our users logging in using Username & passwords. We are just getting a new L2TP link in and with sessions on this link I want to auhenticate *just* on the calling station ID - there will be a username/password BUT these are not what we need. I therefore want to be able to keep username/password for the current sessions, BUT if these fail authenticate on callingtation ID and return IP address details, etc. is there a way to do this ? I worked round it previously by hacking the code BUT I'm sure there is a better way here... Richard

2 2

ldap authentication
by Jason Sigurdur 15 Feb '12

15 Feb '12

Hi, I have an application that requires ldap authentication, but would like it to proxy the authentication to a radius/otp server given the user is part of a specific group. Is this a possibility within freeradius? Thx jason

1 0

Remove authenticated user from Radius
by guibannwart 15 Feb '12

15 Feb '12

Hello all, I'm running Freeradius2 + OpenLDAP with my wireless network. I need to know if it's possible to remove an authenticated user from a specific Access Point via Freeradius. My wireless solution (3Com) doesn't provide me this feature, and 3Com (HP) says that I need to check my Radius documentation for that, however I've already checked and found nothing on the documentation. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Remove-authenticated-user-from-Radi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Accounting for nonexistent users / NAS ?
by justin76＠mac.com 15 Feb '12

15 Feb '12

Hi all, we are using freeradius with mysql. Accounting works fine, but we discovered that the server is doing accounting for users which don't exist at all in our system. They are probably local users but accounting information is sent to our servers. How do we allow accounting for only our users? The server should check whether the user is in the radcheck table as we only keep users that which have a valid account. How can this be achieved? Furthermore, it would be good if we could verify the NAS value so the server should only do accounting when the NAS is allowed. Thanks for the answers.

3 9