March 2012 - Freeradius-Users - lists.freeradius.org

WiMAX PPAQ Identifier
by kondie 07 Mar '12

07 Mar '12

Dear list, I am trying to implement WiMAX prepaid quotas using FreeRADIUS 2.1.12. I want to return to the NAS a Volume-Quota and/or a Duration-Quota. I am able to do this after modifications to the sqlcounter module. However, I need to send a WiMAX-PPAQ-Quota-Identifier as part of the reply to the NAS and this value needs to be generated by the AAA server. The PPAQ Quota Identifier is defined in the dictionary as: ATTRIBUTE WiMAX-PPAQ 37 tlv BEGIN-TLV WiMAX-PPAQ ATTRIBUTE WiMAX-PPAQ-Quota-Identifier 1 octets ATTRIBUTE WiMAX-Volume-Quota 2 integer #kb I would like to know if there is a function in FreeRADIUS that I can use to generate this identifier, and if it exists, how to use it (or you can point me to the appropriate documentation). If there is no such function, how do I return a Quota-Identifier with my Access-Accept? Thank you. Kondie -- View this message in context: http://freeradius.1045715.n5.nabble.com/WiMAX-PPAQ-Identifier-tp5543647p554… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Authorize mac addresses with dbm only
by Christoph Litauer 07 Mar '12

07 Mar '12

Dear freeradius users, maybe you can help me with a - probably simple - problem in authorizing wlan users. I am using freeradius 1.1.7 (on SLES 10sp4). My working configuration is able to authorize users with modules dbm and ldap. Dbm is used for mac-authentication, ldap for 802.1x-authentication. For some reason I need to reduce the number of requests our ldap server(s) gets. The actual configuration checks a mac address against dbm at first and then against ldap. I want mac-addresses exclusively checked against dbm. I can detect mac-authentication requests using the following hint: DEFAULT Colubris-AVPair == "ssid=tsunami" Hint = "DBM" Also I inserted a new DEFAULT entry in users: DEFAULT Hint == DBM Fall-Through = 0 Sending the following Radius-Request: User-Name = 001e52c90573 User-Password = 001e52c90573 Colubris-AVPair = "ssid=tsunami" results in the attached debug output. As you can see, rlm_dbm is used first (with success) but after that, rlm_ldap is used, too. Is it possible to configure radius so that mac-address authorizations are checked against dbm only (whether successful or not)? -- Kind regards Christoph rad_recv: Access-Request packet from host 141.26.71.252:42454, id=114, length=72 User-Name = "001e52c90573" User-Password = "001e52c90573" Colubris-AVPair = "ssid=tsunami" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 hints: Matched DEFAULT at 36 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "001e52c90573", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "001e52c90573" rlm_realm: Proxying request from user 001e52c90573 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 149 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 3 rlm_dbm: try open database file: /etc/raddb/wlan rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add 001e52c90573 to user list sm_parse_user: start parsing: user: 001e52c90573 parse buffer: <<Auth-Type := Local, User-Password == "001e52c90573">> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Service-Type = Login-User>> rlm_dbm: recod parsed rlm_dbm: Reply found Remove 001e52c90573 from user list modcall[authorize]: module "dbm" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for 001e52c90573 radius_xlat: '(uid=001e52c90573)' radius_xlat: 'dc=uni-koblenz,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=uni-koblenz,dc=de, with filter (uid=001e52c90573) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [001e52c90573] (from client test port 0) _________________________________________ Christoph Litauer Uni Koblenz, Computing Centre, Office A 022 Postfach 201602, 56016 Koblenz Fon: +49 261 287-1311, Fax: -100 1311

2 4

Translation of Reply Messages
by Tim White 07 Mar '12

07 Mar '12

I'm wondering if anyone has worked out some way to translate reply messages easily? I'm guessing I probably need to make this happen on the GUI side of my application (Grase Hotspot), but what do other people do in a multi language environment? Thanks Tim

5 4

User maanger for Freeradius users
by Javier Ruiz Escalante 06 Mar '12

06 Mar '12

Good morning, I have my freeradius working with SQL but have no software to manage users. Anybody knows anything? Thanks in advance. Regards

3 2

unlang regex matching
by Scott McLane Gardner 06 Mar '12

06 Mar '12

I'm having trouble getting unlang to match a string inside a larger string. I have a script that outputs a string of domain groups, like this: DOMN\Domain Users 2 DOMN\Wireless Users 2 DOMN\STUsers 2 DOMN\WOCL Wireless DOMN\WOCL Staff I have a unlang conditional written like this which I think should match, but is not matching: If (`/bin/sh /path/to/script` =~ /WOCL\sWireless/) { Do things } Else { Do other things } Can anyone tell me why my regex is not matching?

2 2

status_check vs src_ipaddr
by Brian Julin 06 Mar '12

06 Mar '12

Too late in the week to dig in like I should, but I was just diagnosing a problem and preliminary signs point to this: It appears that a home server entry configured with src_ipaddr will use that source ip address for auth requests, but when directed to do status_check, it sends status request packets using some interface address from some other config item somewhere (not sure from which one yet.) Also the source port on auth requests is usually taken from the OS dynamic range (high port numbers), but for some reason these are sourced from port 1647. Which is odd because I can't seem to grep "1647" out of the source code. Note the server sending these requests is a tad crusty (2.1.10) FWIW.

2 2

Error
by David Peterson 06 Mar '12

06 Mar '12

3 2

sql expiration do not checked
by Paolo Barbato 06 Mar '12

06 Mar '12

Oddly problem. freeradius 2.1.12 up and running authentication ntlm & sql no problem to authenticate users (ntlm on AD and local on mysql ), both from radtest and from NAS work fine I start to work with sql with the idea to set up some "local" users with a well defined expiration date. I imposed an expiration date in radcheck table, but it seems that freeradius doesn't care….of course it's my fault from radius -X I see sql user succefully authenticated but no message related with "expiration" I suppose to have insert all sql directives in proper place…is anything special to be done to tell free radius to check "expiration" attribute ? here dump from mysql…both paolo and pluto work mysql> SELECT * FROM `radcheck` LIMIT 0,1000; +----+----------+--------------------+----+-------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------------+ | 9 | paolo | Expiration | := | 04 Mar 2012 | | 10 | pippo | Cleartext-Password | := | BvKHknVN | | 8 | paolo | Cleartext-Password | := | paolo | | 11 | pippo | Expiration | := | 07 Mar 2012 | +----+----------+--------------------+----+-------------+ 4 rows in set (0.00 sec) Any hints ? Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

1 0

Re: LDAP (POSIX attibutes) password expiry
by up＠3.am 06 Mar '12

06 Mar '12

> On 03/06/2012 02:10 AM, up(a)3.am wrote: >>> On 28/02/12 21:16, up(a)3.am wrote: >>>> However, we just noticed that password expiry isn't working. I suspect this is >> because we are still using all the original POSIX attributes and none of them look >>>> like good for mapping to the ones supplied by FreeRADIUS. I see: checkItem >> Expiration radiusExpiration Our LDAP attributes use the >> following POSIX attributes to determine expiry: shadowMax: 90 >>>> shadowLastChange: 15215 >>> Other replies should have convinced you that there's no built-in support for >> this. You will need to either: >>> 1. Arrange for a FreeRADIUS-ready "radiusExpiration" attribute to be >>> set in LDAP alongside the POSIX/shadow schemas >>> 2. Synthesize an Expiration attribute, or otherwise locally check the >>> POSIX/shadow attributes. >>> One way you might accomplish the 2nd is as follows: >>> == Create some local RADIUS attributes for the shadow values == /etc/raddb/dictionary: >>> ATTRIBUTE Shadow-Max-Age 3000 integer >>> ATTRIBUTE Shadow-Last-Change 3001 integer >>> ATTRIBUTE Shadow-Expires 3002 integer >>> ATTRIBUTE Shadow-Current 3003 integer >>> /etc/raddb/ldap.attrmap: >>> checkItem Shadow-Max-Age shadowMax >>> checkItem Shadow-Last-Change shadowLastChange >>> == Read these attributes from LDAP, then perform some maths == /etc/raddb/sites-enabled/<server>: >>> authorize { >>> ... >>> ldap >>> update control { >>> Shadow-Expires := "%{expr:%{control:Shadow-Last-Change} + >>> %{control:Shadow-Max-Age}}" >>> Shadow-Current := "%{expr:%l / 86400}" >>> } >>> if (control:Shadow-Current> control:Shadow-Expires) { >>> reject >>> } >>> ... >>> } >>> Hopefully it's clear what this does, but basically: >>> 1. Pulls last-change& max-age from LDAP >>> 2. Adds them together, to get expiry (in days since epoch) >>> 3. Divides %l (epoch) by 86400 to get today, in days since epoch 4. Compares >> them >>> - >> It looks to me like it should do all of those things swimmingly...however, I am running into an issue that looks like it might be because we run redundant LDAP servers. I put your 'update control' here, in the authorize : >> redundant LDAP{ >> ldap1 >> ldap2 >> update control {<ETC> >> } >> } > > > Ok, so do: > > redundant { > ldap1 > ldap2 > } > update control { > .. > } Ok, that got it starting and it looks tantalizingly close, but somehow Shadow-Expires isn't getting parsed: ++- entering group LDAP {...} [ldap1] performing user authorization for ldaptestuser [ldap1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> ldaptestuser [ldap1] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldaptestuser) [ldap1] expand: dc=domain,dc=com -> dc=domain,dc=com [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in dc=domain,dc=com, with filter (uid=ldaptestuser) [ldap1] looking for check items in directory... [ldap1] shadowLastChange -> Shadow-Last-Change == 15215 [ldap1] shadowMax -> Shadow-Max-Age == 90 [ldap1] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap1] user ldaptestuser authorized to use remote access [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns ok ++- group LDAP returns ok expand: %{control:Shadow-Last-Change} + %{control:Shadow-Max-Age} -> 15215 + 90 expand: %{expr:%{control:Shadow-Last-Change} + %{control:Shadow-Max-Age}} -> 15305 expand: %l / 86400 -> 1331041623 / 86400 expand: %{expr:%l / 86400} -> 15405 ++[control] returns ok ++? if (control:Shadow-Current > control:Shadow-Expires) Failed parsing "control:Shadow-Expires": Unknown value control:Shadow-Expires for attribute Shadow-Current ----------- To make sure I got the mapping and dictionary definitions right, here's what I have (pretty much just copied and pasted from you): [root@host]# grep -i shadow /etc/raddb/dictionary ATTRIBUTE Shadow-Max-Age 3000 integer ATTRIBUTE Shadow-Last-Change 3001 integer ATTRIBUTE Shadow-Expires 3002 integer ATTRIBUTE Shadow-Current 3003 integer [root@host]# grep -i shadow /etc/raddb/ldap.attrmap checkItem Shadow-Max-Age shadowMax checkItem Shadow-Last-Change shadowLastChange

2 2

Total Data download
by Fazal Ahmed Malik 06 Mar '12

06 Mar '12

Hi, Is there any tool or script with help of which I can get to know how much data downloaded by all user in last 30 days. Please share the solution. Best regards, Fazal Ahmed Malik

3 3