May 2012 - Freeradius-Users - lists.freeradius.org

Using virtual servers to authenticate with different ports and Users
by Alan Kong 04 May '12

04 May '12

Hi, I am new to the idea of virtual servers on freeradius. I would like to authenticate one group of users using Port 1812 and a second group of users on port 1645 with the intention of using virtual server settings. I have got freeradius 2.1.11 with default radiusd.conf settings working according to the instructions from freeradius wiki. I would like to change the default settings in using virutal server by enclosing the first "listen section with type=auth" on default "radiusd.conf" with server wifi. However, the test user was rejected. Please let me know whether I need other settings to be modified to get the user accepted. I am only changing the default settings into one virtual server at the moment. Thank you. Regards Alan Enclosed please find messages from "radiusd -X" after "virtual server wifi" added: Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address * port 1812 as server wifi Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38387, id=56, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 server wifi { WARNING: Empty authorize section. Using default return values. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server wifi Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 56 to 127.0.0.1 port 38387 Waking up in 4.9 seconds. Cleaning up request 0 ID 56 with timestamp +38 Ready to process requests.

2 4

Configuring freeradius for MACsec
by Matija Levec 03 May '12

03 May '12

Hello everyone, I'm trying to configure MACsec (per http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/de… ) in a test lab using cisco supplicant & switch and freeradius 2.1.12. Cisco docs say: "The CAK is delivered in the RADIUS vendor-specific attributes (VSAs) MS-MPPE-Send-Key and MS-MPPE-Recv-Key." "...authentication server sends an EAP key identifier that is derived from the EAP exchange and is delivered to the authenticator in the EAP Key-Name attribute of the Access-Accept message." With successful EAP-TLS authentication the Access-Accept message sent from freeradius looks like this: Sending Access-Accept of id 37 to 10.20.64.9 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "123" MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03640004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" What should be configured for radius to also send EAP-Key-Name AVP? Kind regards, Matija Levec

5 6

sqlcounter_expire_on_login module
by tonimanel 03 May '12

03 May '12

Hi everybody, I have been looking for how to solve this: A user log in to freeradius, and after the first login, exactly one day later the access should to expire. Example: User: 'aaa' - 1 day (24hours). First login: 2012-04-02 12:00:00 Expires on: 2012-04-03 12:00:00 I have enabled sqlcounter_expire_on_login module, when user log in first time, there are not uses (radacct is empty for this user) but, sqlcounter_expire_on_login's query returns empty set value, not returns a valid value (for example 0) so, when freeradius check the return, says this: (freeradius -X output) rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;' [expire_on_login] expand: SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1; -> SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='sa373YIMET' ORDER BY acctstarttime LIMIT 1; sqlcounter_expand: '%{sql:SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='sa373YIMET' ORDER BY acctstarttime LIMIT 1;}' [expire_on_login] sql_xlat [expire_on_login] expand: %{User-Name} -> sa373YIMET [expire_on_login] sql_set_user escaped user --> 'sa373YIMET' [expire_on_login] expand: SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='sa373YIMET' ORDER BY acctstarttime LIMIT 1; -> SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='sa373YIMET' ORDER BY acctstarttime LIMIT 1; rlm_sql (sql): Reserving sql socket id: 3 [expire_on_login] SQL query did not return any results rlm_sql (sql): Released sql socket id: 3 [expire_on_login] expand: %{sql:SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='sa373YIMET' ORDER BY acctstarttime LIMIT 1;} -> rlm_sqlcounter: No integer found in string "" ++[expire_on_login] returns noop Anybody could tell me how can I do to solve it? I hope your answers. Thank you very much. Best regards, Antonio. -- View this message in context: http://freeradius.1045715.n5.nabble.com/sqlcounter-expire-on-login-module-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

realm rewrite or alias?
by Beau Sapach 03 May '12

03 May '12

Hello everyone, I've got FreeRADIUS running to proxy requests from a wireless controller to a domain controller (NPS). The realm name is being passed to NPS as the logon domain, which is fine but I'd like to catch a number of different possible realms that users may put into the login and 'rewrite' them to the proper domain name so that the domain controller doesn't reject the login and we get fewer helpdesk calls. After looking through the config files an doing a bit of searching online I still haven't found a way to do that, is it possible? Beau

2 1

sending mail mechanism of radwatch
by 魏景鹏 03 May '12

03 May '12

2 1

Multi-valued LDAP attribute
by Adam Track 02 May '12

02 May '12

Hi All, In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" ... The perl module currently has the following code because I can't seem to be able to get any result other than the first, ie "employee", and I really need the other two (possibly more) to do a proper VLAN assignment: while (($att,$val) = each(%RAD_REPLY)){ if ($att =~ 'Person-Type'){ $count++; if ($count == 1){ $one = $val; } else { $two = $val; } } } $RAD_REPLY{'Reply-Message'} = "Total: $count, first: $one, second: $two."; The results are: ... Reply-Message = "Total: 1, first: employee, second: ." ... I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}? If not, where are the other values being stored? I read from the archives that this can be done with 3.X and foreach using unlang, but I'm stuck with 2.1.10 at the moment. Or, do multi-valued attributes need to be defined another way? Thanks, A.

2 5

Re: Very huge Acct-Session-Time
by Alan Buxey 02 May '12

02 May '12

That acct-session-time is just a Unix timestamp. As already said, either the NAS has bugs, in which case, check if it has any available firmware updates, or its incorrectly configured...or replace it, or write lots of funky scripts or sql procedures to handle it. alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

Using rlm_caching: rejects on cached requests
by Jeroen Scheerder 01 May '12

01 May '12

Hi, We have a SSL-VPN client that authenticates in two stages. When using authentication with RSA OTP tokens, the second request is considered to be a replay by the RSA server, and denied for that reason. The authentication itself is handled by proxy through a Freeradius server (2.1.12 with experimental modules). What I'd like to acomplish is: - Cache authentication requests - Uncached or expired requests are passed on to the proxy - Cached authentication requests are handled (within the specified TTL) I've set up caching, and I see some of it working. From the debug output, I see this for the first request: ---- Snip ---- +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Could not find the requested key in the database. rlm_caching: Cache Queries: 4, Cache Hits: 0, Hit Ratio: 0.00% […] [then we see the proxy request being handled, successfully] […] +- entering group post-auth {...} ++[exec] returns noop rlm_caching: Found Auth-Type, value: '' [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: VP=Class,VALUE=default_group,length=38,cache record length=39, space left=711 rlm_caching: Storing cache for Key='on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: New value stored successfully. ++[caching] returns ok Sending Access-Accept of id 69 to 127.0.0.1 port 18782 Class = 0x64656661756c745f67726f757000 ---- pinS ---- This all seems more or less plausible, except for "Found Auth-Type, value: ''" For the second request (fired within a few seconds), I see: ---- Snip ---- Executing section authorize from file /root/etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Key Found. rlm_caching: VP='Class',VALUE='default_group',lenth='14',cache record length='39' rlm_caching: Adding Auth-Type '' rlm_caching: Cache Queries: 5, Cache Hits: 1, Hit Ratio: 20.00% ++[caching] returns ok Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject ---- pinS ---- So I'm getting a Reject for a cached Accept, in effect, and that seems to be due to the Auth-Type. This happens equally for non-proxied requests, i.e. with the following entry in "users": testing Cleartext-Password := "password" User-Name = "%{User-Name}", NAS-IP-Address = "%{NAS-IP-Address}" What am I missing, and what can I do to get cached authentication requests handled? TIA, JS. -- Jeroen Scheerder ON2IT B.V. Steenweg 17 B 4181 AJ WAARDENBURG T: +31 418-653818 | F: +31 418-653716 W: www.on2it.net | E: Jeroen.Scheerder(a)on2it.net Premier Business Partner - IBM | Reseller of the Year 2011 - Palo Alto Networks

4 8