September 2012 - Freeradius-Users - lists.freeradius.org

In Access-Request h323-remote-address Multiple times How to get it in SQL query
by Ankur - BillCall 13 Sep '12

13 Sep '12

Hi All, We have configure freeradius on centos with mysql. We are developing solution for Wholesale VOIP. We need to authenticate user on basis of Trunk Id & IP. We are getting Trunk Id and IP in h323-remote-address attribute. Please find my Access-Request. Packet-Type = Access-Request User-Name = "bk" User-Password = "8888891990942XXXX" h323-conf-id = "377BE9DC FC071910 90FB000C 290E95CC" Cisco-AVPair = "remote-media-address=XXX.105.4.197" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=88888919974063392" h323-remote-address = "000111" h323-remote-address = "XXX.105.4.197" Calling-Station-Id = "bk" Called-Station-Id = "88888919974063392" Service-Type = Login-User NAS-IP-Address = 79.99.198.YYY remote-media-address = "XXX.105.4.197" session-protocol = "cisco" gw-rxd-cdn = "8888891997406XXXX" We are getting h323-remote-address multiple times. How can I get both attribute in sql query for authentication? I set sql_user_name = "%{h323-remote-address}". But I get sql_user_name = Trunk ID (000111) only. How can I get IP XXX.105.4.197? Thanks & Regards, Ankur

1 0

[ANN] Version 3.0.0-beta0
by Arran Cudbard-Bell 12 Sep '12

12 Sep '12

The v2.1.x branch was created almost exactly 3 years ago (14/09/2009), and has diverged from the master branch significantly. The majority of the potentially disruptive code changes have now been completed for 3.0 and it is at a stage where community testing would be helpfull. To provide a single point to test against, the release_3_0_0_beta0 tag has been created. The tarball is available here: https://github.com/alandekok/freeradius-server/tarball/release_3_0_0_beta0 Instructions for converting existing 2.1.x configurations are available here: https://github.com/alandekok/freeradius-server/blob/release_3_0_0_beta0/rad… Please post any defects to http://bugs.freeradius.org. The interim changelog for 3.0 is as follows: FreeRADIUS 3.0.0 Mon 01 Jan 8:00:00 CEST 2010, urgency=medium Feature improvements * Largely configuration file compatible with 2.1.x. * Documentation for upgrading from 2.x is in raddb/README.rst Please follow it. Do not just install 3.0. * Updated packet encode/decoder. The resulting code is much simpler and easier to extend. * Updated internal API to support new attributes and formats * Added RADIUS over TLS (i.e. RadSec). See raddb/sites-available/tls * Added "extended attributes" using the new encoder/decoder. * Added the "integer64" data type. * Added full WiMAX support, using the new encoder/decoder. The old code could not handle some unusual corner cases. * Added code to send SNMP Traps. See raddb/trigger.conf. * Added support for Apple's Grand Central Dispatch * Added for MS-CHAP Change Password from Phil Mayers. See raddb/mods-available/mschap, "passchange" subsection. * Added provisions for raddb/dictionary.local, for local changes. See raddb/dictionary for more details. * Added EAP-PWD implementation from Dan Harkins * Added packet/s tracking. See max_pps in the "listen" sections, and auto_limit_acct in the "thread pool" section. * Moved configuration entries in radiusd.conf to make more sense. * Moved raddb/modules/ to raddb/mods-available, and raddb/mods-enabled, following the examples of other projects. * Moved eap.conf to mods-available/eap * Moved sql.conf to mods-available/sql * Moved TLS configuration for EAP into a common subsection. See raddb/mods-available/eap, tls-config section. * Added internal connection pool API, this consolidates connection management code that was previously spread across many modules. Advantages are that it actually works, well, under nearly all conditions, supports triggers, and has 'elastic' limits on the numbers of connections. * SQL now uses the connection pool. * SQL query config has changed to support arbitrary Acct-Status-Types, this change breaks config compatibility with 2.1.x. Configurations must be updated. Bug fixes * All known bug fixes from 2.1.x are included. * Removed "addport" functionality. All features and bug fixes from 2.2.0 are also included.

1 0

Radius Config and Router
by George Innocent 12 Sep '12

12 Sep '12

Hello; I have configured the radius and some servers to authenticate through the Radius. I can authenticate well from the servers but the same is not working on the routers. Users have been created on the router as a test before implementation. The log file has credentials that i have not created. Thanks to assist -- Regards: George Innocent.

4 7

Multiple EAP config
by BILLOT 12 Sep '12

12 Sep '12

Hi, We have a config with 3 virtual servers, running on a different port. Each virtual server must have a particular config (different LDAP server, different SQL server). However, each one uses EAP auth and so the inner-tunnel which is unique. Thus in the inner-tunnel config, default modules are used (ldap and SQL). How can we use a different EAP config for each server and so one particular config for each inner-tunnel ? BR,

3 5

Re: freeradius OTP with OATH
by Thomas Glanzmann 12 Sep '12

12 Sep '12

Hello Henk, > I've looked closely at your video and accomplishment with smsotp, > congrats! thank you. However the video shows something that is outdated. I now wrote a perl module for rlm_perl which does it much better without all the moving parts. > Did you also had a look at OATH TOTP instead of SMS authentication? > This is a RFC (http://tools.ietf.org/html/rfc6238) as you may know. A > user installs an app on their phone which implements this RFC (e.g. > Google Authenticator) and it acts as a soft token. I did and evaluated it together with RADIUS. > I've got this running with freeradius and the google authenticator PAM > module. The downside of PAM is the lack of challenge-access and > response support (AFAIK). If you want a challenge response integration like the user first needs to authenticate with username and password and than gets a challenge and needs to answer with a response that is possible. You could also tweak it that you leave the first step out. Just have a look at the rlm_perl implementation in http://thomas.glanzmann.de/smsotpd.2012-08-16.tar.bz2 > Do you know of anything that supports OATH and TOTP natively with > freeradius and can be used with the access-challenge/response system > (or am I wrong about PAM not supporting that feature)? I think there was a module, but I don't recall, maybe ask the FreeRadius List, or grep in the modules directory. I take it on CC. Cheers, Thomas

2 3

Adding reply AVPs to a replicated proxy request
by Chadwick Sorrell 12 Sep '12

12 Sep '12

Hello, I'm using replicate to proxy my authorization and accounting requests to a server. I'm curious if it's possible to add some of the auth reply attributes to the auth proxy before I send it over. That way the proxied auth has both the request and the reply. Thanks

2 1

Adding reply AVPs to an authorization proxy
by Chadwick Sorrell 11 Sep '12

11 Sep '12

Hello, I'm using replicate to proxy my authorization and accounting requests to a server. I'm curious if it's possible to add some of the auth reply attributes to the auth proxy before I send it over. That way the proxied auth has both the request and the reply. Thanks

1 0

Re: Radius.Logs
by George Innocent 11 Sep '12

11 Sep '12

> I can authenticated successfully using a test user and the NAS but i check > on the logs and the scripts below keep re-appearing even when there is no > attempt on logging to the NAS. > > rad_recv: Access-Request packet from host 10.250.0.7 port 43677, id=185, > length=70 > > NAS-IP-Address = 10.250.0.17 > > NAS-Identifier = "SAM-pst-clt" > > NAS-Port = 1 > > User-Name = "admin" > > User-Password = "admin" > > Tue Aug 7 15:54:08 2012 : Info: # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group authorize {...} > > Tue Aug 7 15:54:08 2012 : Info: ++[preprocess] returns ok > > Tue Aug 7 15:54:08 2012 : Info: ++[chap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[mschap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[digest] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [suffix] No '@' in User-Name = "admin", > looking up realm NULL > > Tue Aug 7 15:54:08 2012 : Info: [suffix] No such realm "NULL" > > Tue Aug 7 15:54:08 2012 : Info: ++[suffix] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [eap] No EAP-Message, not doing EAP > > Tue Aug 7 15:54:08 2012 : Info: ++[eap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[files] returns ok > > Tue Aug 7 15:54:08 2012 : Info: ++[expiration] returns noop > > Tue Aug 7 15:54:08 2012 : Info: ++[logintime] returns noop > > Tue Aug 7 15:54:08 2012 : Info: [pap] WARNING: Auth-Type already set. Not > setting to PAP > > Tue Aug 7 15:54:08 2012 : Info: ++[pap] returns noop > > Tue Aug 7 15:54:08 2012 : Info: Found Auth-Type = PAP > > Tue Aug 7 15:54:08 2012 : Info: # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group PAP {...} > > Tue Aug 7 15:54:08 2012 : Info: [pap] login attempt with password "admin" > > Tue Aug 7 15:54:08 2012 : Info: [pap] Using clear text password "testing" > > Tue Aug 7 15:54:08 2012 : Info: [pap] Passwords don't match > > Tue Aug 7 15:54:08 2012 : Info: ++[pap] returns reject > > Tue Aug 7 15:54:08 2012 : Info: Failed to authenticate the user. > > Tue Aug 7 15:54:08 2012 : Auth: Login incorrect (rlm_pap: CLEAR TEXT > password check failed): [admin/admin] (from client SAM-pst port 1) > > Tue Aug 7 15:54:08 2012 : Info: Using Post-Auth-Type Reject > > Tue Aug 7 15:54:08 2012 : Info: # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > > Tue Aug 7 15:54:08 2012 : Info: +- entering group REJECT {...} > > Tue Aug 7 15:54:08 2012 : Info: [attr_filter.access_reject] expand: > %{User-Name} -> admin > > Tue Aug 7 15:54:08 2012 : Debug: attr_filter: Matched entry DEFAULT at > line 11 > > Tue Aug 7 15:54:08 2012 : Info: ++[attr_filter.access_reject] returns > updated > > Tue Aug 7 15:54:08 2012 : Info: Delaying reject of request 43 for 1 > seconds > > Tue Aug 7 15:54:08 2012 : Debug: Going to the next request > > Tue Aug 7 15:54:08 2012 : Debug: Waking up in 0.9 seconds. > > Tue Aug 7 15:54:09 2012 : Info: Sending delayed reject for request 43 > > Sending Access-Reject of id 185 to 10.250.0.7 port 43677 > > Tue Aug 7 15:54:09 2012 : Debug: Waking up in 4.9 seconds. > > Tue Aug 7 15:54:14 2012 : Info: Cleaning up request 43 ID 185 with > timestamp +519 > Tue Aug 7 15:54:14 2012 : Info: Ready to process requests. > > -- Regards: George Innocent.

1 0

Re: LDAP module file using localhost instead of external?
by Jennifer Mehl 11 Sep '12

11 Sep '12

> On 09/10/2012 11:47 PM, Jennifer Mehl wrote: > >> Here is the output of freeradius -X showing part of the file being read but then ignored?: > > It doesn't look to me like it's ignoring it, which in any event the > server doesn't do. It looks like it's just a different file. It's not > just the hostname that is different. For example: > >> Module: Instantiating module "ucsbnetid" from file /etc/freeradius/modules/ldap >> server = "localhost" >> filter = "(uid=%u)" >> base_filter = "(objectclass=radiusprofile)" > > >> Here is my /etc/freeradius/modules/ldap file (password obfuscated): >> >> server = "directory.ucsb.edu" >> filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" >> base_filter = "(objectclass=ucsbperson)" >> #base_filter = "(objectclass=radiusprofile)" > > ...amongst (many) others. > > You *can't* be editing the same file. Do you have chroot or jails or > similar in use, and if so are you editing the file inside the > chroot/jail or outside? Are you sure you're not leaving backup "file~" > from editors in the directory? Aha, good advice that got me on the right track. Copy/paste foils again: deca:/etc/freeradius/modules# file ldap ldap: UTF-8 Unicode English text I created a new file as ASCII English text and typed everything in manually, and it is now reading my file properly. Now, on to the next part of the troubleshooting process. :-) thank you, Jennifer ================================== Jennifer L. Mehl Director of Information Technology Dept. of Chemistry and Biochemistry 2618 PSBN University of California, Santa Barbara Santa Barbara, CA 93106-9510 mailto: mehl(a)chem.ucsb.edu 805-893-4392 (office) 805-451-7486 (cell) ==================================

1 0

radlogin works, mobile device not
by Mihajlo Joksimovic 11 Sep '12

11 Sep '12

Hi everybody, I've a Problem with my freeradius installation. In the office i have access points, which will authenticate over the freeradius server. Freeradius should look in ldap for username and password. Thats what i get when i try to login with an iphone or ipad. rad_recv: Access-Request packet from host 10.119.12.3 port 1178, id=17, length=199 Message-Authenticator = 0x0842b4ee5b5b8aa8cdfd939570dc1cc3 Service-Type = Framed-User User-Name = "test.user" Framed-MTU = 1488 Called-Station-Id = "204E7FE98E93:test-int" Calling-Station-Id = "145A05C362D4" NAS-Identifier = "aptest03" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001501646f6d696e697175652e6d6f747a6574 NAS-IP-Address = 10.119.12.3 NAS-Port = 2 NAS-Port-Id = "STA port # 2" +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "test.user", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for dominique.motzet WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=test.user)) expand: dc=test,dc=local -> dc=test,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,dc=test,dc=local/Testing123 to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=test,dc=local, with filter (&(objectClass=sambaSamAccount)(!(shadowExpire=1))(uid=test.user)) rlm_ldap: checking if remote access for dominique.motzet is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{crypt}$1$cyxWDOrg$J0RAKfQ8wiqboGuKakbNx0" rlm_ldap: LDAP attribute sambaNtPassword as RADIUS attribute NT-Password == 0x3245453043333441393146393533443035414246463830413531433346433037 rlm_ldap: LDAP attribute sambaLmPassword as RADIUS attribute LM-Password == 0x4633413830383632323945384445453438314645364439304239333331374342 rlm_ldap: looking for reply items in directory... rlm_ldap: user test.user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [test.user/<no User-Password attribute>] (from client aptest03 port 2 cli 145A05C362D4) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test.user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Thx for help. MJ -- Adfinis SyGroup AG Mihajlo Joksimovic, System Engineer Güterstrasse 86 | CH-4053 Basel Tel. 061 333 80 33

4 19