September 2012 - Freeradius-Users - lists.freeradius.org

read ldap groups for a user not specified in User-Name
by David Aldwinckle 27 Sep '12

27 Sep '12

Hi list, I've been given a set of requirements and I am having a hard time wrapping my head around what needs to happen in order to make things work. Here is the scenario: 1. External to FreeRadius, a user can sponsor the creation of a guest account. The sponsor and guest accounts are in separate LDAP databases. 2. Normally, I just need to handle authentication for the guest accounts. That part is easy, I have PEAP configured with LDAP and NT hashes. 3. the special requirement is that IF the sponsor account gets locked (deleted, expired, etc), then the guest account can no longer login either. So, what I was thinking I could do was an LDAP group check on the sponsor userid (which would be put into a new attribute stored in the guest LDAP db), and then check the sponsors group memberships. The problem with that is that I don't know how to get FreeRadius to read the groups for an arbitrary user that is not %User-Name. Can I copy another variable into the User-Name attribute in Post-Auth, and then do the group check there? Any suggestions? Thanks, Dave

2 1

rlm_cache
by Franks Andy (RLZ) IT Systems Engineer 27 Sep '12

27 Sep '12

Hi All, I've looked around the internet a bit and obviously looked at the wiki page and configuration page for rlm_cache and can't quite understand how it works. Does anyone have any practical examples of simply storing an attribute/value pair or pairs and then check the value later in the processing? Thanks

2 1

suffix not work for me
by Tony Peña 27 Sep '12

27 Sep '12

hi again... i try to get suffix work but i guess missing something... here some debugs and confs rad_recv: Access-Request packet from host 10.10.64.67 port 16829, id=53, length=208 Framed-Protocol = PPP User-Name = "*usertest(a)my.domain.cu*" User-Password = "*secret*" NAS-Port-Type = Async Calling-Station-Id = "123456789" Called-Station-Id = "987654321" Connect-Info = "44000/28800 V90/V44/LAPM" Cisco-AVPair = "v92-info=V.92 QC/QC Short Train Success/0/0" NAS-Port = 443 NAS-Port-Id = "Async3/11*E1 7/0:7" Service-Type = Framed-User NAS-IP-Address = 10.10.64.67 # Executing section authorize from file /etc/freeradius/sites-available/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> *usertest(a)my.domain.cu* expand: %{tolower:%{User-Name}} -> *usertest(a)my.domain.cu* ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns ok *[suffix] No '@' in User-Name = "usertest", looking up realm NULL <---why not found '@' if is coming in radius packet and check in the conf???* [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for *usertest* [ldap] expand: %{Stripped-User-Name} -> *usertest* [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=* usertest*) *<---------- this works stripped-user-name OK* [ldap] expand: ou=group,ou=my,dc=domain,dc=cu -> ou=group,ou=my,dc=domain,dc=cu . *checking user/pass works fine... now check monthlycounter to compare hours..* . [monthlycounter1] sql_xlat [monthlycounter1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [monthlycounter1] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> *usertest* [monthlycounter1] sql_set_user escaped user --> '*usertest*' *IF stripped-user-name works here at monthlycounter why the query not use it! and use user with realm??/* [monthlycounter1] expand: SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000' -> SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000' rlm_sql (sql1): Reserving sql socket id: 4 [monthlycounter1] row[0] returned NULL rlm_sql (sql1): Released sql socket id: 4 [monthlycounter1] expand: %{sql1:SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000'} -> *rlm_sqlcounter: No integer found in string "" <------------- must be found integer to compare with max-monthly-session, in database i have only usernames, not with realms* +++[monthlycounter1] returns noop hints confs *DEFAULT Suffix == "@my.domain.cu", Strip-User-Name = Yes* Hint = "userdefault", Service-Type = Framed-User, Framed-Protocol = PPP, site-available/default # cat sites-available/default | egrep -v '\#|^$' authorize { preprocess filter_username *suffix* ldap redundant-load-balance { monthlycounter1 monthlycounter2 } checkval1 checkval2 checkval3 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique *suffix* } accounting { redundant-load-balance { sql1 sql2 } } session { load-balance { sql1 sql2 } } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } thanxs for any help. -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

4 10

Cloud Radius Server
by Michael Geary 27 Sep '12

27 Sep '12

Good Evening, We have several separate networks. Our main network runs PPPoE while all of the others run over DHCP. I would like to migrate the DHCP networks to use PPPoE. Currently, our Radius server resides at the head end of our PPPoE network. I would like to remove the chance that if the Internet failed there, that no one on the separate networks would be able to authenticate. Has anyone had any experience with using a Radius server in the cloud to authenticate users? Thank you very much, -- Michael Geary GAW High-Speed Internet 72 Shaker Rd. Enfield, CT 06082 www.GAW.com <http://www.gaw.com/> Office: 877.543.8429 Direct: 413.203.4911 Cell: 413.218.1446 Fax: 877.816.7068 netops(a)gaw.com -- “The information contained in this email message may be confidential. If you are not the intended recipient any use, distribution, disclosure or copying of this information is prohibited. If you receive this email in error, please tell us by return email and destroy this communication and any attachments from your system."

3 4

EAP-PSK : 16 bytes Pre shared key not configured
by Tatiana DIBANDA 27 Sep '12

27 Sep '12

Hi, I implemented the module eap2 to make freeradius with the eap_psk . After started the freeradius server (radius_output file attached to this mail), i launched my client openpana, the authentication failed and i have this error message "EAP-PSK : 16 bytes Preshared key not configured" (refer to openpana_client_output file attached to this mail) I would like to know how to configure the pre-shared key in my server? Thanks.

5 5

handling win domain name in username
by Crne We 27 Sep '12

27 Sep '12

Environmnet: Freeradius with PAP on Windows Username: domain\user1 password: ******* Looks like the Freeradius doesn't seem to like the windows domain name as part of username? Just plain username without a backslash works fine.

3 5

How to force users file parsing when returning proxied reply to add per-user AV-Pairs
by Gianni Costanzi 26 Sep '12

26 Sep '12

Hi, I've configured a freeradius server A (version 1.1.3) to proxy request for a specifix realm XYZ to another radius server B. Then, from the online docs, I understood that when A receives the reply from B it should go through its users file and if it finds a match it should add the specified AV-Pairs, like Service-Type (which is the one I need), to the reply it returns to the client that wants to authenticate a user: http://www.gnu.org/software/radius/manual/html_node/Proxy-Service.html#SEC16 Should it do this automatically or do I need to specify something in the realm definition? Second question: I've specified in the realm definition on radius A to remove the @XYZ suffix (strip) when it passes the request to radius B.. Then, when radius A looks into its own users file to append AV-Pairs to the answer, does it look for the stripped user or the user+realm? Thank you in advance for any help. PS: I know that this version may be old, but I can not easily update it at present time. -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi(a)gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------

2 3

Reporting from logs
by Leal, Paulo 26 Sep '12

26 Sep '12

Hi guys, We are new to eduroam and we are using FreeRadius for authentication and connection to national proxies. Just wondering what kind of reporting you have managed to get out from the FreeRadius logs, we wanted some user friendly reports with user numbers, success and failed attempts, what realms were used and numbers, even possibly bandwidth consumed per user. Daily, weekly and monthly reports. Would be grateful to find out what everyone is using to achieve this and if someone has some sample reports would be great. Cheers Paulo Paulo Leal Senior Network Analyst Enterprise Technology Services City University London Tel: 020 7040 8186 Got an IT problem? - please visit: www.city.ac.uk/itservicedesk<http://www.city.ac.uk/itservicedesk>

5 9

segmentation fault eap2 in freeradius
by arnauld ndefo 26 Sep '12

26 Sep '12

Hi, I tried to recompile freeradius raising option O2 in CFLAGS. I followed the following steps: . / configure - with-experimental-modules - with-rlm_eap2 Make.inc edit and remove 'O2' in CFLAGS make clean make make install My server started without error (radiusd_out file) When my openpana client sent an authenticator mesage ,I had a segmentation fault, and I always value optimized out in the gdb trace (gdb-radiuslog1). I don't understand why the different librairies related to the rlm_eap2 module in /usr/local/lib are not up to date when i rebuild the servers. The date still stay the old one. rwxr-xr-x 1 root root 44318 2012-09-18 04:31 rlm_eap2-2.2.0.so lrwxrwxrwx 1 root root 17 2012-09-18 04:31 rlm_eap2.so -> rlm_eap2-2.2.0.so -rwxr-xr-x 1 root root 872 2012-09-18 04:31 rlm_eap2.la -rw-r--r-- 1 root root 45698 2012-09-18 04:31 rlm_eap2.a lrwxrwxrwx 1 root root 11 2012-09-18 04:31 rlm_eap2-2.2.0.la -> rlm_eap2.la How can i resolve this issue? Thanks. PS: Freeradius commit 02567cf3c5aa758d7153c0bd7020e27a5067f7c3 Author: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Date: Tue Sep 18 14:15:14 2012 +0100

3 2

Dynamic realm+home_server_pool from LDAP/SQL
by Wilco Baan Hofman 25 Sep '12

25 Sep '12

Hi, I'm looking through the code and documentation of freeradius now to see if it is possible to use freeradius with a backend database for realms. For clients this can be fixed with dynamic clients and overwriting attributes.. but for realms this does not seem possible. Did I miss something? I'm looking to implement this if it's not there, in what way can I do this where my patches would be accepted (assuming clean code obviously)? Regards, Wilco Baan Hofman

3 4