January 2013 - Freeradius-Users - lists.freeradius.org

dialup.conf custom attributes failure in freeradius 2.2
by Miha Petkovsek 28 Jan '13

28 Jan '13

Hi, I need some help with inserting custom attributes to MySQL server. It seems that version 2.2 broke it, at least on my server… When I revert back to 2.1 it immediately starts to work with same config files. Below are config files and traces for both versions. Any idea? thanks, brm ---------------------- Relevant part of dialup.conf (modified to include custom attributes): accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ imsi, imei, ms_timezone, \ rat_type, user_location_info, realm, \ nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{3GPP-IMSI}', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', \ '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0')" Slightly modified dictionary.3gpp file to include custom attributes: # new attributes ATTRIBUTE 3GGP-IMEISV 20 string ATTRIBUTE 3GPP-RAT-type 21 byte ATTRIBUTE 3GPP-User-Location-Info 22 octets ATTRIBUTE 3GPP-MS-TimeZone 23 integer has_tag # set RAT-TYPE VALUE 3GPP-RAT-Type Reserved 0 VALUE 3GPP-RAT-Type UTRAN 1 VALUE 3GPP-RAT-Type GERAN 2 VALUE 3GPP-RAT-Type WLAN 3 VALUE 3GPP-RAT-Type GAN 4 VALUE 3GPP-RAT-Type HSPA-Evolution 5 VALUE 3GPP-RAT-Type IEEE-802-16e 101 VALUE 3GPP-RAT-Type 3GPP2-eHRPD 102 VALUE 3GPP-RAT-Type 3GPP2-HRPD 103 VALUE 3GPP-RAT-Type 3GPP2-1xRTT 104 VALUE 3GPP-RAT-Type 3GPP-EPS 105 This is the accounting start record from debug mode: rad_recv: Accounting-Request packet from host xxxxxxxx port 54002, id=50, length=375 Acct-Status-Type = Start Event-Timestamp = "Jan 26 2013 18:20:08 CET" Framed-IP-Address = xxxxxxx Called-Station-Id = "xxxxxx" Calling-Station-Id = "xxxxxxx" NAS-IP-Address = xxxxxxx NAS-Identifier = "xxxxxxx" Service-Type = Framed-User NAS-Port-Type = Virtual Acct-Session-Id = "5BB9DD25a7846fd9" 3GPP-IMSI = "xxxxxxx" 3GPP-IMSI-MCC-MNC = "xxxxxxx" 3GPP-NSAPI = "5" 3GGP-IMEISV = "xxxxxxx" 3GPP-RAT-type = UTRAN 3GPP-User-Location-Info = 0x0192f307000a79be 3GPP-Charging-ID = 2810474457 3GPP-PDP-Type = IP 3GPP-Selection-Mode = "0" Error on version 2.2: ... +- entering group accounting {...} [sql] expand: %{Calling-Station-Id} -> xxxxxxxx [sql] sql_set_user escaped user --> 'xxxxxxxxx' [sql] WARNING: Unknown module "3GPP-IMSI" in string expansion "%', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0')" [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('5BB9DD25a7846393', 'b158b29df3a9d9e4', 'xxxxxxxxx', ' rlm_sql_mysql: MYSQL check_error: 1064 received [sql] Couldn't insert SQL accounting START record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 Success on version 2.1: … +- entering group accounting {...} [sql] expand: %{Calling-Station-Id} -> XXXXXXXXXXX [sql] sql_set_user escaped user --> 'XXXXXXXXXXX' [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{3GPP-IMSI}', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NU [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, sgsnipaddress, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('5BB9DD25a7846fd9', '03de33c93bd3a02b', 'XXXXXXXXXXX', 'XXXXXXXXXXX', 'XXXXXXXXXXX', '0x04fc', 'UTRAN', '0x0192f307000a79be', '', 'XXXXXXXXXXX', '', 'Virtual', '2013-01-26 18:20:06', NULL, '0', '', '', '', '0', '0', 'XXXXXXXXXXX', 'XXXXXXXXXXX', '', 'Framed-User', 'GPRS-PDP-Context', 'XXXXXXXXXXX', '0', '0') rlm_sql (sql): Released sql socket id: 24 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> ++[attr_filter.accounting_response] returns noop Sending Accounting-Response of id 50 to XXXXXXXXXXX port 54002 Finished request 0.

4 6

move /etc/raddb/users file to mysql
by Stefan König 28 Jan '13

28 Jan '13

Hello List, I inherited an old freeradius 1.1.8 system which is configured to use a mysql DB. So far so good, but now I discovered, that someone also created a /etc/raddb/users file with some DEFAULT information in it. The funny thing is, that I have also some DEFAULT information in my DB in radgroupreply, which is where I think the data from the "users" file belongs. As far as I see in our config, the flat files have precedence over SQL. I am not very deep into freeradius, so I have some questions which I hope someone can answer: 1) Does the data from the "users" file go into radgroupreply table? 2) I have a DEFAULT groupname in the DB and in the flat file, will I have to rename the flat file DEFAULT groupname to something else to avoid problems? 3) "op" needs to be "=~" and ":=" for the first to settings and "==" for all the following? For your reference here is the anonymized content of my users file: DEFAULT User-Name =~"@example\.net$", Auth-Type := "Accept" Context-Name == local, Tunnel-Domain == 1, Tunnel-Type == L2TP, Tunnel-Medium-Type == IP, Tunnel-Client-Endpoint == xxx.xxx.xxx.xxx, Tunnel-Server-Endpoint == yyy.xxx.xxx.xxx, Tunnel-Password == password, Tunnel-Assignment-Id == zzz.xxx.xxx.xxx, Tunnel-Function == 1, Tunnel-Local-Name == EXAMPLE.NET Thanks for any help or hints! regards Stefan

2 1

Thoughts on a FreeRadius setup with OpenLDAP and Kerberos serving Windows and Ubuntu Clients
by Nicola Volpini 28 Jan '13

28 Jan '13

Hi everyone, I've been assigned the exciting task to setup a wired 802.1x environment to manage the access to our office infrastructure. I'm currently gathering all the possible informations to plan and deploy the solution since it's the first time I approach 802.1x and FreeRadius. I'm reading Freeradius beginner's guide by Dirk Van Der Walt and experimenting a bit with a freshly installed Ubuntu 12.04 freeradius server. Since I'm still in the planning phase I'd like to correctly understand which possibilities I have to deploy this of setup according to the needs of my company. This would be the list of requirements, my thoughts will follow: 1. user authentication and authorisation against our OpenLDAP directory, which is currently setup to store passwords with a SASL mechanism (the pass is hashed, and Apache Directory Studio shows the value of the UserPassword attribute of each user as "SASL hashed password". This note is important, see further on) 2. Switchport dynamic VLAN assignment on the Cisco Catalyst switches depending on the gidNumber of the user 3. Multiplatform support (Windows 7, Ubuntu 10.04, Ubuntu 12.04) 4. FreeRadius server certificate validation (no client certificates used) and 802.1x authentication by providing user/pass My concerns and thoughts, point by point: 1. From what I had the opportunity to read in the FreeRadius configuration files, using LDAP as a password store is not possible when having hashed passwords. Yet, when I test the password validation via radtest the software succeeds and gives me an accept-accept. Intentionally mistyping the pass gives a reject. What am I doing wrong? Is the radtest tool using some other mechanism then MSCHAPv2? 2. this appears to be fairly easy to achieve by configuring the users file with one line per LDAP group like "DEFAULT LdapGroup == xxx" to return the "Tunnel-private-group-ID [81]" VDA depending on the match... or maybe in some other place of the config via ulang? I still need to understand how it works 3. and 4. Both of these points, together with our infrastructure not being ready yet for client certificates validation, led me to the conclusion that PEAPv0/EAP-MSCHAPv2 could be the way to go... but point 1 would invalidate this assumption. Is my reasoning correct? I'm still at a very early stage of the planning and a bit confused. Thanks for your help! Nicola -- Nicola Volpini The information in this email is confidential and may be legally privileged. If you are not the intended recipient, you must not read, use or disseminate that information and upon reception, permanently delete the original and destroy any copies. Although this email and any attachments are believed to be free of any virus or any other defect which might affect any computer or IT system into which they are received and opened, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by Kambi for any loss or damage arising in any way from receipt or use thereof.

2 2

mac address format
by François Dagorn 28 Jan '13

28 Jan '13

Hello all, I'm running FreeRADIUS Version 2.1.5 (installed in 2009) configured to use Mac auth. Runs well indeed, but a brand new Cisco wireless controler is a bit disturbing i.e. Calling-Station mac address is not as usual. Following is my mac-authorized file : 062f68c7dcc2 Auth-type := Accept, User-Password == "062f68c7dcc2" ..... but now the stations controlled by the new Cisco appears as follows 06:2f:68:c7:dc:c2 So my first idea was to duplicate entries in the authorized file included within my conf, unfortunantely it does not run. So, is there a simple way to force radiusd to accept different mac address format ? Sorry if this is a FAQ, of course I've not changed anything within my conf since 2009 ! Any help would be appreciated. Cheers! -- François Dagorn Universite de Rennes France

4 3

upgrading freeradius
by Tzvika Gelber 28 Jan '13

28 Jan '13

I have a working server running on version 2.1.10 I just saw that there is version 2.2.0 and i would like to ask if an upgrade is a must and where can i fined the documentation about how to do such a thing? My FR us running on Ubuntu 12.04. Thank you -- ____ Sometimes you just glow in the dark...

5 6

Re: Quick question about RFC 3579 2.6.5
by Alan Buxey 26 Jan '13

26 Jan '13

Really? Hmm, the rest of eduroam are using operator-name. Will check about prevalence if the wispr attribute alan

2 1

Quick question about RFC 3579 2.6.5
by Olivier Beytrison 26 Jan '13

26 Jan '13

Hi, Well, RFC 3579 2.6.5 says : If EAP-Message, then there MUST not be a Reply-Message. I understand the point on this based on the RFC. In my case (remember the eduroam design thread from a while back), I have several "local" Radius which proxy all request to my central radius, which in turn perform the authn+z for the users, or forward the request to the top level radius if the user do not belong to our organization (eduroam stuff, nothing new so far). So, I would like, in case of Access-Reject of OUR users, logging in OUR schools, to send back a reply-message to the local radius in the outer reply, so the local admin know why its user has been rejected. This would be logged then stripped before the reply reach the NAS. If it's an external user in our network, or one of our users but in an external network, then I won't add the Reply-Message. Would this still be illegal and would I end in jail ? ;) Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

4 4

Terminate PEAP on freeradius then proxy MSCHAPv2 to NPS
by Bertalan Voros 25 Jan '13

25 Jan '13

Hello All, Could someone tell me if it is possible to terminate PEAP on a freeradius server then proxy the request to an NPS server using MSCHAPv2? Thenk you and best regards, Bertalan

5 9

None
by Alireza Goftari 25 Jan '13

25 Jan '13

Hi, I’m trying to deploy FreeRadius as an accounting solution in my network. my scenario is like this: [image attached] Fortigate Firewall is already integrated with Active Directory and may send authenticated requests to FreeRadius, which is as well integrated with Active Directory. The work to be done: 1. using NAS (Fortigate Firewall in this case) attributes to do the accounting; 2. Specifying special Active Directory groups in FreeRadius configuration to have Internet access. May you help me with the solution or at least give me some hints? Thanks, Alireza Goftari

2 1

HuntGroup in FR1
by Lorenzo Milesi 25 Jan '13

25 Jan '13

Hi. I need to give user specific limitation based on where they connect to. I.e. I have two nas where the user can roam to, but when he logs into hs A he gets Max-Daily-Session := 60, while on B has no daily limit. Based on research, this should be done with Huntgroup. Current wiki page [1] doesn't eplain very much... I appended maxxer NAS-IP-Address == 87.24.AA.BB to /etc/freeradius/huntgroups In radiusd.conf, preprocess section, I have huntgroups = ${confdir}/huntgroups Running freeradius -x I see it reads huntgroups file, but if I try logging in to the NAS at ip 87.24.AA.BB the user doesn't get any special property. (Sadly) I'm (still) using FreeRadius 1.1.x. What did I do wrong? thanks [1] http://wiki.freeradius.org/config/Huntgroups -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 3