January 2013 - Freeradius-Users - lists.freeradius.org

Re: No authenticate method (Auth-Type) found for the request
by Alan Buxey 18 Jan '13

18 Jan '13

...and then you did comment . And added more. It's open source and the documentation and Wikipedia is there for everyone.e to contribute. Don't like it? Feel free to show the world how you think it should look, or add the missing bits you have discovered. Unfortunately , what we get is people saying the docs are poor...that they found out how to do what they want...and never tell us. The next person who comes along then faces the same issue as the initial person was selfish. It's not a developer problem. alan

1 0

Re: Chap/Pap Authentication
by Alan Buxey 18 Jan '13

18 Jan '13

Forget the user-password. You are not using it, you are trying to kludge it. Just use the variable you have, or the facsimile you are making. This is freeradius, there are at least a dozen ways of doing what you want, Alan has given you a fine method alan

1 0

Chap/Pap Authentication
by Joseph Showalter 18 Jan '13

18 Jan '13

What we would like to do is this: Take this request: User-Name = "6064191111(a)evdo.myawi.net" CHAP-Password = 0x59db2896a9629a7a1296e8e3dc7751da58 NAS-IP-Address = 10.130.2.1 CHAP-Challenge = 0x022074534be2e8405c867f676b46b432 3GPP2-Attr-60 = 0x00000001 3GPP2-Attr-61 = 0x0106000000010209a0000029275c41 Message-Authenticator = 0x01f9054690c3a469fa1bf824dfba3bbe Proxy-State = 0x3136 And instead of using chap to authenticate the user, we take the 3GPP2-Attr-61, convert it to the password we want, set it into the cleartext-password, and have the sql module query the DB for that new password. Here is the perl code that we run prior to the pap module: $retattr .= "Cleartext-Password := $meid"; $retattr .= ", CHAP-Password :=\"\" , CHAP-Challenge :=\"\" "; $retattr .= ", Auth-Type := PAP "; We return the retattr to freeradius. Here is the output: Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 10.130.2.1 [preprocess] expand: %{NAS-IP-Address} -> 10.130.2.1 ++[preprocess] returns ok [evdoesn] expand: %{User-Name} -> 6064191111(a)evdo.myawi.net Exec-Program output: Cleartext-Password := 268435460102579521, CHAP-Password :="" , CHAP-Challenge :="" , Auth-Type := PAP Exec-Program-Wait: value-pairs: Cleartext-Password := 268435460102579521, CHAP-Password :="" , CHAP-Challenge :="" , Auth-Type := PAP Exec-Program: returned: 0 ++[evdoesn] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.55.42.32/auth-detail-20130118 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.55.42.32/auth-detail-20130118 [auth_log] expand: %t -> Fri Jan 18 11:06:43 2013 ++[auth_log] returns ok [sql] expand: %{User-Name} -> 6064191111(a)evdo.myawi.net [sql] sql_set_user escaped user --> '6064191111(a)evdo.myawi.net' rlm_sql (sql): Reserving sql socket id: 50 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='6064191111(a)evdo.myawi.net' rlm_sql_postgresql: query: SELECT GroupName FROM usergroup WHERE UserName='6064191111(a)evdo.myawi.net' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] User found in group evdo [sql] expand: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): Released sql socket id: 50 ++[sql] returns ok [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. CHAP-Password is incorrect. Failed to authenticate the user. Login incorrect: [6064191111(a)evdo.myawi.net/<CHAP-Password>] (from client radius08 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default -- regards, Joseph

2 5

Session time again
by Emmanuel BILLOT 18 Jan '13

18 Jan '13

Hi, I saw that interim-update was a partial report of what was done during the session, fixed on interval for not losing all data if connexion fail for accounting. Ok, but i knew there was regular re-auth session to keep the connexion alive, right ? If it is right, what could be the attribut to increase interval between two checks ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

Session-Timeout
by Emmanuel BILLOT 18 Jan '13

18 Jan '13

Hi, We want to "force" Session-Timeout for all our users. Authorization and authentication are made by LDAP. Is it possible to add Session-Timeout in a file or config file to apply it to all our users ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

Re: Session-Timeout
by Alan Buxey 18 Jan '13

18 Jan '13

Yes. You could do it simply with users file, use unlang in post-auth or add it to LDAP as 3 places to start with (just one way is enough!) And you'll need to ensure tour NAS kit follow/honours the value you provide. If you are proxying a la eduroam then the remote site providing the service will decide what to do. They may honour your value, they may filter it out or they may override it with their chosen value alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Send Access-Reject when user does not match any group?
by Bogdan Enache 18 Jan '13

18 Jan '13

Hi, Is there a way to configure FreeRadius 2.1.10 to send Access-Reject on users which don't match any of the defined groups? I tried with: DEFAULT Group-Name !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No and DEFAULT Group !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No as the last and only rule in "users" but it isn't working, freeradius still sends Access-Accept, even if the user does not match any groups. Thanks!

2 7

Question on attributes
by Tiago 17 Jan '13

17 Jan '13

Hello everyone, I'm struggling with something that should be simple to fix. I have a rp-pppoe NAS server here that correctly understand a few attributes (radreply) that come from freeradius 1.x (w/mysql database). Example: Download (for download rates) attribute Simple real example, from pppoe server: # cat /var/run/radattr.ppp479 .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Download 12000 Upload 3072 Its ok. However, when I change the auth target to redirect auth requests to my freeradius 2.x (using the same database as freeradius 1.x), I will get the customer authenticated perfectly, but: # cat /var/run/radattr.pppxxx .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Without Download/Upload attributes. Debugging my freeradius 2.x I get a few relevant lines: including dictionary file /etc/freeradius/dictionary (which contains the same attributes as freeradius 1.x, including Download/Upload) .... few sql lines here... [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lokan' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lokan' ORDER BY id .... few other SQL lines here rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "852236" [pap] Using clear text password "852236" [pap] User authenticated successfully ++[pap] returns ok Login OK: [lokan/852236] (from client pppoe01 port 110 cli 52:E6:FC:9C:54:E7) # +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 192 to NASPPPOE01 port 48956 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cliente = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Framed-MTU = 1500 WISPr-Bandwidth-Max-Down = 256000 WISPr-Bandwidth-Max-Up = 256000 Finished request 0. Going to the next request What I'm missing? it seems like the attributes are not being sent to NAS, but I could be wrong. Thanks in advance for any help.

3 9

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Ajay Garg 17 Jan '13

17 Jan '13

I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? On Mon, Jan 7, 2013 at 11:35 AM, Ajay Garg <ajaygargnsit(a)gmail.com> wrote: > > > On Sun, Jan 6, 2013 at 8:00 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> Ajay Garg wrote: >> > I just realised that I can put the issue in a simpler realm (not >> > requiring any externally written client-code files ) :: >> > >> > I am unable to get "TLS-authentication" working, when a >> > "Fedora-17-client" tries to connect to a "WPA/WPA2-Enterprise network" >> > through "gnome-shell-applet", via Freeradius-running-on-Fedora-17". >> >> Look at the debug logs on the server. And on the client. Without >> that, your message is content-free. >> > > > Thanks Alan for the reply. > > a) > Alan, I am attaching the logs of "sudo /usr/sbin/radiusd -X". > These logs show failure-decryption errors. > > b) > Also, I tried taking up the "/var/log/messages" for only the > trying-to-connect duration (via "sudo rm /var/log/messages"; "sudo touch > /var/log/messages"), but the file then showed empty :( Please let me > know if this is indeed required; if yes, I will post this file too. > > c) > Also, I am attaching a snapshot of the settings entered for connecting to > the network. > > > > >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > -- > Regards, > Ajay > -- Regards, Ajay

5 30

Use of %{Framed-IP-Address} in dialup.conf
by Örn Arnarson 16 Jan '13

16 Jan '13

I'm logging into MySQL via post_auth_query = SQL query. I've added some fields that I want to log, such as the allocated IP address, the NAS IP address and the Calling-Station-ID. All fields are logging fine except for Framed-IP-Address which just seems to be absent. Is that variable not supposed to be accessible at that point? Here's an example entry from radreply, showing that I am indeed using Framed-IP-Address: +-----+---------------------+-------------------+----+--------------+ | id | username | attribute | op | value | +-----+---------------------+-------------------+----+--------------+ | 1 | username(a)host.com | Framed-IP-Address | := | 10.10.10.10 | Here's what I have in dialup.conf: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, response, nas, location, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{Framed-IP-Address}', \ '%{NAS-IP-Address}', \ '%{Calling-Station-ID}', '%S')" Is there anything obvious that I'm missing? Any suggestions on where to look for problems? Best regards, Örn

3 5