November 2013 - Freeradius-Users - lists.freeradius.org

SERVICE PROVISIONING USING AAA
by Russell Mike 08 Nov '13

08 Nov '13

Dear Community i need help, i do work with an ISP has wireless network across the country build up using more than 5000 wireless devices using Motorola/Cambium Canopy microwave radios. Currently, if a customer did not pay the subscription until the last day of the month. A agent from customer support department disconnect the customer manually by disabling SM's (subscriber Module) interface. 1.) i have been requested to come up with some kind of solution where this must happen automatically (connection/disconnection). because we have grow enough and it is actually difficult to handle this manually. if [[ disconnection]]; then customer should be redirected to a static web page, where he is told the reason of disconnection that his subscription has expired. 2.) i did research about it and came up with the solution to setup Freeradius v2.2.0. 3.) FR has been configure properly, i have tested with Cisco & Chilli NAS using MySQL Database users. AAA functionality works as expected, Max-All-Sessions, Session-Timeout etc.. etc.. etc.. WORKS !! 4.) i know Cambium AP can also act as NAS and support EAP method as well. But i am unable to understand the logic that how it can archive the above mentioned requirement - PROVISIONING SERVICE USING AAA 5.) i have also setup open-ldap servers as replication model on *CentOS 6x, UB 12.4LTS & FreeBSD Unix*, because i learnt that these are the components are the answer to our requirements. But i am not so much clear how LDAP can be used to authenticate SM's. i have little idea from my research that i can use Session-Timeout attribute so that SM needs to authenticate everyday. This is here the confusion is. i can figure out using MSSQL query from our CRM database that who has not paid. But what should happen if customer did not paid? user should be deleted from LDAP? so that SM is unable to authenticate by FR ? Am i correct that LDAP can be used in such scenario ? i know many admins are using such techniques. Thats why seeking help & their advice. if someone has little time just to help me understanding how to put components together, will very very grateful. all component has been setup but could not understand how it would work together. Thanks / RM--

2 1

Per nas simultaneous-use limit
by ST Wong (ITSC) 08 Nov '13

08 Nov '13

Hi all, We want to per user limit login to 4 for particular NAS. I added following in users: DEFAULT Huntgroup-Name == "broadband", Simultaneous-Use := 4 Fall-Through = Yes And in huntgroups: broadband NAS-IP-Address == 192.168.192.201 broadband NAS-IP-Address == 192.168.192.204 Is seems the limit of 4 is for all users in the same NAS instead of particular users. We're using 2.2.0. Would anyone advise? Thanks lot. Rgds, /st

2 2

Re: eapol_test for EAP testing
by Stefan Winter 08 Nov '13

08 Nov '13

Hi, replying to this on -users. This is not a development question. > [eap] EAP NAK > [eap] NAK asked for unsupported type EAP-TTLS > [eap] No common EAP types found. Reading this in your debug output would have helped. You did not configure FreeRADIUS for EAP-TTLS - but that's the only thing eapol_test was told to use. FR's default_eap_type is also EAP-MD5, which is not what you want. Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

1 0

Re: chain certificate problem
by Theral Mackey 07 Nov '13

07 Nov '13

>> Concatenate your root and intermediates and use those. Beware of using a cert dir and the CA path as if done incorrectly then >someone could authenticate just by having a cert signed with the same root CA as your RADIUS server >> >> alan >> >Thank you for your answer, but it doesn't work. I don't see where you can declarate this certificate. >There is field CAfile, but it is related to the authentication of the client (EAP-TLS). Furthermore, if I use this field with all the >certificates concatenated, freeradius complains it is not readable. > >My question is: is it a way to deal with a chain other than load the full chain in the client ? This is really more of a general SSL question. The client will need to be able to somehow follow the cert chain from the cert back through the intermediaries to the CA. The easiest way is to concat them all into one file, in order (shouldn't matter but some programs are picky). When doing a cert concat, make sure you *ONLY* concat the cert itself, not the text info that is in some certs. Remove anything that is not between the -----BEGIN CERTIFICATE------ and -----END CERTIFICATE----- lines (the BEGIN and END lines themselves DO need to be in the result though), openssl will sometimes dump the cert info as text above the BEGIN line. Your eap.conf should have CA_file and certificate_file set to tell radius which ones to use for eap. -T

1 0

can't find new custom module (shared library object file)
by Bill Schoolfield 07 Nov '13

07 Nov '13

I built a customized version of the rlm_detail module. It was compiled externally against a version of freeradius built from source. The version I'm using is 2.1.12 as this version matches that of the installed YUM package for centos 6.x. On another centos host (same version, 64 bit etc), I installed the packaged version of FR (via yum). Then I copied the rlm_billmax.so to /usr/lib64/freeradius, placed the billmax configure file in the modules directory and added the billmax directive to the default site file (accounting section) and yet freeradius fails to load/find the library file. I have checked the file permissions so that isn't it. What am I missing? Here is the last part of the radiusd -X log: > Wed Nov 6 21:04:26 2013 : Debug: Module: Linked to module rlm_acct_unique > Wed Nov 6 21:04:26 2013 : Debug: Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique > Wed Nov 6 21:04:26 2013 : Debug: acct_unique { > Wed Nov 6 21:04:26 2013 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" > Wed Nov 6 21:04:26 2013 : Debug: } > Wed Nov 6 21:04:26 2013 : Debug: (Loaded rlm_files, checking if it's valid) > Wed Nov 6 21:04:26 2013 : Debug: Module: Linked to module rlm_files > Wed Nov 6 21:04:26 2013 : Debug: Module: Instantiating module "files" from file /etc/raddb/modules/files > Wed Nov 6 21:04:26 2013 : Debug: files { > Wed Nov 6 21:04:26 2013 : Debug: usersfile = "/etc/raddb/users" > Wed Nov 6 21:04:26 2013 : Debug: acctusersfile = "/etc/raddb/acct_users" > Wed Nov 6 21:04:26 2013 : Debug: preproxy_usersfile = "/etc/raddb/preproxy_users" > Wed Nov 6 21:04:26 2013 : Debug: compat = "no" > Wed Nov 6 21:04:26 2013 : Debug: } > Wed Nov 6 21:04:26 2013 : Debug: Module: Checking accounting {...} for more modules to load > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/modules/billmax[7]: Failed to link to module 'rlm_billmax': file not found > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/sites-enabled/default[384]: Failed to load module "billmax". > Wed Nov 6 21:04:26 2013 : Error: /etc/raddb/sites-enabled/default[378]: Errors parsing accounting section. The file: > [root@ip-10-0-0-65 freeradius]# ls -l /usr/lib64/freeradius/rlm_billmax.so > -rwxr-xr-x 1 root root 20193 Nov 6 20:55 /usr/lib64/freeradius/rlm_billmax.so Bill

5 12

question about radsec and FR3
by Alex Sharaz 07 Nov '13

07 Nov '13

Hi, Quick question about setting up radsec and FR3. When I was playing with RADSEC and Radiator, a permanent link was established between two radsec endpoints ( had radsec/ipv4 -> Ubuntu VM out in the cloud and then radsec/ipv6 -> Radiator on OS X machine at home). Should FR do this as well, or does it just establish a connection whenever it needs one? Had some sort of success with radsecproxy and FR3 but then FR3 complained about exceeding max client connections (>16) Rgds Alex

3 4

mschap passchange in Freeradius 3
by Davide Garofalo 07 Nov '13

07 Nov '13

Hi all, passchange works very fine, but in windows 7, if the user inserts an incorrect password it will promped the message "password incorrect". At this point if the user insert the correct password, in the radius log i've always this error: 9) mschap : Program returned code (1): Logon failure (0xc000006d) (9) mschap : External script failed (9) ERROR: mschap : External script says: Logon failure (0xc000006d) (9) mschap : FAILED: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject (9) MSCHAP-Error: �E=691 R=1j? Could not parse new challenge from MS-CHAP-Error: 2 MSCHAP Failure -- *Davide Garofalo*

3 7

Realm
by Wederson Rodrigues 07 Nov '13

07 Nov '13

Hi guys, I need to release the authentication (no username and password) for certain realm (anything @ domain1 connect with any username and password. domain2 users continue normally. Is it possible? -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

1 0

DHCP from LDAP
by Zeus Panchenko 07 Nov '13

07 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, is there way to serve DHCP queries from an LDAP database? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlJ7ZGAACgkQr3jpPg/3oyp1eQCgjWs5GG2sZvlxmi030iDQUBrz TNkAn04HnDnfZuYnUixieYnENY87+gsq =Kffc -----END PGP SIGNATURE-----

2 1

Radclient COA - sending Cisco non-AVpair attributes
by Steve Schubert 06 Nov '13

06 Nov '13

Hi, I'm trying to do an account-logon to a cisco ISG (aka NAS). I've created a file to carry the attributes. The file looks like this.. User-Name += "jane" Service-Type = Outbound-User cisco-command-code=01 cisco-avpair = "ssg-account-info=S10.174.168.2:294", Here's the command I sent. Radclient x f /home/admin/coa_file 10.172.168.6:3799 coa testing123 The debug from radclient doesn't show any errors. It shows Cisco-Command-Code = "01" Here's the debug from the cisco router. Nov 6 22:40:03.489: RADIUS/DECODE: Reply-Message fragments, 13, total 13 bytes Nov 6 22:43:43.542: RADIUS: COA received from id 164 10.194.170.150:43374, CoA Request, len 84 Nov 6 22:43:43.542: RADIUS/ENCODE(00000000):Orig. component type = Invalid Nov 6 22:43:43.542: RADIUS/ENCODE: Skip encoding 0 length AAA attribute formatted-clid Nov 6 22:43:43.543: RADIUS(00000000): sending Nov 6 22:43:43.543: RADIUS(00000000): Send CoA Nack Response to 10.194.170.150:43374 id 164, len 120 Nov 6 22:43:43.543: RADIUS: authenticator 00 37 CB 5E 01 05 D8 08 - 3F 8F EA 3D 09 88 E4 8F Nov 6 22:43:43.543: RADIUS: User-Name [1] 6 "jane" Nov 6 22:43:43.543: RADIUS: Service-Type [6] 6 Outbound [5] Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 29 Nov 6 22:43:43.543: RADIUS: Cisco AVpair [1] 23 "service-type=Outbound" Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 10 Nov 6 22:43:43.543: RADIUS: ssg-command-code [252] 4 Nov 6 22:43:43.543: RADIUS: 30 31 [Unknown 01] Nov 6 22:43:43.543: RADIUS: Vendor, Cisco [26] 25 Nov 6 22:43:43.543: RADIUS: ssg-account-info [250] 19 "S10.174.168.2:294" Nov 6 22:43:43.543: RADIUS: Reply-Message [18] 18 Nov 6 22:43:43.543: RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] Nov 6 22:43:43.543: RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405] As you can see it's translating the command code from decimal to hex. How do I specify the command code to be hex? (I've tried 0x01 but again it converts the ascii to hex) Also, is there documentation that explains the syntax to be used in the attribute file? Thanks, Steve

2 1