February 2013 - Freeradius-Users - lists.freeradius.org

Config question: substitute another attribute for username
by Adam Moffett 19 Feb '13

19 Feb '13

I have a wireless system that can talk to RADIUS to control access for the wireless stations. The AP is a NAS and the stations can be programmed with a username and password. The idea is you reply with VSA's that set up QoS policies for the clients. This is all working fine and dandy. What I'd like to do is actually ignore the username and password they're sedning and instead match a vendor specific attribute called DAN-CPE-MAC-ADDRESS. Alternately, they all come with a default username set in them. Will there be any harm if I make multiple users with the same name? "cpe1" DAN-CPE-MAC-ADDRESS := "0a:0b:0c:0d:0e:0f" "cpe1" DAN-CPE-MAC-ADDRESS := "01:02:03:04:05:06" etc etc.

2 2

User disconnects but stays online in radius
by Mobin Yazarlou 19 Feb '13

19 Feb '13

Hi, I am using freeradius v2.1.12 with MySQL support and noticed if a user disconnect when radius server is down, NAS can not inform radius about user being disconnected and radius assume user is still online after coming up again. This restricts user from connecting again when you set simultaneous-use to 1. Is there any solution for this? My NAS is pptpd on Debian 6. Thank you, Moby

4 17

EAP-TLS certificate problem
by Muhammad Nadeem 19 Feb '13

19 Feb '13

Hi, everybody I have used pre-shipped certificates of Freeradius for testing purpose. This testing was succeed with a test user 'bob', with files authentication. Now in the next step I wanna authenticate a user from my Database with Digital certificates. When i authenticate the user, server side confirm and send "Access-Accept" packet, but at client, following error occurs. " No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 02:00:00:00:00:01: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet" I googled this problem and found a solution that the user Auth-type is set to Accept (I manually checked the user in Database , and its Auth-Type was Accept) and this type prevent further process. Now my question is that , could I continue EAP-TLS authentication, regardless of Auth-Type is set to Accept??? Thanks in advance

4 5

Advice on where to look next...
by Johnson, Jeffrey 19 Feb '13

19 Feb '13

I've configured my server to successfully authenticate against AD using my ldap module. However, my users are in multiple OUs, and I can only specify one basedn at a time. I know that's probably not good directory structure, but I don't manage our directory. What approach to others use to search multiple basedns? In case it would help, here is the relevant portions from my ldap module, which is curently working (I've remved most comments to make it concise: ldap { server = xxx identity = "cn=ldapuser,ou=service accounts,dc=cphc,dc=local" password = xxx basedn = "dc=cphc,dc=local" ***This doesn't work without a specific OU. My users are in multiple OUs**** #basedn = "OU=CHA-Staff (No Folder Redir),DC=cphc,DC=local" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(member=%{check:Ldap-UserDn})" groupmembership_attribute = member #compare_check_items = yes #do_xlat = yes access_attr_used_for_allow = yes } *One thing that confuses me is that ldapsearch works fine using basedn="dc=cphc,dc=local". Any my error output: [ldap] performing user authorization for jpjohnson [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=jpjohnson) [ldap] expand: dc=cphc,dc=local -> dc=cphc,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to tch-nt2.cphc.local:389, authentication 0 rlm_ldap: bind as cn=ldapuser,ou=service accounts,dc=cphc,dc=local/xxx to tch-nt2.cphc.local:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=cphc,dc=local, with filter (sAMAccountName=jpjohnson) rlm_ldap: ldap_search() failed: Operations error [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail -Jeff

2 1

Passing regexps from SQL to unlang
by Maxim S. Denisov 19 Feb '13

19 Feb '13

Hello, I need to translate calling-station-id to E.164. NAS can send these numbers in several formats, for example number +74951234567 can come as 1234567, 04951234567 or 0074951234567. I think about adding a field in nas table and specify several regexps with delimiter. Can I fetch this field, parse it to several regexps and use them in unlang as regexps?

2 3

Need to change response type to Access-Challenge from rlm_perl
by Walter Goulet 18 Feb '13

18 Feb '13

Hi, Looking through archives for this exact question, I see a post from 2008 ( http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg47423.…) where this exact question was previously asked. Here is my server version info: radiusd: FreeRADIUS Version 2.2.0, for host x86_64-unknown-linux-gnu, built on Feb 17 2013 at 03:34:41 Here's my code: # Construct HTTP request my $authresult = &authamis($RAD_REQUEST{'User-Name'},$RAD_REQUEST{'User-Password'}); &radiusd::radlog(L_DBG, "Result after authamis call -> $authresult"); if($authresult eq "true") { $RAD_CHECK{'Response-Packet-Type'} = "Access-Challenge"; $RAD_REPLY{'Reply-Message'} = "authentication successful"; for (keys %RAD_REPLY) { &radiusd::radlog(L_DBG, "RAD_REPLY: $_ = $RAD_REPLY{$_}"); } for (keys %RAD_CHECK) { &radiusd::radlog(L_DBG, "RAD_CHECK: $_ = $RAD_CHECK{$_}"); } for (keys %RAD_CONFIG) { &radiusd::radlog(L_DBG, "RAD_CONFIG: $_ = $RAD_CONFIG{$_}"); } return RLM_MODULE_OK } else { $RAD_REPLY{'Reply-Message'} = "authentication failure"; return RLM_MODULE_REJECT; } Here is the relevant debug output: Found Auth-Type = perl # Executing group from file /opt/app/freeradius/etc/raddb/sites-enabled/default +- entering group perl {...} rlm_perl: RAD_REQUEST: User-Name = test rlm_perl: RAD_REQUEST: User-Password = 42594190 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.65.1 rlm_perl: AMIS request: http://amis.jdt.com:8080/auth/authenticate/test/42594190 rlm_perl: Result after authamis call -> true rlm_perl: RAD_REPLY: Reply-Message = authentication successful rlm_perl: RAD_CHECK: Response-Packet-Type = Access-Challenge rlm_perl: RAD_CHECK: Auth-Type = perl rlm_perl: RAD_CONFIG: Auth-Type = perl rlm_perl: Added pair User-Name = test rlm_perl: Added pair User-Password = 42594190 rlm_perl: Added pair NAS-IP-Address = 192.168.65.1 rlm_perl: Added pair Reply-Message = authentication successful rlm_perl: Added pair Response-Packet-Type = Access-Challenge rlm_perl: Added pair Auth-Type = perl ++[perl] returns ok # Executing section post-auth from file /opt/app/freeradius/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 81 to 192.168.65.1 port 53504 Reply-Message = "authentication successful" Finished request 0. Going to the next request Clearly the Access-Challenge setting is not being honored by the server. Is there another attribute that must be set to configure the response type? Thanks, Walter

1 1

Clients connecting without group
by Michell 18 Feb '13

18 Feb '13

Hello all, what would be the best way to not allow the user connection that does not have a group or have a group that does not exist? Should I create a policy or a check attributes. Does anyone have an example? I have the problem of authenticating customers without being group and navigating without bandwidth control, as this is defined by the groups in radius. This issue has already been addressed here, but still not getting success. http://freeradius.1045715.n5.nabble.com/Default-behavior-for-users-not-in-a… I appreciate everyone's attention, Michell Antunes

2 1

Re: Freeradius-Users Digest, Vol 94, Issue 49
by Mollatt Ntini 18 Feb '13

18 Feb '13

On 15-Feb-13 09:19, freeradius-users-request(a)lists.freeradius.org wrote: > [SNIP/] >> > I hope someone can point me in the right direction here. I am trying to >> > build FR version 2.1.12 with the option "--with-experimental-modules" on >> > Debian Linux Squeeze 2.6.32-5-amd64 because I need to build support for >> > Wimax stuff. However I get the following compiling error(s): >> > >> > checking openssl/hmac.h usability... no >> > checking openssl/hmac.h presence... no >> > checking for openssl/hmac.h... no >> > configure: WARNING: silently not building rlm_wimax. >> > configure: WARNING: FAILURE: rlm_wimax requires: openssl/hmac.h. >> > configure: creating ./config.status >> > config.status: creating Makefile > you dont have the required headers present to build the code. check you have the openssl > devel package installed.... libssl-dev IIRC ... and that was it. Thanks a lot again Alan. > Molla.

1 0

EAP-TLS problem
by Muhammad Nadeem 18 Feb '13

18 Feb '13

Hi, I am trying to understand EAP-TLS. I have googled a lot, and found many information about EAP-TLS. So I well aware of, how EAP-TLS works, its benefits etc etc. Now I want to practically test EAP-TLS with freeradius on REDHAT 5. I have configured eap.confg to use EAP-TLS. But i don't know , how to send requests to freeradius server, so that he can authenticate the user using TLS (with digital certificate). Can anyone help me, thanks in advance..

4 7

Design question - proxying RADIUS auth request to a backend webservice
by Walter Goulet 17 Feb '13

17 Feb '13

Hi, I'm looking for some input from the experts to help validate a solution approach that I've come up with. The problem I'm trying to solve is that allow NAS equipment and other RADIUS clients to authenticate users against a proprietary authentication service that uses REST APIs over HTTP. The solution that I've put together is to use rlm_perl which allows me to use standard Perl modules to interact with the authentication service. I'm pretty happy with the results so far in that I am able to build exactly what I need and authentication against the webservice works just fine. The question to the list, are there other solution approaches that might be better? Any significant disadvantages to using rlm_perl as I've described? Would it be better to write a custom module instead, hoping that by doing so there may be some performance improvements? Any input is greatly appreciated. Walter Goulet

5 6