April 2013 - Freeradius-Users - lists.freeradius.org

RADIUS shared secret over internet
by Muhammad Nuzaihan Kamal Luddin 09 Apr '13

09 Apr '13

Hi, I have read on the archives regarding the above issue and that the RADIUS shared secret is an obfuscation method of securing the communications between the NAS and RADIUS Server. One method i have read is by using IPSec but i am asking around if there are other ideas that i may not have thought of. Regards, Muhammad Nuzaihan Bin Kamal Luddin -- Taqi Systems 269-J Jalan Panji Kampung Chempaka, Kota Bharu, Kelantan 16100 pub 4096R/4C77F88C 2013-04-06 [expires: 2015-04-06] Key fingerprint = 2FE1 87FA E775 2E05 CC0F B3F6 3CB7 C65F 4C77 F88C uid Muhammad Nuzaihan Bin Kamal Luddin

2 1

perl examples
by Alex Sharaz 08 Apr '13

08 Apr '13

Hi, There don't seem to be many examples relating to using perl to access remote databases…. in fact there don't seem to be many perl examples at all. Got example.pl configured a wee bit and running on test server but could do with a better db related example. Unfortunately my perl skills aren't ts good as they could be. In post-auth I want to extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply Anyone got some form of template I could use for the above? Rgds Alex

4 10

rlm_sql - authenticatione vs authorization - update internal attribute within sql module
by duffy 08 Apr '13

08 Apr '13

hi list, i'm trying to set one custom attribute during rad_check to use it while selecting proper vsa in rad_reply. these are my 4 steps: 1) add custom attribute to the dictionary; 2) get it set by rad_check, if necessary; 3) modify dialup.conf to pass my custom attribute to rad_reply [using control variable?]; 4) check my custom attribute to choose reply vendor specific attributes; i would set this custom attribute by returning it from radcheck query but radreply query doesn't recognize it: where am i wrong? how can i update custom attribute within sql module? can anyone please help me? thanks, duffy ############ my dictionary $INCLUDE /usr/share/freeradius/dictionary VENDOR Me 35612 BEGIN-VENDOR Me ATTRIBUTE Service-Type 1 integer VALUE Service-Type Hotline 0 VALUE Service-Type DynamicUser 1 VALUE Service-Type StaticUser 2 ATTRIBUTE Hotlining-Enabled 2 integer VALUE Hotlining-Enabled False 0 VALUE Hotlining-Enabled True 1 ATTRIBUTE Hotlining-Class 3 integer VALUE Hotlining-Class User-New-Provisioning 0 VALUE Hotlining-Class User-Already-Connected 1 VALUE Hotlining-Class User-Not-Enabled 2 END-VENDOR Me ############ my radcheck stored procedure SELECT * INTO userinfo FROM users WHERE inner_id = ParmInnerId; hotlining = userinfo.hotline; IF userinfo.isactive = False THEN hotlining = TRUE; END IF; IF hotlining = TRUE THEN RETURN QUERY SELECT 0, ParmInnerId, 'Hotlining-Enabled'::varchar, ':='::char(2), 'True'::varchar; END IF; RETURN QUERY SELECT * FROM vsa_check WHERE inner_id = ParmInnerId ORDER BY id; RETURN; END ############ my dialup.conf ... authorize_reply_query="\ SELECT id, inner_id, attribute, val, op \ FROM radreply(\ '%{SQL-User-Name}@%{Realm}',\ '%{NAS-Ip-Address}'::inet, \ COALESCE(NULLIF('%{control:Hotlining-Enabled}', ''), 'FALSE')::boolean);" ... ############ my radiusd -X output ... rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, inner_id, attribute, val, op FROM radcheck( COALESCE(NULLIF('%{Event-Timestamp}', ''), '%S')::timestamp with time zone, '%{SQL-User-Name}', '%{Realm}', '%{Nas-Ip-Add ress}'::inet, '%{Calling-Station-Id}'::macaddr, parse_bssid(NULLIF('%{WiMAX-BS-Id}', '')), COALESCE(NULLIF('%{WiMAX-PDFID}', ''), '0')::smallint); -> SELECT id, inner_id, attribute, val, op FROM radcheck( COALESCE(NULLIF('Apr 4 2013 18:42:05 CEST', ''), '2013-04-04 18:42:42')::timestamp with time zone, 'test', 'freeradius', '192.168.98.101'::inet, '0C4C399C58F7'::macaddr, parse_bs sid(NULLIF('0x303030303230303630313030', '')), COALESCE(NULLIF('', ''), '0')::smallint);rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, inner_id, attribute, val, op FROM radreply( '%{SQL-User-Name}@%{Realm}', '%{NAS-Ip-Address}'::inet, COALESCE(NULLIF('%{control:Linkem-Hotlining-Enabled}', ''), 'FALSE'): :boolean); -> SELECT id, inner_id, attribute, val, op FROM radreply( 'test@freeradius', '192.168.98.101'::inet, COALESCE(NULLIF('', ''), 'FALSE')::boolean); ... ############# from my psql console csnrads=# SELECT id, inner_id, attribute, val, op FROM radcheck( COALESCE(NULLIF('Apr 4 2013 18:42:05 CEST', ''), '2013-04-04 18:42:42')::timestamp with time zone, 'test', 'freeradius', '192.168.98.101'::inet, '0C4C399C58F7'::macaddr, parse_bssid(NULLIF('0x303030303230303630313030', '')), COALESCE(NULLIF('', ''), '0')::smallint); id | inner_id | attribute | val | op --------+-----------------+--------------------------+--------+---- 0 | test@freeradius | Hotlining-Enabled | True | := 702095 | test@freeradius | Cleartext-Password | test01 | := 702096 | test@freeradius | Simultaneous-Use | 1 | := (3 rows) csnrads=# SELECT id, inner_id, attribute, val, op FROM radreply( 'test@freeradius', '192.168.98.101'::inet, COALESCE(NULLIF('True', ''), 'FALSE')::boolean); id | inner_id | attribute | val | op -----+-----------------+--------------------------+----------------------------------------------------------+---- 6 | test@freeradius | Hotline-Indicator | active | := 7 | test@freeradius | Hotline-Profile-Id | freeradius/hotprofile | := 11 | test@freeradius | Termination-Action | Radius-Request | := 35 | test@freeradius | Session-Timeout | 900 | := (4 rows)

1 0

session section is not working
by Mehdi Ravanbakhsh 07 Apr '13

07 Apr '13

Hi All my Session Section in site enable in not woking ! i do not have any log about that section in my radius.log file . Do you have any Ideas why?

2 2

Freeradius as DHCP server (static IP + some options)
by Leo Combes 05 Apr '13

05 Apr '13

Hello. I successfully run ISC-DHCP server for provisioning modems in an ISP's network, but what I wanted to try is something more modern and with database support. I want to try using Freeradius as DHCP server, but first I want to know if it is possible with these requirements: - Need to deliver fixed IP (or static) according to mac-address. - Need to provide, in addition to the IP, some DHCP options. Option 1 (Subnet mask), Option 3 (Routers), Option 6 (DNS server), Option 15 (Domainname), Option 18 (Extensions path), Option 66 (TFTP server name), Option120 (SIP Servers DHCP Option). - The IP and Options corresponding to each mac-address has to be stored in mysql. According dhcpdump, the dhcp client request looks like this: TIME: 2013-01-21 16:23:30.787 IP: 0.0.0.0 (0:13:96:0:f9:84) > 255.255.255.255 (ff:ff:ff:ff:ff:ff) OP: 1 (BOOTPREQUEST) HTYPE: 1 (Ethernet) HLEN: 6 HOPS: 0 XID: 8e22cb4d SECS: 0 FLAGS: 7f80 CIADDR: 0.0.0.0 YIADDR: 0.0.0.0 SIADDR: 0.0.0.0 GIADDR: 0.0.0.0 CHADDR: 00:13:96:00:f9:84:00:00:00:00:00:00:00:00:00:00 SNAME: . FNAME: . OPTION: 53 ( 1) DHCP message type 1 (DHCPDISCOVER) OPTION: 61 ( 8) Client-identifier 01:00:13:96:00:f9:84:00 OPTION: 51 ( 4) IP address leasetime -256 () OPTION: 51 ( 4) IP address leasetime -1 () OPTION: 55 ( 11) Parameter Request List 1 (Subnet mask) 3 (Routers) 6 (DNS server) 15 (Domainname) 18 (Extensions path) 66 (TFTP server name) 120 (SIP Servers DHCP Option) 135 (???) 213 (???) 214 (???) 215 (???) Freeradius 2.2.0 can provide this functionality just configuring it, or it would be necessary to use modules or developments that aren't available yet? Thanks in advance!

4 16

Problem with login in FR wiki
by Leo Combes 05 Apr '13

05 Apr '13

I'm trying to post on FR WIKI with an openID account, as I try to log in with my ID I get an "Authentication failed - Insufficient data from authentication provider, name not provided or empty" error. The same happens to me when I try to log in with my GitHub account. Somebody has an idea?

2 2

Groupname is not written in the table radacct
by Geovanny Varela 05 Apr '13

05 Apr '13

Hi. I need the groupname field radacct table is informed. Configured in Section Accounting_stat_query in File dialup.conf the groupname field and value '% {SQL-Group}' according to information obtained on the internet but got no success. I can appreciate a solution because of the success of my project depends on this configuration. Thank you. Greetings from Brazil

2 2

disconected after one second
by Łukasz Kopiszka 05 Apr '13

05 Apr '13

Hi, I have strange problem host can't receive IP becouse he get Acct-Status-Type = Stop Acct-Update-Reason = AAA_LOAD_ACCT_SESSION_DOWN after one second before: Acct-Status-Type = Start Acct-Update-Reason = AAA_LOAD_ACCT_SESSION_UP short log: Sending Access-Accept of id 126 to 91.231.70.5 port 1812 Service-Type = Outbound-User Framed-IP-Address == 91.231.71.17 Acct-Interim-Interval == 300 Service-Type == Outbound-User Connect-Info == "1" Port-Limit == 1 DHCP_Max_Leases == 1 Context-Name == "CLIPS" HTTP-Redirect-Profile-Name == "" Forward-Policy == "in:CLIPS-DEFAULT" QOS-Rate-Outbound == "20480" QOS-Rate-Inbound == "2048" Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 91.231.70.5 port 1812, id=223, length=385 User-Name = "00:17:08:2e:76:d2" Acct-Status-Type = Start Acct-Session-Id = "0100FFFF7800029F-515D7656" Service-Type = Outbound-User Acct-Update-Reason = AAA_LOAD_ACCT_SESSION_UP NAS-Identifier = "ALFASYSTEM" NAS-Port = 33619968 NAS-Real-Port = 553649127 NAS-Port-Type = Virtual NAS-Port-Id = "2/1 vlan-id 999 clips 131743" Medium-Type = DSL Mac-Addr = "00-17-08-2e-76-d2" Platform-Type = SE-100 OS-Version = "6.5.1.5" Acct-Authentic = RADIUS Port-Limit = 1 DHCP-Max-Leases = 1 Framed-IP-Address = 91.231.71.17 Source-Validation = Enabled DHCP-Option = "\014\014\004alfa" Acct-Interim-Interval = 600 Forward-Policy = "in:CLIPS-DEFAULT" QOS-Rate-Outbound = "20480:0:0" QOS-Rate-Inbound = "2048:0:0" Qos-Policing-Profile-Name = "customer-out" Qos-Metering-Profile-Name = "customer-in" Event-Timestamp = "Apr 4 2013 14:47:18 CEST" << start rad_recv: Accounting-Request packet from host 91.231.70.5 port 1812, id=224, length=603 User-Name = "00:17:08:2e:76:d2" Acct-Status-Type = Stop Acct-Session-Id = "0100FFFF7800029F-515D7656" Service-Type = Outbound-User Acct-Update-Reason = AAA_LOAD_ACCT_SESSION_DOWN NAS-Identifier = "ALFASYSTEM" NAS-Port = 33619968 NAS-Real-Port = 553649127 NAS-Port-Type = Virtual NAS-Port-Id = "2/1 vlan-id 999 clips 131743" Medium-Type = DSL Mac-Addr = "00-17-08-2e-76-d2" Platform-Type = SE-100 OS-Version = "6.5.1.5" Acct-Authentic = RADIUS Port-Limit = 1 DHCP-Max-Leases = 1 Framed-IP-Address = 91.231.71.17 Source-Validation = Enabled DHCP-Option = "\014\014\004alfa" Acct-Session-Time = 1 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets-64 = 0x0000000000000000 Acct-Output-Packets-64 = 0x0000000000000000 Acct-Input-Octets-64 = 0x0000000000000000 Acct-Output-Octets-64 = 0x0000000000000000 Acct-Mcast-In-Packets = 0 Acct-Mcast-Out-Packets = 0 Acct-Mcast-In-Octets = 0 Acct-Mcast-Out-Octets = 0 Acct-Mcast-In-Packets-64 = 0x0000000000000000 Acct-Mcast-Out-Packets-64 = 0x0000000000000000 Acct-Mcast-In-Octets-64 = 0x0000000000000000 Acct-Mcast-Out-Octets-64 = 0x0000000000000000 Acct-Interim-Interval = 600 Forward-Policy = "in:CLIPS-DEFAULT" QOS-Rate-Outbound = "20480:0:0" QOS-Rate-Inbound = "2048:0:0" Qos-Policing-Profile-Name = "customer-out" Qos-Metering-Profile-Name = "customer-in" Event-Timestamp = "Apr 4 2013 14:47:19 CEST" << stop after 1 second! full log: http://pastebin.com/HTYxdg1B Everything was working great until I change something but I don't remember what was it -- Pozdrawiam, Łukasz Kopiszka tel. 694-212-718 www.alfa-system.pl

3 5

freeradius 2.2 COA capability
by Mehdi Ravanbakhsh 05 Apr '13

05 Apr '13

hi all freeradius 2.2 can support COA (for something like changing bandwidth) or just can handel POD?

1 0

update coa not working
by Mehdi Ravanbakhsh 03 Apr '13

03 Apr '13

Hi all i configure all config file to use COA . i can use update disconnect and it work will in all section , but update coa is not working. i read all file for 10 times but can not find where is the problem. in log file i can not find any message that related to update COA in any section. my config file : * clent.conf : * client lar { ipaddr = 5.190.103.4 secret = testing123 require_message_authenticator = no nastype = other coa_server = lar } *coa-originate :* home_server lar { type = coa ipaddr = 5.190.103.4 port = 1700 secret = testing123 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool main { type = fail-over home_server = lar } server originate-coa.lar { pre-proxy { # update proxy-request { # NAS-IP-Address = 127.0.0.1 # } ok } # # Handle the responses here. # post-proxy { switch "%{proxy-reply:Packet-Type}" { case CoA-ACK { ok } case CoA-NAK { # the NAS didn't like the CoA request ok } case Disconnect-ACK { ok } case Disconnect-NAK { # the NAS didn't like the Disconnect request ok } # Invalid packet type. This shouldn't happen. case { fail } } # # These methods are run when there is NO response # to the request. # Post-Proxy-Type Fail-CoA { ok } Post-Proxy-Type Fail-Disconnect { ok } } } *default config :* preacct { update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Mikrotik-Rate-Limit = "256K/256K" } } -------------------

1 0