April 2013 - Freeradius-Users - lists.freeradius.org

Adding variable to logs
by Nick Khamis 01 May '13

01 May '13

Hello Everyone, We are using freeradius for accounting purposes. When trying to add a new variable to the logs (e.g., NAS-PORT-TYPE) what is required to be modified on the client. We are using radiusclient-ng. In the default dictionary: ATTRIBUTE NAS-Port-Type 61 integer VALUE NAS-Port-Type Async 0 VALUE NAS-Port-Type Sync 1 VALUE NAS-Port-Type ISDN 2 VALUE NAS-Port-Type ISDN-V120 3 VALUE NAS-Port-Type ISDN-V110 4 However, NAS-Port-Type is not being included in the logs, Tue Apr 30 05:50:08 2013 Acct-Status-Type = Start Service-Type = SIP Sip-Response-Code = 200 Sip-Method = Invite Event-Timestamp = "Apr 30 2013 05:50:08 EDT" Sip-From-Tag = "3B7C575D-E798317A" Sip-To-Tag = "as183d6189" Acct-Session-Id = "b7c2af61-2d1b4daf-e558033c(a)192.168.2.11" User-Name = "1001(a)example.server.com" NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "f538381d8187adf7" Timestamp = 1367315408 Is NAS-PORT-TYPE not being included in the log because it's null? Please excuse the noob question. Kind Regards, Nick

3 12

SQL and Huntgroups
by gregoire.leroy＠retenodus.net 01 May '13

01 May '13

Hello, I'm translating a flat file configuration into a MySQL configuration, but I have some difficulties with huntgroups. An example of what I have in my flat file : 21 example@domain>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Cleartext-Password := "password" 22 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Service-Type = Framed-User, 23 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Framed-Protocol = PPP, 24 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Type = L2TP, 25 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Medium-Type = IP, 26 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Assignment-ID = "RAN.DOM.I.P", 27 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Server-Endpoint = "RAN.DOM.I.P", 28 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Client-Auth-ID = "auth_id", 29 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Password = "password_tunnel", 30 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Fall-Through = Yes 31 32 example@domain>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Cleartext-Password := "password", Huntgroup-Name == "one_huntgroup_name" 33 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Framed-IP-Address = STAT.IC.I.P So, if the request doesn't have the huntgroup set, only the first part is applied. Else, both are applied. In SQL, I'm going to create a group "example_users", with all the common data (line 22 to 30), an user "example@domain" who belongs to "example_users". I'm going to create an entry in radhuntgroup, with my "one_huntgroup_name" and the IP of my NAS. Now, I see one problem : how can I differenciate when a request has the user/pass/huntgroup and when it has only the user/pass ? I suppose that create 3 entries in readcheck won't work because it seems awkward. ( example@domain | Cleartext-Password | password | =: example@domain | Huntgroup-Name | one_huntgroup_name | == example@domain | Cleartext-Password | password | =: ) Does someone know a solution to this problem ? Thank you, Regards, Grégoire

5 17

rlm_ippool vs rlm_sqlippool
by George Chelidze 01 May '13

01 May '13

Greetings, We use rlm_ippool for pool management. Each pool is configured with 16K addresses. About 10K are used in the peek time (per pool). I believe we have almost reached our IO capacity, because heavy IO operations like gzipping a 300M file cause freeradius to throw errors like: Error: Discarding duplicate request from client C port 65038 - ID: 109 due to unfinished request 34797335 Error: Discarding duplicate request from client C port 65035 - ID: 98 due to unfinished request 34797336 and a bit later: Error: WARNING: Unresponsive child for request 34797366, in component post-auth module ippool-A Error: WARNING: Unresponsive child for request 34797382, in component post-auth module ippool-A Will it make any sense to switch to rlm_sqlippool? Will it be less IO sensitive? I know it's worth a try, however any additional information would be helpful. Thank you in advance, -- George Chelidze

3 4

Radius Server Segmentation Fault
by Mitch Yackobeck 30 Apr '13

30 Apr '13

2 2

Digest using an external database for the Password
by Mike Brennan 30 Apr '13

30 Apr '13

Hi I am running version 2.1.12. I want to use FreeRadius in the following way: - Use Digest Authentication - The password is stored in an external database (it has a complicated schema) that I am connecting to via sql.conf. - I want to extract the password from this database so that it can be used in Digest Authentication (SIP – using RFC 4590) Now I have tested FreeRadius with the radclient using digest authentication by placing the Cleartext-Password in the users file – this worked. Is it possible to get the Cleartext-Password (or is it the User-Password) from my external database through authorize_check_query ? If so, how do I assign this attribute to the value returned in my query? I can’t store any information in my external database as I am not allowed to create any tables The following query would return the password – can I use it in authorize_check_query? authorize_check_query="SELECT password FROM fusion.cdm_credentials WHERE person_id=(SELECT person_id FROM fusion.cdm_person WHERE user_name='%{User-Name}');" As you can see in the query I have to use password as it is a column entry in my database There is a similar mechanism for LDAP where you can use the passsword_attribute Or am I totally off track? Thx Mike -------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Thrupoint, Inc. nXaR2cC3

3 10

pptpd+freeradius+ldap: which password encryption can I use?
by Alberto Aldrigo 30 Apr '13

30 Apr '13

Hi Everybody, I'm trying to setup a PPTPD server which would authenticate users using my openLDAP user database, in doing so I need freeradius. By now the only setup that actually works is: users in LDAP with clear text password. Obviously I want to use some kind of encryption for passwords and I don't like the solution of using cleartext passwords and the use of a specific user allowed to access to the password attribute, so my question is: which other possibilities I have? Looking to this table http://deployingradius.com/documents/protocols/compatibility.html I understand that I can use pap + sha1 but I can't understand how. Can anyone help me understand what is possible and what not? Many thanks Alberto

3 2

EAP-AKA testing without HLR/HSS
by antoni milton 30 Apr '13

30 Apr '13

Hi, Please let me know , if its possible to test EAP-AKA authentication without HLR/HSS using freeradius. i.e can freeradius gernarte the quients from given RAND, Key value ?. if yes means , where can get the code for this algorithm? Thanks Antoni Milton.

3 4

Session-Timeout
by David Peterson 30 Apr '13

30 Apr '13

3 4

Grab request password with ASCII character
by Mehdi Ravanbakhsh 30 Apr '13

30 Apr '13

Hi Alll i need to Grab request password to insert in database if Cleartext-Password is "import" so i write this unlang script in authenticate section : Auth-Type PAP { pap { reject = 1 } if (reject) { if ("%{control:Cleartext-Password}"=="import" ) { ok update control { password-import = "%{sql:SELECT change_impoprt_password ('%{User-Name}'::varchar,'%{User-Password}'::varchar)}" Log-State := "New Password Is Imported" } } else { if (("%{control:Bad-Password-Pool}") && ("%{control:Bad-Password-Pool}" != "" ) ) { ok update control { Auth-Type := "Accept" Pool-Name := "%{control:Bad-Password-Pool}" Log-State := "PAP Password Is Not Correct" } update reply { Reply-Message = "Your Password in not correct in system" } } else { update control { Log-State := "PAP Password Is Not Correct - Reject" Auth-Type := "Reject" } update reply { Reply-Message := "Your Password in not correct in system" } } } ok } } but if user use symbols like ! @#& or any character that is based on ASCII character i can not get real password character for example : import password is : "test!@#" request:user-password is : "test=21@=23" do we have any way to get or convert request:user-password to none ASCII .

3 4

Re: How to fix the proxy source port
by Okis Chuang 30 Apr '13

30 Apr '13

> Chuang Okis wrote: > > I think you misunderstanding my point a bit. Maybe I don't express it clear > enough. > > I only need fixing my *source port* instead of random port, I don't care IP > address at all. > > Ah, OK. > > > Actually, due to some maintenance issue, we want to know that could we fix > our arc port while our freeRADIUS AS A ROAMING CENTER. We are trying > reducing the number of firewall logs. That's why we want to keep src port the > same. > > No there's no way to fix the source port. > > Even if you did, the server would dynamically open *new* source ports > when it gets busy. That's how UDP applications work. > Ok, now I've saved lots of time finding any possible way to do this. Thanks for being so concise about this issue. > It should be OK to have a firewall rule which allows packets FROM the > proxy IP, TO the home server IP and home server port. Adding the source > port is pretty much pointless. > > Alan DeKok. > Hmm. That sounds making sense. I'll discuss with our firewall policy manager about it. However, thank you very much Alan. Okis.

1 0