May 2013 - Freeradius-Users - lists.freeradius.org

RE: Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 13 May '13

13 May '13

Hi, The upgraded freeradius works fine, no surprise there I guess. Can't get any updated control, reply or whatever attributes to pass back to the default virtual server from the tunnel though, try as I might. Perhaps it's something to do with it being PEAP? I tried the authorize section and post auth section, but it never makes it through. It's not really critical at this point, just annoying me. I'm sure it's something I need to do differently but I'm not sure what. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 11 May 2013 14:26 To: FreeRadius users mailing list Subject: Re: Inner tunnel post auth question Franks Andy (RLZ) IT Systems Engineer wrote: > My FR version is 2.1.10+dfsg-3build2_amd64. Unless there’s a nice > package for Ubuntu 12.04 server then I’ll be compiling from source then > I think. Yes. Upgrading would be good. > so yes, the “use_tunneled reply” bit is there. Is that what’s causing > the copying of attributes from within the tunnel to fail, or is that > setting what it’s supposed to be? The "use_tunneled_reply" configuration only works for Access-Accept. > I’m still getting my head around the > eap thing – like for example why I need authorization and authentication > settings in the inner-tunnel virtual server for eap again – my intuition > would tell me that the inner eap just needs mschap in there if that’s > the protocol inside the tunnel, but then perhaps it’s something to do > with the “protection” bit of peap that means it’s a “tunnel within a > tunnel” or something. Like I said still getting my head around it all. You need "eap" in the inner-tunnel because PEAP sends EAP in the inner-tunnel. > I’d still like to get the attributes copying from the inner to outer > tunnels regardless of the fix in 2.2. It’s gnawing at me a bit. Well... if you want a feature from a later version of the server, upgrade. You can't magically create a feature without code changes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FreeRadius Wimax-TLV with external program
by Ali Majdzadeh 12 May '13

12 May '13

Hi I’m using freeradius 2.1.12 with external program for authentication (Written in C), so I’m sending radius attributes in Access-Accept by printf. How can I send Wimax-TLV? May someone give me a sample? *Ali Majdzadeh Kohbanani* *Managing Director* *Abshar Data Processing* *Tel:+982144160700 * * Tel/Fax: +982144160701 * *Cell:+989123614728* *majdzadeh(a)abshar.biz * *http://www.abshar.biz*

2 1

RE: Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 11 May '13

11 May '13

My FR version is 2.1.10+dfsg-3build2_amd64. Unless there's a nice package for Ubuntu 12.04 server then I'll be compiling from source then I think. This is the peap bit of eap.conf : peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" so yes, the "use_tunneled reply" bit is there. Is that what's causing the copying of attributes from within the tunnel to fail, or is that setting what it's supposed to be? I'm still getting my head around the eap thing - like for example why I need authorization and authentication settings in the inner-tunnel virtual server for eap again - my intuition would tell me that the inner eap just needs mschap in there if that's the protocol inside the tunnel, but then perhaps it's something to do with the "protection" bit of peap that means it's a "tunnel within a tunnel" or something. Like I said still getting my head around it all. I'd still like to get the attributes copying from the inner to outer tunnels regardless of the fix in 2.2. It's gnawing at me a bit. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alex Sharaz Sent: 10 May 2013 14:09 To: FreeRadius users mailing list Subject: Re: Inner tunnel post auth question Andy, What version of FreeRadius are you using? I *think* that unless you are using the git source for 2.2.1, post-auth reject is broken. There was some stuff I was doing a few months ago that got fixed in 2.2.1 ... but I'm getting old and can't remember all the details :-( On 10 May 2013, at 13:53, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: Hi, This may have come up before but I can't find any solutions : I'm using a NAS which always performs EAP/MSCHAP2 authentication, so I've stripped the sites-enabled/default right down to pretty much just include the eap stuff for authorisation/authentication, and am doing all the rest inside the inner tunnel - fine. When the radius returns an access-accept, it runs the stuff in the inner-tunnel post_auth section ok, and I can record the attributes I want to a mysql db, including a custom ldap attribute inserted into a control variable. However it seems that following a reject, the post_auth reject section of inner-tunnel isn't actually used, so it doesn't record any info about the attributes in the sql database if I use an sql call. Ok .. so do it in the default post_auth reject bit - ok but I can't figure how to pass back control variables to the outer tunnel. I'd imagine it should be similar to the description in the post auth reject section of the inner tunnel : update outer.reply { User-Name = "%{request:User-Name}" } have u got use_tunneled_reply = yes set up in eap.conf? Rgds Alex But the section never gets called, so I tried putting it after the ldap authorization bit, as I can't do it in the authentication part, or so I gather (no unlang support in there?). In the below update, ldap-UserDescription is my custom attribute, which I can see from the logs is being populated : [ldap] description -> Ldap-UserDescription == "test ip phone" Authorize { .. .. ldap update outer.control { Ldap-UserDescription := "%{control:Ldap-UserDescription}" } } But again it doesn't make it through (or am I doing it wrong?) +- entering group REJECT {...} expand: %{control:Ldap-UserDescription} -> : ++[reply] returns noop Am I being stupid? The best thing would be for the post_auth reject section in inner tunnel to run, but failing that I need to work out the control item passback to the outer tunnel. Thanks for any help in advance! Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Need help with making RPM from v2.x.x branch
by Divyesh Raithatha 10 May '13

10 May '13

Hello all, has anyone had success in building an RPM from the v2.x.x branch from http://git.freeradius.org? I am following the information from http://wiki.freeradius.org/guide/Red-Hat-FAQ On a CentOS 6.4 x64 system I was able to build an RPM from 2.2.0 source successfully but I want to get all of the recent patches from the v2.x.x branch. However, when I tried to build the RPM from v2.x.x I get the following message: Hunk #1 FAILED at 121. 1 out of 1 hunk FAILED -- saving rejects to file src/main/radtest.in.rej error: Bad exit status from /var/tmp/rpm-tmp.uETav5 (%prep) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.uETav5 (%prep) Here is the radtest.in.rej file contents: --- src/main/radtest.in 2011-09-30 10:12:07.000000000 -0400 +++ src/main/radtest.in 2012-01-05 15:51:56.877585514 -0500 @@ -121,7 +121,7 @@ echo "EAP-Code = Response" echo "EAP-Type-Identity = \"$1\"" fi - if [ "$6" ] + if [ ! -z "$6" ] && [[ $6 =~ ^[0-9]+$ ]] && [ $6 -gt 0 ] then echo "Framed-Protocol = PPP" fi Here is the contents of /var/tmp/rpm-tmp.uETav5 #!/bin/sh RPM_SOURCE_DIR="/home/test/rpmbuild/SOURCES" RPM_BUILD_DIR="/home/test/rpmbuild/BUILD" RPM_OPT_FLAGS="-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic" RPM_ARCH="x86_64" RPM_OS="linux" export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_DOC_DIR="/usr/share/doc" export RPM_DOC_DIR RPM_PACKAGE_NAME="freeradius" RPM_PACKAGE_VERSION="2.2.0" RPM_PACKAGE_RELEASE="1.el6" export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE LANG=C export LANG unset CDPATH DISPLAY ||: RPM_BUILD_ROOT="/home/test/rpmbuild/BUILDROOT/freeradius-2.2.0-1.el6.x86_64" export RPM_BUILD_ROOT PKG_CONFIG_PATH="/usr/lib64/pkgconfig:/usr/share/pkgconfig" export PKG_CONFIG_PATH set -x umask 022 cd "/home/test/rpmbuild/BUILD" LANG=C export LANG unset DISPLAY cd '/home/test/rpmbuild/BUILD' rm -rf 'freeradius-server-2.2.0' /usr/bin/bzip2 -dc '/home/test/rpmbuild/SOURCES/freeradius-server-2.2.0.tar.bz2' | /bin/tar -xf - STATUS=$? if [ $STATUS -ne 0 ]; then exit $STATUS fi cd 'freeradius-server-2.2.0' /bin/chmod -Rf a+rX,u+w,g-w,o-w . echo "Patch #1 (freeradius-cert-config.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-cert-config.patch | /usr/bin/patch -p1 -b --suffix .cert-config --fuzz=0 echo "Patch #2 (freeradius-radtest.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-radtest.patch | /usr/bin/patch -p1 -b --suffix .radtest --fuzz=0 #%patch3 -p1 -b .man #%patch4 -p1 -b .unix-passwd-expire echo "Patch #5 (freeradius-radeapclient-ipv6.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-radeapclient-ipv6.patch | /usr/bin/patch -p1 -b --suffix .radeapclient-ipv6 --fuzz=0 #%patch6 -p1 #%patch7 -p1 -b perl echo "Patch #8 (freeradius-dhcp_sqlippool.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-dhcp_sqlippool.patch | /usr/bin/patch -p1 --fuzz=0 # Some source files mistakenly have execute permissions set find $RPM_BUILD_DIR/freeradius-server-2.2.0 $ -name '*.c' -o -name '*.h' $ -a -perm /0111 -exec chmod a-x {} + exit 0 Any Ideas? Thank you.

6 15

Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 10 May '13

10 May '13

Hi, This may have come up before but I can't find any solutions : I'm using a NAS which always performs EAP/MSCHAP2 authentication, so I've stripped the sites-enabled/default right down to pretty much just include the eap stuff for authorisation/authentication, and am doing all the rest inside the inner tunnel - fine. When the radius returns an access-accept, it runs the stuff in the inner-tunnel post_auth section ok, and I can record the attributes I want to a mysql db, including a custom ldap attribute inserted into a control variable. However it seems that following a reject, the post_auth reject section of inner-tunnel isn't actually used, so it doesn't record any info about the attributes in the sql database if I use an sql call. Ok .. so do it in the default post_auth reject bit - ok but I can't figure how to pass back control variables to the outer tunnel. I'd imagine it should be similar to the description in the post auth reject section of the inner tunnel : update outer.reply { User-Name = "%{request:User-Name}" } But the section never gets called, so I tried putting it after the ldap authorization bit, as I can't do it in the authentication part, or so I gather (no unlang support in there?). In the below update, ldap-UserDescription is my custom attribute, which I can see from the logs is being populated : [ldap] description -> Ldap-UserDescription == "test ip phone" Authorize { .. .. ldap update outer.control { Ldap-UserDescription := "%{control:Ldap-UserDescription}" } } But again it doesn't make it through (or am I doing it wrong?) +- entering group REJECT {...} expand: %{control:Ldap-UserDescription} -> : ++[reply] returns noop Am I being stupid? The best thing would be for the post_auth reject section in inner tunnel to run, but failing that I need to work out the control item passback to the outer tunnel. Thanks for any help in advance! Andy

3 2

how to get linelog() see see packet-types other than access-request
by Jeff Smith 09 May '13

09 May '13

Hello, I've got a freeradius server 2.2.0 configured to process requests, and now I'd like to add some logging that would look something like this: Wed May 8 14:53:16 2013 Access-Request for abcd(a)purdue.edu from MAC address (Calling-Station-Id) 84-3a-4b-0c-46-44 NAS lwsn-b143-wism2-11 I actually have that working, but would like for linelog to also log a line for packet types access-challenge, access-accept, and access-reject. My /opt/freeradius/etc/raddb/modules/linelog has: reference = "%{%{Packet-Type}:-format}" # # Followed by a series of log messages. Access-Request = "%t %{Packet-Type} for %{User-Name} from MAC address (Calling-Station-Id) %{Calling-Station-Id} NAS %{NAS-IDentifier}" Access-Reject = "Rejected access: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" Access-Challenge = "Sent challenge: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" Access-Accept = "Accepted access: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" That is, slight changes from the examples given. I've added calls to linelog to the following sections in sites-enabled/default and sites-enabled/inner-tunnel: authorize authenticate preacct accounting post-auth

2 2

radgroupcheck attributes and test client
by ch2009＠arcor.de 09 May '13

09 May '13

All, I'm a newbie in radius. I've setup freeradius with mySQL and max-daily-session. When I set max-daily-session := 10 in radgroupcheck table, a user of this group can login (accept packet after authentication), even if he already has been logged in for 10 seconds before. I'm using NTRadPing and Radius Test Rig Utily as a client. I've sent accounting packages. Radacct table got populated (beginning and end of session, no octets). Is it a client issue? Must NTRadPing send any additional parameters? Any help is appreciated. Chris

4 7

re: RE: how to get linelog() see see packet-types other than access-request
by Jeff Smith 08 May '13

08 May '13

Argh. Please accept my apologies -- I accidentally sent the previous message before I had finished composing it. Jeff

1 0

smbpasswd or etc_smbpasswd?
by Bill McGonigle 08 May '13

08 May '13

Hi, everybody, I was setting up freeradius to authenticate against an smbpasswd file, and got tripped up by the sample config. I have: modules/smbpasswd with: passwd smbpasswd { filename = and: sites-available/default (and inner-tunnel) with: # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. etc_smbpasswd under 'authorize'. From what I can tell, these all need to match, with either "etc_smbpasswd" or "smbpasswd" in all each location. If they differ, I get a startup error, something like: radiusd.conf[862]: etc_smbpasswd: Module instantiation failed. radiusd.conf[1866] Unknown module "etc_smbpasswd". radiusd.conf[1789] Failed to parse authorize section. If they match, it works great. I'm seeing the same sample configuration on el5, el6, and on git head, so maybe I'm doing something wrong? Thanks, -Bill -- Bill McGonigle, Owner BFC Computing, LLC http://bfccomputing.com/ Telephone: +1.855.SW.LIBRE Email, IM, VOIP: bill(a)bfccomputing.com VCard: http://bfccomputing.com/vcard/bill.vcf Social networks: bill_mcgonigle/bill.mcgonigle

2 1

AAA Accounting Relay
by Raithatha, Divyesh 08 May '13

08 May '13

Newbie question for the group. Has anyone successfully set up a Radius Relay for Accounting as this older article for LDAP lists? http://freeradius.org/radiusd/doc/ldap_howto.txt What we would like to do is to send both Auth and Accounting requests to a AAA server and then forward just the accounting records to another AAA server that is back-ended to MySQL. Thanks.

3 2