June 2013 - Freeradius-Users - lists.freeradius.org

Mac-auth. authorized_macs file sintax
by Roberto Ortega Ramiro 21 Jun '13

21 Jun '13

Hello, I have configured freeradius for accept one host conection over host mac address This is the log, at the end appear the error: Called-Station-Id = "00-90-0B-23-2E-BF:EquiposPortatiles" Calling-Station-Id = "98-0C-82-B5-00-F2" Framed-MTU = 1250 NAS-Port-Type = Wireless-802.11 Framed-Compression = None Connect-Info = "CONNECT 802.11g" EAP-Message = 0x02010010016c756e612e20626f726a61 Message-Authenticator = 0xa4425334968358101505d6ea0a22f5d8 Fri Jun 21 12:25:22 2013 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jun 21 12:25:22 2013 : Info: +- entering group authorize {...} Fri Jun 21 12:25:22 2013 : Info: ++[preprocess] returns ok Fri Jun 21 12:25:22 2013 : Info: ++- entering policy rewrite.calling_station_id {...} Fri Jun 21 12:25:22 2013 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Fri Jun 21 12:25:22 2013 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Fri Jun 21 12:25:22 2013 : Info: expand: %{Calling-Station-Id} -> 98-0C-82-B5-00-F2 Fri Jun 21 12:25:22 2013 : Info: expand: policy.mac-addr -> policy.mac-addr Fri Jun 21 12:25:22 2013 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Fri Jun 21 12:25:22 2013 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Fri Jun 21 12:25:22 2013 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Fri Jun 21 12:25:22 2013 : Info: +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} Fri Jun 21 12:25:22 2013 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 98-0C-82-B5-00-F2 Fri Jun 21 12:25:22 2013 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 98-0c-82-b5-00-f2 Fri Jun 21 12:25:22 2013 : Info: ++++[request] returns ok Fri Jun 21 12:25:22 2013 : Info: ++++[updated] returns updated Fri Jun 21 12:25:22 2013 : Info: +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated Fri Jun 21 12:25:22 2013 : Info: +++ ... skipping else for request 3: Preceding "if" was taken Fri Jun 21 12:25:22 2013 : Info: ++- policy rewrite.calling_station_id returns updated Fri Jun 21 12:25:22 2013 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> 98-0c-82-b5-00-f2 Fri Jun 21 12:25:22 2013 : Info: ++[authorized_macs] returns noop I have this authorized_macs file: 98-0c-82-b5-00-f2 Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" What's wrong? I have try with: 98-0c-82-b5-00-f2 Expiration := "10 Jul 2013" 98-0c-82-b5-00-f2 Auth-Type := Accept But nothing runs. Thank you. -- Un saludo. ____________________ Roberto Ortega Profesor de Informática. http://www.proyectoret.es Escuelas San José Valencia Avd.Cortes Valencianas nº1 46015 Valencia R4600489A Tf:963499011 ext. 262 Fax:963488835 http://www.escuelassj.com No imprimas este correo si no es necesario. Protejamos el medio ambiente.

4 11

Log auth message
by BALSIANOK, Peter 21 Jun '13

21 Jun '13

Hi, radiusd: FreeRADIUS Version 3.0.0, for host x86_64-unknown-linux-gnu, built on May 16 2013 at 19:51:06 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... Is it OK, when i don`t see any log message for authetification process ( when i run radiusd only with parameter -d ) ? Radiusd.conf: ... Log { ... auth = yes auth_badpass = yes auth_goodpass = yes } Log output: Mon Jun 17 14:01:55 2013 : Info: Loaded virtual server <default> Mon Jun 17 14:01:55 2013 : Info: Loaded virtual server default Mon Jun 17 14:01:55 2013 : Info: Ready to process requests. No log messages for authentification process When i add parameter -x ( in command line ), i will see log message(s) marked ### Log output: Mon Jun 17 13:57:28 2013 : Info: Loaded virtual server <default> Mon Jun 17 13:57:28 2013 : Info: Loaded virtual server default Mon Jun 17 13:57:28 2013 : Info: Ready to process requests. Mon Jun 17 14:01:14 2013 : Info: Signalled to terminate Mon Jun 17 14:01:14 2013 : Info: Exiting normally. WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) radiusd: #### Opening IP addresses and Ports #### Listening on proxy address * port 0 Listening on auth address * port 1812 as server default Listening on auth address * port 1645 as server default Ready to process requests. Waking up in 0.3 seconds. (0) # Executing section authorize from file /storage/app/radius/raddb/auth/sites-enabled/default rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Acct-Session-Id = d597d9250ac7aeba rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 421995222222 rlm_perl: Added pair Called-Station-Id = GRETEST01BB2.VPS rlm_perl: Added pair Framed-Protocol = GPRS-PDP-Context rlm_perl: Added pair User-Name = 421995222222(a)gretest01bb2.vps rlm_perl: Added pair NAS-Identifier = ggsn-01-bb2.orange.sk rlm_perl: Added pair User-Password = test rlm_perl: Added pair Acct-Multi-Session-Id = d597d92505600f87 rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair Stripped-User-Name = test rlm_perl: Added pair NAS-IP-Address = 213.155.110.101 rlm_perl: Added pair Current-Time = 1371470484 ### (0) Invalid user: [421905012430(a)gretest01bb2.vps/test] (from client localhost port 0 cli 421995222222) (0) # Executing group from file /storage/app/radius/raddb/auth/sites-enabled/default Waking up in 0.7 seconds. Waking up in 1.9 seconds. Ready to process requests. Thank you very much. Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

5 18

RE: rlm_securid
by Franks Andy (RLZ) IT Systems Engineer 20 Jun '13

20 Jun '13

I think you're right. But then life will carry on without you.. From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of RONAN BLANEY Sent: 20 June 2013 22:50 To: FreeRadius users mailing list Subject: Re: rlm_securid you need a break On Thu, Jun 20, 2013 at 9:41 PM, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: Hi, Just a quick question : has anyone got the rlm_securid module working in 3.0? I've managed, after some messing, to get the module to compile, but after copying the securid "mod" to mods-available and linking it to mods-enabled, running freeradius -X gives : /usr/local/etc/raddb/mods-enabled/securid[6]: Failed to link to module 'rlm_securid': /usr/local/lib/rlm_securid.so: undefined symbol: securid_session_free Anyone got any ideas? I really could do with getting this module to work! Thanks Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

rlm_securid
by Franks Andy (RLZ) IT Systems Engineer 20 Jun '13

20 Jun '13

Hi, Just a quick question : has anyone got the rlm_securid module working in 3.0? I've managed, after some messing, to get the module to compile, but after copying the securid "mod" to mods-available and linking it to mods-enabled, running freeradius -X gives : /usr/local/etc/raddb/mods-enabled/securid[6]: Failed to link to module 'rlm_securid': /usr/local/lib/rlm_securid.so: undefined symbol: securid_session_free Anyone got any ideas? I really could do with getting this module to work! Thanks Andy

3 2

RE: rlm_securid
by Franks Andy (RLZ) IT Systems Engineer 20 Jun '13

20 Jun '13

Hi Arran, You seem to work 24 hours a day!? Done a git pull, but I think there's some other update that's broken the make, even renaming my local FR git cache and re-downloading (./configure is w/o the securid stuff) I get : CC src/main/radmin.c gcc: error: no: No such file or directory make: *** [build/bin/local/radmin] Error 1 Hmm.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 20 June 2013 21:55 To: FreeRadius users mailing list Subject: Re: rlm_securid On 20 Jun 2013, at 21:41, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: > Hi, > > Just a quick question : has anyone got the rlm_securid module working in 3.0? I've managed, after some messing, to get the module to compile, but after copying the securid "mod" to mods-available and linking it to mods-enabled, running freeradius -X gives : > > /usr/local/etc/raddb/mods-enabled/securid[6]: Failed to link to module > 'rlm_securid': /usr/local/lib/rlm_securid.so: undefined symbol: > securid_session_free Hm, wasn't included in all.mk.in, pull and re-run configure and it should work. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

User disconnect
by Dagia Dorjsuren 20 Jun '13

20 Jun '13

Hello, Does anyone know how to solve following issue? In this case : 1. NAS (Chillispot based access point) 2. Freeradius If NAS is shutdowned, the freeradius keeps all user logins of that NAS. In this case, the users session is alive. In fact, freeradius doesn't know if NAS's status is shutdowned or running. Is there any configuration that freeradius disconnects the users automatically when NAS is shutdowned? On the other hand, I would like to terminate the user's session when NAS is shutdowned or unavailable.

5 9

Setting VLAN based on ldap attribute id
by Thomas Hermarij Maimann Andersen 20 Jun '13

20 Jun '13

Hi, I've been reading the mailing list for a few days and tried to see if there are any posts resempling mine. There are a few "almost" but noting that has got me that final step. Currently i have a radius server authenticating with ntlm to an AD. What I wan't now, is to assign a VLAN to the user based on ExtensionAttribute1, which is set to a numeric value which represents the VLAN id. E.g. 1001 I am currently messing with sites-enabled/default in the post-auth section where I try to set Tunnel-Private-Group-Id to the number they have in their attribute, but I have no clue on how to link that. Please help. -- Med venlig hilsen / With best regards Thomas Andersen Systems and Network Administrator IT University in Copenhagen Rued Langgaards Vej 7 2300 København S Phone: +45 72185249 ________________________________________________________________ **NEVER DISCLOSE YOUR PASSWORD OR SHOE SIZE - NOT EVEN TO YOUR DENTIST**

2 1

terminate eap-ttls
by adrian.p.smith＠bt.com 20 Jun '13

20 Jun '13

I have managed to setup a simple test using eapol_test as per http://www.openlogic.com/wazi/bid/188089/Authenticating-Wi-Fi-Users-with-Fr… and it all works as described except that I have to use ca.pem instead of server.pem. I think this might be because the example uses an older version of FreeRadius? What I really need to do is proxy the inner message to another Radius server which will do the authentication but I cannot get this to work. Whatever I try, I always see an EAP-Message avp heading off to the remote server. I have looked at the proxy-inner-tunnel virtual server but am unsure how to use it. Some simple steps would be appreciated. Many thanks in advance.

3 7

Re: User disconnect
by Arran Cudbard-Bell 20 Jun '13

20 Jun '13

On 20 Jun 2013, at 11:00, Dagia Dorjsuren <dagmid_d(a)yahoo.com> wrote: > Could you explain more about it? Where I can find schema/scripts? So the idea is that you have a column in the database that gets update every time you receive an interim-update. If the difference between NOW() and the last update is greater than the interim update interval, then the client has most likely gone offline, and the session can be marked as closed. The extended schema (it's only one more column) and updated queries are in the master branch. You can't copy and paste directly because of the configuration file format changes, but you can just copy the queries across between 3.0.0, 2.0.0 as the schema hasn't changed that much. For closing out stale sessions, as I said, you can run multiple queries (separated by semi colon), so can use accounting packets to trigger the process. Or you can just use cron, and call whatever client binary is appropriate for your database. Do whatever you think is appropriate. Personally i'd go for cron, but some people like to have the server be self maintaining. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

EAP-SIM
by romy rooman 20 Jun '13

20 Jun '13

Hi all, i have read many posts about eap sim i have create simtriplets.dat and i want to use eap sim for tests and i get notification that rlm_sim_files not found what should i do?

2 1