March 2014 - Freeradius-Users - lists.freeradius.org

Fwd: LDAP + CHAP
by Adam Seed 05 Mar '14

05 Mar '14

Hi all, I have a freeraidus server set up which uses an openLDAP back for its users and groups while it works fine for PAP passwords, it seams most clients are wanting to use CHAP. I have read that CHAP passwords will not work however on the faq its says; ' There are however provisions to extract the user password from the LDAP and make it available to the server core and the chap module' (http://wiki.freeradius.org/guide/faq) How is this done/setup? Thanks Adam

4 27

Questions about proxying to other servers over TLS
by stefan.paetow＠diamond.ac.uk 05 Mar '14

05 Mar '14

Hi, I have a quick question... Am I correct in saying that if I want to do all my proxying over TLS to another server, I have to define the default realm in /etc/raddb/sites-enabled/tls and comment it out in proxy.conf? And additionally, I have to define the proxy server as a client in the "clients radsec" section and as a server further down in the file? With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 1

Cisco attributes for freeradius
by Lalit Choudhary 05 Mar '14

05 Mar '14

Hello All, I configured freeradius for mikrotik NAS,it taking user reply attributes from mysql database. eg. Mikrotik-Rate-Limit (to limit user bandwidth ) and Mikrotik-Total-Limit (data usage limit) ,its working fine. I also configured Cisco NAS with freeradius can someone help me to find out which attributes we use to Limit user bandwidth and Data usage limit to send in request reply. I checked few post and set user bandwidth limit using following attribute. Cisco-Avpair = 'lcp:interface-config#1=rate-limit output 4194304 10000 10000 conform-action continue exceed-action drop' Cisco-Avpair += 'lcp:interface-config#2=rate-limit input 3194304 10000 10000 conform-action continue exceed-action drop' It's working for limit user upload /download speed. Warm Regards, Lalit

2 2

Getting the number of currently tracked requests
by Louis Munro 05 Mar '14

05 Mar '14

Hello, I am trying to find a way to get the number of currently tracked connections by FreeRADIUS (2.2.1) in order to size my max_requests. Is there a way to get that information from radmin or some other tool? I realize I can always set it to some value based on the number of clients and just see if there are warnings in the logs about max_requests being too low but I would like to monitor the number of requests to tune FR as much as possible. If the same method works for other values (such as the current queue_size ) that would be a bonus. Regards, -- Louis Munro

2 3

FreeRadius 3.0.1 perl module attr problem
by Alexander Kosykh 05 Mar '14

05 Mar '14

Hi I'm trying to move my freeradius 2.2 configuration to new installed 3.0.1. All seem to work but perl clean up some attributes empty. This is my test perl script use strict; use warnings; # use ... use Data::Dumper; use DBI; # mysql information base # # Configuration parameters use constant { DEBUG => '1', # for debuggin # # database parameters DB_HOSTNAME => 'db.example.com', DB_NAME => 'radius', DB_USER => 'radius', DB_PASS => 'secret' }; # Bring the global hashes into the package scope our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK); # # This the remapping of return values # use constant { RLM_MODULE_REJECT => 0, # /* immediately reject the request */ RLM_MODULE_FAIL => 1, # /* module failed, don't reply */ RLM_MODULE_OK => 2, # /* the module is OK, continue */ RLM_MODULE_HANDLED => 3, # /* the module handled the request, so stop. */ RLM_MODULE_INVALID => 4, # /* the module considers the request invalid. */ RLM_MODULE_USERLOCK => 5, # /* reject the request (user is locked out) */ RLM_MODULE_NOTFOUND => 6, # /* user not found */ RLM_MODULE_NOOP => 7, # /* module succeeded without doing anything */ RLM_MODULE_UPDATED => 8, # /* OK (pairs modified) */ RLM_MODULE_NUMCODES => 9, # /* How many return codes there are */ # Same as src/include/radiusd.h L_DBG => 1, L_AUTH => 2, L_INFO => 3, L_ERR => 4, L_PROXY => 5, L_ACCT => 6 }; our $dbh; # Connecting datebase sub CLONE { $dbh = DBI->connect("dbi:mysql:dbname=".DB_NAME.";host=".DB_HOSTNAME,DB_USER,DB_PASS,{PrintError => 0}) or &radiusd::radlog(L_DBG, "DEBUG post_auth: DBI error: ".$DBI::errstr); if (!defined($dbh)) { &err_out; &radiusd::radlog(L_ERR, "can't connect to database!"); $RAD_REPLY {'Reply-Message'} = "Internal server error"; return RLM_MODULE_FAIL; } } sub authorize { print Dumper (%RAD_REQUEST); return RLM_MODULE_OK; } And the radius -X output This one without perl script Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.240 port 1812, id=62, length=205 User-Name = 'test_jur' CHAP-Password = 0x01cc75f2ddb427d70 CHAP-Challenge = 0xea55985e715e3e1f Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = 'test-se600' NAS-Port = 50462720 NAS-Real-Port = 838860811 NAS-Port-Type = Virtual NAS-Port-Id = '3/2 vlan-id 11 pppoe 60' Medium-Type = DSL Mac-Addr = '00-50-56-84-69-59' Platform-Type = SE-600 OS-Version = '12.1.1.5' (5) # Executing section authorize from file /usr/local/etc/raddb/sites-available/pppoe (5) authorize { (5) filter_username filter_username { (5) ? if (!User-Name) (5) ? if (!User-Name) -> FALSE (5) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) (5) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) -> FALSE (5) ? if (User-Name == 'Redback') (5) ? if (User-Name == 'Redback') -> FALSE (5) ? if (User-Name =~ / /) (5) ? if (User-Name =~ / /) -> FALSE (5) ? if (User-Name =~ /@.*@/ ) (5) ? if (User-Name =~ /@.*@/ ) -> FALSE (5) ? if (User-Name =~ /\\.\\./ ) (5) ? if (User-Name =~ /\\.\\./ ) -> FALSE (5) ? if (User-Name =~ /\\.$/) (5) ? if (User-Name =~ /\\.$/) -> FALSE (5) ? if (User-Name =~ /(a)\\./) (5) ? if (User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) ? if (OS-Version == '12.1.1.5') (5) ? if (OS-Version == '12.1.1.5') -> TRUE (5) if (OS-Version == '12.1.1.5') { ... } # empty sub-section is ignored ..... And this one with perl rad_recv: Access-Request packet from host 192.168.20.240 port 1812, id=60, length=205 User-Name = 'test_jur' CHAP-Password = 0x016dbecc2a777 CHAP-Challenge = 0xec96dfb8b8af Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = 'test-se600' NAS-Port = 50462720 NAS-Real-Port = 838860811 NAS-Port-Type = Virtual NAS-Port-Id = '3/2 vlan-id 11 pppoe 58' Medium-Type = DSL Mac-Addr = '00-50-56-84-69-59' Platform-Type = SE-600 OS-Version = '12.1.1.5' (0) # Executing section authorize from file /usr/local/etc/raddb/sites-available/pppoe (0) authorize { $VAR1 = 'OS-Version'; $VAR2 = ''; $VAR3 = 'NAS-Port-Type'; $VAR4 = 'Virtual'; $VAR5 = 'NAS-Real-Port'; $VAR6 = '838860811'; $VAR7 = 'CHAP-Password'; $VAR8 = '0x016dbecc2a777'; $VAR9 = 'Service-Type'; $VAR10 = 'Framed-User'; $VAR11 = 'Medium-Type'; $VAR12 = 'DSL'; $VAR13 = 'Framed-Protocol'; $VAR14 = 'PPP'; $VAR15 = 'User-Name'; $VAR16 = ''; $VAR17 = 'CHAP-Challenge'; $VAR18 = '0xec96dfb8b8af'; $VAR19 = 'NAS-Identifier'; $VAR20 = ''; $VAR21 = 'Platform-Type'; $VAR22 = 'SE-600'; $VAR23 = 'NAS-Port'; $VAR24 = '50462720'; $VAR25 = 'Mac-Addr'; $VAR26 = ''; $VAR27 = 'NAS-Port-Id'; $VAR28 = ''; rlm_perl: Added pair OS-Version = rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair NAS-Real-Port = 838860811 rlm_perl: Added pair CHAP-Password = 0x016dbecc2a777 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Medium-Type = DSL rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = rlm_perl: Added pair CHAP-Challenge = 0xec96dfb8b8af rlm_perl: Added pair NAS-Identifier = rlm_perl: Added pair Platform-Type = SE-600 rlm_perl: Added pair NAS-Port = 50462720 rlm_perl: Added pair Mac-Addr = rlm_perl: Added pair NAS-Port-Id = (0) [perl_pppoe] = ok (0) filter_username filter_username { (0) ? if (!User-Name) (0) ? if (!User-Name) -> FALSE (0) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) (0) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) -> FALSE (0) ? if (User-Name == 'Redback') (0) ? if (User-Name == 'Redback') -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = ok (0) [preprocess] = ok (0) ? if (OS-Version == '12.1.1.5') (0) ? if (OS-Version == '12.1.1.5') -> FALSE .... As you can see in the second -X output perl cleared some attributes: OS-Version (which I tested with if statement after perl) User-Name NAS-Identifier Mac-Addr NAS-Port-Id Why is it so? Did I do something wrong or it's a perl bug? P.S. In 2.2 this perl script work fine. *Regards,* *Alexander.*

2 1

APC NetBotz User attribute issue.
by Rishabh.Shukla 04 Mar '14

04 Mar '14

Hello All, * Our Setup -> Centos, Free Radius, MySQL and Daloradius as Front End management GUI Tool. * Devices use for Authentication -> APC NetBotz 200 Rack monitoring device as NAS. * Attribute Details of user -> 1- APC-Service-Type = Admin and 2- Auth-Type =System * Goal -> NetBotz Device users should get authenticated & login with Administrative rights. * Problem -> We need to get APC Netbotz authentication from Radius server configured and APC has 3 level of users : 1-Administrator, 2-Device, 3-Read only. Along with radius authentication radius need to supply user attributes to Netbotz for user level & its access credentials. We have configured Administrative attribute with users in radius but it does not supply with authentication, there for user get only very lower level access "read only". Our goal is to get Administrative access with radius authentication. * Radisud debug mode output as follows : # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "rishabh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> rishabh [sql] sql_set_user escaped user --> 'rishabh' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rishabh' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rishabh' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User rishabh not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> rishabh attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 38 to 192.168.12.240 port 64015 Waking up in 4.9 seconds. Cleaning up request 0 ID 38 with timestamp +9 Ready to process requests. Please help us to resolve above issue. Thanks, Rishabh

4 4

FreeRADIUS 3.0: 3rd party module build structure?
by Julius Plenz 03 Mar '14

03 Mar '14

Hi, I'm currently trying to migrate a FreeRADIUS 2.x config to the new 3.0 version. I have a few custom rlm_* modules that I want to compile against the 3.0 sources. Previously, I had a Makefile similar to this: FR_SOURCE = $(HOME)/src/freeradius TARGET = rlm_omapi SRCS = rlm_omapi.c RLM_DIR = $(FR_SOURCE)/src/modules/rlm_example/ top_builddir = $(FR_SOURCE)/ include $(FR_SOURCE)/src/modules/rules.mak RLM_CFLAGS = -I/server/dhcp/server/include -I/server/dhcp/src/isc-dhcp/bind/include RLM_LDFLAGS = -L/server/dhcp/server/lib -ldhcpctl -lomapi -ldns -lisc This way I got "magically working" targets to build and install my module. However, now the build system was changed for good and I cannot really figure out how to achieve the same effect. (In particular, the "rules.mak" file is apparently "No longer needed" since 80f92e5aee, Feb 27 2013.) Is there an easy way so I don't have to write out all the long libtool command lines myself? Any help is appreciated! Julius

3 9

FreeRadius v.2.2.3 Proxy/Copy mode issue
by Giuliano De Paolis 03 Mar '14

03 Mar '14

Hi all. I post this topic to help me to solve this strange behavior occurred in a scenario involving the Proxy/Copy server. I have 2 installation of FreeRadius 2.2.3. Please find the details below: INSTALLATION A FR: FreeRadius Server 2.2.3 O.S.: Solaris 10 Update 2011 Generic_147440-09 Proxy pool server: 1 Copy pool server: 1 INSTALLATION B FR: FreeRadius Server 2.2.3 O.S.: Solaris 10 Update 2009 Generic_142900-14 Proxy pool server: 10 Copy pool server: 10 Here's the architecture (common for both the installations): RadiusClient --> Proxy --> BE Accounting Radius Server On the Installation (A) all works fine; due to high traffic the FR Proxy server performs both proxy and copy operations and I'm able to see all the responses on my radius client. On the Installation (B) instead, despise the correct proxy/copy operations execution, there are several request packets from wich I do not receive the corresponding response packets on the Radius Client. The strange thing is that all the packets (even the missing ones) are traced at snoop level by the BE Accounting Layer. On the Proxy Layer I can "see" the missing packets, but even running at debug my FR Server I didn't see any specific error regarding to the missing packets. Can you suggest me what kind of checks I can perform to understand better where the problem is? Thanks in advance, best regards. G.

2 1

How many NAS kann radius take?
by Anja Ruckdaeschel 03 Mar '14

03 Mar '14

Hi there! Having some performance trouble at our campus site with lots of "Discarding Duplicate request" errors. Our setup is freeradius 2.2.0 with ldap and sql. ; Intel Xeon CPU E5630 2.53GHz 2CPUs with 8 Core (hyperthreading enabled), 24 GB RAM sql is only used to determine the replied VLAN-ID from a very small read only table by a local mysql instance, so no performance or connection issues here (we do not do accounting into the db or anything like that). ldap works fast. And there are no messages from rlm_ldap or rlm_sql which indicate trouble with sql or ldap connections So we kind of sorted out the "classic causes" for slowing down radius .... If our people move over the campus with ~3.000 smartphones with actvated wifi, request numbers increase when they enter new wi-fi cells and trouble begins: There is barely an auth ok or incorrect in the log but lots of discarding duplicates messages and cpu load is going up to 120 and a higher number of messages like Tue Feb 11 18:22:37 2014 : Error: rlm_eap: No EAP session matching the State variable. appears in the log. I can see that there are a few messages like Tue Feb 11 09:26:50 2014 : Info: WARNING: Module rlm_preprocess became unblocked for request 241193 and Tue Feb 11 09:26:51 2014 : Info: WARNING: Module rlm_eap became unblocked for request 241193 at the time when the problem appears. Can this point to the preprocess module where it gets "slow", with eap getting blocked as a consequence of a blocked preprocess module? We have a lot of NAS in our environment: there are over 2200 NAS in total in clients.conf, which are 350 heavily used WLAN access points (auth only, no acct) and switches which do a administrative login only every 5 min, and ~ 10 VPN controllers. As having so many NAS, preprocess has to do a max of 2200 expansion like Fri Feb 7 15:41:16 2014 : Debug: [preprocess] expand: %{Client-IP-Address} -> x.x.x.x in order to determine the allowed client. That are ~26.400 checks for preprocess in one peap/mschap request for example (~12 request-packtes x NAS). Is there some kind of "recommened maximum number of NAS" for one instance of freeradius? Here is our thread_pool and request config: max_request_time = 120 cleanup_delay = 5 #256 x NAS (By the way: "This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. " Is client in this contenxt supplicant or NAS?) max_requests = 563200 thread pool { start_servers = 5 max_servers = 128 min_spare_servers = 3 max_spare_servers = 128 # max_queue_size = 65536 max_requests_per_server = 0 } Thanks for your help Kind regards Anja

8 28

FR3 reply ldap's attr when bind as a user
by zz d 03 Mar '14

03 Mar '14

I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter '(sAMAccountName=abc)' (2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work. Is it possible? Any suggestions will be appreciated.

2 7