March 2014 - Freeradius-Users - lists.freeradius.org

update : Re: Authentication on the basis of circuit id and not mac address
by Mahima Kumar 10 Mar '14

10 Mar '14

Hello Alan, Thanks for your reply. To be more specific i can tell you my scenario. client---switch---alcatel(dhcp relay agent)---freeradius and dhcp server The dhcp relay agent is generating a circuit id which i can see in the debug output, it is a hex string beginning from 0x as well as the dhcp agent remote id is visible as a hex string. Now i am putting the username format in the alcatel as mac address and i have no problem in authenticating the client from the radius server on the basis of mac address and dhcp server is giving ip address to the client. But my goal is to authenticate my client on the basis of this circuit id which is being generated by the alcatel dhcp relay agent , and hence provide ip address to the client on from the dhcp server. As i change the username format to circuit-id in the alcatel relay agent, the authentication fails as the debug output in alcatel shows the username format implies circuit-id. I am actually implementing the Alcatel Triple Play ESM scenario(alcatel also has IES and VPLS running on it), but instead of a dslam or any other relay agent i have to use the alcatel router only as the dhcp relay agent. Also i would like to know what changes i have to make in the users file or dhcp-static file or default file or radcheck, so as to do the client authentication based on the cirucit id being generated. (I tried to make a few changes but nothing works for me). Goal is : Authentication of client from radius server on the basis of circuit id and assigning ip address to the client from the dhcp server. Thanks in advance. On Mon, Mar 10, 2014 at 10:23 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Authorise based on Calling Station ID ? (Alan DeKok) > 2. Re: Authentication on the basis of circuit id and not mac > address (Alan DeKok) > 3. Re: your mail (A.L.M.Buxey(a)lboro.ac.uk) > 4. Re: Old school: FreeRADIUS and NIS (Mark Haney) > 5. Re: Old school: FreeRADIUS and NIS (Alan DeKok) > 6. Re: Old school: FreeRADIUS and NIS (Phil Mayers) > 7. Re: Old school: FreeRADIUS and NIS (Mark Haney) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Mar 2014 08:10:31 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authorise based on Calling Station ID ? > Message-ID: <531DABB7.50105(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Darren Ward (darrward) wrote: > > The mac address was sent by the wifi controller as the > > calling-station-id but the question is how do I match that field against > > the user to authorise them? > > $ man unlang > > It tells you how to do if/then/else checks. > > Perhaps you have a more specific question? > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Mon, 10 Mar 2014 08:33:25 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authentication on the basis of circuit id and not mac > address > Message-ID: <531DB115.70109(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Mahima Kumar wrote: > > I have used an Alcatel router as relay agent which gives the circuit id > > and i can see that in the radius debug output, so the client is getting > > authenticated on the basis of mac address and is getting the ip address > > from the Dhcp server , now i want to authenticate the client based on > > the circuit id provided by the relay agent in between, > > First, does the circuit ID show up in a RADIUS packet? If so, what > attribute is it? > > > but the radius > > server doesn't accept username as circuit id, it only authenticates > > based on mac address of the client(i tried changing the users file), so > > can anyone please guide me as to what changes i have to make for this to > > be possible. > > I'm not sure what you're trying to do, so I don't have a good answer > for you. > > What does debug output say? What do you think it *should* say? > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Mon, 10 Mar 2014 13:54:26 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: your mail > Message-ID: <20140310135426.GC3021(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'd like to install on FreeBSD 9.2 > > FreeRadius2 with MySQL > > which bits of http://wiki.freeradius.org/guide/SQL-HOWTO did you > follow, which bits didnt work? > > alan > > > ------------------------------ > > Message: 4 > Date: Mon, 10 Mar 2014 10:03:55 -0400 > From: Mark Haney <mhaney(a)practichem.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DC64B.4010806(a)practichem.com> > Content-Type: text/plain; charset="ISO-8859-1" > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > On 03/07/14 16:00, Alan DeKok wrote: > > >> The only thing I've changed in the config files is to add the > >> DEFAULT Auth-Type = System at the top of the users file. > > > > Which I don't recommend you do. > > > > Anyawyas, debug mode shows: > > > > ++[unix] returns notfound > > > > Which is pretty definitive. > > Okay, what would recommend then? And the ++[unix] returns notfound is > definitive of /what/? > > Since I'm setting up FreeRADIUS on my NIS master, I don't really need > NIS integration, the user accounts are all in /etc/passwd (and > /etc/shadow) so all I need is radiusd to check for local accounts and > authenticate against them. This /should/ simplify things, but > apparently I'm missing something, and something probably relatively > simple. Question is, what? > > > - -- > Mark Haney > Network/Systems Administrator > Practichem > W: (919) 714-8428 > Fedora release 20 (Heisenbug) 3.13.4-200.fc20.x86_64 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1 > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQEcBAEBAgAGBQJTHcZEAAoJEM/YzwEAv6e7VfIH+gLyCl0i8wJg8yrNRh93PUKG > tuKKRyelWUur6p1Hem/G3LtEBkczbfPw1Mk1mD0McWmrH58lMoFccnFp3KF//QF7 > NNBBrbbtkFLq0gdEUr7vr7ICXDqRKnrSSSh+zjOFZ5DwG4pSjhexqwgRZNw34prg > ddG6qsnVwktztIBuiXI05iWL1yqoTVveiXJCRcoOFMc1cKABt4tYR0y2/7QGmjT2 > DvfvhD3K+pDtO1HLwPOKay9D47AHSsRyvO64d1zfSVokt/7/FLbUuHtoZ9lXK5uH > BjteP//mlE017d848wHF5PzmYXIPQhT3ANQ274TB/Q9wPalhx/7KMd+WN6CvHeA= > =QgVT > -----END PGP SIGNATURE----- > > > > ------------------------------ > > Message: 5 > Date: Mon, 10 Mar 2014 10:21:05 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DCA51.6070309(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Mark Haney wrote: > >> ++[unix] returns notfound > > > >> Which is pretty definitive. > > > > Okay, what would recommend then? And the ++[unix] returns notfound is > > definitive of /what/? > > Uh.... the module looks users up in /etc/passwd. What could > "notfound" possibly mean? > > > Since I'm setting up FreeRADIUS on my NIS master, I don't really need > > NIS integration, the user accounts are all in /etc/passwd (and > > /etc/shadow) so all I need is radiusd to check for local accounts and > > authenticate against them. This /should/ simplify things, but > > apparently I'm missing something, and something probably relatively > > simple. Question is, what? > > The user isn't in /etc/passwd. > > Alan DeKok. > > > ------------------------------ > > Message: 6 > Date: Mon, 10 Mar 2014 14:33:55 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DCD53.9080402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 10/03/14 14:03, Mark Haney wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > > > > > On 03/07/14 16:00, Alan DeKok wrote: > > > >>> The only thing I've changed in the config files is to add the > >>> DEFAULT Auth-Type = System at the top of the users file. > >> > >> Which I don't recommend you do. > >> > >> Anyawyas, debug mode shows: > >> > >> ++[unix] returns notfound > >> > >> Which is pretty definitive. > > > > Okay, what would recommend then? And the ++[unix] returns notfound is > > definitive of /what/? > > rlm_unix has a flow like this: > > r = getpwnam(username) > if not r: > return NOTFOUND > if not r.passwd or len(r.passwd) < 10: > s = getspnam(username) > if not s: > return NOTFOUND > passwd = s.passwd > else: > passwd = r.passwd > > So, either FreeRADIUS is getting no reply to getpwnam() or it's getting > an empty or "x" value for the password hash at that stage, *then* > calling getspnam() and getting no value. > > My NIS is rusty, but IIRC calling the getspnam() routines under NIS > requires you being root? Most likely this is the problem. > > PAM has a suid-root helper for this; FreeRADIUS doesn't. So one possible > alternative would be to use rlm_pam, and let PAM do the work of getting > at the shadow data. > > > ------------------------------ > > Message: 7 > Date: Mon, 10 Mar 2014 12:23:29 -0400 > From: Mark Haney <mhaney(a)practichem.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DE701.5090606(a)practichem.com> > Content-Type: text/plain; charset="ISO-8859-1" > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > On 03/10/14 10:33, Phil Mayers wrote: > > > > > rlm_unix has a flow like this: > > > > r = getpwnam(username) if not r: return NOTFOUND if not r.passwd or > > len(r.passwd) < 10: s = getspnam(username) if not s: return > > NOTFOUND passwd = s.passwd else: passwd = r.passwd > > > > So, either FreeRADIUS is getting no reply to getpwnam() or it's > > getting an empty or "x" value for the password hash at that stage, > > *then* calling getspnam() and getting no value. > > > > My NIS is rusty, but IIRC calling the getspnam() routines under > > NIS requires you being root? Most likely this is the problem. > > Le me re-iterate. Since I've installed FreeRADIUS on my NIS master, I > no longer care so much about dealing with NIS. At this stage, it's > simply a matter of getting FR and rlm_unix to see and access my local > user/pwd sitting in /etc/passwd and /etc/shadow. Surely, setting up > Fr for that is not /that/ complicated. So, forget about NIS. That is > not a problem. > > So, now that I have that out of the way, it seems rlm_unix isn't able > to read /etc/shadow. I'm assuming the getspnam(username) call is > trying to read /etc/shadow? If so, how is the best way to fix this? > I read somewhere that rlm_unix didn't need to copy the password files > into a temp file with radwtmp unless there was a specific reason for > it. What exactly is that all about? > > > - -- > Mark Haney > Network/Systems Administrator > Practichem > W: (919) 714-8428 > Fedora release 20 (Heisenbug) 3.13.4-200.fc20.x86_64 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1 > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQEcBAEBAgAGBQJTHeb2AAoJEM/YzwEAv6e7EtsH/1DSyXULTwGN2Y4x/lvq/5cj > OYj585upGm0gZlNTEBjDYF1eJQw+S26bIhbogiaaWElBhnNE43K0iXnlJMxC3rwJ > ZRdoT5dQHufyOAFpDrg0GvR4BsnlSUlRzckBDGdFSsEtHHUtH0UU/ajuKo8JgXxZ > 4smQ1dl9dFY9A9xe7AI7MGMI76QAqTIuTREmEwfPVKl9HSsBHAFr64hzxsUc8TcE > 5GEizfXQv3XvTLsYuDCPRF2SxZr5ZpLi3Yuu/GLlC6Vl88qpNHgbPVf5rKw1NVMl > OhYFHSnz+pzgyAKJBg3Np5xoV1cvDYf0wQ3Kv0i1UwP3SF4r9RvdAPNjyyzjZJc= > =mS2E > -----END PGP SIGNATURE----- > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 107, Issue 38 > ************************************************* > > -- Regards, Mahima Kumar 1365962

2 1

None
by krylov＠ukr.net 10 Mar '14

10 Mar '14

Good day. I'd like to install on FreeBSD 9.2 FreeRadius2 with MySQL # radiusd -X ... rad_recv: Access-Request packet from host 1.2.3.4 port 15191, id=95, length=46 User-Name = "krylov" User-Password = "password" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: -> [sql] Error generating query; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] = fail +} # group authorize = fail Using Post-Auth-Type REJECT WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 95 to 1.2.3.4 port 15191 Waking up in 4.9 seconds. =-=-=-=-=-=-=-=-=-=-=-=-=-=- Radius can't create sql-query Please, help me. May be anybody nows where is examples or howto...

4 3

Authentication on the basis of circuit id and not mac address
by Mahima Kumar 10 Mar '14

10 Mar '14

Hi , I have used an Alcatel router as relay agent which gives the circuit id and i can see that in the radius debug output, so the client is getting authenticated on the basis of mac address and is getting the ip address from the Dhcp server , now i want to authenticate the client based on the circuit id provided by the relay agent in between, but the radius server doesn't accept username as circuit id, it only authenticates based on mac address of the client(i tried changing the users file), so can anyone please guide me as to what changes i have to make for this to be possible. TIA Regards, Mahima

2 1

Testing an access-request user without the debugging mode
by Hangi Christian 10 Mar '14

10 Mar '14

Hello Guys, I am new in Freeradius server and also in linux and I need your help regarding the functionality of the server. I am currently using freeradius version 2.2.3 and my desktop computer is running the CentOS 6.4 linux operating. First of all, I've downloaded the uncompressed freeradius software package (freeradius-server-2.2.3.tar) from the freeradius website: http://www.freeradius.org from source code in the tar format. Then after I had to create a folder using CentOS linux in order to the freeradius server source code package to the folder, uncompressed and installed on the computer. After copied to the folder, I used the tar commands to uncompress the source code package and install it on the computer using #./configure, #make and #make install commands from the INSTALL file of the uncompressed server package. After installed, the configurations files of the RADIUS SERVER were found under /usr/local/etc/raddb directory path. i tested the server on the debugging mode using radiusd -X and at the end of the output i saw this line " Ready to process requests". I have first created a user inside the users file and I did the normal default testing with the debugging mode and the user was accepted. After that i change the clients.conf file putting my shared key and the IP Address of the switch and also configure ssh on the server side I have done the AAA , Radius and SSH configurations on the switch, then I used Putty on another computer to access to the server by putting the IP address of the switch . Is this the right way to access the server ? i ran the debugging mode on the server and try to access using putty on another PC . here is the result i got this : rad_recv: Accounting-Request packet from host 192.168.9.26 port 5001, id=151, length=122 User-Name = "testing" NAS-Identifier = "002389550a92" NAS-Port = 16781313 NAS-Port-Type = Ethernet Calling-Station-Id = "0000-0000-0000" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "1100030205009" Framed-IP-Address = 192.168.9.25 NAS-IP-Address = 192.168.9.26 Event-Timestamp = "Apr 2 2000 12:00:06 ICT" Service-Type = Login-User # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 16781313,NAS-Identifier = "002389550a92",NAS-IP-Address = 192.168.9.26,Acct-Session-Id = "1100030205009",User-Name = "testing"' [acct_unique] Acct-Unique-Session-ID = "6ff6addd9c912e31". ++[acct_unique] = ok [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 192.168.9.26 [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] expand: %t -> Mon Mar 10 13:12:05 2014 ++[detail] = ok ++[unix] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 151 to 192.168.9.26 port 5001 Finished request 1. Cleaning up request 1 ID 151 with timestamp +122 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +122 Ready to process requests. then i stopped the debugging mode. and run the server using this commands [root@chris raddb]# service radiusd restart Stopping radiusd: [ OK ] Starting radiusd: [ OK ] on the user's PC side i got access denied and the server does not report on the radius.log file . please help me and also correct me where ever i went wrong. With Regards, Chris

2 1

RE: dailycounter isnt started
by Sanity Computers 08 Mar '14

08 Mar '14

Guys, I found the right code from the Daloradius /sql/counter.conf. In all my googling I have not seen it like this. I found it a little tough when the wiki and Github show code that does not work for a daily-max-session. I guess there is a reason but loads of the examples out there simply don't work unless the radacct table is already populated, cheers. sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL(SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" Regards Jim

2 1

rlm_unix and logging of bad passwords
by Mischa Diehm 07 Mar '14

07 Mar '14

Hi, I run: freeradius-2.2.0p2 on OpenBSD 5.4 and I'm wondering how I can stop freeradius to log bad passwords to /var/log/radius/radius.log. The users are in the system password-db. I checked in rlm_unix.c where the log is happening but from there didn't figure what could be done to prevent the line from being logged: //line371ff if (fr_crypt_check((char *) request->password->vp_strvalue, (char *) vp->vp_strvalue) != 0) { radlog_request(L_AUTH, 0, request, "invalid password \"%s\"", request->password->vp_strvalue); return RLM_MODULE_REJECT; } Any hints? Thanks in advance. Mischa -- Mischa Diehm | Network Operations Center (NOC) UniBasel | UniRechenZentrum (URZ) Klingebergstr. 70 | CH-4056 Basel Tel. +41 61 267 1574 | http://urz.unibas.ch

3 2

mod_xml_radius concurrency limit
by Ričardas Stoma 07 Mar '14

07 Mar '14

I'm using mod_xml_radius module to do radius authentication and accounting. When doing stress test (using sipp), i noticed that EVERY time when the number of concurrent calls reached exactly 245, authentications started to fail. >From the logs, i see these errors appearing after 245 calls: freeswitch: rc_send_server: no reply from RADIUS server localhost.localdomain:1812, 127.0.0.1 FreeSwitch and FreeRadius are communicating over localhost. I'm using 3 servers to do this stress test. First server generates calls, seconds server does freeswitch + freeradius stuff and third servers is used for terminating calls. Calls are generated with RTP stream. Wireshark shows that freeradius is sending correct responses to every mod_xml_radius request, but after 245 calls, responses do not reach destination (i see error messages "destination port is unreachable"). When the number of concurrent calls drops below 245, new calls are authenticated correctly (until it reaches that weird 245 limit). I'm using CentOS 6 (64 bit) Does anyone know why i'm getting this weird limitation? Is this related to freeswitch? freeradius server? mod_xml_radius? freeradius-client? linux?

2 1

Failover with two different versions of FR
by Erwann Thoraval 07 Mar '14

07 Mar '14

Hi list, I have a working config with one FR 2.2.0 server. I also setup a FR 3.0.1 server for failover purpose. Accouting is done with one pgsql server. Is it safe for the acounting database to be written by two different versions of FR? (ie 2.x and 3.x) Thanks, -- Erwann

2 1

Re: dailycounter isnt started
by Sanity Computers 06 Mar '14

06 Mar '14

Sorry I thought I was clear, the debug looked absolutely normal except no sign of the counter doing its job. I have used all default settings from the wiki but I'm a bit lost to how the counter works and what I should be seeing. I found a few other users with the same problem - this chap found a solution and added to githup so I will attempt to find it. http://freeradius.1045715.n5.nabble.com/Probmels-with-sqlcounter-module-in-F reeRADIUS-2-1-12-td5713958.html The issue is when the counter first runs on the first login there is no data in radacct ... so the query has no result. Someone also said this is the query to use: query = "SELECT COALESCE( SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) ) FROM radacct WHERE username = '%{${key}}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" but that didn't work for me, I'll check github, thanks.

1 0

X11 Authentication
by Jon Spriggs 06 Mar '14

06 Mar '14

Hi, I've deployed FreeRadius and am using it without issue on web applications and SSH sessions, however, I'm trying to expand this usage into GUI logins on an Ubuntu Linux based system (using one of the LightDM, GDM or KDM login managers - any will suffice, but ideally LightDM for Unity). I realise that this is outside the normal remit of this mailing list, and I'm happy to be told to look elsewhere, but as the project shepherds the pam_radius plugin, I was wondering whether there was just some settings I needed to tweak or configure in that plugin, or even whether I'm just looking in the wrong place to support my desired outcome. Many thanks in advance, -- Jon "The Nice Guy" Spriggs

2 3