August 2014 - Freeradius-Users - lists.freeradius.org

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 25 Aug '14

25 Aug '14

Hello! Thanks for you help! All right, I was able to compile freeradius with firebird support! =) my inexperience, some later I noticed that configure --help tells me next params: --with-experimental-modules, and also I viewed the file "stable" in src.../drivers directory, and saw that firebird is not stable. Then I'am run configure with next params: ./configure --prefix=/usr \ --exec-prefix=/usr \ --mandir=/usr/share/man \ --sysconfdir=/etc \ --libdir=/usr/lib/freeradius \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=/etc/freeradius \ --with-logdir=/var/log/freeradius \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --without-rlm_sql_postgresql \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl \ --with-experimental-modules \ --without-rlm_opendirectory \ --without-rlm_redis \ --without-rlm_rediswho \ --without-rlm_ruby \ --without-rlm_sql_sqlite \ --without-rlm_sql_db2 and then make and checkinstall make install as a result I got the module freeradius-XYZ.deb, which was successfully installed in the system. Yes, I expected that I must be got separate module, as to freeradius-firebird.deb, thanks you for you explaining, that my expectations are wrong. =) And question about why we are using firebird database. The reason is very simple, out billing software begun develops long ago, and for historical reasons used firebird database engine. This software was developed inside the company, and modernization of it is a complex process in which we do not need, except that we can't use freeradius, unfortunately, in production. May be only after full testing, may be. It is a pity that the module is still experimental, eh. Thanks for your answers!

4 4

Understanding radgroupcheck
by Marcus Ng 25 Aug '14

25 Aug '14

1. When a user has multiple entries of the same attribute in radgroupcheck, it is a OR condition meaning that if he satisfies one of the entry it is a PASS? E.g. If there are 3 NAS-IP-Address entries, then satisfying any of the 3 IP address is a PASS? 2. What if there are more than 1 type of attributes. Does it mean it is a PASS only if each of the attribute is satisfied at least once? E.g. if there are 3 entries of AttrA and 2 entries of AttrB, then it is a PASS if and only if at least 1 entry of AttrA is true and at least 1 entry of AttrB is true? 3. Does this apply to radcheck as well? Regards, -Marcus

2 1

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 23 Aug '14

23 Aug '14

Hello! I try it. By manual from http://wiki.freeradius.org/building/Build#Building-Debian-packages I did these steps: I'm install firebird-dev package. Result of command "sudo dpkg -L firebird-dev" /. /usr /usr/lib /usr/lib/i386-linux-gnu /usr/share /usr/share/doc /usr/include /usr/include/perf.h /usr/include/ibase.h /usr/include/iberror.h /usr/include/ib_util.h /usr/lib/i386-linux-gnu/libfbembed.so /usr/lib/i386-linux-gnu/libfbclient.so /usr/share/doc/firebird-dev then I fix debian/rules file in this part (added strings with word "firebird"): ./configure $(confflags) \ --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-rlm_sql_firebird \ --with-rlm_sql_firebird_lib_dir=`/usr/lib/i386-linux-gnu/` \ --with-rlm_sql_firebird_include_dir=`/usr/include/` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl But, firebird deb is absent, although other packages, such as mysql, postgresql is present. Why? Please tell me, where is my error? I would be very grateful for any help!

4 6

FreeRadius Support with Windows 2012 R2 domain
by Dennis Xu 21 Aug '14

21 Aug '14

Hello, Does FreeRadius support Windows 2012 R2 servers for PEAP MS-CHAPV2 authentication? Thanks! --- Dennis Xu Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

3 3

Issue with OpenLdap and FreeRadius
by Andrew Niemantsverdriet 21 Aug '14

21 Aug '14

Hi All, I'm am using FreeRadius 2.1.12 from the CentOS repo and am trying to get it working with OpenLDAP 2.3.43 also from the CentOS repo. Everything is working great until I add and ACL to OpenLDAP that gives self write access to sambaNTpassword. When that line is added FreeRadius will stop authenticating clients. I'm including a link to my log file gathered from radiusd -X > debug.txt. At the end of that file you can see where I turned off the sambaNTpassword and things start working again. Any idea on how I can fix this? https://www.dropbox.com/s/vhuolmhl62fphfd/debug.txt Thanks, -- _ /-\ ndrew Niemantsverdriet Linux System Administrator Academic Computing (406) 238-7360 Rocky Mountain College 1511 Poly Dr. Billings MT, 59102

3 7

Operator ":=" in reply packets
by Axel Luttgens 21 Aug '14

21 Aug '14

Hello, Let's define this query: authorize_reply_query = "\ SELECT 1, '%{SQL-User-Name}', 'Reply-Message', 'Hey', ':=' \ UNION \ SELECT 2, '%{SQL-User-Name}', 'Reply-Message', 'Hello', ':=' \ ORDER BY 1" In radiusd -X output, on may then read: Sending Access-Accept Id 201 from 127.0.0.1:1812 to 127.0.0.1:62417 Reply-Message = 'Hey' Reply-Message = 'Hello' A Reply-Message may indeed appear multiple times in an Acces-Accept (or -Reject or -Challenge) packet. Now, according to http://wiki.freeradius.org/config/Operators, operator ":=" has the same meaning as a reply item than as a check item. As a check item, it "replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added." How should that idea of replacement of "any attribute of the same name" then be interpreted? TIA, Axel

2 3

custom reply message
by Rando Nakarmi 21 Aug '14

21 Aug '14

Hello there, I use radutmp file for simualtanesou use and set Simultaneous-Use := 2 -- this works very well for me. but for the third connection it fails (which is normal) but I get message Invalid User in radius.log file which is in fact confusing. radiusd[26044]: Invalid user: user@localhost/<no User-Password attribute>] How do I change or where so than I can add custom message for simultaneous-Use message like "your connection exceed the limit" etc. any example or sample would help me.

1 0

Serving multiple groups of users
by Marcus Ng 21 Aug '14

21 Aug '14

Hi, I would like to configure freeradius2 to have multiple listening ports, with each port catering to a unique group of users. I.e. if a user comes in through listening port 1, his credentials will be checked against a subset of the radcheck. if a user comes in through listening port 2, his credentials will be checked against a different subset of the radcheck. The subsets do not mix. What is the easiest way to do that? I am using postgres for authorization. -Marcus

5 10

hi friends
by Ciprian ARSENIE 20 Aug '14

20 Aug '14

Hi I want to implement this tcl script on a cisco http://www.yasinkaplan.com/docs/simplelcr.pdf I have this auth querry rad_recv: Access-Request packet from host xxxxxxxxxxx port 1645, id=4, length=298 User-Name = "2001" User-Password = "" Cisco-AVPair = "call-id=77a36bec512d59f2148f4a935ed0c2f6@37.153.137.2:5060" h323-conf-id = "h323-conf-id=B6EED6D8 27D911E4 88FA91CF 8B17EE77" Cisco-AVPair = "remote-media-address=xxxxxxxx" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "h323-ivr-out=transactionID:3" Called-Station-Id = "40755xxxxxxx" Service-Type = Login-User NAS-IP-Address = 46.214.35.172 And database is heare voip_cdr=# SELECT * from destinations ; prefix | destination | type | carrier --------+-------------+------------+------------ 4075 | RO ORANGE | MOB | 9901 (1 row) voip_cdr=# select * from carriers ; carrier | description ---------+------------- 9901 | orange (1 row) I m stucked heare CREATE function [dbo].[select_carrier](@dnis nvarchar(50)) returns table as return select top 1 'cisco|100' as Attribute, 'carrier:' + carrier as [Value] from destinations where prefix=substring(@dnis,1, len(prefix)) order by len(prefix) desc and as exmple of querry for freeradius is authorize_check_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" Thanks in advance

1 0

freeRADIUS -> AD Auth
by nfischer＠hush.com 19 Aug '14

19 Aug '14

Hi, after I fully crashed my freeRADIUS Server I have to ask again: It still fails with: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] Told to do MS-CHAPv2 for hausmeister@OBLAN with NT-Password [mschap] expand: %{Stripped-User-Name} -> hausmeister [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=hausmeister [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] expand: %{mschap:Challenge} -> 01b99ad5745936be [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=01b99ad5745936be [mschap] expand: %{mschap:NT-Response} -> cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt- response=cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject so Im not sure why. I think its because hes not allowed to execute the ntlm or my mschap is cofigured wrong. (or both) I checked the users/groups: sambashare:x:111:haus-meister winbindd_priv:x:112:freerad freerad:x:113:freerad ssl-cert:x:114:freerad looks fine to me? So my NTLM_Auth string in the modules/mschap is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" I allso tried a lot of other stuff nothing change. Hope you can help me again. -- Mit freundlichem Gruß Nicolas Fischer email: nfischer(a)hush.com jabber: jagger(a)jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF… If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)

4 7