June 2015 - Freeradius-Users - lists.freeradius.org

using ippol
by Randeep 20 Jun '15

20 Jun '15

Hi all, I'm trying to configure freeradius to send the ip for the user. In the radiusd.conf i have uncommented $INCLUDE sqlippool.conf in the sqlippool.conf, I have enabled mysql ippool.conf in the file /etc/raddb/modules/ippool, I have defined ippool main_pool. And specified the range, netmask etc in the block. Key I have specified as key = "%{NAS-IP-Address} %{NAS-Port}" But my radippool table is empty. Do I have to specify anything there? I'm testing with radtest. I hope this can be tested with it. In the respose i'm getting like this [root@localhost ~]# radtest randeep randeep123 192.168.1.182 0 lukup124 Sent Access-Request Id 110 from 0.0.0.0:49548 to 192.168.1.182:1812 length 77 User-Name = 'randeep' User-Password = 'randeep123' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = 'randeep123' Received Access-Accept Id 110 from 192.168.1.182:1812 to 0.0.0.0:0 length 56 Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1500 Framed-Routing = Broadcast-Listen Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User [root@localhost ~]# Do I have to give sqlippool or mainpool in authenticate/authorize/account/preauth in sites-enabled/default? Please advice. Regards, Randeep

2 7

Populating radacct
by Randeep 19 Jun '15

19 Jun '15

Hi, I would like to test limiting the max usable size for a user. But I dont have a real NAS and client. Is there anyway I can send fake usage updates and when next Access-Request comes I can check the total used data and maximum limit and reject the request? Please advice. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 1

post-proxy section ( 3.0.9 bump )
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, I want to log proxy request in the case of Access-Reject from proxy server In the conf file (site-enables/default): post-proxy { log_proxy_reply Post-Proxy-Type Fail-Authentication { log_proxy_request log_control } } I've tested it with Fail or Fail-Authentication. The same result, proxy request wasn't printed out. Debug ouput: .... post-proxy { log_proxy_reply Post-Proxy-Type Fail-AuthenticationOpening new proxy socket 'proxy address * port 0' Listening on proxy address * port 43154 (0) Proxying request to home server 127.0.0.1 port 10812 timeout 14.000000 (0) Sent Access-Request Id 129 from 0.0.0.0:43154 to 127.0.0.1:10812 length 182 (0) NAS-Port-Type = Virtual (0) CHAP-Password = 0x0103d8b4385d31b89f746a2838b87fa049 (0) Service-Type = Framed-User (0) Called-Station-Id = 'proxy.corp' (0) Calling-Station-Id = '421905725408' (0) Framed-Protocol = PPP (0) CHAP-Challenge = 0xe3c6f04f3c08c6067deb9c79c060e966 (0) User-Name = '421905725408' (0) Connect-Info = '8640000' (0) NAS-IP-Address = 85.237.227.1 (0) NAS-Port = 385 (0) Qos-Policy-Policing = 'Uniq-Sess-ID385' (0) Event-Timestamp = 'Jun 18 2015 11:48:41 CEST' (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313131 Waking up in 0.3 seconds. (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 129 from 127.0.0.1:10812 to 127.0.0.1:43154 length 25 (0) Proxy-State = 0x313131 (0) # Executing section post-proxy from file ./sites-enabled/default (0) post-proxy { (0) log_proxy_reply: EXPAND /app_log/radius/auth/radius.log (0) log_proxy_reply: --> /app_log/radius/auth/radius.log (0) log_proxy_reply: EXPAND %t : Info PROXY-REPLY(%{User-Name}): %{pairs:proxy-reply:} (0) log_proxy_reply: --> Thu Jun 18 11:48:41 2015 : Info PROXY-REPLY(421905725408(a)proxy.corp): Proxy-State = 0x313131 (0) [log_proxy_reply] = ok (0) } # post-proxy = ok (0) Login incorrect (Home Server says so): [421905725408(a)proxy.corp/<via Auth-Type = CHAP>] (from client localhost port 385 cli 421905725408) (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file ./sites-enabled/default (0) Sent Access-Reject Id 111 from 127.0.0.1:1812 to 127.0.0.1:33136 length 0 (0) Finished request What i am doing wrong ? Thx.

2 3

processing in case of proxied authentification
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, In the documentation ( http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf) on the page 42 is Figure 4.3 Packet Processing Section Usage. In case of Proxied authentification following sections will be processed: Authorize, Pre-proxy and Post-proxy. As i can see in the debug output also post-auth section is processed. Is it correct ? .. (2) # Executing section post-proxy from file ./sites-enabled/default (2) post-proxy { ... (2) } # post-proxy = ok (2) Found Auth-Type = Accept (2) Auth-Type = Accept, accepting the user (2) # Executing section post-auth from file ./sites-enabled/default (2) post-auth { .... (2) } # post-auth = reject (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. ... Thx.

2 1

LDAP Operations Error
by Syed Rais Ahmad NON DRI 18 Jun '15

18 Jun '15

In my FreeRadius configuration, ntlm_auth gives me successful search output: [root@rscradiuspr01 samba]# ntlm_auth --request-nt-key --domain=DRI_NT1 --username=SYEDRA password: NT_STATUS_OK: Success (0x0) However, RADIUS rejects the user: Thu Jun 18 16:02:46 2015 : Debug: [ldap] waiting for bind result ... Thu Jun 18 16:02:46 2015 : Debug: [ldap] Bind was successful Thu Jun 18 16:02:46 2015 : Debug: [ldap] performing search in ou=users,dc=darden,dc=com, with filter (uid=SYEDRA) Thu Jun 18 16:02:46 2015 : Error: [ldap] ldap_search() failed: Operations error Thu Jun 18 16:02:46 2015 : Info: [ldap] search failed Thu Jun 18 16:02:46 2015 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jun 18 16:02:46 2015 : Info: ++[ldap] returns fail Thu Jun 18 16:02:46 2015 : Info: Using Post-Auth-Type Reject Thu Jun 18 16:02:46 2015 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Jun 18 16:02:46 2015 : Info: +- entering group REJECT {...} Thu Jun 18 16:02:46 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> SYEDRA Thu Jun 18 16:02:46 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 18 16:02:46 2015 : Info: ++[attr_filter.access_reject] returns updated Thu Jun 18 16:02:46 2015 : Info: Delaying reject of request 1 for 1 seconds Thu Jun 18 16:02:46 2015 : Debug: Going to the next request What could be the cause of this reject? Thanks. This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

3 2

Using AD and SQL to authenticate Wi-Fi users
by Bruno de Paula Larini 18 Jun '15

18 Jun '15

Hi guys, I've been using FR (3.0.4) to authenticate Wi-Fi users against Active Directory and it is working fine. But now I need to check users in SQL database too, like this: SSID1 -> check for users in AD SSID2 -> check for users in SQL database I've managed to get it working, but only if the other authentication method is disabled. Only one would work at a time. To get SQL working, I've either commented the ntlm_auth from mods-enabled/mschap or added the following to the authorize section in sites-enabled/inner-tunnel: ... update control { MS-CHAP-Use-NTLM-Auth := No } mschap ... Removing the above and/or uncommenting the ntlm_auth line, users from AD are authenticated successfully but SQL users are not. I wanted to use unlang to check if the request came from a specific Called-Station-Id, but the inner-tunnel doesn't bring this information and always return false. Is there some check I can use to know where the request came from? Thank you!

3 2

Valid SSL certificate deployment process
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 18 Jun '15

18 Jun '15

Hello All, I am using FR 3.0.8 version. I have done setup EAP-TTLS with PAP. For local setup and testing, I have used self-signed certificates. Now my setup and configuration is done and I want to do setup on production side. I have following certificates from CA, however, I am not getting how do I deploy certificates in FreeRadius because /etc/raddb/certs folder contains lots of certificate and its related to file. Root-ca.cer Ca.cer Server.cer Kindly help me on this? --- Thanks, Sunil Kulkarni

2 1

radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Dear Mr. Herwin Weststrate I just have followed your instructions and radiusd and radclient with -x options done everything fine! If need I could send the logs but they look as typical without any warnings or errors. Just both work fine. :-) I hope I can to go forward with freeradius 3.0.8 and freebsd and tune them with mysql. I will try radtest once again... May be something wrong with FreeBSD 10.... Thank you a lot for the fast feedback best wishes with radius and linux Victor ps Sorry for the repetition Среда, 17 июня 2015, 17:03 +02:00 от Herwin Weststrate <herwin(a)quarantainenet.nl>: >On 17-06-15 16:52, Victor Beliaiev wrote: >> 2/ Concole #2 >> radtest -x -4 bob hello 127.0.0.1 0 testing123 >> (0) Error parsing "stdin": Failed to get value > >radtest is a wrapper for radclient. There are two possibilities here: >either the output of radtest is invalid, or there is something wrong >with radclient. > >Could you put the following text in a file and feed that to radclient > > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00 > Cleartext-Password = 'hello' > >To feed it to radclient: > > radclient -4 -x 127.0.0.1 auth testing123 < $filename > >All my 3.0.8 installs here work fine, but they're all on linux. > >-- >Herwin Weststrate -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru ---------------------------------------------------------------------- -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru

1 0

radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Hi guys, FreeRadius3-3.0.8 has been installed 14/06/2015 FreeBSD 10.1-RELEASE #0 r274401 1/ Console #1 $su - #radiusd -X Listening on auth address * port 1812 bound to server default Listening on auth address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on auth address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 34557 Ready to process request 2/ Concole #2 radtest -x -4 bob hello 127.0.0.1 0 testing123 (0) Error parsing "stdin": Failed to get value 3/ raddb/users file checked and seems is everything ok no any other outputs in Console#1 and Console#2 windows 4/ /var/log/radius.log has no outputs 5/ ping 127.0.0.1 - is ok 6/ stdin stdout - checked ok 7/ freeradius mail archive is passed please, could you advise smth ? Thank you in advance Victor Beliaiev belve(a)mail.ru

3 2

Fwd: radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Dear Mr. Herwin Weststrate I just have followed your instructions and radiusd and radclient with -x options done everything fine! If need I could send the logs but they look as typical without any warnings or errors. Just both work fine. :-) I hope I can to go forward with freeradius 3.0.8 and freebsd and tune them with mysql. I will try radtest once again... May be something wrong with FreeBSD 10.... Thank you a lot for the fast feedback best wishes with radius and linux Victor Среда, 17 июня 2015, 17:03 +02:00 от Herwin Weststrate <herwin(a)quarantainenet.nl>: >On 17-06-15 16:52, Victor Beliaiev wrote: >> 2/ Concole #2 >> radtest -x -4 bob hello 127.0.0.1 0 testing123 >> (0) Error parsing "stdin": Failed to get value > >radtest is a wrapper for radclient. There are two possibilities here: >either the output of radtest is invalid, or there is something wrong >with radclient. > >Could you put the following text in a file and feed that to radclient > > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00 > Cleartext-Password = 'hello' > >To feed it to radclient: > > radclient -4 -x 127.0.0.1 auth testing123 < $filename > >All my 3.0.8 installs here work fine, but they're all on linux. > >-- >Herwin Weststrate -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru ---------------------------------------------------------------------- -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru

1 0