- Freeradius-Users - lists.freeradius.org

Re: Password change after expire with Cisco ASA to local FR user DB (text file) Not Working
by Will Richmond 09 Feb '12

09 Feb '12

thx all, i am stuck on this point now: mschap { passchange { local_cpw = "%{xlat:...} } Does there exist an "xlat:" that NT-hashs new cleartext password, deletes the change pass xtrl attribute in users file and then writes the new pass there? or am I going about this the wrong way? thx, Will -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Wednesday, February 8, 2012 12:42 PM To: will(a)bootit.com, 'FreeRadius users mailing list' Subject: Re: Password change after expire with Cisco ASA to local FR user DB (text file) Not Working On Thu, Feb 9, 2012 at 3:38 AM, Will Richmond <will(a)bootit.com> wrote: > Thx alan, I found/read read the docs, but still trying to determine this: Which config file contains this setting: > > To actually force a client to change passwords, you must set the expiry bit in the SMB-Account-Ctrl value - for example: > > update control { > # U == user > # e == expired > SMB-Account-Ctrl-Text := '[Ue]' > } > > and how can i control this on a per user basis in teh users file? IOW, i dont want to force everyone to change their password. so there must be some sort of per-user flag to configure in the users file? any attribute that you put in the control block should also be able to go into first line of users file (where you put Expiration earlier), or radcheck table. see "man 5 users" and doc/rlm_sql. -- Fajar

3 2

Sample Radius Accounting Data
by Christ Schlacta 09 Feb '12

09 Feb '12

I'm trying to find some sample accounting data from freeradius, preferably in a mysql database to run some test analyses on. I'm considdering using Freeradius + Mysql accounting in my environment, and don't have the infrastructure to generate test data, and would like to analyze some to see what useful metrics I can actually extract from it. If anyone here knows of some good sample data online (my searches have turned up nothing) or is willing to provide some in the form of a sanitized mysql dump, I'd much appreciate it and I'm sure others might as well :) Thanks in advance!

1 0

Re: Password change after expire with Cisco ASA to local FR user DB (text file) Not Working
by Will Richmond 08 Feb '12

08 Feb '12

Thx alan, I found/read read the docs, but still trying to determine this: Which config file contains this setting: To actually force a client to change passwords, you must set the expiry bit in the SMB-Account-Ctrl value - for example: update control { # U == user # e == expired SMB-Account-Ctrl-Text := '[Ue]' } and how can i control this on a per user basis in teh users file? IOW, i dont want to force everyone to change their password. so there must be some sort of per-user flag to configure in the users file?

2 1

Last login time in LDAP?
by John Doppke 08 Feb '12

08 Feb '12

Does someone know if freeradius can update an LDAP user attribute as part of post processing? Would it be via xlat or unlang? tia -John

3 2

Password change after expire with Cisco ASA to local FR user DB (text file) Not Working
by Will Richmond 08 Feb '12

08 Feb '12

special thx to phil and alex for inital help testing FR with password change. With some help today, I managed to download, compile and install the latest copy of FR source code on centOS server. I cannot however get a password change prompt to appear on my calling-station device. any ideas? I am running this in test lab with cisco ASA, which is sending MS-CHAPv2 request to FR server, as some debug output shows: MS-CHAP-Challenge = 0x0d786b3e916d7e (shortened) MS-CHAP2-Response = 0x008ebeb5e7b5 (shortened) My local user account in users file is configured with NT-LM Hash, and set to expire: wrichmond NT-Password :="64f12cddaa88057e06a81b54e73b949b", Expiration :="Dec 04 1994" I can login fine when Expiration filed is commented out. I have configured dictionary file for password expiration: VALUE Server-Config Password-Expiration 30 VALUE Server-Config Password-Warning 5 When I send AUTH request, I am denied login, with an account password is expired message. I should get a prompt on my calling-station device to change password. The cisco ASA is configure with password-management: tunnel-group TG_VPN_1 general-attributes default-group-policy GPOL_1 password-management password-expire-in-days 5 On FR server, I get this debug output: rad_recv: Access-Request packet from host 2.2.2.2 port 1025, id=28, length=217 User-Name = "wrichmond" NAS-Port = 188416 Called-Station-Id = "3.3.3.3" Calling-Station-Id = "1.1.1.1" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "1.1.1.1" MS-CHAP-Challenge = XXXXXXXXXXXXXXXXXXXX MS-CHAP2-Response = XXXXXXXXXXXXXXXXXXXXXX NAS-IP-Address = 2.2.2.2 Cisco-AVPair = "ip:source-ip=1.1.1.1" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [preprocess] = ok (0) [chap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix : No '@' in User-Name = "wrichmond", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) files : users: Matched entry wrichmond at line 76 (0) [files] = ok (0) expiration : Checking Expiration time: 'ÐLá.04 1994' (0) expiration : Account has expired (0) expiration : expand: Password Has Expired -> Password Has Expired (0) [expiration] = userlock (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) group REJECT { (0) - entering group REJECT {...} (0) attr_filter.access_reject : expand: %{User-Name} -> wrichmond (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) - entering policy remove_reply_message_if_eap {...} (0) ? if (reply:EAP-Message && reply:Reply-Message) (0) ? Evaluating (reply:EAP-Message ) -> FALSE (0) ? Skipping (reply:Reply-Message) (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) - entering else else {...} (0) [noop] = noop (0) - else else returns noop (0) - policy remove_reply_message_if_eap returns noop (0) Finished request 0.

2 1

mulitipule connections
by Ski Mountain 07 Feb '12

07 Feb '12

Hello, I have searched quite a bit. I am looking for a answer on the best way to disable mulitipule logins by the same user. I have been reading http://freeradius.org/radiusd/doc/Simultaneous-Use One problem is I get a error when I try to run radwho radwho: Error reading /var/log/freeradius/sradutmp: No such file or directory This checkrad.pl scrpt I can not find it anywhere on my ubuntu 10.04 server. Where would if find a copy. I do have a radutmp file. Should there be entries in it when no one is connected? So is the only way,to run snmp on the server, or has that way outdated now? Thanks for the help

4 4

Freeradius doesn't record acct-stop-time.
by Rodrigo Yoshioka 07 Feb '12

07 Feb '12

Hi... My freeradius are recording in mysql all sessions about start connection, but it didn´t finish it. when a device is logged out it remain connected at mysql, doing my proprietary CRM mistake to return connection data. Checking detailed log, its registering start connection and stop connection, the problem is just in mysql... It is probably a configuration that I should enable, but I don´t know wich. Can anyone help me.?

2 1

Authorize with extra attributes
by tonimanel 07 Feb '12

07 Feb '12

Hi, I have been testing in my FreeRADIUS, login with some users. I would like that these users could to do login to my NAS that contains an extra attribute called WISPr-location-name. I think that when users try to login, this attribute is not being checked by FreeRADIUS server or my NAS device has not sent it. I have defined in radgroupcheck this attribute with its groupname, attribute name, op (==) and its Value. If I configured my NAS with location1 in Location name, and in radgroupcheck table I have got location2, login process should not works? In my case works fine. So I think that is wrong. I have been reading and is not necessary to add an extra configuration. These attributes would should works fine with standard configuration. Any advice or idea? Thank you very much. Output result: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 50 reject_delay = 3 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "19m_K28hespggeR" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 8 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 7 rlm_sql (sql): Read entry nasname=80.26.102.157,shortname=NataliWifi,secret=sj6bo5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 80.26.102.157 (NataliWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=0.0.0.0/0,shortname=FaberWifi,secret=62p@%5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 0.0.0.0 (FaberWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=213.0.2.116,shortname=WifiPoint,secret=Mb6xUH14yXK27F1d rlm_sql (sql): Adding client 213.0.2.116 (WifiPoint, server=<none>) to clients list rlm_sql (sql): Read entry nasname=80.36.217.106,shortname=PamadiWifi,secret=mk5mk5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 80.36.217.106 (PamadiWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=213.97.154.93,shortname=PamadiWifiArenas,secret=mk6ml5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 213.97.154.93 (PamadiWifiArenas, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 7 Module: Linked to module rlm_sqlcounter Module: Instantiating module "noresetcounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 11274 rlm_sqlcounter: Current Time: 1328610162 [2012-02-07 11:22:42], Next reset 0 [2012-02-07 11:00:00] rlm_sqlcounter: Current Time: 1328610162 [2012-02-07 11:22:42], Prev reset 0 [2012-02-07 11:00:00] Module: Instantiating module "noresetcounter2" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter noresetcounter2 { counter-name = "One-All-Session-Time" check-name = "One-All-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute One-All-Session-Time is number 11275 rlm_sqlcounter: Check attribute One-All-Session is number 11276 rlm_sqlcounter: Current Time: 1328610162 [2012-02-07 11:22:42], Next reset 0 [2012-02-07 11:00:00] rlm_sqlcounter: Current Time: 1328610162 [2012-02-07 11:22:42], Prev reset 0 [2012-02-07 11:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 81.32.199.141 port 46129, id=19, length=225 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "F0:7D:68:5F:58:3D" Called-Station-Id = "demohotspot" NAS-Port-Id = "wlan1" User-Name = "D3s85x" NAS-Port = 2147483651 Acct-Session-Id = "80000003" Framed-IP-Address = 172.21.254.255 Mikrotik-Host-IP = 172.21.254.255 WISPr-Location-Name = "location1" CHAP-Challenge = 0x1059ebebe06029bf09e9e5917b2eeedc CHAP-Password = 0x8c2b42aacc0c71b31a795ca5f99e8b8fb3 Service-Type = Login-User WISPr-Logoff-URL = "http://172.21.0.1/logout" NAS-Identifier = "Pruebas fabergames" NAS-IP-Address = 192.168.1.118 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "D3s85x", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> D3s85x [sql] sql_set_user escaped user --> 'D3s85x' rlm_sql (sql): Reserving sql socket id: 6 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'D3s85x' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'D3s85x' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'D3s85x' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'DEMO01_000020' ORDER BY id rlm_sql (sql): Released sql socket id: 6 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter2] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. CHAP-Password is correct. # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 19 to 81.32.199.141 port 46129 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 81.32.199.141 port 40336, id=20, length=168 Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "F0:7D:68:5F:58:3D" Called-Station-Id = "demohotspot" NAS-Port-Id = "wlan1" User-Name = "D3s85x" NAS-Port = 2147483651 Acct-Session-Id = "80000003" Framed-IP-Address = 172.21.254.255 Mikrotik-Host-IP = 172.21.254.255 WISPr-Location-Name = "location1" Event-Timestamp = "Feb 7 2012 11:24:13 CET" NAS-Identifier = "Pruebas fabergames" Acct-Delay-Time = 0 NAS-IP-Address = 192.168.1.118 # Executing section preacct from file /etc/freeradius/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2147483651,Client-IP-Address = 81.32.199.141,NAS-IP-Address = 192.168.1.118,Acct-Session-Id = "80000003",User-Name = "D3s85x"' [acct_unique] Acct-Unique-Session-ID = "4a9f038f14d22291". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "D3s85x", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop # Executing section accounting from file /etc/freeradius/sites-enabled/default +- entering group accounting {...} [sql] expand: %{User-Name} -> D3s85x [sql] sql_set_user escaped user --> 'D3s85x' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP rlm_sql (sql): Reserving sql socket id: 5 rlm_sql (sql): Released sql socket id: 5 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> D3s85x attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 20 to 81.32.199.141 port 40336 Finished request 1. Cleaning up request 1 ID 20 with timestamp +91 Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 19 with timestamp +91 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorize-with-extra-attributes-tp5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

free radius with cisco asa and password change feature
by Will Richmond 07 Feb '12

07 Feb '12

Hi, does free radius support password change feature when authenticating cisco asa vpn users via the radius server? authentication method doesnt matter, I am just wondering if its possible to force a local radius DB user to change their password via a vpn login with the cisco product devices? This is support for example with Microsoft IAS, but user has to live in Microsoft AD DB. thx in advance, Will

3 3

Returning Filter-Id based on LDAP group
by Cornelius Kölbel 06 Feb '12

06 Feb '12

Hello list, I'd like to set the Filter-Id in the response based on an LDAP group. authorize { .... if ( Ldap-Group =~ /CN=group1,ou=groups,dc=company,dc=com/ ) { update control { Tmp-String-1 := "group1" } .... } post-auth { .... update reply { Filter-Id := "%{control:Tmp-String-1}" } } This works like a charme! As I got a lot of groups, I'd like to do some pattern matching... if ( Ldap-Group =~ /CN=(xyz),ou=groups,dc=company,dc=com/ ) { update control { Tmp-String-1 := "%{1}" } ... but it seems that the ldap_groupcmp does not support pattern matching? Am I right or does anybody has another idea? Thanks a lot and kind regards Cornelius

2 2