- Freeradius-Users - lists.freeradius.org

Using different realm in the same server
by Gabriele Brosulo 31 Jan '12

31 Jan '12

Hi all, I'm trying to use different realm into the same server, but I probably miss something. I just want to check my users in radcheck table as user@realm, but I can't get it working. here you are my radcheck table mysql> select * from radcheck where username like 'tesths%'; +----+------------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+------------------+--------------------+----+--------------+ | 5 | tesths2 | Cleartext-Password | := | tesths2 | | 4 | tesths@drupalAP1 | Cleartext-Password | := | tesths | | 11 | tesths@drupalAP1 | Login-Time | := | Any1000-2000 | | 8 | tesths@drupalAP1 | Max-Daily-Session | := | 36000 | | 12 | tesths@drupalAP1 | Expiration | := | 31 Mar 2012 | +----+------------------+--------------------+----+--------------+ 5 rows in set (0.03 sec) Following the output of freeradius -X replying to my Access-Request. As you can see it search for the cleartext password for tesths@drupalAP1, but it doesn't find it: rad_recv: Access-Request packet from host 213.144.94.217 port 2060, id=64, length=322 ChilliSpot-Version = "1.2.7-svn" User-Name = "tesths@drupalAP1" CHAP-Challenge = 0x1d5cbf018e5c3e1f0f27db84019d6334 CHAP-Password = 0x00e56e25844efe021fe0ada407d300798d Service-Type = Login-User Acct-Session-Id = "4f28155900000001" Framed-IP-Address = 10.1.0.3 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "48-5D-60-71-DC-CC" Called-Station-Id = "58-6D-8F-B4-69-F7" NAS-IP-Address = 192.168.2.152 NAS-Identifier = "coovaAP01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Coova_HotSpot01" WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3660/logoff" Message-Authenticator = 0xcbdb61af05f57eb2c5ef22c62a339623 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "drupalAP1" for User-Name = "tesths@drupalAP1" [suffix] No such realm "drupalAP1" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> tesths@drupalAP1 [sql] sql_set_user escaped user --> 'tesths@drupalAP1' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tesths@drupalAP1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tesths@drupalAP1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tesths@drupalAP1' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' -> SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> tesths@drupalAP1 [dailycounter] sql_set_user escaped user --> 'tesths@drupalAP1' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' -> SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' rlm_sql (sql): Reserving sql socket id: 0 [dailycounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 0 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'} -> rlm_sqlcounter: No integer found in string "" ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: '31 Mar 2012' ++[expiration] returns ok rlm_logintime: Checking Login-Time: 'Any1000-2000' rlm_logintime: timestr returned accept rlm_logintime: Session-Timeout set to: 9240 ++[logintime] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "tesths@drupalAP1" with CHAP password [chap] Using clear text password "tesths" for user tesths@drupalAP1 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tesths@drupalAP1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 64 to 213.144.94.217 port 2060 Waking up in 4.9 seconds. Cleaning up request 3 ID 64 with timestamp +378 Ready to process requests. How can I have the realm be part of the authentication? Thanks a lot -- Gabriele Dr. Brosulo Responsabile Web EdiSoft Srl

1 0

Setting Acct-Interim-Interval for all users
by Nataniel Klug 31 Jan '12

31 Jan '12

Hello all, I recently went through a problem concerning Acct-Interim-Interval that, for some reason, was not been set for some of my clients. The result was catastrophic inside my network. Hopefully and been helped by Fajar A. Nugraha (which I thank for the time spent) I was able to identify the problem but I am not been able to solve the problem for good. Sometimes my Freeradius send information about a client from radgroupreply and sometimes, for the same client, it send from radreply. The problem is in this trick when it send from radreply it was not sending Acct-Interim-Interval because it was not there. I am changing my software (not freeradius) to update my SQL tables correctly but, to solve this problem, I wish I could set a DEFAULT value for Acct-Interim-Update that would work as a backup plan in cases like this. Is it possible to setup this parameter as a default for all clients using my Radius? -- Regards, Nataniel Klug

2 2

Question about WARNING in rlm_sql_mysql
by Krzysztof Grobelak 31 Jan '12

31 Jan '12

Hello all, Can somebody shed some light what the 'You probably need to lower "min"' means. I just installed fresh freeradius from git. All my settings are the same as in the last version but apart from the radiusd -X not working (but the radiusd -lxx -l stdout is) radius.log displays this warning about lowering number of sql connections. Can anybody give some advice?? Regards, Krzysztof

3 4

Mixed Environment Question
by Paul Stewart 31 Jan '12

31 Jan '12

Hi there. Thank you to those folks to helped me recently understanding the Juniper attributes etc - much appreciated. What is the practical issues with a users file entry that is mixing vendor attributes? Ie. pstewart-stat Auth-Type = System Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = xxx.xxx.xxx.73, Cisco-AVPair = "lcp:interface-config#2=rate-limit output 512000 375000 512000 conform-action transmit exceed-action drop", Cisco-AVPair = "lcp:interface-config#1=rate-limit input 512000 375000 512000 conform-action transmit exceed-action drop", ERX-Ingress-Policy-Name = lite, ERX-Egress-Policy-Name = lite So far I have tested this on a Juniper ERX and it simply ignores the Cisco attributes, which was what I'm hoping for. I plan to float some Juniper attributes towards some Cisco gear at some point to see how it handles it. Anyone have much practical experience with this? Is it expected to always ignore additional VSA's or is it a 'crap shoot' depending on the vendor? We have customers that sometimes will connect to Cisco for example, but could also connect that same username to a Juniper (not at the same time, but within minutes of one another). I am trying to come up with a users file entry that keeps all vendor specific attributes in intact - am I playing with fire? ;) Paul

3 8

Decoding complex CableLabs-Event-Message
by Laurent Debacker 31 Jan '12

31 Jan '12

Hi, We would like to use FreeRadius to decode Cablelabs accounting messages, as specified in http://www.cablelabs.com/packetcable/downloads/specs/PKT-SP-EM-I12-05812.pdf . FreeRadius has a CableLabs dictionary, which works fine, but... The value of one of the AVP, CableLabs-Event-Message, is actually an HEX value containing additional fields. For example: CableLabs-Event-Message = 0x0001d2d2026d30310000000000003030313030303000 0e812333000100033031000000000000303031303030300000000006323031323031333130363032 32312e3633390000000081000500 The FreeRadius does not decode that value to get all details. For example, bytes 4 to 28 (d2d2026d303100000000000030303130303030000e812333) is actually the BCID (Billing Correlation ID) field. The BCID itself contains 4 "sub" fields: NTP time reference (4 first bytes), Element ID (next 8 bytes), Time Zone (next 8 bytes), and Event counter (ast 4 bytes). See the packet cable specifications for more details. I understood the only way would be to write a perl module to decode those values. Before I start writing, does anyone know of any implementation of such a perl module? I would not like spending my time rewriting something that already exists. Thanks in advance for any help anyone could provide on this topic. Laurent.

2 2

How to Restrict All Users from Certain APs
by White III, Joe 31 Jan '12

31 Jan '12

I'm running Freeradius 1.0.1 using MySQL as the database backend. I need to configure the server so that all users are restricted from using certain access points (i.e. guest network). It appears I need to use a DEFAULT user definition in the users file, but I can't find any examples to work from. Has someone else done this? If so, I'd give anything to see how you did it. Thanks. Joe White System Administrator @ Arvato Digital Services @ 108 Monticello Rd, Weaverville, NC 28787 @ 828-423-0269

4 5

Setting Acct-Interim-Interval for all users
by Nataniel Klug 30 Jan '12

30 Jan '12

Hello all, I recently went through a problem concerning Acct-Interim-Interval that, for some reason, was not been set for some of my clients. The result was catastrophic inside my network. Hopefully and been helped by Fajar A. Nugraha (which I thank for the time spent) I was able to identify the problem but I am not been able to solve the problem for good. Sometimes my Freeradius send information about a client from radgroupreply and sometimes, for the same client, it send from radreply. The problem is in this trick when it send from radreply it was not sending Acct-Interim-Interval because it was not there. I am changing my software (not freeradius) to update my SQL tables correctly but, to solve this problem, I wish I could set a DEFAULT value for Acct-Interim-Update that would work as a backup plan in cases like this. Is it possible to setup this parameter as a default for all clients using my Radius? -- Descrição: 111027-nata_at_cnett

1 0

Problems using SQL IP Pool
by Nataniel Klug 30 Jan '12

30 Jan '12

Hello all, Ive been using Freeradius for a long time and about 5 months ago I made a change in my default layout so I could use Freeradius SQL-IPPool running over PostgreSQL. This is working almost fine but for some reason I cant figure out its giving the same IP address to two different clients. So, my network layout is something like this: [ freeradius ] -- [ external* mysql ] -- [ external* postgresql ] * external I mean as the databases are running in separate hardware but in the same physical network My customers are authenticating over PPPoE interfaces on two parallel servers that work as a backup for each other but they are running simultaneously. This would be layout for my clients: (internet) [ auth01/auth02 ] (clients) Auth01 and Auth02 can both communicate with Freeradius in the same physical network and they are getting there with no more than 1 ms (its a gigabit network that fairly is using 50 mbit). I am using MySQL and PostgreSQL for a reason: somehow the software I use to bill my customers can only work with MySQL radacct table and it was not able to read the radacct from PostgreSQL. So I am running accounting over MySQL and Authentication/Authorization over PostgreSQL (I will post the configuration files in the end of this message). So, returning to the problem, this is what is happening: http://www.cnett.com.br/nata/imagens/Capturar.JPG There is two clients using the SAME IP which is a problem. Looking into my Freeradius log file I could not find when cjunior got the IP I have JUST taise allocation: Fri Jan 27 12:20:03 2012 : Auth: Login OK: [cjunior] (from client LJS.AUTH.02 port 69822 cli 74:EA:3A:D1:FD:17) Fri Jan 27 12:20:03 2012 : Info: Allocated IP: 186.251.148.216 from main_pool (did cnett_pppoe cli 74:EA:3A:D1:FD:17 port 69822 user cjunior) Fri Jan 27 14:41:38 2012 : Info: Released IP 186.251.148.216 (did cnett_pppoe cli 74:EA:3A:D1:FD:17 user cjunior) Fri Jan 27 14:45:47 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.02 port 69530 cli 00:02:72:89:34:C5) Fri Jan 27 14:45:47 2012 : Info: Allocated IP: 186.251.150.130 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69530 user taise) Fri Jan 27 15:18:01 2012 : Auth: Login OK: [cjunior] (from client LJS.AUTH.02 port 69668 cli 74:EA:3A:D1:FD:17) Fri Jan 27 15:18:01 2012 : Info: Allocated IP: 186.251.150.226 from main_pool (did cnett_pppoe cli 74:EA:3A:D1:FD:17 port 69668 user cjunior) Fri Jan 27 12:19:14 2012 : Info: Allocated IP: 186.251.150.136 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69799 user taise) Fri Jan 27 23:22:04 2012 : Info: Released IP 186.251.150.130 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:19:05 2012 : Info: Released IP 186.251.150.5 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:20:23 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.02 port 69525 cli 00:02:72:89:34:C5) Mon Jan 30 08:20:23 2012 : Info: Allocated IP: 186.251.151.65 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 69525 user taise) Mon Jan 30 08:23:54 2012 : Info: Released IP 186.251.151.65 (did cnett_pppoe cli 00:02:72:89:34:C5 user taise) Mon Jan 30 08:24:05 2012 : Auth: Login OK: [taise] (from client LJS.AUTH.01 port 350112 cli 00:02:72:89:34:C5) Mon Jan 30 08:24:05 2012 : Info: Allocated IP: 186.251.150.118 from main_pool (did cnett_pppoe cli 00:02:72:89:34:C5 port 350112 user taise) This is really strange. Bellow I am showing my PostgreSQL radippool table and there is just the taise record (ok, I know, it could not have both). http://www.cnett.com.br/nata/imagens/Capturar1.JPG Looking for problems I also checked the usage of CPU and RAM on PostgreSQL box and MySQL box but there is nothing I could use. For those who ask I change the pool_key because I was having duplicated pool_key from my NAS (Auth01 and Auth02) so I just made a change where the name of the server is showing. The problem with the duplicate IPs is older than the change so the pool_key is discarded. http://www.cnett.com.br/nata/imagens/cpu_usage_postgres-mysql.JPG Is it possible to someone help me finding a solution? -- Descrição: Descrição: 111027-nata_at_cnett

2 5

self-signed root CA
by McNutt, Justin M. 30 Jan '12

30 Jan '12

So I'm getting some pushback in my organization against using a self-signed CA for signing my RADIUS server certs. To make a long story short, I was asked to find out what other people were doing. For my own reasons, I'd like to know slightly more than that. If you AREN'T using a self-signed CA for your RADIUS server, what made you use another CA, and what CA did you use? And just to be clear, is the concensus still that a self-signed CA is the way to go, assuming that you have a decent way to distribute the CA cert (which we do) to the clients who need to trust it? I've read /etc/raddb/certs/README and I've done some Googling and everything I find pretty much assumes that you're using a self-signed CA. The README explains briefly why, but my management wants more assurance than that, so here I am. Looking forward to your responses, and thanks in advance. --J

7 11

Access-Accept if user exists in database
by Mika 30 Jan '12

30 Jan '12

Hello. Running 2.1.10 with virtual-servers configured with many port configurations, sql modules loaded and working. The idea for this new port is: Users authenticating with smartcards that get checked outside the FreeRadius and we want to permit/deny access if the user-name does or does not exist in a SQL database. This means no User-Password checking. We have the NAS configured so it will send user-name and an empty or a bogus password in the Access-Request for each User-Name I would like to add a port configuration that checks the above. My unlang skill are limited so i am hoping for some good pointers here. Something like: authorize { update request { TmpString := "%{sql:select User FROM table where.... }" if User-Name == %{TmpString} send Access-Accept else send Access-Reject There are probably easier ways of doing this? Is this possible or is the User-Password required for every authentication? Any help appreciated. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/Access-Accept-if-user-exists-in-dat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1