- Freeradius-Users - lists.freeradius.org

Access-Accept with multiple entries for VSA
by Al Morce 27 Nov '11

27 Nov '11

Hi, I just subscribed to this mailing list and would like to try it with a problem ! I configured the users file with a vendor specific attribute to be sent as part of the Access-Accept packet. 1- The client expect to have as many entries of that attribute as needed. 2- Freeradius allows for one entry only (under the matched user name). As a consequence: Other entries of that same attribute are discarded. What would be the right way to have a reply with multiple entries of the same attribute (vendor-specific in that case) ? Thanks, Al Morce

2 1

Why Authorization before Authentication?
by Edgar Fuß 27 Nov '11

27 Nov '11

A probably simple question I could not find explained in the FAQ or the Concepts section: Given that Authentication is proving who I am and Authorization is checking what I'm allowed to do, I naively would have expected a RADIUS server to first authenticate me an then check my authorization. Surely for a reason, what FreeRADIUS does is the other way round: first try all authorization modules and then use one authentication module. I hope I got this right. I would like to be pointed to a document explaining the rationale behind this. It's probably obvious to anyone familiar with the matter, but that doesn't include me. Thanks.

7 19

Framed-IP-Address Reply-item Value not send to NAS in Proxy Config
by klaus.ahl＠atos.net 26 Nov '11

26 Nov '11

Hi , we are using radiusd: FreeRADIUS Version 2.1.8, for host x86_64-suse-linux-gnu, built on Sep 2 2010 at 13:08:34 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. as Radius Proxy to another Radius Server (RSA 6.1) sample of users file -------------------------------------------------------------- henning Service-Type = Framed-User, Framed-IP-Address = 192.168.82.108 ----------------------------------------------------------------- (tried with TAB, blanks , with ceck-items, without check-items etc) FreeRadius is configured as a Radius Proxy, Proxy-ing works, accept Pakets are send to the NAS 192.168.4.36, but not Framed-IP !? any idea? with Version 1.0 something like this has worked : user-name Proxy-To-Realm := "company.com.de" Class = "OU=cp-man-ip;", Framed-IP-Address = 192.168.82.108 output of radiusd -X ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.4.36 port 1700, id=5, length=129 User-Name = "henning@ <mailto:henning@eplus.de> company.de" User-Password = "xxxx76506321" NAS-Port = 25550 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "x.y.146.7" Calling-Station-Id = "x.y.145.186" Tunnel-Client-Endpoint:0 = "x.y.145.186" NAS-IP-Address = 192.168.4.36 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "company.de" for User-Name = "henning@ <mailto:henning@eplus.de> company.de" [suffix] Found realm "company.de" [suffix] Adding Stripped-User-Name = "henning" [suffix] Adding Realm = "company.de" [suffix] Proxying request from user henning to realm company.de [suffix] Preparing to proxy authentication request to realm "company.de" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry henning at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 75 to x.y.131.201 port 1645 User-Name = "henning" User-Password = "xxxxxx06321" NAS-Port = 25550 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "x.y.146.7" Calling-Station-Id = "x.y.145.186" Tunnel-Client-Endpoint:0 = "x.y.145.186" NAS-IP-Address = 192.168.4.36 NAS-Port-Type = Virtual Proxy-State = 0x35 Proxying request 0 to home server x.y.131.201 port 1645 Sending Access-Request of id 75 to x.y.131.201 port 1645 User-Name = "henning" User-Password = "xxxxx506321" NAS-Port = 25550 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "x.y.146.7" Calling-Station-Id = "x.y.145.186" Tunnel-Client-Endpoint:0 = "x.y.145.186" NAS-IP-Address = 192.168.4.36 NAS-Port-Type = Virtual Proxy-State = 0x35 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. rad_recv: Access-Accept packet from host x.y.131.201 port 1645, id=75, length=81 Class = 0x53425232434ca1a7b0d282b793e7bd801180250180038198ce8002800881b499ade6f3 a5dce712800e81a1a7b0d282b793e7bd80808ebc8c Proxy-State = 0x35 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 5 to 192.168.4.36 port 1700 Class = 0x53425232434ca1a7b0d282b793e7bd801180250180038198ce8002800881b499ade6f3 a5dce712800e81a1a7b0d282b793e7bd80808ebc8c Finished request 0. Going to the next request Waking up in 4.9 seconds. ^C [12:58:10] radius1:~ # __________________________________________________________________________________________________________________________________________ Atos Information Technology GmbH, Theodor-Althoff-Straße 47, D-45133 Essen, Postfach 100 123, D-45001 Essen Telefon: +49 201 4305 0, Fax: +49 201 4305 689095, www.de.atos.net ING Bank AG, Frankfurt/Main: Konto 001 014 0937, BLZ 500 210 00, Swift / BIC INGBDEFF, IBAN DE74 5002 1000 0010 1409 37 Geschäftsführer: Winfried Holz, Vorsitzender des Aufsichtsrats: Peter Hollfelder, Handelsregister Essen HRB 19354, Ust.-ID.-Nr.: DE147861238 ___________________________________________________________________________________________________________________________________________

2 1

freeradius 2.1.7-7.el5 - How to get vendor specific attributes from LDAP
by Jakub Pech 25 Nov '11

25 Nov '11

Hello, please can anybody give me a hint how to get vendor specific atributes from LDAP and send it to the NAS? My freeradius version is 2.1.7-7.el5. When I authenticate against the users file, everything works well. rad_recv: Access-Request packet from host 31.186.188.2 port 60528, id=101, length=73 User-Name = "rad-oper" User-Password = "rad-oper" NAS-Identifier = "ar-srx100-default" NAS-IP-Address = 31.186.188.2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rad-oper", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry rad-oper at line 53 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "rad-oper" [pap] Using clear text password "rad-oper" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 101 to 31.186.188.2 port 60528 Juniper-Local-User-Name := "class2" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 101 with timestamp +302 Ready to process requests. As you can see, I need to send Vendor Specific Attribute : Juniper-Local-User-Name := "class2" which is associated with group of availalble commands on device. On OpenLDAP I edited the schema and added attributetype ( 1.3.6.1.1.1.1.28 NAME 'radiusJuniperLocalUserName' DESC 'Juniper Auth Class' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.1.1.2.13 NAME 'radiusprofile' DESC 'Abstraction of an account with RADIUS attributes' SUP top AUXILIARY MAY radiusJuniperLocalUserName ) Then I've added theese items to my test user "pech". On freeradius server I've edited: 1. ldap.attrmap checkItem Juniper-Local-User-Name radiusJuniperLocalUserName replyItem Juniper-Local-User-Name radiusJuniperLocalUserName 2. modules/ldap ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "10.10.x.y" identity = "cn=sa,dc=viphone,dc=eu" password = testtest basedn = "dc=viphone,dc=eu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" Now when I try to authenticate LDAP user "pech" I'll get: rad_recv: Access-Request packet from host 31.186.188.2 port 60647, id=85, length=69 User-Name = "pech" User-Password = "securepassword" NAS-Identifier = "ar-srx100-default" NAS-IP-Address = 31.186.188.2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "pech", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "securepassword" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 85 to 31.186.188.2 port 60647 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 85 with timestamp +17 Ready to process requests. So the user is authenticated but no Juniper-Local-User-Name attribute have been sent. Thank you very much for your help. Kind regards, Jakub Pech System Developer ------------------ Spinoco Czech Republic, a.s. Šafránkova 1243/3 155 00 Praha 5 tel +420 257 895 495 jakub.pech(a)spinoco.com www.spinoco.com Spinoco – firemní komunikace

4 19

Re: Why Authorization before Authentication?
by Alan Buxey 24 Nov '11

24 Nov '11

What are you going to send from authenticate? It should be simple, password correct or password wrong. Everything else should be in post auth, authorize or post proxy even alan -- Message may be brief as it has been sent from my mobile

1 0

rlm_perl radiusd::radlog $type codes
by Edgar Fuß 24 Nov '11

24 Nov '11

The rlm_perl Documentation (in the Wiki) lists the $type values for radiusd::radlog($type, $message) as 0 - Debug 1 - Auth 2 - Proxy 3 - Info 4 - Error while include/radiusd.h says #define L_DBG 1 #define L_AUTH 2 #define L_INFO 3 #define L_ERR 4 #define L_PROXY 5 #define L_ACCT 6 #define L_CONS 128 and I can see no translation in src/modules/rlm_perl.c. Am I missing something or is this a documentation error?

1 0

Technical paper how Freeradius works?
by Andreas Rudat 24 Nov '11

24 Nov '11

Hi, are there any and I don't see them, besides man pages/config files? Thanks

3 4

Testing Wlan
by Andreas Rudat 24 Nov '11

24 Nov '11

Hi, is there any possibility to test if two machines with the same login can sniff each others traffic? Thanks

3 4

How to use radacct in two different databases
by Nataniel Klug 24 Nov '11

24 Nov '11

Hello all, I am having a problem. The problem is I was trying to use MySQL and SQLIPPOOL but I had many problems with IP allocation and release so I choose to try PostgreSQL and it worked really fine in every aspect. The problem is: I use a software made by a third part company that can only read MySQL tables (they use some kind of a socket to connect to database) and I need to measure my clients usage and show it to the clients so they have a web PHP/Java page where my client can see his usage. So, as I am using PostgreSQL this become impossible so, is there any way to use PostgreSQL for authentication and MySQL for accounting? Is this possible? -- Descrição: 111027-nata_at_cnett

3 5

Number of queued Requests
by Mohd Khaldi 24 Nov '11

24 Nov '11

Hellow all, I have question how to find number of Access_Requests and Accounting_Request are actualy in the Radius queue. best regards Rasmi

2 1