- Freeradius-Users - lists.freeradius.org

Operator change post proxy
by Dan Fisher | Fluidata 20 Oct '11

20 Oct '11

Hi, We are using Cisco and Juniper devices as LAC's to terminate DSL sessions before sending on via L2TP to customer LNS's. We allow our customers to use radius Attribute 67 via our radius servers to specify the tunnel-server-endpoint for their sessions. We have been using Cisco LACs predominantly over the last couple of years but now have a need to move to Juniper kit for scalability constraints. The issue I have is how we allow customers to specify groups of radius reply values for failover/load balancing across their LNS's. Below is an example showing what we are sending back to our Cisco LAC's (please note the use of += as the operator for the "second" group in the list): Sending Access-Accept of id 216 to 192.168.1.1 port 50075 Tunnel-Client-Auth-Id:1 = "xxxxxxxx" Tunnel-Type:1 = L2TP Tunnel-Password:1 = "yyyyyyy" Tunnel-Server-Endpoint:1 = "1.2.3.4" Tunnel-Preference:1 = 10 Tunnel-Client-Auth-Id:2 += " xxxxxxxx" Tunnel-Type:2 += L2TP Tunnel-Password:2 += " yyyyyyy" Tunnel-Server-Endpoint:2 += "1.2.3.5" Tunnel-Preference:2 += 10 The issue I have is that the Juniper device will not process the += operator based results, so in order to have the same functionailty, the radius result would have to look like below (please note there is no += anymore): Sending Access-Accept of id 217 to 192.168.1.1 port 50075 Tunnel-Client-Auth-Id:1 = "xxxxxxxx" Tunnel-Type:1 = L2TP Tunnel-Password:1 = "yyyyyyy" Tunnel-Server-Endpoint:1 = "1.2.3.4" Tunnel-Preference:1 = 10 Tunnel-Client-Auth-Id:2 = " xxxxxxxx" Tunnel-Type:2 = L2TP Tunnel-Password:2 = " yyyyyyy" Tunnel-Server-Endpoint:2 = "1.2.3.5" Tunnel-Preference:2 = 10 I have a case open with Juniper to resolve the +=/= issue, but I haven't got an ETA of the fix yet, and I cannot just wait for it. I cannot force all of my customers to change the attributes they send me back from proxying based on the NAS-IP-Address, so I have to make the necessary changes myself on my radius servers. I know I can add a bit of code in post proxy using ulang to carry out something when the Juniper devices IP's are listed as the NAS-IP-Address, but I cannot see how to change the operator that is sent from += to =. The only complication I have is that people could send back upto 8 groups to me, and there is no guarantee that the groups will be number 1,2,3,4 etc, the customer could choose anything they like. Anyone got any ideas or able to point me in the right direction? Thanks Dan Technical Manager T 0845 868 7848 F 0845 868 7858 www.fluidata.co.uk<http://www.fluidata.co.uk/> www.twitter.com/fluidata<http://www.twitter.com/fluidata> 2 More London SE1 2AP get your data flowing ... This message is intended solely for the use of the individual or organisation to whom it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Fluidata Ltd. Fluidata accepts no responsibility for loss or damage arising from its use, including damage from virus.

3 2

setup freeradius to generateng COA
by Alex rsm 20 Oct '11

20 Oct '11

Hi, I am trying to setup freeradius to generateng COA after receiving Access-Request packets. Is there any document on how to configure this setting? It seems I am sending Accounting packet to authorization port: After sending ... echo "User-Name=test,User-Password=abc123" | /usr/local/bin/radclient -x localhost:11812 coa testing1234 I got the following debug log: Listening on authentication address * port 11812 Listening on accounting address * port 11813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 11814 Ready to process requests. Invalid packet code 43 sent to authentication port from client localhost port 34917 : IGNORED Ready to process requests. Invalid packet code 43 sent to authentication port from client localhost port 34917 : IGNORED Ready to process requests. Invalid packet code 43 sent to authentication port from client localhost port 34917 : IGNORED Ready to process requests. Thanks, ASM

3 7

Windows (7) Machine Certificates (Half Domain).
by Christ Schlacta 19 Oct '11

19 Oct '11

I've got a handful of windows clients. I'm most concerned about the Windows 7 machines, but there are a few Vista, and even an XP client. I want to deploy "Machine account certificates" for wifi authentication, so machines will be able to connect to the network BEFORE the user logs on (mainly for accessing remote shares), but only some of these machines are connected to the local DOMAIN (Samba 3, not overly relevant I don't think). What I would like to know is what should, or must, or what have you, the CN or DN attribute on the certificates for these systems look like to be used for machine authentication. I've tried just placing certificates with cn=hostname,... to the certificate store for the machine account, but they're never used, and the machine complains about not having a certificate when I try t connect to wifi. Also, most of these machines are wifi, though I plan to deploy radius on the switch soon (once the machine auth with wifi is working). I know this is a little off topic, but as it all relates to radius, I hope someone here will know the proper answer(s) or where to find clear concise documentation explaining this.

2 2

FreeRADIUS sends proxy packets out the proper interface, but with the wrong source IP (simple udpfromto problem?)
by Adam Bultman 19 Oct '11

19 Oct '11

Quick summary: I have RADIUS servers that are performing authentication and accounting for various NAS devices. I recently set up a new accounting proxy, to put a copy of my accounting files on remote hosts via a private network. I've created an additional detail writer, and created a reader. With radclient, this works. With radiusd, it does not. Problem: The detail reader, when sending the accounting packets, sends them out the *correct* interface, but with the *wrong* source IP address. (It will send out eth2, but have the source IP of eth0.) I proxy to other hosts as well, so I cannot simply force a single proxy ip address, since that will break other things. (As far as I can tell.) All my routing is good, no firewalls are in the way, etc. When I send a packet from the RADIUS servers to the new proxy hosts via radclient, it works perfectly. When radiusd tries, it doesn't work (and the new proxies show up as zombies, and then dead.) I've dug through the mailing list, the release notes, and dug through bugzilla, and about the closest thing I found was this bug: https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=38 The mailing list shows some results, but not quite what I'm looking for. Is my problem a simple lack of 'udpfromto'? My RADIUS servers bind on specific IP addresses, and not '*', so they aren't listening on INADDR_ANY. Attempting to get the server reading the detail files to also bind to an IP address and port doesn't fix it, nor does configuring the server to have an interface in addition to an ipaddr. Creating a 'middleman' - a local proxy, listening on the private IP address, which then proxies to the final accounting servers - doesn't work either. (I had hoped that if it were receiving packets on an interface, that it would know where they were accepted, and then proxy out that same interface, with the same source IP.) The 'fix' I found was a mixture of arptables and iptables. It works but I'm not happy with having to mangle any proxied packets. I'm on freeRADIUS 2.1.10, and I know there's a newer version. Should I simply build a new version, and make sure that I change my spec file to include '--with-udpfromto' (in the current one doesn't?) -- Adam

2 3

sql expansion with query string stored in attribute?
by Fajar A. Nugraha 19 Oct '11

19 Oct '11

Hi, Is it possible to use sql expansion with query stored in a radius attribute (e.g. Tmp-String-0)? Currently it mime-encodes the characters equal (=) and single quote (') to "=3D" and "=27", so it's not usable. For example, I have something like this to store my local configuration variables: local-config { sql-now="select concat('Current time = ',now())" } ... and modify safe-characters on an sql/mysql/dialup.conf to include some extra characters (including equal sign and single quote) safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /'=" ... and put some test sql expansion (on sites-available/default, authorize section) update control { Tmp-String-0 := "${local-config.sql-now}" } update reply { Reply-Message := "Test1: ${local-config.sql-now}" Reply-Message += "Test2: %{sql:${local-config.sql-now}}" Reply-Message += "Test3: %{control:Tmp-String-0}" Reply-Message += "Test4: %{sql:%{control:Tmp-String-0}}" } ... and the resulting radtest output: $ radtest testuser testpass 127.0.0.1 0 testing123 Sending Access-Request of id 228 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=228, length=166 Reply-Message = "Test1: select concat('Current time = ',now())" Reply-Message = "Test2: Current time = 2011-10-19 13:35:21" Reply-Message = "Test3: select concat('Current time = ',now())" Reply-Message = "Test4: " So the fourth test (sql expansion with query in an attribute) failed. Radius debug output shows this ++[control] returns updated sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select concat('Current time = ',now()) -> select concat('Current time = ',now()) rlm_sql (sql): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql): Released sql socket id: 4 expand: Test2: %{sql:select concat('Current time = ',now())} -> Test2: Current time = 2011-10-19 13:35:21 expand: Test3: %{control:Tmp-String-0} -> Test3: select concat('Current time = ',now()) sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: %{control:Tmp-String-0} -> select concat=28'Current time = '=2Cnow=28=29=29 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, select concat=28'Current time = '=2Cnow=28=29=29: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '=2Cnow=28=29=29' at line 1 rlm_sql (sql): Released sql socket id: 3 expand: Test4: %{sql:%{control:Tmp-String-0}} -> Test4: ++[reply] returns updated Is there a way to change which characters remain unencoded? Thanks. -- Fajar

6 9

Problems with my radrelay configuration?
by tonimanel 19 Oct '11

19 Oct '11

Hi, When I launch freeradius with -X and -n radrelay options, I get this message: Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.851083 sec The radacct directory exists, but the detail file not exists, is it an error? What's happened? I post the result in debug mode. Thanks, ==================================== root@debian:/etc/freeradius# freeradius -X -n radrelay FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radrelay.conf including configuration file /etc/freeradius/modules/always main { allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "@libdir@" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 65536 pidfile = "/var/run/radrelay/radrelay.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 0 status_server = no } } radrelay: #### Loading Realms and Home Servers #### home_server radrelay { ipaddr = 192.168.1.130 port = 1812 type = "acct" secret = "testing123" response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool radrelay { type = fail-over home_server = radrelay } realm radrelay { acct_pool = radrelay } radrelay: #### Loading Clients #### radrelay: #### Instantiating modules #### instantiate { } radrelay: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radrelay.conf modules { Module: Checking preacct {...} for more modules to load } # modules } # server radrelay: #### Opening IP addresses and Ports #### listen { type = "detail" listen { filename = "/var/log/freeradius/radacct/detail" load_factor = 50 poll_interval = 1 retry_interval = 30 } } Listening on /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 1.000000 sec Listening on proxy address * port 1188 Waking up in 0.9 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.914341 sec Waking up in 0.9 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 1.093880 sec Waking up in 1.0 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.851083 sec Waking up in 0.8 seconds. ^C -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-my-radrelay-configura… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 33

DHCP with multiple interfaces
by Francois Gaudreault 19 Oct '11

19 Oct '11

Hi, I configured (basic) DHCP on two different interfaces : listen { ipaddr = * port = 67 type = dhcp interface = eth0 broadcast = yes } listen { ipaddr = * port = 67 type = dhcp interface = eth1.102 broadcast = yes } I need to establish a different (basic for now) lease policy by interface (ie. different network range). How can I know from which interface the request came? PS. By the way, if I don't set ipaddr = * , broadcast are not handled. Normal? -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 3

Del dynamic client working?
by tohaikmeng 18 Oct '11

18 Oct '11

Hello guys, In order to delete a dynamically defined client, the client IP file needs to reside in dynamic-clients folder upon startup of the radius daemon. I wondering if we are able to delete the dynamic defined client without restart of the radius daemon? ERROR: Client 192.168.169.89 was not dynamically defined. alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/Del-dynamic-client-working-tp491292… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Framed-IP-Address null value
by Alejandro Gandara 17 Oct '11

17 Oct '11

Hello all! Im testing freeradius in a preproduction machine. I've configured It with freeradius + Ldap. At this moment I only need read from ldap these attributes: user, password and Framed-IP-Address to assing an IP to an specific User. The problem cames when i use this: in /etc/freeradius/sites-enable/default (authorize section) update reply { Framed-IP-Address := "%{Client-IP-Address}" } I got the following error in debug mode: ++? if (NAS-Port-Type == 'Ethernet') ? Evaluating (NAS-Port-Type == 'Ethernetl') -> TRUE ++? if (NAS-Port-Type == 'Ethernet') -> TRUE ++- entering if (NAS-Port-Type == 'Ethernet') {...} expand: %{Framed-IP-Address} -> ERROR: Failed parsing value "" for attribute Framed-IP-Address: Failed to find IP address for But if I change %{Framed-IP-Address} this for %{Client-IP-Address}, just to check if the query is right. I got the result expected "The client IP Address". Can someone give me some light on the issue? Thanks very much. Álex

5 4

Problem with F5 BigIP accouting : hexadecimal attribute
by Vincent, Fabien 17 Oct '11

17 Oct '11

Dear all, I'm using Radius for authenticating admin users on different network equipments. "group authorize {...}" works fine with rlm_ldap and group management. But I have some problem for accounting on F5 BigIP LTM / GTM. In fact, my radius accounting server is receiving accounting-request like this : Accounting-Request packet from host 10.10.10.10 port 36875, id=29, length=281 NAS-IP-Address = [IP address unknown, not corresponding to NAS interfaces] F5-Attr-14 = [Hexa decimal output starting with 0x .] WARNING: Empty section. Using default return values. +- entering group accounting {...} [sql] expand: packet has no accounting status type. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> packet has no accounting status type. [user '', nas '[nas IP unknown]'] [sql] packet has no accounting status type. [user '', nas '[nas IP unknown]'] ++[sql] returns invalid Finished request 37. Cleaning up request 37 ID Did someone here already use accounting with F5 BigIP LTM or GTM ? I'm looking to make this working by changing audit_forward TCL script provided with F5 (syslog-ng) but I wasn't able to produce something different . I also tried to edit the dictionnary for F5 in /usr/share/freeradius/dictionary.f5 ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string ++ ATTRIBUTE F5-Attr-14 14 octets Thanks in advance for your help ! Fabien VINCENT <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr

5 6