- Freeradius-Users - lists.freeradius.org

Windows (7) Machine Certificates (Half Domain).
by Christ Schlacta 19 Oct '11

19 Oct '11

I've got a handful of windows clients. I'm most concerned about the Windows 7 machines, but there are a few Vista, and even an XP client. I want to deploy "Machine account certificates" for wifi authentication, so machines will be able to connect to the network BEFORE the user logs on (mainly for accessing remote shares), but only some of these machines are connected to the local DOMAIN (Samba 3, not overly relevant I don't think). What I would like to know is what should, or must, or what have you, the CN or DN attribute on the certificates for these systems look like to be used for machine authentication. I've tried just placing certificates with cn=hostname,... to the certificate store for the machine account, but they're never used, and the machine complains about not having a certificate when I try t connect to wifi. Also, most of these machines are wifi, though I plan to deploy radius on the switch soon (once the machine auth with wifi is working). I know this is a little off topic, but as it all relates to radius, I hope someone here will know the proper answer(s) or where to find clear concise documentation explaining this.

2 2

FreeRADIUS sends proxy packets out the proper interface, but with the wrong source IP (simple udpfromto problem?)
by Adam Bultman 19 Oct '11

19 Oct '11

Quick summary: I have RADIUS servers that are performing authentication and accounting for various NAS devices. I recently set up a new accounting proxy, to put a copy of my accounting files on remote hosts via a private network. I've created an additional detail writer, and created a reader. With radclient, this works. With radiusd, it does not. Problem: The detail reader, when sending the accounting packets, sends them out the *correct* interface, but with the *wrong* source IP address. (It will send out eth2, but have the source IP of eth0.) I proxy to other hosts as well, so I cannot simply force a single proxy ip address, since that will break other things. (As far as I can tell.) All my routing is good, no firewalls are in the way, etc. When I send a packet from the RADIUS servers to the new proxy hosts via radclient, it works perfectly. When radiusd tries, it doesn't work (and the new proxies show up as zombies, and then dead.) I've dug through the mailing list, the release notes, and dug through bugzilla, and about the closest thing I found was this bug: https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=38 The mailing list shows some results, but not quite what I'm looking for. Is my problem a simple lack of 'udpfromto'? My RADIUS servers bind on specific IP addresses, and not '*', so they aren't listening on INADDR_ANY. Attempting to get the server reading the detail files to also bind to an IP address and port doesn't fix it, nor does configuring the server to have an interface in addition to an ipaddr. Creating a 'middleman' - a local proxy, listening on the private IP address, which then proxies to the final accounting servers - doesn't work either. (I had hoped that if it were receiving packets on an interface, that it would know where they were accepted, and then proxy out that same interface, with the same source IP.) The 'fix' I found was a mixture of arptables and iptables. It works but I'm not happy with having to mangle any proxied packets. I'm on freeRADIUS 2.1.10, and I know there's a newer version. Should I simply build a new version, and make sure that I change my spec file to include '--with-udpfromto' (in the current one doesn't?) -- Adam

2 3

sql expansion with query string stored in attribute?
by Fajar A. Nugraha 19 Oct '11

19 Oct '11

Hi, Is it possible to use sql expansion with query stored in a radius attribute (e.g. Tmp-String-0)? Currently it mime-encodes the characters equal (=) and single quote (') to "=3D" and "=27", so it's not usable. For example, I have something like this to store my local configuration variables: local-config { sql-now="select concat('Current time = ',now())" } ... and modify safe-characters on an sql/mysql/dialup.conf to include some extra characters (including equal sign and single quote) safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /'=" ... and put some test sql expansion (on sites-available/default, authorize section) update control { Tmp-String-0 := "${local-config.sql-now}" } update reply { Reply-Message := "Test1: ${local-config.sql-now}" Reply-Message += "Test2: %{sql:${local-config.sql-now}}" Reply-Message += "Test3: %{control:Tmp-String-0}" Reply-Message += "Test4: %{sql:%{control:Tmp-String-0}}" } ... and the resulting radtest output: $ radtest testuser testpass 127.0.0.1 0 testing123 Sending Access-Request of id 228 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=228, length=166 Reply-Message = "Test1: select concat('Current time = ',now())" Reply-Message = "Test2: Current time = 2011-10-19 13:35:21" Reply-Message = "Test3: select concat('Current time = ',now())" Reply-Message = "Test4: " So the fourth test (sql expansion with query in an attribute) failed. Radius debug output shows this ++[control] returns updated sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select concat('Current time = ',now()) -> select concat('Current time = ',now()) rlm_sql (sql): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql): Released sql socket id: 4 expand: Test2: %{sql:select concat('Current time = ',now())} -> Test2: Current time = 2011-10-19 13:35:21 expand: Test3: %{control:Tmp-String-0} -> Test3: select concat('Current time = ',now()) sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: %{control:Tmp-String-0} -> select concat=28'Current time = '=2Cnow=28=29=29 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, select concat=28'Current time = '=2Cnow=28=29=29: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '=2Cnow=28=29=29' at line 1 rlm_sql (sql): Released sql socket id: 3 expand: Test4: %{sql:%{control:Tmp-String-0}} -> Test4: ++[reply] returns updated Is there a way to change which characters remain unencoded? Thanks. -- Fajar

6 9

Problems with my radrelay configuration?
by tonimanel 19 Oct '11

19 Oct '11

Hi, When I launch freeradius with -X and -n radrelay options, I get this message: Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.851083 sec The radacct directory exists, but the detail file not exists, is it an error? What's happened? I post the result in debug mode. Thanks, ==================================== root@debian:/etc/freeradius# freeradius -X -n radrelay FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radrelay.conf including configuration file /etc/freeradius/modules/always main { allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "@libdir@" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 65536 pidfile = "/var/run/radrelay/radrelay.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 0 status_server = no } } radrelay: #### Loading Realms and Home Servers #### home_server radrelay { ipaddr = 192.168.1.130 port = 1812 type = "acct" secret = "testing123" response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool radrelay { type = fail-over home_server = radrelay } realm radrelay { acct_pool = radrelay } radrelay: #### Loading Clients #### radrelay: #### Instantiating modules #### instantiate { } radrelay: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radrelay.conf modules { Module: Checking preacct {...} for more modules to load } # modules } # server radrelay: #### Opening IP addresses and Ports #### listen { type = "detail" listen { filename = "/var/log/freeradius/radacct/detail" load_factor = 50 poll_interval = 1 retry_interval = 30 } } Listening on /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 1.000000 sec Listening on proxy address * port 1188 Waking up in 0.9 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.914341 sec Waking up in 0.9 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 1.093880 sec Waking up in 1.0 seconds. Polling for detail file /var/log/freeradius/radacct/detail Detail listener /var/log/freeradius/radacct/detail state unopened signalled 0 waiting 0.851083 sec Waking up in 0.8 seconds. ^C -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-my-radrelay-configura… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 33

DHCP with multiple interfaces
by Francois Gaudreault 19 Oct '11

19 Oct '11

Hi, I configured (basic) DHCP on two different interfaces : listen { ipaddr = * port = 67 type = dhcp interface = eth0 broadcast = yes } listen { ipaddr = * port = 67 type = dhcp interface = eth1.102 broadcast = yes } I need to establish a different (basic for now) lease policy by interface (ie. different network range). How can I know from which interface the request came? PS. By the way, if I don't set ipaddr = * , broadcast are not handled. Normal? -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 3

Del dynamic client working?
by tohaikmeng 18 Oct '11

18 Oct '11

Hello guys, In order to delete a dynamically defined client, the client IP file needs to reside in dynamic-clients folder upon startup of the radius daemon. I wondering if we are able to delete the dynamic defined client without restart of the radius daemon? ERROR: Client 192.168.169.89 was not dynamically defined. alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/Del-dynamic-client-working-tp491292… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Framed-IP-Address null value
by Alejandro Gandara 17 Oct '11

17 Oct '11

Hello all! Im testing freeradius in a preproduction machine. I've configured It with freeradius + Ldap. At this moment I only need read from ldap these attributes: user, password and Framed-IP-Address to assing an IP to an specific User. The problem cames when i use this: in /etc/freeradius/sites-enable/default (authorize section) update reply { Framed-IP-Address := "%{Client-IP-Address}" } I got the following error in debug mode: ++? if (NAS-Port-Type == 'Ethernet') ? Evaluating (NAS-Port-Type == 'Ethernetl') -> TRUE ++? if (NAS-Port-Type == 'Ethernet') -> TRUE ++- entering if (NAS-Port-Type == 'Ethernet') {...} expand: %{Framed-IP-Address} -> ERROR: Failed parsing value "" for attribute Framed-IP-Address: Failed to find IP address for But if I change %{Framed-IP-Address} this for %{Client-IP-Address}, just to check if the query is right. I got the result expected "The client IP Address". Can someone give me some light on the issue? Thanks very much. Álex

5 4

Problem with F5 BigIP accouting : hexadecimal attribute
by Vincent, Fabien 17 Oct '11

17 Oct '11

Dear all, I'm using Radius for authenticating admin users on different network equipments. "group authorize {...}" works fine with rlm_ldap and group management. But I have some problem for accounting on F5 BigIP LTM / GTM. In fact, my radius accounting server is receiving accounting-request like this : Accounting-Request packet from host 10.10.10.10 port 36875, id=29, length=281 NAS-IP-Address = [IP address unknown, not corresponding to NAS interfaces] F5-Attr-14 = [Hexa decimal output starting with 0x .] WARNING: Empty section. Using default return values. +- entering group accounting {...} [sql] expand: packet has no accounting status type. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> packet has no accounting status type. [user '', nas '[nas IP unknown]'] [sql] packet has no accounting status type. [user '', nas '[nas IP unknown]'] ++[sql] returns invalid Finished request 37. Cleaning up request 37 ID Did someone here already use accounting with F5 BigIP LTM or GTM ? I'm looking to make this working by changing audit_forward TCL script provided with F5 (syslog-ng) but I wasn't able to produce something different . I also tried to edit the dictionnary for F5 in /usr/share/freeradius/dictionary.f5 ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string ++ ATTRIBUTE F5-Attr-14 14 octets Thanks in advance for your help ! Fabien VINCENT <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr

5 6

Re: Problem with F5 BigIP accouting : hexadecimal attribute
by Len Conrad 17 Oct '11

17 Oct '11

Thanks, but I won't transfer until closer to the expiration date, so please lock it up again. also wanted to make sure somebody was on watch, hadn't been in contact since Don died. Len ---------- Original Message ---------------------------------- From: Phil Mayers <p.mayers(a)imperial.ac.uk> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Date: Mon, 17 Oct 2011 15:51:28 +0100 >On 17/10/11 12:26, Vincent, Fabien wrote: > >> F5-Attr-14 = /[Hexa decimal output starting with 0x ]/ > >This happens when an unknown attribute is found. The attribute is >assumed to be type "octets" and is rendered at hex. > >> */++ ATTRIBUTE F5-Attr-14 14 octets/* > >This won't help at all. This is ALREADY what FreeRADIUS assumes for >unknown attributes. > >Try: > >ATTRIBUTE F5-Attr-14 14 string > >...and see if it's readable. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

Multiple NAS freeradius
by Alejandro Gandara 17 Oct '11

17 Oct '11

Hi list, Im using freeradius 2.1.10 with ldap and I have a doubt. Im testing radius with two NAS , first one an openvpn service and the other one is a switch Procurve. My question is the following: Can I configure the openvpn nas to read some attribute from the ldap ( as framedipaddress) and at the same time configure switch procurve to read the attribute pool-name from the radius? How can I tell freeradius which attribute read for each nas? For example: User1 connect trhough openvpn so it will get the ip provided from framedipaddress attribute. User 1 disconnect openvpn User 1 connect with wired connection so it will get the IP provided for ippool after read poolname attribute from ldap. Thanks very much for your time and peacence. Regards, Alejandro Gándara Álvarez

2 3