- Freeradius-Users - lists.freeradius.org

"authentication" sub in perl
by Alex rsm 03 Oct '11

03 Oct '11

Hi, I am trying to call an external perl function within "authentication" sub" - functions are uncommented in modules/perl file ... func_authenticate = authenticate func_authorize = authorize ... - subs are modified in /raddb/example.pl sub authenticate{ print "TEST1\n"; } sub authenticate { print "TEST2\n"; /usr/local/etc/raddb/test.pl; } When freeradius receives a REQUEST, only "authenticate" sub is called and not "authenticate" sub. How can I enable "authenticate" to be called when a REQUEST is arrived? Here is the debug log: ali@lab-openser01:~$ sudo radiusd -X FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Sep 29 2011 at 14:33:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default.orig main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.10.10.31 { require_message_authenticator = no secret = "testing123" shortname = "ba20-seansdesk" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /usr/local/etc/raddb/modules/perl perl { module = "/usr/local/etc/raddb/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 41951 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=27, length=169 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000801616c69 Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x0200000801616c69 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 27 to 10.10.10.31 port 50032 EAP-Message = 0x0101001604107e5377146691b447d19cd03c54d1c0fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=28, length=185 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0xbb8cb579bb8db14c50324b609a9d0c10 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type PEAP [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ali attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 28 to 10.10.10.31 port 50032 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 27 with timestamp +29 Waking up in 1.0 seconds. Cleaning up request 1 ID 28 with timestamp +29 Ready to process requests. Thanks, ASM

4 11

Virtual server basic proxy configuration?
by John Douglass 03 Oct '11

03 Oct '11

Freeradius gurus, I have looked over the documentation and searched for examples and haven't found anything concrete that I feel will solve my configuration. Perhaps someone has implemented this or can offer up some advice on how to approach this. Basically wanting to create a virtual server listening on port 1818 that simply proxies ALL AUTH requests to radius1.gatech.edu port 1812. I am used to the virtual-server configuration as I have multiple radius based services running on different ports, but am not sure how to only proxy those entries on that particular virtual server and not the other virtual servers I have running on this server. At a first read/glance, it looks like the proxy settings might apply to all virtual servers instead of just the one on port 1818 that I am defining. From reading "proxy.conf" would I just define something like: home_server radius1 { type = auth ipaddr = 10.10.10.10 port = 1818 secret = testing123 } Now...I am not sure how to apply this to a single virtual server. All I really want to do is redirect the requests and respond. Any tips would be appreciated, - John Douglass, Georgia Institute of Technology

3 2

Rlm_ldap Login withount a identity
by Esdras Caleb Oliveira Silva 03 Oct '11

03 Oct '11

My LDAP server requires autentication, but for security reasson I cant let a user with permission to read all data from outher to made the bind for radius. Studing the log and using radiusd in debug mod I discovered if I let the identity and password in black the raius try log with the login and password provide by the user of radius, and it binds, but afther it also tryes retrive the user info with the user login, what fails. There is a way to do the login with LDAP without the identity or password? Using the information provide by the user to try bind in LDAP and if bind is sucessufull the RADIUS autenticates?? Sorry bad English Esdras Caleb -- (Você irá para o céu ou não? Acesse www.BoaPessoa.com.br já para saber!) "Não se VAI à Igreja. Se É Igreja."

1 0

rlm_ldap patch for access_attr_deny_value
by Fred 03 Oct '11

03 Oct '11

Hi all, This patch is an attempt to have a more generic custom access_attr support, by introducing a new ldap module configuration parameter named "access_attr_deny_value" allowing to check arbitrary access_attr attribute value to reject user. Without this patch, configured access_attr attribute is checked against a static,(hard-coded) "FALSE" value. With this patch, rlm_ldap module user can configure not only custom access_attr attribute, but also custom access_attr_deny_value value to control user lock status. Default value remains FALSE, to maintain backward compatibility. This patch has been made because if, for example, inetUserStatus is used at ldap server level to control lock user status, this control is done by ldap server when user tries to bind to the ldap. >From freeradius point of view, if ldap bind is not done for any reason (e.I. because radiusd received a MSCHAP challenge, and just replayed MSCHAP using ntPassword or lmPassword retrieved during author) , ldap server will not have occation to reject the user at binding, so radiusd has to do the job himself for inetUserStatus to be honored. If radiusd does not do the job, only ldap-binded user will be rejected (by ldap) but non-binded user will be accepted, thus making ldap settings disabling the user with inetUserStatus set to "inactive" will not be honored at radius level and user will be unexpectedly accepted. For example, ${confdir}/modules/ldap : access_attr = inetUserStatus # OID 2.16.840.1.113730.3.1.692 access_attr_deny_value = "inactive" With this setup, if inetUSerStatus is set to inactive in ldap directory for a particular user, this user will be rejected early during authorization. Best regards, Fred MAISON ############################################### diff -u ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c --- ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c 2011-09-20 14:11:34.000000000 +0200 +++ ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c 2011-09-29 17:39:32.000000000 +0200 @@ -146,6 +146,7 @@ char *default_profile; char *profile_attr; char *access_attr; + char *access_attr_deny_value; char *passwd_hdr; char *passwd_attr; int auto_header; @@ -304,6 +305,8 @@ offsetof(ldap_instance,access_attr), NULL, NULL}, {"access_attr_used_for_allow", PW_TYPE_BOOLEAN, offsetof(ldap_instance,default_allow), NULL, "yes"}, + {"access_attr_deny_value", PW_TYPE_STRING_PTR, + offsetof(ldap_instance,access_attr_deny_value), NULL, "FALSE"}, {"chase_referrals", PW_TYPE_BOOLEAN, offsetof(ldap_instance,chase_referrals), NULL, NULL}, {"rebind", PW_TYPE_BOOLEAN, @@ -1405,8 +1408,8 @@ if (inst->access_attr) { if ((vals = ldap_get_values(conn->ld, msg, inst->access_attr)) != NULL) { if (inst->default_allow){ - RDEBUG("checking if remote access for %s is allowed by %s", request->username->vp_strvalue, inst->access_attr); - if (!strncmp(vals[0], "FALSE", 5)) { + RDEBUG("checking if remote access for user %s is %s by %s", request->username->vp_strvalue, inst->access_attr_deny_value, inst->access_attr); + if (!strncmp(vals[0], inst->access_attr_deny_value, sizeof(inst->access_attr_deny_value))) { RDEBUG("dialup access disabled"); snprintf(module_fmsg,sizeof(module_fmsg)," [%s] Access Attribute denies access", inst->xlat_name); module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ); ###############################################

1 1

Ubuntu client always connect to wlan even if it is not allowed by Freeradius
by PROST Frédéric 03 Oct '11

03 Oct '11

Hello, I set up Freeradius 2.1.11 to authenticate against ActiveDirectory (with ntlm) after having validated the mac Address (with mac-auth), for a wireless Lan (Netgear WPAN320). Everything is working fine on Windows but I have a problem with workstation on Ubuntu 11.04 : on the first connection, everything is working fine : it checks if the MAC address and login/password are correct and allow connection or not. But if the connection is correct at the first time and if I then change one of those parameters (ie, disable MAC address on the radius server or change login on my Ubuntu workstation), I can still connect to my WLAN. The only way to correct this problem is to physically switch off and on the wlan card on Ubuntu workstation. It seems that it has a kind of cache but I can't determine where and how to disable it (on my Radius server). Here is a freeradius log extract of the first connection where we can see that it checks the MAC address Mon Oct 3 11:55:51 2011 : Info: ++- entering policy rewrite.calling_station_id {...} Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Mon Oct 3 11:55:51 2011 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Mon Oct 3 11:55:51 2011 : Info: expand: %{Calling-Station-Id} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: policy.mac-addr -> policy.mac-addr Mon Oct 3 11:55:51 2011 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Mon Oct 3 11:55:51 2011 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} Mon Oct 3 11:55:51 2011 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: ++++[request] returns ok Mon Oct 3 11:55:51 2011 : Info: ++++[updated] returns updated Mon Oct 3 11:55:51 2011 : Info: +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated Mon Oct 3 11:55:51 2011 : Info: +++ ... skipping else for request 11: Preceding "if" was taken Mon Oct 3 11:55:51 2011 : Info: ++- policy rewrite.calling_station_id returns updated Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] users: Matched entry 00-18-de-55-61-7f at line 2 Mon Oct 3 11:55:51 2011 : Info: ++[authorized_macs] returns ok Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!EAP-Message) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(EAP-Message) -> FALSE Here is the Freeradius log file for the second connection, after disable MAC Address and restarted FreeRadius (it connects directly without checking MAC address) : rad_recv: Accounting-Request packet from host 192.168.2.15 port 32847, id=2, length=152 Acct-Session-Id = "4E8592C9-00000140" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "salons" NAS-IP-Address = 192.168.2.15 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "20-4E-7F-3C-EF-00:mdwifi" Calling-Station-Id = "00-18-DE-55-61-7F" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Mon Oct 3 11:50:16 2011 : Info: # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group preacct {...} Mon Oct 3 11:50:16 2011 : Info: ++[preprocess] returns ok Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.2.15,NAS-IP-Address = 192.168.2.15,Acct-Session-Id = "4E8592C9-00000140",User-Name = "salons"' Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Acct-Unique-Session-ID = "94477ec3eb897dd7". Mon Oct 3 11:50:16 2011 : Info: ++[acct_unique] returns ok Mon Oct 3 11:50:16 2011 : Info: [suffix] No '@' in User-Name = "salons", looking up realm NULL Mon Oct 3 11:50:16 2011 : Info: [suffix] No such realm "NULL" Mon Oct 3 11:50:16 2011 : Info: ++[suffix] returns noop Mon Oct 3 11:50:16 2011 : Info: ++[files] returns noop Mon Oct 3 11:50:16 2011 : Info: # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group accounting {...} Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %{Packet-Src-IP-Address} -> 192.168.2.15 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %t -> Mon Oct 3 11:50:16 2011 Mon Oct 3 11:50:16 2011 : Info: ++[detail] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[unix] returns ok Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Info: ++[radutmp] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[exec] returns noop Mon Oct 3 11:50:16 2011 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Debug: attr_filter: Matched entry DEFAULT at line 12 Mon Oct 3 11:50:16 2011 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 2 to 192.168.2.15 port 32847 Mon Oct 3 11:50:16 2011 : Info: Finished request 1. Mon Oct 3 11:50:16 2011 : Info: Cleaning up request 1 ID 2 with timestamp +17 Mon Oct 3 11:50:16 2011 : Debug: Going to the next request Mon Oct 3 11:50:16 2011 : Info: Ready to process requests. Do you have any idea of how to correct this ? Thank you very much, Regards, Fred

4 3

FW: Radius Server Doesn't Communicate AP
by Alejandro Moreno 03 Oct '11

03 Oct '11

Hi my problem is that im trying to communicate my radius server with the access point that i already configured and already added to the clients list and still doesn't work! i've been in all the forums about freeradius and i've read all the documentation of freeradius but nothing solve thisim really frustrated about this so i'd really appreciate it if someone could help me thank u

8 25

Re: Radius Server Doesn't Communicate AP
by Alan Buxey 02 Oct '11

02 Oct '11

Hi, You box is on a different subnet to your wireless router. What kit do you have UK place to ensure your 192.168.0.0/24 kit can talk to the 192.168.75.0/24? You should always be able to reach 127.0.0.1 on whatever box you are on ;) alan

1 0

Freeradius for Lan
by Andreas Rudat 02 Oct '11

02 Oct '11

Hello, I use radius for my wlan auth but I also want it for lan but how? I use pfsense with radius 2.x It works fine with wlan but how I use it for lan? If I connect via lan port on my AP I can reach everything without radius auth. Thanks Andreas

6 9

Using unlang to customize Tunnel-Medium-Type for 3com switches
by Stanisław Kamiński 30 Sep '11

30 Sep '11

Hi, my problem: I use RADA on 2 lines of 3com switches: - those with ComWare 5 expect Radius to return Tunnel-Medium-Type = "IEEE-802" - those with ComWare 3 expect Tunnel-Medium-Type = "802" Of course, in users, I can use only one of those values, as follows: f0-0f-de-ad-f0-01 Cleartext-Password := "f0-0f-de-ad-f0-01" Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id := 3, Tunnel-Type = VLAN Fortunately, after switching Radius mode on Comware3 switches to "extended", they started to introduce themselves: rad_recv: Access-Request packet from host 172.23.30.70 port 41201, id=97, length=130 User-Name = "f0-0f-de-ad-f0-01" User-Password = "f0-0f-de-ad-f0-01" NAS-IP-Address = 172.23.30.210 NAS-Identifier = "deadbeef1e02" NAS-Port = 16867329 NAS-Port-Id = "unit=1;subslot=0;port=22;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f00f-dead-f001" 3Com-Connect_Id = 9 3Com-Product-ID = "4200G" 3Com-NAS-Startup-Timestamp = 954636905 I can see 3Com-Product-ID = "4200G", and I would like to change Tunnel-Medium-Type to 802 if I see it. After looking at unlang man page - explains the basics, but show no examples; radiusd.conf - still no examples; and googling - some examples, but I counted 4 of them (maybe I searched the wrong way, but see for yourself what does "unlang examples" yield) I decided to write here for help. From what I read, I should add the condition in "post-auth" section. As I understand it, it should look like this: if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } } is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec). Thanks in advance, Stan

4 3

missing "rlm_perl.so" in the built from src file
by Alex rsm 30 Sep '11

30 Sep '11

Hi, I built a fresh freeradius on a ubuntu server from source files. When I add perl module and start the freeradiusin the debug mode, it is asking for "rlm_perl.so" that can not find it. It seems the make file does not create the shared lib file for perl module. Is there any change should be made in Makefile to create "rlm_perl.so" file? Thanks, ASM

2 1