- Freeradius-Users - lists.freeradius.org

WISPr-Bandwidth-Max-Down / ChilliSpot-Bandwidth-Max-Down ?
by becoco 05 Jul '11

05 Jul '11

Hello, What is the difference between WISPr-Bandwidth-Max-Down and ChilliSpot-Bandwidth-Max-Down ? Thank you, Mickael

2 1

"use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 05 Jul '11

05 Jul '11

Hello All, I'm using FreeRADIUS 2.1.11 as a proxy for authenticating PEAP clients with RADIUS server not supporting EAP. All is working well except that when I use "proxy_tunneled_request_as_eap = no" in eap.conf, FreeRADIUS is not passing back all the AVPs sent by RADIUS server in Access-Accept(MSCHAPv2) to the Client, only few ones. But when I set it as "proxy_tunneled_request_as_eap = yes", FreeRADIUS is relaying back all the AVPs received from the RADIUS server properly. eap.conf: ------------ eap { peap { copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } } Hence, in spite of setting "use_tunneled_reply = yes", why isnt FR copying all attributes in Access-Accept back to client ? Is this some bug, fixed in 3.x ? -- Nitin

2 1

Different config based on NAS
by Hilton Boyce 05 Jul '11

05 Jul '11

Hi I need to know if there is a way of having the same username and password but sending a different reply based. For example Client send request for DSL Auth send reply for that config or client send L2TP Auth reply with different config. regards Hilton

2 2

AW: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 05 Jul '11

05 Jul '11

>>> Defining all three server whithin one section in modules/ldap >>> >>> ldap { >>> server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" >>> .} >>> >>> And setting just "ldap" within authorize and authenticate: >>> >>> With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. >>> (1-3 minutes at most will be acceptable, "zero outage" >>> gorgeous/expected) >>It should not take 15 minutes. >>What is your "net_timeout" set to? >net_timeout = 1 >timelimit = 2 >timeout = 4 >For testing i added a hostroute to an other gateway (=host unreachable) OK, i tested around with a single ldap section. Setting a route to a different interface for testing was a bad idea! I watched at the connections on the ldap port, and made my tests. - I made the first request (with positive answer) - A connection to one server was opend and resides "established"! - adding the route for that server to an other gateway - the established connection is still visible (netstat -anlp | grep <ldap-server-port>) - all requests for the next 15 minutes fail (server not rachable) - after 15 minutes, the esablished connection terminates, and a new connection to an other server is opened. Radius has switched to an other server, and everything went fine from now on. But i made the same test again, with "tcpkill" from the dsniff package, instead of setting a route. And with this tests radius switches imediately to an other server, no request fails! :-) Now is just unclear, will these tests be representative for real ldap-server or connection problems? Jan

2 1

Freeradius 2.1.11 and Oracle support
by Aurélien Lafranchise 05 Jul '11

05 Jul '11

Hi all, I thought that the 2.1.11 version should be easier to compile and get Oracle support. However, I can tell you that is not easy. I am doing a ./configure --with-oracle-version=11 --with-oracle-lib-dir=/usr/lib/oracle/11.2/client64/lib --with-oracle-include-dir=/usr/include/oracle/11.2/client64 but the ./src/modules/rlm_sql/drivers/rlm_sql_oracle/config.log tell me some interesting stuff, I have the feeling that it does not take the oracle version number : ... conftest.c:8:17: fatal error: oci.h: No such file or directory ... configure:2771: gcc -o conftest -g -O2 -I/usr/include/oracle/11.2/client64/ conftest.c -L/usr/lib/oracle/11.2/client64/lib/ -lclntsh -lnnz10 >&5 => should be lnnz11 /usr/bin/ld: cannot find -lnnz10 => normal, i don't have it ... configure:2837: WARNING: FAILURE: rlm_sql_oracle requires: libclntsh libnnz10. => why 10 ? ... Thanks Aurélien Lafranchise | Consultant *Tél. : +33 (0)6 03 88 36 26 *| Fax : +33 (0)1 75 43 55 11 www.snype-consulting.com

2 2

pre-check OTP token
by Cor Bosman 05 Jul '11

05 Jul '11

Hi all, im setting up an OTP authentication service for our customer base. They should be able to authenticate with both their login/pass or an OTP. Ive got this working just fine by using PAM/radius where each pam services checks 2 radius servers. First the one doing the login/pass (this is a bit of a black box I cant modify too easily), and if that fails it checks the OATH/TOTP/HOTP radius daemon. The second radius server is a Freeradius installation, where the OTP checks are (currently) done using exec. The idea is that customers could be in an insecure environment like an internet cafe and use their OTP token to login through their regular websites or even with their IMAP client. Since we have a pretty large userbase of a few hundred thousand customers, and are regularly bombarded with brute force attacks in some form, i expect a lot of hits on the OTP radius server. Would their be some way, in either the PAM stage, or in the FreeRadius stage before Exec to pre-validate if ive got a token-reponse? They're always 10 digit numbers. Regards, Cor Freeradius: 2.1.10

4 4

how to use groups within freeradius
by Ken Felix 04 Jul '11

04 Jul '11

Can anybody post a simple howto with regards to using groups within freeradius? What we would like todo is restricted some user from logging into various firewalls. I've created usergroups and defined mysql> select * from usergroup ; +------------------+-------------+----------+ | UserName | GroupName | priority | +------------------+-------------+----------+ | | login users | 1 | | asa1.test | adminasa | 1 | | test.user | Login users | 1 | +------------------+-------------+----------+ and mysql> select * from radgroupcheck ; +----+-----------+----------------+----+----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+----------------+ | 1 | adminasa | NAS-IP-Address | == | 10.252.128.11 | | 2 | adminasa | NAS-IP-Address | == | 10.252.253.199 | | 3 | adminasa | NAS-IP-Address | == | 10.250.32.68 | | 4 | adminasa | NAS-IP-Address | == | 10.250.32.69 | | 5 | adminasa | NAS-IP-Address | == | 10.254.32.68 | | 6 | adminasa | NAS-Identifier | == | 10.252.128.11 | +----+-----------+----------------+----+----------------+ 6 rows in set (0.00 sec) debug shows the following; Sending Access-Reject of id 10 to 10.159.103.154 port 1812 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.252.128.11:1025, id=40, length=67 User-Name = "asa1.test" User-Password = "33333333333330" NAS-IP-Address = 10.252.128.11 NAS-Port = 43 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "chap" returns noop for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "asa1.test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 18 modcall[authorize]: module "files" returns notfound for request 18 radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 18 modcall: leaving group authorize (returns ok) for request 18 auth: type Crypt Login OK: [asa1.test] (from client SBBC port 43) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 18 rlm_sql (sql): Processing sql_postauth radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 18 modcall: leaving group post-auth (returns ok) for request 18 Sending Access-Accept of id 40 to 10.252.128.11 port 1025 Service-Type = Dialout-Framed-User Finished request 18 Going to the next request So I need some starting point of what/where to look at. Thanks

3 3

Help debugging unstable server
by Carlos Eduardo Tavares Terra 04 Jul '11

04 Jul '11

Today I have 2 freeradius servers running... Both of them in a CentOS 5.6. The first is stable, without problems running freeradius 1.1.3. The second is running freeradius 2.1.7 and in the last 3 months became very unstable. After some time running the threads just shutdown... Reading the /var/log/radius/radius.log, the only message in the moment of the problem is: Sun Jul 3 06:53:41 2011 : Info: Exiting normally. When I check the running processes, the radiusd is running... the 'service radiusd status' command displays the pid of the runnind daemon... but radiusd is not listening the network ports anymore. I tried to keep the radius in debug mode (radiusd -XXXX) for a week, but in this case the problem didn't happen. Is there some way to force the radiusd print why it is exiting 'normally' ?? Thanks -- Carlos Eduardo Tavares Terra Red Hat Certified Engineer Consultor em Infraestrutura de TI GNU/Linux #413291 [http://counter.li.org]

2 2

Patch for radiusclient: new program radlistdictionary and fixes to PPTP/CHAP problem
by freeradius developer/user identity 04 Jul '11

04 Jul '11

I have posted at http://www.cardiothink.com/downloads/ a set of patches which, when applied to the latest stable freeradius-client (version 1.1.6) and to the CVS version, fixes the problem with PPTP and radiusclient that results in failure of CHAP authentication with the syslog errors: rc_avpair_new: unknown attribute 11 rc_avpair_new: unknown attribute 25 (The problem, for me, turned out to be blanks at the start of every line in dictionary.microsoft. The patches, among other things, skip the blanks.) Included in the patches is a new program in the src subdirectory that I have named radlistdictionary (you can change it if you like). It is a simple program that uses the installed freeradius-client library to read dictionaries, and it displays the loading and parsing steps explicitly so that you can see where errors are occurring. (This program requires that the library itself be patched to show the parsing.) Fixing problems with the dictionaries is easy once you can see what is going on! Please see the above web site for more details, and let me know of any problems.

1 0

Include directive for separate ippool configs not working
by Tom De Vylder 04 Jul '11

04 Jul '11

Hi all, I'd like to integrate freeradius into a config management framework. In order for this to work with multiple ippool instances I've decided to create a ippool.d/ directory containing several config files. Loading the config files itself is not a problem, however placement of the include statement is. I've tried to put the following line in several places: $INCLUDE /etc/freeradius/ippool.d/ E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ... Nothing seems to work. Freeradius -X starts the service correctly. I can see my configs are loaded. However anything that's defined inside them just doesn't show up. I'm running the current Debian stable package (2.1.10). > FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including configuration file /etc/freeradius/snmp.conf > including configuration file /etc/freeradius/eap.conf > including configuration file /etc/freeradius/sql.conf > including files in directory /etc/freeradius/ippool.d/ > including configuration file /etc/freeradius/ippool.d/foobar.conf > > main { > allow_core_dumps = no > } > including dictionary file /etc/freeradius/dictionary > main { > > [ ... ] > > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on proxy address * port 1814 > Ready to process requests. Kind regards, Tom De Vylder

3 6