- Freeradius-Users - lists.freeradius.org

Help on passing parameter to exec
by nghiapt 03 Nov '10

03 Nov '10

Hi all, At first, to the people who is working on FreeRADIUS, you're doing an awesome, awesome job! Ok, so I'm having this configuration: in sites-available/default: [...] preacct { # Echo here yields WARNING and doesn't catch Session-Timeout # echo if (Acct-Status-Type == "Start"){ acctstart } if (Acct-Status-Type == "Stop"){ acctstop } [...] where acctstart and acctstop is 2 exec modules, defined like this: exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}" input_pairs = reply output_pairs = reply shell_escape = yes } exec acctstop { wait = yes program = "/accounting_stop_sh.sh %{User-Name} input_pairs = reply output_pairs = reply shell_escape = yes } Basically, the shell script is to ssh and terminate stuff in NAS after Session-Timeout seconds have passed (Don't ask, but NAS doesn't support Session-Timeout so we need to do it this way). The problem is, when we have a run, the debug yield: [...] Sending Access-Accept of id 121 to 127.0.0.1 port 45280 Reply-Message = "Hello, test" Session-Timeout = 94 Finished request 0. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 45280, id=123, length=155 NAS-Identifier = "OpenVPN.localhost.localdomain" User-Name = "test" NAS-Port = 27 Service-Type = Dialout-Framed-User Framed-Protocol = PPP Acct-Status-Type = Start Framed-IP-Netmask = 255.255.248.0 Acct-Session-Id = "OpenVPN.localhost.localdomain.as0t1.1288162180.5521.27" Framed-IP-Address = 5.5.8.25 NAS-Port-Type = Virtual +- entering group preacct {...} ++? if (Acct-Status-Type == "Start") ? Evaluating (Acct-Status-Type == "Start") -> TRUE ++? if (Acct-Status-Type == "Start") -> TRUE ++- entering if (Acct-Status-Type == "Start") {...} [acctstart] WARNING! Input pairs are empty. No attributes will be passed to the script [acctstart] expand: %{User-Name} -> test [acctstart] expand: %{reply:Session-Timeout} -> expr: syntax error Exec-Program output: test is scheduled to be terminated after min(s) Exec-Program-Wait: plaintext: test is scheduled to be terminated after min(s) Exec-Program: returned: 0 [...] Note the 2 bold lines, the Session-Timeout isn't passed to the acctstart exec, leading to shellscript doesn't run correctly. My question is can I somehow pass the Session-Timeout value from the Access-Accept packet to this section of preaccounting? FYI, I'm using sql counter (the default noresetcounter) to calculate the Session-Timeout. Thanks a lot in advance, N. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-on-passing-parameter-to-exec-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

None
by Влад Власов 03 Nov '10

03 Nov '10

Hello everyone, Please help me I try to setup FreeRadius as proxy. I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another radius server ,that does not work with a EAP-PEAP. changed only the following items:

1 0

dot1x with samba workstation accounts part two
by steffo76＠gmx.de 02 Nov '10

02 Nov '10

Hi list, I am new here and would like to respond to a message which has been sent before I was subscribed: https://lists.freeradius.org/pipermail/freeradius-users/2010-June/msg00432.… I ran into the same problem and might have a solution that satisfies both sides, I added a configuration option to modules/mschap which is called "enforce_user_flag". With this patch the following happens: If the disabled flag is set, it rejects anyway. If the enforce_user_flag is not set or set to 'yes', mschap checks for the presence of the user flag (this has been the behaviour so far). If enforce_user_flag is set to 'no', mschap checks for the presence of the „workstation trust account“ „server trust account“ or „normal user account“. If one of them is present it is satisfied with the flags. With this solution mschap behaves like it did before with out of the box settings but is able to honor the workstation or server trust account flags if the configuration option is set accordingly. There would be no need to disable the check of the 'disabled' flag. It is probably not the best code ever but maybe it helps someone. Regards Stephan

1 0

Building freeradius from source
by Nirmal Guhan 02 Nov '10

02 Nov '10

Hi, Am trying to compile freeradius (freeradius-server-2.1.10) for my own distro (based on 2.6.32 kernel from kernel.org) and running into compilation errors. : libtool: link: `rlm_eap_md5.lo' is not a valid libtool object gmake[9]: *** [rlm_eap_md5.la] Error 1 Please let me know a way to fix this. Also, radiusd seems to be pulling in many shared libraries. Do I need to compile them from source myself or are there any short cuts (if someone has tried this before) ? I know compiling it for Fedora or a similar distro is easier but unfortunately that won't help me. Note that I just need simple password (cleartext) based authentication leaving out the crypto stuff. Thanks, Nirmal

2 3

Authenticating agains AD issues
by Johnson, Neil M 02 Nov '10

02 Nov '10

I've been following the reciepe on the "Deploying RADIUS" web site, but I have been unable to get an iPhone or Laptop to authenticate to wireless. It appears from the log that ntlm_auth is behaving correctly but the the challenge continues. I'm running 2.1.9 on Fedora 12 using the demonstration certificates. Here is the last part of the log file: Thanks in advance. -Neil [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for nmjoo with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> IOWA\nmjoo [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User- Name:-None}} -> --username=IOWA\nmjoo [mschap] mschap2: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> -- challenge=13fe382b60e3bba9 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> -- nt-response=24bf15cdc812e5f7fb9723f21143bb775b24a1914870caf0 Exec-Program output: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program-Wait: plaintext: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 112 to 128.255.11.74 port 32768 EAP-Message = 0x010a005b19001703010050f59dec82774ce4b8dc5bb542e29881b2cb321a7136c39e4f1a498708fa2515da475f29ec726bd310dd96ab7ae6de4a85f079285567b375a7fa02d137f9d0d2adcf75dc887c91c50a41e041c13b370882 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa489d972ac83c05d8d6d2302f3fa3977 Finished request 17. Going to the next request Waking up in 3.2 seconds. Cleaning up request 0 ID 95 with timestamp +9 Cleaning up request 1 ID 96 with timestamp +9 Cleaning up request 2 ID 97 with timestamp +9 Cleaning up request 3 ID 98 with timestamp +9 Cleaning up request 4 ID 99 with timestamp +9 Cleaning up request 5 ID 100 with timestamp +9 Cleaning up request 6 ID 101 with timestamp +9 Cleaning up request 7 ID 102 with timestamp +9 Cleaning up request 8 ID 103 with timestamp +9 Waking up in 1.0 seconds. Cleaning up request 9 ID 104 with timestamp +10 Cleaning up request 10 ID 105 with timestamp +10 Cleaning up request 11 ID 106 with timestamp +10 Cleaning up request 12 ID 107 with timestamp +10 Cleaning up request 13 ID 108 with timestamp +10 Cleaning up request 14 ID 109 with timestamp +10 Cleaning up request 15 ID 110 with timestamp +10 Cleaning up request 16 ID 111 with timestamp +10 Cleaning up request 17 ID 112 with timestamp +10 Ready to process requests. -- Neil Johnson Network Engineer Information Technology Services The University of Iowa Work: 319 384-0938 Mobile: 319 540-2081 Fax: 319 355-2618 E-mail: neil-johnson(a)uiowa.edu

5 13

RE: Problem with LDAP and SSHA password
by Maurice James 01 Nov '10

01 Nov '10

I posted a working config for your exact problem last week. Take Johns advice. Thanks -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of Rafal Kaminski Sent: Monday, November 01, 2010 10:59 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Problem with LDAP and SSHA password W dniu 11/1/10 3:56 PM, Rafał Kamiński pisze: > Hi, > > I configured Freeradius + Ldap and ssha Password like userPassword but > when I try connect I have this debug log: > > ---CUT--- Ok - my bad :) I clicked "Send" fast. ---CUT--- Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: looking for reply items in directory... Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: user rafal.kaminski authorized to use remote access Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[ldap] returns ok Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[expiration] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[logintime] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[pap] returns noop Mon Nov 1 14:53:39 2010 : Debug: rad_check_password: Found Auth-Type EAP Mon Nov 1 14:53:39 2010 : Debug: auth: type "EAP" Mon Nov 1 14:53:39 2010 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Mon Nov 1 14:53:39 2010 : Debug: auth: Failed to validate the user. Mon Nov 1 14:53:39 2010 : Auth: Login incorrect: [rafal.kaminski/<via Auth-Type = EAP>] (from client 192.168.37.3 port 0) Mon Nov 1 14:53:39 2010 : Debug: Found Post-Auth-Type Reject Mon Nov 1 14:53:39 2010 : Debug: +- entering group REJECT Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: expand: %{User-Name} -> rafal.kaminski Mon Nov 1 14:53:39 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[attr_filter.access_reject] returns updated Mon Nov 1 14:53:39 2010 : Debug: Delaying reject of request 0 for 1 seconds Mon Nov 1 14:53:39 2010 : Debug: Going to the next request Mon Nov 1 14:53:39 2010 : Debug: Waking up in 0.9 seconds. Mon Nov 1 14:53:40 2010 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 217 to 192.168.37.3 port 1812 ---END-CUT--- Where is the problem? Thanks for help, because I can't resolve that problem for 2-3 days :( -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Problem with LDAP and SSHA password
by Rafał Kamiński 01 Nov '10

01 Nov '10

Hi, I configured Freeradius + Ldap and ssha Password like userPassword but when I try connect I have this debug log: ---CUT--- -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany

4 4

Dynamic VLAN Assignment based on a certificate, not a user.
by Бисер Миланов 01 Nov '10

01 Nov '10

Hello! Some time ago Alan mentioned that the new 2.1.10 version will support such a thing. However, I can't seem to find it in the docs. Can anyone shed some light on how that can be done with the new functionality? ----------------------------------------------------------------- Вижте последните новини във Vesti.bg! http://www.vesti.bg/

2 1

FAQ and Wiki down?
by David Jea 31 Oct '10

31 Oct '10

Hi, For past two days, I can't reach to these 2 tabs: FAQ and Wiki. All the others are good. http://wiki.freeradius.org/index.php/FAQ http://wiki.freeradius.org/ I thought it was my issue, but my internet is good, no proxy, tried with IE and Firefox, it does seem to me that wiki site is down. Thought should report. Thanks, David

9 9

Re: Counter SQL Calculation
by Neville 30 Oct '10

30 Oct '10

Hi Everyone, Here is some Debug if anyone can help explain or correct the [monthlytraffic] Counter calculation. Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='%{User-Name}' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW()) -> SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW()) Sat Oct 30 22:39:39 2010 : Debug: sqlcounter_expand: '%{sql:SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())}' Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_xlat Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: %{User-Name} -> FTU-GzwgcD Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_set_user escaped user --> 'FTU-GzwgcD' Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW()) -> SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW()) Sat Oct 30 22:39:39 2010 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_xlat finished Sat Oct 30 22:39:39 2010 : Debug: rlm_sql (sql): Released sql socket id: 4 Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: %{sql:SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())} -> 991187 Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Check item is greater than query result Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Authorized user FTU-GzwgcD, check_item=262100000, counter=991187 Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Sent Reply-Item for user FTU-GzwgcD, Type=Session-Octets-Limit, value=262191221 Sat Oct 30 22:39:39 2010 : Info: ++[monthlytraffic] returns ok The Important bit is that the counter returns 991187, but then the Reply-Item "Session-Octets-Limit" is set to 262191221, which is actually an INCREASE of 91221, how is this calculation CORRECT? Thx Nev > >> Hi everyone, >> >> I have a small problem where the counter is not working how I would like >> it two work. >> >> sqlcounter monthlytraffic { >> counter-name = Monthly-Traffic >> check-name = Max-Monthly-Traffic >> reply-name = Session-Octets-Limit >> sqlmod-inst = sql >> key = User-Name >> reset = monthly >> query = "SELECT >> IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE >> username='%{%k}' AND Month(acctstoptime) =(Month(NOW())) AND >> Year(acctstoptime) = Year(NOW())" >> } >> >> The problem with this, is that it the SELECT statement returns a value >> Less than the value of Max-Monthly-Traffic, then sets >> Session-Octets-Limit is set to equal Max-Monthly-Traffic. >> >> What I need it to do is to populate Session-Octets-Limit with the VALUE >> of Max-Monthly-Traffic, then subtract the VALUE of the Select Statement. >> >> E.G. if Max-Monthy-Traffic is set to 250Mb or 262100000, and the SELECT >> returns a result of 52430000 being 50Mb of usage, then >> Session-Octets-Limit should be set to 262100000 - 5230000 being 256870000 >> >> Can anyone point in the right direction on this please. >> >> Thx >> Nev >

1 0