- Freeradius-Users - lists.freeradius.org

Re: Radius proxy - kind of
by Matija Levec 28 Sep '10

28 Sep '10

Hi! I still can't find solution to my problem in documentation so I'll rephrase the question. Is it possible to proxy requests in a way analogous to bogus example below? realm example.com { auth_pool = pool1 { reject = 1 ok = return } auth_pool = pool2 { reject = 1 ok = return } } # Authentication fails only if both pools return reject. I know documentation says "... It proxies packets ONLY when it receives a packet or a re-transmission from the NAS. If the NAS never re-transmits, the proxy never re-transmits, either." Can someone at least suggest in what direction to look for solution? Thank you, Matija >>> Matija Levec 24.9.2010 16:24 >>> Hi everyone! First a little bit of explaining... - auth_server 1 client - fr_proxy -[ - auth_server 2 (client=random NAS, fr_proxy=freeradius, auth_server=two-factor auth server(s)) Currently we have clients authenticating directly to auth_server 1. We would like to gradually (and transparently) move users to new authenticators which use auth_server 2 Question What I would like to accomplish is: If auth_server 1 returns notfound or reject or fail, proxy request to auth_server 2 Is it possible to use 'configurable module fail over'-like syntax for configuring proxy (home)servers? I hopes this makes sense. Anyway... all ideas appreciated! Regards, Matija

2 1

Problemers using Freeradius with Anyconnect..
by Thomas Raabo - ZitCom A/S 28 Sep '10

28 Sep '10

Iam trying to use Freeradius with Cisco ASA anyconnect.. But I just can´t get it to work The problem is that when I use Freeradius the ASA just don't seem to get the framed-ip-address or something... ( when we try to connect with anyconnect it gives the error host or network is 0) with IAS the right ip gets assigned and all just works If I try the same thing with Microsoft IAS it just works Here is the output from radtest First MS IAS [root@mgmt3 raddb]# radtest tr2(a)test.local XXXX 172.16.16.206:1812 1 test Sending Access-Request of id 185 to 172.16.16.206 port 1812 User-Name = "tr2(a)test.local" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.206 port 1812, id=185, length=259 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.129 Class = 0xb4fc099a0000013700011700fe80000000000000e42365c53146798301cb5ed46d12aaaa0000000000000056 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#101=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" >From Freeradius [root@mgmt3 raddb]# radtest hmm2 XXXX 172.16.16.202:1812 1 Rzitcom! Sending Access-Request of id 79 to 172.16.16.202 port 1812 User-Name = "hmm2" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.202 port 1812, id=79, length=222 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.128 Class = 0x4f553d54455354 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" INSERT INTO `radreply` (`id`, `UserName`, `Attribute`, `op`, `Value`) VALUES (3, 'hmm2', 'Framed-IP-Netmask', ':=', '255.255.255.128'), (4, 'hmm2', 'Framed-Protocol', ':=', 'PPP'), (5, 'hmm2', 'Service-Type', ':=', 'Framed-User'), (6, 'hmm2', 'Framed-IP-Address', ':=', '172.20.3.128'), (8, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0'), (9, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0'), (7, 'hmm2', 'Class', ':=', 'OU=TEST'); This is the out from the ASA so its able to use freeradius... :) we also use it for administrative users test aaa-server authentication RadiusServers host 172.16.16.202 us$ INFO: Attempting Authentication test to IP address <172.16.16.202> (timeout: 12 seconds) INFO: Authentication Successful Med venlig hilsen | Best regards Thomas Raabo Netværksansvarlig [Description: Description: Description: cid:image001.jpg@01C9A70C.01A27540]<http://www.zitcom.dk/> tr(a)zitcom.dk<mailto:tr@zitcom.dk> | Direkte: +45 69 10 60 18 | Tlf: +45 70 23 55 66

2 2

problema con la instalacion freeradius en debian
by Samuel Isaias Barriga Perez 27 Sep '10

27 Sep '10

Estimados: Estoy tratando de configurar un servidor Radius (Freeradius) en debian (Lenny), el problema es que cuando uso el comando radisud -XX el resultado me da el siguiente: radius01:~# radiusd -XX Mon Sep 27 20:49:45 2010 : Info: FreeRADIUS Version 2.1.9, for host x86_64-unknown-linux-gnu, built on Sep 27 2010 at 02:41:08 Mon Sep 27 20:49:45 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Sep 27 20:49:45 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Sep 27 20:49:45 2010 : Info: PARTICULAR PURPOSE. Mon Sep 27 20:49:45 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Sep 27 20:49:45 2010 : Info: GNU General Public License v2. Mon Sep 27 20:49:45 2010 : Info: Starting - reading configuration files ... Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Mon Sep 27 20:49:45 2010 : Debug: main { Mon Sep 27 20:49:45 2010 : Debug: allow_core_dumps = no Mon Sep 27 20:49:45 2010 : Debug: } Mon Sep 27 20:49:45 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Mon Sep 27 20:49:45 2010 : Error: Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Couldn't open dictionary "/usr/local/share/freeradius/dictionary": No such file or directory y si me voy al path /usr/local/share/freeradius/dictionary este archivo no existe, que puedo hacer al respecto gracias samuel

2 1

Additional Restrictions for users
by William Burnett 27 Sep '10

27 Sep '10

I currently have my RADIUS servers setup to handle authentication for my various NAS's to grant users access to network resources. I would like to use the same servers to handle authentication for SSH for various routers. This all works, but I'm having a hard time getting the RADIUS server to only accept requests from users of the "ssh" group. I obviously don't want john.doe accessing my core routers. What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right. contents of sites-enabled/default: ...authorize { preprocess if (Service-Type == "Login-User") if ( %{group_membership_query} == "ssh") { update reply { ok-to-continue } } else { update reply { Auth-Type := Reject } }.... The group_membership_query would reference this: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" Any help/suggestions would be much appreciated. Sincerely, William Burnett burnett.w(a)gmail.com

3 5

sending accounting for two home servers
by Evgeniy Kozhuhovskiy 27 Sep '10

27 Sep '10

Is it possible to send accounting packets to two home servers? In fact, one server is real auth+acct server, and another server is a web filter that applies rules according information at start packets. -- С уважением, Евгений Кожуховский Руководитель группы сервисных платформ УИТ ЦИТС МГТС РУП Белтелеком +375-29-3998175 +375-29-7561625 +375-17-3060026

3 7

eap-tls certificates
by Peter McEvoy 27 Sep '10

27 Sep '10

Hi. I'm in the process of setting up freeradius 2.1.9 on debian lenny/sparc. I've got everything working for eap tls with the self signed certificates that come with freeradius. This is working well for macs and some smartphones but I'm having trouble with windows machines. My research indicates that buying a certificate from a known CA will solve my problems (or I believe I could import a certificate into the windows devices but with up to 1000 clients I'd prefer not to have to do this). Can anyone confirm if this is the case? If so, is there a specific type of certificate I need to buy that would include some 'extensions' that I'm told windows clients require. Cheers -- Pete

2 2

Re: Re: radius client / send NAS IP ?
by Michael Arndt 27 Sep '10

27 Sep '10

Hello Alan, sorry, my fault :-) radclient saves my day, indeed i can send any attribute / value pair i like thanks for your help Micha

1 0

Re: Pushing group attribute from OpenDirectory to Cisco
by Sander van Loosbroek 26 Sep '10

26 Sep '10

Just wanted to let you all know that I got it working with your instructions. In the end I realized that there were multiple groups associated with each user and that such a lookup wasn't gonna work anyway. I created single user entries like this in the users file: user1 Cleartext-Password := "userpassword" Service-Type = NAS-Prompt-User, cisco-avpair = "webvpn:user-vpn-group=management" The user has to be active in the OpenDirectory as well for this to work but this is desired behaviour in my configuration anyway. Now the avpair gets pushed to the Cisco router and used to select the correct policy in the WebVPN context. I'm gonna write a blogpost on my full setup on http://edgetechnology.wordpress.com that explains the full setup for those interested. Thank you all for your help. Sander On 24 sep 2010, at 12:00, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Fri, 24 Sep 2010 09:04:34 +0200 > From: Sander van Loosbroek <sander(a)vanloosbroek.com> > Subject: Re: Freeradius-Users Digest, Vol 65, Issue 105 > To: freeradius-users(a)lists.freeradius.org > Message-ID: <9C852831-8F4D-4DCF-9A2A-1D6C3D8EDD96(a)vanloosbroek.com> > Content-Type: text/plain; charset=us-ascii > > What I'm trying to do is retrieve the user group from the OpenDirectory instead of setting a static one. There is only one NAS and the Mac OS X Server runs a standalone OpenDirectory Master so I don't need any huntgroups then? > > On 24 sep 2010, at 05:42, freeradius-users-request(a)lists.freeradius.org wrote: > >> Date: Fri, 24 Sep 2010 08:02:38 +1200 >> From: Peter Lambrechtsen <plambrechtsen(a)gmail.com> >> Subject: Re: Pushing group attribute from OpenDirectory to Cisco >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: >> <AANLkTik16Nrmbb1OmrVWcFuhTFKnLEDYwvPFs5FydrbT(a)mail.gmail.com> >> Content-Type: text/plain; charset="iso-8859-1" >> >> In the "users" file is where you specify the reply attributes in my example. >> >> So using your example: >> >> DEFAULT Huntgroup-Name == CiscoVPN, Ldap-Group == >> "cn=CiscoVPN,ou=Roles,ou=Radius,DC=ACME,DC=COM" >> Service-Type = "NAS-Prompt-User", >> Idle-Timeout = 600, >> Cisco-AVPair = >> "webvpn:user-vpn-group=whatevervpngroupyouwanttoaddtheuserto" >> >> Then you can either use the huntgroup file and set the IP addresses of the >> Routers (NAS's) you're using: http://wiki.freeradius.org/Huntgroups >> >> Or you can have the Huntgroups in ldap as per my e-mail, and that would be >> if you have a more dynamic environment or want to move the NAS between >> different huntgroups easily. >> >> >> >> On Fri, Sep 24, 2010 at 2:03 AM, Sander van Loosbroek < >> sander(a)vanloosbroek.com> wrote: >> >>> Hello Peter and Alan, >>> >>> Thank you for your reply. I've given the documentation of Peter a look but >>> I'm not that familiar with LDAP or how its underpinnings work in OS X >>> Server. >>> >>> When the Cisco router now authenticates against the FreeRADIUS server all >>> works fine except for the fact that the group name is not returned with the >>> webvpn:vpn-user-group attribute. What is unclear to me is how I instruct >>> FreeRADIUS to include that attribute when it returns the authorization >>> message. I have made the following addition to my clients file: >>> >>> client 192.168.13.1/32 { >>> secret = xxx >>> shortname = vpn >>> nastype = cisco >>> } >>> >>> I have added a policy to the Cisco router to pick up the attribute but it >>> doesn't seem to get through. Can you suggest what to try next? >>> >>> Thanks, >>> Sander >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1

is the book published?
by Spacelee 26 Sep '10

26 Sep '10

is the book for freeradius published? -- *Space Lee*

1 2

DHCP server does not process requests
by Alexander Shikoff 25 Sep '10

25 Sep '10

Hello, In my network there is Cisco ISG acting as DHCP relay. It relays requests from customers to DHCP server of freeradius: Sep 25 12:51:05.045: DHCPD: input i/f override GigabitEthernet0/1.33 for client Sep 25 12:51:05.045: DHCPD: Reload workspace interface GigabitEthernet0/1.33 tableid 0. Sep 25 12:51:05.049: DHCPD: tableid for 193.200.84.232 on GigabitEthernet0/1.33 is 0 Sep 25 12:51:05.049: DHCPD: client's VPN is . Sep 25 12:51:05.049: DHCPD: using received relay info. Sep 25 12:51:05.049: DHCPD: Sending notification of DISCOVER: Sep 25 12:51:05.049: DHCPD: htype 1 chaddr 00e0.9110.8347 Sep 25 12:51:05.049: DHCPD: remote id 000600226b2a8d52 Sep 25 12:51:05.049: DHCPD: circuit id 000400210103 Sep 25 12:51:05.049: DHCPD: interface = GigabitEthernet0/1.33 Sep 25 12:51:05.049: DHCPD: class id 4d53465420352e30 Sep 25 12:51:05.049: DHCPD: No internally specified class returned Sep 25 12:51:05.049: DHCPD: Looking up binding using address 193.200.84.232 Sep 25 12:51:05.049: DHCPD: Found previous binding with giaddr 193.200.84.232 Sep 25 12:51:05.049: DHCPD: Keeping state for received DHCPDISCOVER, from UNNUM-IF Sep 25 12:51:05.049: DHCPD: setting giaddr to 193.200.84.232. Sep 25 12:51:05.053: DHCPD: BOOTREQUEST from 0100.e091.1083.47 forwarded to 193.200.85.22. freeradius listens 67 port on 193.200.85.22: # sockstat |grep rad freeradius radiusd 94903 5 udp4 193.200.85.22:67 *:* I see incoming packets: # tcpdump -vvvni re0 port 67 tcpdump: listening on re0, link-type EN10MB (Ethernet), capture size 96 bytes 16:05:23.403248 IP (tos 0x0, ttl 254, id 142, offset 0, flags [none], proto UDP (17), length 345) 193.200.84.232.67 > 193.200.85.22.67: BOOTP/DHCP, Request from 00:e0:91:10:83:47, length 317, hops 1, xid 0x4bb0c74b, Flags [none] (0x0000) Gateway-IP 193.200.84.232 Client-Ethernet-Address 00:e0:91:10:83:47 [|bootp] 16:05:26.404455 IP (tos 0x0, ttl 254, id 143, offset 0, flags [none], proto UDP (17), length 345) 193.200.84.232.67 > 193.200.85.22.67: BOOTP/DHCP, Request from 00:e0:91:10:83:47, length 317, hops 1, xid 0x4bb0c74b, secs 768, Flags [none] (0x0000) Gateway-IP 193.200.84.232 Client-Ethernet-Address 00:e0:91:10:83:47 [|bootp] But radiusd does not process them: I see no any debug output when running 'radiusd -X'. The dhcp configuration is default from raddb/sites-available, I only added 'detail' in every dhcp-section. Any ideas? Thanks in advance. -- MINO-RIPE

2 2