- Freeradius-Users - lists.freeradius.org

Pushing group attribute from OpenDirectory to Cisco
by Sander van Loosbroek 20 Sep '10

20 Sep '10

Hello, I have successfully set up Freeradius that comes with Mac OS X Server 10.6 to authenticate WebVPN users on a Cisco IOS router. Now I'm trying to parse the webvpn:user-vpn-group attribute to the Cisco so I can set up different WebVPN policies. I run into 2 problems: 1) There doesn't seem to be a dictionary for Cisco's Webvpn. There are some for the VPN concentrator series but this are not compatible with Cisco's IOS. Does that mean I have to build my own? The attribute value-pairs are listed here: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6657/pr… 2) I can't find out how to connect the group name value from OpenDirectory to an attribute. The rlm_opendirectory module does check for a group (to see if it's allowed to use the Radius service) but it's unclear to me how to grab that value and use it as an attribute. Any thoughts are appreciated. Regards, Sander

3 2

HOWTO:Centralised LDAP Authentication
by Peter Lambrechtsen 19 Sep '10

19 Sep '10

FreeRADIUS Network Element LDAP based authentication In this post I hope to explain how I have done Network Element (Switches, Routers, AP's etc) based NAS devices to have PAP authentication for centralised administration of those devices using FreeRADIUS to authenticate against your centralised LDAP Directory. It does not deal with EAP or 802.1x, it is only focused on PAP Username & Cleartext Password authentication and authorization to network elements. Please search for other documents which detail how to implement EAP/802.1x There were a number of business requirements when I setup this environment: 1) Centralised users. All users would only exist in the LDAP directory and their profiles are driven out of the directory. 2) Supporting different makes and models and use cases of Network Elements (NAS) 3) Grouping NAS's together so that a single role could gain access to multiple devices. IE Switches in Building A, Routers in DMZ, LAB Switches etc. This is done using FreeRADIUS Huntgroups. 4) Multiple Roles per NAS Group. So that you can have a Read-Only, Read-Write, Administrator role for a group of NAS's and that a person could be a member of a role per NAS Group. IE Read-Write LAB Switches, Read-Only Switches in Building A. And last but most importantly. It's easy to manage, not require LDAP Schema Extensions and where possible not require building new tools to manage it. LDAP Design: I used Novell eDirectory as that is what we run, however the LDAP directory being used doesn't matter since no Radius Schema extensions are required, only "User" objects and "Group" objects will be used in new Organizational Units (OU) to be created. I will however use Active Directory based naming to try and be as generic as possible. First create a OU called Radius somewhere in your LDAP Structure to hold all the Radius objects that need to be created. In the following examples I will use the AD Domain of ACME.COM, DC=ACME,DC=COM Start with: OU=Radius,DC=ACME,DC=COM Then create two OU's under Radius. Elements and Roles OU=Elements,OU=Radius,DC=ACME,DC=COM Elements will hold a record of every NAS in your Network. You will create Group objects based on the IP Address of the NAS and set the "Location" or "l" attribute to the NAS Huntgroup the NAS belongs to allow them to be centrally managed in LDAP. IE CN=10.1.2.3,OU=Elements,OU=Radius,DC=ACME,DC=COM With a "l" value of "CiscoRTR" for a Cisco Router that has a NAS-IP-Address or Source-IP-Address of 10.1.2.3. This will make more sense further on. OU=Roles,OU=Radius,DC=ACME,DC=COM Roles will hold Group objects of the LDAP roles that users will be put into to grant them access to the NASs Now that you have your basic LDAP structure we will move onto the FreeRADIUS configuration files that need to be modified. Configuration Files: Following standard practice from the freeradius-users mailing list: ** DOWNLOAD THE LATEST VERSION OF FREERADIUS, TAKE THE DEFAULT CONFIGURATION AND ONLY MODIFY THE SETTINGS IN THE CONFIGURATION YOU NEED TO ** With that in mind I will go through the files I have modified to make the LDAP Authentication work: FILE:/etc/raddb/modules/ldap This is the main LDAP Module configuration file that needs to be modified, I've added comments above each line detailing what it's needed for: ldap { # The Server IP Address or DNS name, preferably run FreeRADIUS on the same server as the LDAP directory so then you can use Cleartext non-SSL connections from FreeRADIUS to the LDAP directory. Using SSL slows down the authentication slightly due to needing to setup SSL Connection for the LDAP Bind for the user. server = "ldap.acme.com" # This is a proxy username with enough read rights to find the user and check they have a valid role. Needs to be able to search users and Groups, and group "member" and "l" values. identity = "cn=Proxy,ou=Users,DC=ACME,DC=COM" # The identity's password. password = mypass # The top level of the LDAP Tree to search for users. Set this as high as practically possible. basedn = "DC=ACME,DC=COM" # I normally set the search to be cn=username, rather than uid=username. filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" #** Leave other default's alone ** # Allow searching of LDAP Groups. groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # Need to support XLAT for HuntGroups do_xlat = yes # Leave other defaults alone } FILE:/etc/raddb/clients.conf Standard clients.conf where you specify the shared secret password. Since I am lazy just specify "password" for the whole 10.x.x.x network: client 10.0.0.0/8 { secret = password shortname = 10Network } FILE:/etc/raddb/users This file is where a Huntgroup (Group of NASs) and a LDAP Group (that the user needs to be a member of) is checked, if they both match then the NAS VSA attributes below the Huntgroup/LDAP Group match are returned. It's also important to have the last line of this file saying "DEFAULT Auth-Type := Reject" since this means that no matches were found, so access should be rejected. Below is a few examples of how it could be configured, this file will be the only file you need to modify when adding a new role or NAS Group. -----BEGIN # Below if you are coming from the CiscoRTR NAS Huntgroup, and you are a member of the "Guest" group, you get the below access. DEFAULT Huntgroup-Name == CiscoRTR, Ldap-Group == "cn=CiscoGuest,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "NAS-Prompt-User", Idle-Timeout = 600, Cisco-AVPair = "shell:priv-lvl=1" # DEFAULT Huntgroup-Name == CiscoRTR, Ldap-Group == "cn=CiscoAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "NAS-Prompt-User", Idle-Timeout = 600, Cisco-AVPair = "shell:priv-lvl=15" # DEFAULT Huntgroup-Name == Junipers, Ldap-Group == "cn=JuniperAdmin,ou=Roles,ou=Radius,DC=ACME,DC=COM" Service-Type = "Login-User", Idle-Timeout = 600, Juniper-Local-User-Name = "admin" # DEFAULT Auth-Type := Reject -----END As you can see for each Role, or Group of NAS's you need a entry. This file will grow to cater for as many roles as you need. And to get FreeRADIUS to re-read this file you need to "kill -HUP" the radiusd. FILE:/etc/raddb/sites-enabled/default This is the main site configuration file with the Authorize and Authenticate of the user occurs. Below are the exact versions of both the Authorize and Authenticate sections, since I commented out all services apart from the ones I need: I left all other sections alone, just update these two. -----BEGIN authorize { # First we need to lookup the NAS IP Address based off the Packet-Src-IP-Address. # I used this rather than %{NAS-IP-Address} as per: http://wiki.freeradius.org/Run-time_variables # Since a few NAS devices I have used send bogus NAS-IP-Addresses, and no NAT translations occur within our network so we can trust the Src-IP # So what this is doing is looking up in LDAP using the CN=IPAddress, and looking up the "l" attribute against that object, and updating the "Huntgroup-Name" with that value # This way if you setup the LDAP object correctly you can easily move the NAS from one Huntgroup to another by only updating the "l" attribute in LDAP. update request { Huntgroup-Name := "%{ldap:ldap:///ou=Elements,ou=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" } # Now lookup LDAP to find the user's full DN to see if they really do exist in LDAP. ldap # Lastly using the user you just found above, lookup to see if the Huntgroup they are coming from, matches any of the LDAP group they need to belong to as per the above "users" file to assign the relevant role and update the response with the VSA's specified in the "users" file. files } authenticate { # All you need in the authenticate section is "ldap" so that FreeRADIUS checks the password the user specified is correct. If they get it wrong they get all the VSA's returned for the role they have access to, but get an Access-Reject. ldap } -----END Once you have done this, all the administration is done in the LDAP directory by adding or removing users from the relevant LDAP Group. When a new NAS Group, or Role is required all that is needed is to update the "users" file, and kill -HUP radiusd. I hope someone finds this useful. And that it gets turned into a Wiki Entry. Cheers Peter Lambrechtsen plambrechtsen at gmail dot com

2 1

queue radius message when resource is in use
by kabilius smith 18 Sep '10

18 Sep '10

Hi all, Happy Friday! Radius version: 1.1.7-r0.0.2 Here is my problem: I have configured the FreeRadius server to write to a file c:\test.log, and one of our programs reads contents from c:\ test.log as well. When our program is reading c:\ test.log, we open it with “deny write” permission, so the I saw the error message “Error: rlm_detail: Couldn't open file c:/test.log: Device or resource busy” in Radius.log. My question is: Can FreeRadius be configured to “delay write”? meaning, if it is unable to access c:\test.log, could it queue the message, and write to the file at a later time? My 2nd question: When FreeRadius receive a radius message, can it redirect the message to another TCP or UDP link? If it is possible, then we will just setup a TCP or UDP link to listen for the message from the FreeRadius server. Thank you, Alex

2 2

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

> Why are you trying to change the configuration on the server? > > You were already told where the problem was. It's not the server. > > If you're not going to read the answers on this list, there's no > reason to post questions. Sorry , i didn't understood you. Where i said the answer? Why it's not server problem. If it can't read normal user info means that something wrong in its config and i didn't find any problem (coz i'm not guru at all). I know how use and search such lists and forums. but nothing helped me to solve the problem. Already three i'm tring to male this EAP-TLS to work but nothing works. maybe someone can structurize my knowledge or give me some basic hints hot build this EAP-TLS server-client structure ? I don't know. what to do. I don't know why but i'm sure problem is in server configuration. I'm just asking for help.

2 3

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

forgot to mention that my try to make: heck_cert_cn = %{User-Name} => entered in users db username same as CN is in certificate with password supplied during client-cert generation with OpenSSL (A challenge password []:whatever) didn't work. As well as placing my real cert data in this filed: check_cert_issuer = "/C=ZZ/ST=Yyyyy/L=yyyyy/O=Xxx" No luck! Also i've mentioned this comments in eap.conf: # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate What is DN? maybe this one should be configured and work properly ?

2 1

Re: [help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

setup is. Mikrotik WDS AP + Mikrotik WDS Station....so suplicant is Mikrotik Station.... Mikrotik has only EAP-TLS .1x method for authentication and as i got EAP-TLS is using only certificates for auth. i'm sure that i have problem configuring eap TLS module. radius can't retrieve UserIdentity from certificate. I have found some kind of solution (but it didn't work) uncommented one by one strings in eap.conf check_cert_issuer = "/C=ZZ/ST=Yyyyy/L=yyyyy/O=Xxx" or check_cert_cn = %{User-Name} Also i tried next from this string: check_cert_cn = %{User-Name} => entered in users db username same as CN is in certificate with password supplied during client-cert generation with OpenSSL (A challenge password []:whatever) how radius should read user cert. whats wrong ? One more time, right now, TTLS working on same server using same tls module but with Ubiquiti equipment. P.S.: here is my discussion thread on mikrotik forum, but they don't have glue about freeradius setups (most of them) http://forum.mikrotik.com/viewtopic.php?f=7&t=45124&p=227563#p227563

1 0

Re: Support of Tag 0x00 for Tunnel-Server-Endpoint
by Naoufel 17 Sep '10

17 Sep '10

To clarify : > I'm using free radius 2.1.9 as a client to connect to a > distant server (not freeradius). I'm using API for client access not the freeradius as a server > We are facing a problem for Tunnel-Server-Endpoint > attribute : > > RFC http://www.ietf.org/rfc/rfc2868.txt > indicates for Tunnel-Server-Endpoint : > > Tag > The Tag field is one octet in length and is intended to provide a > means of grouping attributes in the same packet which refer to the > same tunnel. If the value of the Tag field is greater than 0x00 > and less than or equal to 0x1F, it SHOULD be interpreted as > indicating which tunnel (of several alternatives) this attribute > pertains. If the Tag field is greater than 0x1F, it SHOULD be > interpreted as the first byte of the following String field. > > So, there is no explicit prohibition of use of 0x00 as a Tag value. > > What we see in freeradius is that this values makes as ignore the value of the atrtribute. This means : - if we receive a Tunnel-Server-Endpoint with a Tag 0x01 value and that contains an IP@, the IP is taken into consideration and its value is returned by the API. Applicative layer uses it. - But if we receive a Tunnel-Server-Endpoint with a Tag 0x00 value and that contains an IP@, the IP is just ignored, its value is not returned by the API. The call to recv_one_paquet returns an empty Tunnel-Server-Endpoint value The no tag, is may be whell managed at server part, but misused by client part ? > Is there some other RFCs that show explicitely that the > 0x00 tag should lead to this behavior ? > Is it a freeradius bug ? > Any help about where is it managed in the code ? > > Thanks for help

2 1

[help] Mikrotik WDS + WPA2-EAP TLS + FreeRadius = failure
by Denis Iskandarov 17 Sep '10

17 Sep '10

Hello I'm trying to do WDS WPA2-EAP TLS authentication of 2 RB600 Simple WDS AP+station without EAP is working. I've already searched forum for related topics. but they didn't help me. So what do i have: 2x RB600 CentOS 5.5 => freeradius2-2.1.7-7.el5 + mysql Ver 14.12 Distrib 5.0.77, + daloRADIUS 0.9.8 (SVN 0.9.9) This setup works perfectly with Ubiquiti Nanobridge M5 EAP-TTLS. What i've done on RB's: Wireless interface: WDS static, AP bridge + station on other RB. SSID,FQ,Band = same Time and date adjusted for proper cert authentication. Most things i'm doing through winbox gui. AP bridge security profile and rad. server: [admin@RB600_test1] > /radius print Flags: X - disabled # SERVICE CALLED-ID DOMAIN ADDRESS SECRET 0 wireless 192.168.0.29 secret Here's debug of radius: It's says that it can't identify username. what should i write in db as username? as i knew EAP-TLS is using certificate authentication without usernames and passwords like EAP-TTLS is doing. FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server_keycert.pem" certificate_file = "/etc/raddb/certs/server_keycert.pem" CA_file = "/etc/raddb/certs/cacert.pem" private_key_password = "lettheserverin" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radiusdb" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.168.0.140,shortname=ubntAP,secret=secret123 rlm_sql (sql): Adding client 192.168.0.140 (ubntAP, server=<none>) to clients list rlm_sql (sql): Read entry nasname=192.168.0.22,shortname=RB600_test1,secret=secret rlm_sql (sql): Adding client 192.168.0.22 (RB600_test1, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.22 port 41953, id=93, length=201 Service-Type = Framed-User Framed-MTU = 1400 Acct-Session-Id = "82100859" Acct-Multi-Session-Id = "00-0C-42-31-5C-70-00-0C-42-23-48-0A-82-10-00-00-00-00-08-59" Calling-Station-Id = "00-0C-42-23-48-0A" Called-Station-Id = "00-0C-42-31-5C-70:MikroTik-test" EAP-Message = 0x0200000501 Message-Authenticator = 0x99441f609c780c7b28d234de47b36283 NAS-Identifier = "RB600_test1" NAS-IP-Address = 192.168.0.22 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok [eap] EAP packet type response id 0 length 5 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> [sql] sql_set_user escaped user --> '' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] UserIdentity Unknown [eap] Identity Unknown, authentication failed [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [<no User-Name attribute>] (from client RB600_test1 port 0 cli 00-0C-42-23-48-0A) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.0.22 port 41953, id=93, length=201 Waiting to send Access-Reject to client RB600_test1 port 41953 - ID: 93 Waking up in 0.5 seconds. rad_recv: Access-Request packet from host 192.168.0.22 port 41953, id=93, length=201 Waiting to send Access-Reject to client RB600_test1 port 41953 - ID: 93 Sending delayed reject for request 0 Sending Access-Reject of id 93 to 192.168.0.22 port 41953 Waking up in 4.9 seconds. Cleaning up request 0 ID 93 with timestamp +35 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.22 port 54462, id=94, length=201 Service-Type = Framed-User Framed-MTU = 1400 Acct-Session-Id = "8210085a" Acct-Multi-Session-Id = "00-0C-42-31-5C-70-00-0C-42-23-48-0A-82-10-00-00-00-00-08-5A" Calling-Station-Id = "00-0C-42-23-48-0A" Called-Station-Id = "00-0C-42-31-5C-70:MikroTik-test" EAP-Message = 0x0200000501 Message-Authenticator = 0xed7b325c353b295032cd7532f1b225cb NAS-Identifier = "RB600_test1" NAS-IP-Address = 192.168.0.22 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok [eap] EAP packet type response id 0 length 5 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> [sql] sql_set_user escaped user --> '' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] UserIdentity Unknown [eap] Identity Unknown, authentication failed [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [<no User-Name attribute>] (from client RB600_test1 port 0 cli 00-0C-42-23-48-0A) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.0.22 port 54462, id=94, length=201 Waiting to send Access-Reject to client RB600_test1 port 54462 - ID: 94 Waking up in 0.4 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 94 to 192.168.0.22 port 54462 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.22 port 54462, id=94, length=201 Sending duplicate reply to client RB600_test1 port 54462 - ID: 94 Sending Access-Reject of id 94 to 192.168.0.22 port 54462 Waking up in 4.9 seconds. Cleaning up request 1 ID 94 with timestamp +73 Ready to process requests.

2 1

Support of Tag 0x00 for Tunnel-Server-Endpoint
by Naoufel 16 Sep '10

16 Sep '10

Hi, I'm using free radius 2.1.9 as a client to connect to a distant server (not freeradius). We are facing a problem for Tunnel-Server-Endpoint attribute : RFC http://www.ietf.org/rfc/rfc2868.txt indicates for Tunnel-Server-Endpoint : Tag The Tag field is one octet in length and is intended to provide a means of grouping attributes in the same packet which refer to the same tunnel. If the value of the Tag field is greater than 0x00 and less than or equal to 0x1F, it SHOULD be interpreted as indicating which tunnel (of several alternatives) this attribute pertains. If the Tag field is greater than 0x1F, it SHOULD be interpreted as the first byte of the following String field. So, there is no explicit prohibition of use of 0x00 as a Tag value. What we see in freeradius is that this values makes as ignore the value of the atrtribute. Is there some other RFCs that show explicitely that the 0x00 tag should lead to this behavior ? Is it a freeradius bug ? Any help about where is it managed in the code ? Thanks for help

2 1

Re: Error: "Discarding duplicate request..."
by Alan Buxey 16 Sep '10

16 Sep '10

2.1.3 is very old now , 2.1.9 is current and has many fixes over that - check its changelog .. this error message suggests that you've got a slow backend somewhere - be that ldap, sql or even a bit of perl ----- Reply message ----- From: "Mike Diggins" <mike.diggins(a)mcmaster.ca> Date: Wed, Sep 15, 2010 16:22 Subject: Error: "Discarding duplicate request..." To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Our students have returned this week, and I've noticed a couple new messages logged to my FreeRadius 2.1.3 server. When it happens, my controllers fail over to the secondary Radius server. This has happened a few times. My Radius servers are only lightly loaded, and only configured to do authentication. No databases. Any idea what might be causing this? Sep 15 10:06:44 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 218 due to unfinished request 35236 Sep 15 10:07:01 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 219 due to unfinished request 35237 Sep 15 10:07:24 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:41 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35239, in module component Sep 15 10:07:52 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35240, in module component Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client FHSWLC-1 port 32768 - ID: 205 due to unfinished request 35245 -Mike

3 2