- Freeradius-Users - lists.freeradius.org

Rlm_Perl question
by tyllerd 10 Aug '10

10 Aug '10

Hello. I realise how stupid this question sounds, but I just don't know the answer. In the example file it says this # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } What is "/^baduser/i" ? I am wanting to use the perl module with freeradius, but I am still learning Perl and I currently have that (the example.pl) file running and have replaced baduser with test. so it looks like # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^test/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } However I can still login with test. I just would like to know should it be "test", 'test'.. I have tried those and they also do not work, so maybe it is something else. Thank you if anyone can help. -- View this message in context: http://old.nabble.com/Rlm_Perl-question-tp29375020p29375020.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Accounting info
by JOE 10 Aug '10

10 Aug '10

Hi all, Does freeradius support receiving Interim-Update with the accounting info? meaning updating the radacct table with user usage / session time at regular intervals? Regards

2 2

RE: RE: MAC based authentication
by ralfheise＠freenet.de 10 Aug '10

10 Aug '10

Phil Mayers wrote: > You've enabled 802.1x, not MAC-based VLANs. You'll need to configure 802.1x at the servers or configure MAC-based auth at the switch. I thought I'd. Indeed authentication is working now, however the switch doesn't assign clients to the VLAN the RADIUS server instructs to. May be off-topic, but would you mind give me hint? The EX monitor output gives me: Aug 10 17:57:42.740610 Processing authentication response complete Aug 10 17:57:42.740657 authentication client Aug 10 17:57:42.740723 Sending message to authentication client Aug 10 17:57:42.742750 Received message from authentication client Aug 10 17:57:42.742815 reply: 1aba028 rply_hdr: 1abc000 bytes_remnant :0 len:2757 reply_len:2757 Aug 10 17:57:42.742845 hdr_bytes_read 0 Aug 10 17:57:42.742865 len read : 28 reply_len: 2735 Aug 10 17:57:42.742917 bytes_remnant 2707 tot_bytes_read 28 Aug 10 17:57:42.742954 bytes_read 2707 Aug 10 17:57:42.742974 Creating background job to process reply from authentication client Aug 10 17:57:42.743103 Entering background job to process message from authentication client Aug 10 17:57:42.743132 process_auth_reply len:2735 Aug 10 17:57:42.743157 Received VLAN ID/name 110 from authentication server Aug 10 17:57:42.743199 Invoking state machine for authentication response for mac address AA:00:00:7F:9C:90 Aug 10 17:57:42.743223 on intf ge-1/0/4.0 . ... and root@EX4200-VC> show dot1x interface 802.1X Information: Interface Role State MAC address User ge-1/0/4.0 Authenticator Authenticated AA:00:00:7F:9C:90 aa00007f9c90 However: root@EX4200-VC> show vlans PRIV0 Name Tag Interfaces PRIV0 110 None root@EX4200-VC> show vlans default Name Tag Interfaces default ge-1/0/4.0*, ge-1/0/5.0* That's odd, since I think I did everything appropriate. A snippt from configuration: interfaces { . .. ge-1/0/4 { unit 0 { family ethernet-switching; } } ge-1/0/5 { unit 0 { family ethernet-switching; } } . .. protocols { . .. dot1x { traceoptions { file dot1x; flag state; flag dot1x-debug; } authenticator { authentication-profile-name auth; interface { ge-1/0/4.0 { supplicant multiple; mac-radius { restrict; } } ge-1/0/5.0 { supplicant multiple; mac-radius { restrict; } } } } . .. access { radius-server { 10.10.10.10 { . .. } } profile auth { authentication-order radius; radius { authentication-server 10.10.10.10; } } } vlans { . .. PRIV0 { vlan-id 110; } } freenetMail mobil – Alle E-Mails auf Ihrem Handy versenden und empfangen. Jetzt kinderleicht und kostenlos einrichten. http://tls.freenet.de/tipp/handymail/index.html

2 2

Import to MySQL from Flat Files
by Gabriel Marais 10 Aug '10

10 Aug '10

Hi Guys I was wondering if there was any "easy" way to import the accounting packets recorded in the flat files located at /var/log/freeradius/radacct into a MySQL database... My entries in the flat files looks like this (entry stripped) :- Wed Jul 7 22:37:39 2010 NAS-IP-Address = x.x.x.x NAS-Identifier = "rbggs2" Called-Station-Id = "xxxxxx" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = xxxxxx Calling-Station-Id = "xxxxxx" Acct-Status-Type = Stop Framed-IP-Address = 10.0.1.46 Acct-Session-Id = "29D015A2275DA802" User-Name = "xxxxxx" Acct-Input-Octets = 7453 Acct-Output-Octets = 5195 Acct-Input-Packets = 108 Acct-Output-Packets = 53 Acct-Terminate-Cause = User-Request Acct-Authentic = RADIUS Acct-Delay-Time = 0 3GPP-PDP-Type = 0 3GPP-SGSN-Address = x.x.x.x 3GPP-GGSN-Address = x.x.x.x Acct-Unique-Session-Id = "684b91e88bf31a83" Timestamp = 1278535059 Request-Authenticator = Verified Thanks, Gabriel

2 1

MAC based authentication
by ralfheise＠freenet.de 10 Aug '10

10 Aug '10

Hi I want to deploy MAC based RADIUS authentication (only - non responsive hosts). To be honest, I don't want to authenticate users at all, all I want is to assign hosts dynamically to different VLANS according to their MAC address. The one side is done by a Juniper EX series switch, which is - I think - configured appropriately and forwards requests to my RADIUS server (freeradius 2.1.9+dfsg-1+b on Debian Squeeze/Testing). My radiusd.conf is: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes client switch { ipaddr = 10.10.10.254 secret = juniper require_message_authenticator = no nastype = other } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } authorize { preprocess files } authenticate { } You can see, I disabled any authentication method beside of files. The users file is this: aa00007f9c90 Auth-Type := "EAP", Cleartext-Password == aa00007f9c90 Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "110" Now I start auth: root@EX4200-VC> restart dot1x-protocol Port based Network Access Control started, pid 25579 {master:0} root@EX4200-VC> show dot1x interface 802.1X Information: Interface Role State MAC address User ge-1/0/4.0 Authenticator Connecting ge-1/0/5.0 Authenticator Connecting and on the radius server: root@data:~# freeradius -X FreeRADIUS Version 2.1.9, for host x86_64-pc-linux-gnu, built on Jun 18 2010 at 03:16:00 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### ... radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. If I now try to communicate through the interface to be authenticated I get: Hi I want to deploy MAC based RADIUS authentication (only - non responsive hosts). To be honest, I don't want to authenticate users at all, all I want is to assign hosts dynamically to different VLANS according to their MAC address. The one side is done by a Juniper EX series switch, which is - I think - configured appropriately and forwards requests to my RADIUS server (freeradius 2.1.9+dfsg-1+b on Debian Squeeze/Testing). My radiusd.conf is: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes client switch { ipaddr = 10.10.10.254 secret = juniper require_message_authenticator = no nastype = other } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } authorize { preprocess files } authenticate { } You can see, I disabled any authentication method beside of files. The users file is this: aa00007f9c90 Auth-Type := "EAP", Cleartext-Password == aa00007f9c90 Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "110" Now I start auth: root@EX4200-VC> restart dot1x-protocol Port based Network Access Control started, pid 25579 {master:0} root@EX4200-VC> show dot1x interface 802.1X Information: Interface Role State MAC address User ge-1/0/4.0 Authenticator Connecting ge-1/0/5.0 Authenticator Connecting and on the radius server: root@data:~# freeradius -X FreeRADIUS Version 2.1.9, for host x86_64-pc-linux-gnu, built on Jun 18 2010 at 03:16:00 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### ... radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. If I now try to communicate through the interface to be authenticated I get: Hi I want to deploy MAC based RADIUS authentication (only - non responsive hosts). To be honest, I don't want to authenticate users at all, all I want is to assign hosts dynamically to different VLANS according to their MAC address. The one side is done by a Juniper EX series switch, which is - I think - configured appropriately and forwards requests to my RADIUS server (freeradius 2.1.9+dfsg-1+b on Debian Squeeze/Testing). My radiusd.conf is: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes client switch { ipaddr = 10.10.10.254 secret = juniper require_message_authenticator = no nastype = other } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } authorize { preprocess files } authenticate { } You can see, I disabled any authentication method beside of files. The users file is this: aa00007f9c90 Auth-Type := "EAP", Cleartext-Password == aa00007f9c90 Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "110" Now I start auth: root@EX4200-VC> restart dot1x-protocol Port based Network Access Control started, pid 25579 {master:0} root@EX4200-VC> show dot1x interface 802.1X Information: Interface Role State MAC address User ge-1/0/4.0 Authenticator Connecting ge-1/0/5.0 Authenticator Connecting and on the radius server: root@data:~# freeradius -X FreeRADIUS Version 2.1.9, for host x86_64-pc-linux-gnu, built on Jun 18 2010 at 03:16:00 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### ... radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. If I now try to communicate through the interface to be authenticated I get: rad_recv: Access-Request packet from host 10.10.10.254 port 58798, id=45, length=118 User-Name = "aa00007f9c90" NAS-Port = 119 EAP-Message = 0x0200001101616130303030376639633930 Message-Authenticator = 0x4ab3cccda64e92e76dfa2a97172cebca Acct-Session-Id = "8O2.1x81eb00c2" NAS-Identifier = "EX4200-VC" NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[files] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 45 to 10.10.10.254 port 58798 Waking up in 4.9 seconds. Cleaning up request 0 ID 45 with timestamp +62 Ready to process requests. and on the switch it remains on: ge-1/0/4.0 Role: Authenticator Administrative state: Auto Supplicant mode: Multiple Number of retries: 3 Quiet period: 60 seconds Transmit period: 30 seconds Mac Radius: Disabled Mac Radius Strict: Enabled Reauthentication: Enabled Reauthentication interval: 3600 seconds Supplicant timeout: 30 seconds Server timeout: 30 seconds Maximum EAPOL requests: 2 Guest VLAN member: Number of connected supplicants: 1 Supplicant: aa00007f9c90, AA:00:00:7F:9C:90 Operational state: Authenticating Authentcation method: Radius Authenticated VLAN: configured/default Reauthentication due in 0 seconds Any clues? freenetMail - Der zuverlässige E-Mail-Dienst von freenet.de Jetzt kostenlose E-Mail-Adresse mit 1 GB Speicher und Profi-Spamschutz sichern! Sofort anmelden!

3 2

RE: MAC based authentication
by ralfheise＠freenet.de 10 Aug '10

10 Aug '10

Chun (Andrew) Xu wrote: > You will need EAP-MD5 to do authentication with Juniper EX switch as > authenticator. Enable eap in your authorize and authenticate > section. The default settings in eap.conf should work without any > tweaks. Great. That worked smoothly. Thank you! freenetMail - Der zuverlässige E-Mail-Dienst von freenet.de Jetzt kostenlose E-Mail-Adresse mit 1 GB Speicher und Profi-Spamschutz sichern! http://tls.freenet.de/tipp/1gb-speicher/index.html

1 0

ldap authentication using free radius
by Aqdas Muneer 10 Aug '10

10 Aug '10

Hello, We recently had a event during which our radius server lost connectivity to our Active Directory server. all the network gear could contact radius so none fell back to the backup authentication method (local), but because AD was down we couldn't get into our devices. is there a way to use some locally stored password in free radius if the ldap server cant be reached? Thanks, Aqdas

2 2

radius does not check table radgroupcheck
by Erick de A. Fabbio 10 Aug '10

10 Aug '10

Hi! I'm having the following problem: Any item that I put in radgroupcheck is not being considered by the radius ... the radius only checks the table radcheck ... I'm using Radius 2 with mysql database. *nas *id: 200 idrevenda: 1 nasname: 192.168.0.10 shortname: rb45g type: other ports: 1812 secret: 123 *radcheck* idrevenda: 1 username: "john" attribute: "user-password" op: "==" value: "123456" *radgroupcheck* idrevenda: 1 groupname: "office" attribute: "Calling-Station-Id" op: "==" value: "00:00:00:00:00:00" *radusergroup* idrevenda: 1 username: "john" groupname: "office" priority: 1 Suppose that the John's MAC Address is 00:a2:bf:66:dd:ff ... the radius should not allow the access... # radtest john 123456 192.168.0.10 10 123 Sending Access-Request of id 218 to 192.168.0.10 port 1812 User-Name = "john" User-Password = "123456" NAS-IP-Address = 192.168.0.10 NAS-Port = 10 rad_recv: Access-Accept packet from host 192.168.0.10 port 1812, id=218, length=20 #radius -X ... rad_recv: Access-Request packet from host 192.168.0.10 port 44307, id=218, length=56 User-Name = "john" User-Password = "123456" NAS-IP-Address = 192.168.0.10 NAS-Port = 10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> john [sql] sql_set_user escaped user --> 'john' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT aut.id, aut.username, aut.attribute, aut.value, aut.op FROM radcheck aut WHERE aut.username = '%{SQL-User-Name}' and aut.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) ORDER BY aut.id-> SELECT aut.id, aut.username, aut.attribute, aut.value, aut.op FROM radcheck aut WHERE aut.username = 'john' and aut.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '192.168.0.10' LIMIT 0,1) ORDER BY aut.id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT rp.id, rp.username, rp.attribute, rp.value, rp.op FROM radreply rp WHERE rp.username = '%{SQL-User-Name}' and rp.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) ORDER BY rp.id -> SELECT rp.id, rp.username, rp.attribute, rp.value, rp.op FROM radreply rp WHERE rp.username = 'john' and rp.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '192.168.0.10' LIMIT 0,1) ORDER BY rp.id [sql] expand: SELECT ug.groupname FROM radusergroup ug WHERE ug.username = '%{SQL-User-Name}' and ug.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) ORDER BY ug.priority -> SELECT ug.groupname FROM radusergroup ug WHERE ug.username = 'john' and ug.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '192.168.0.10' LIMIT 0,1) ORDER BY ug.priority [sql] expand: SELECT gc.id, gc.groupname, gc.attribute, gc.Value, gc.op FROM radgroupcheck gc WHERE gc.groupname = '%{Sql-Group}' and gc.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) ORDER BY gc.id -> SELECT gc.id, gc.groupname, gc.attribute, gc.Value, gc.op FROM radgroupcheck gc WHERE gc.groupname = '27' and gc.idrevenda = (SELECT distinct n.idrevenda FROM nas n WHERE n.nasname = '192.168.0.10' LIMIT 0,1) ORDER BY gc.id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group PAP {...} [pap] login attempt with password "123456" [pap] Using clear text password "123456" [pap] User authenticated successfully ++[pap] returns ok expand: -> Login OK: [john/123456] (from client radtest port 10) +- entering group post-auth {...} [sql] expand: %{User-Name} -> john [sql] sql_set_user escaped user --> 'john' [sql] expand: %{User-Password} -> 123456 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'john', '123456', 'Access-Accept', '2010-08-06 17:30:29') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'john', '123456', 'Access-Accept', '2010-08-06 17:30:29') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 218 to 192.168.0.10 port 44307 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 218 with timestamp +6 Ready to process requests. *dialup.conf: *authorize_check_query = "SELECT aut.id, aut.username, aut.attribute, aut.value, aut.op \ FROM ${authcheck_table} aut \ WHERE aut.username = '%{SQL-User-Name}' \ and aut.idrevenda = (SELECT distinct n.idrevenda FROM ${nas_table} n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) \ ORDER BY aut.id" authorize_reply_query = "SELECT rp.id, rp.username, rp.attribute, rp.value, rp.op \ FROM ${authreply_table} rp \ WHERE rp.username = '%{SQL-User-Name}' \ and rp.idrevenda = (SELECT distinct n.idrevenda FROM ${nas_table} n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) \ ORDER BY rp.id" group_membership_query = "SELECT ug.groupname \ FROM ${usergroup_table} ug \ WHERE ug.username = '%{SQL-User-Name}' \ and ug.idrevenda = (SELECT distinct n.idrevenda FROM ${nas_table} n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) \ ORDER BY ug.priority" authorize_group_check_query = "SELECT gc.id, gc.groupname, gc.attribute, \ gc.Value, gc.op \ FROM ${groupcheck_table} gc \ WHERE gc.groupname = '%{Sql-Group}' \ and gc.idrevenda = (SELECT distinct n.idrevenda FROM ${nas_table} n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) \ ORDER BY gc.id" authorize_group_reply_query = "SELECT gr.id, gr.groupname, gr.attribute, \ gr.value, gr.op \ FROM ${groupreply_table} gr \ WHERE gr.groupname = '%{Sql-Group}' \ and gr.idrevenda = (SELECT distinct n.idrevenda FROM ${nas_table} n WHERE n.nasname = '%{NAS-IP-Address}' LIMIT 0,1) \ ORDER BY gr.id"* *What can it be? Thank's you for help! -- Erick de A. Fabbio MSN/GTalk: erickfabbio(a)gmail.com Skype: erickfabbio

5 8

Of accounting data and security
by Natr Brazell 10 Aug '10

10 Aug '10

Is there a way to secure the communication between the radius server and the NAS especially wrt accounting data?

6 11

Sizo Nsibande invites you to use Boxbe
by Sizo Nsibande 10 Aug '10

10 Aug '10

I'd like to share approved contacts with you on Boxbe Here's the link: https://www.boxbe.com/register?tc=4159834829_1430679976 -Sizo This message was sent at the request of ooziss(a)gmail.com. If you want to opt-out of invitations from Boxbe members, use this link: https://www.boxbe.com/unsubscribe?email=freeradius-users@lists.freeradius.o… Boxbe, Inc. | 2390 Chestnut Street #201 | San Francisco, CA 94123

1 0