- Freeradius-Users - lists.freeradius.org

Novell E-Directory
by John McDonnell 13 Jul '10

13 Jul '10

I've noticed in all the old documentation that it says to configure FreeRADIUS with --with-edir to enable support for Novell. All of the documentation for this that I've found is generally old and referencing FR v1.x and not 2.x. On FreeBSD, in the ports system, the with-edir toggle has been removed from the config options when building FR v2.x though it is still something available in the older FR v1.x. My question is, do I need to do anything special when building FR v2.x to get support for the couple of e-directory options (edir_account_policy_check come to mind) or if this just works out of the box. If I do still need to configure --with-edir when compiling, does anyone happen to know the syntax for FreeBSD to include it since it is no longer a toggle option. (If it is required, I'll drop an e-mail on the maintainer to see if it can be added again to make things simpler in the future.) Thanks. :) -- John McDonnell Penn Cambria School District mcdonnjd(a)pcam.org O< ASCII Ribbon Campaign - www.asciiribbon.org

2 1

Is there a definitive config guide for installing 1.1.7 on Solaris 10
by Avery, Larry EIS-ERDC-ITL-MS Contractor 13 Jul '10

13 Jul '10

I'm running a Solaris 10 U6 (10/08) whole-root zone where I'm trying to install freeRadius 1.1.7 from packages (Sunfreeware). I've loaded what is listed (on Sunfreeware) as dependencies (and dependencies of those packages), but I still get a segmentation fault on startup. No changes have been made to any of the radius config files. Is there a complete list of packages required for freeRADIUS on my version of Solaris 10? The attempted startup of radius, with the "-X" option is shown below: # ./S99rad* start -n Starting FreeRADIUS: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Segmentation Fault - core dumped radiusd # I've seen queries from others with the same problem, but I can't find a resolution. Thanks for the help, Larry Avery

3 2

Log Client-NAS-IP insetad of shortname
by Matthias Cramer 13 Jul '10

13 Jul '10

Hi I have a bunch of Routers authentication agoinst a freeradius instance. All using the same secret, therefore I configured them as follows in the clients.conf client dynamicdsl { secret = XXXXXX shortname = dynamicdsl nastype = cisco ipaddr = xxx.xxx.xxx.0 netmask = 20 } Now it would be nice if it would be possible to log the NAS IP instead of the shortname in radius.log Is that possible. Would someone be willing to add such an option if not allready implemented ? Regards Matthias -- Matthias Cramer / mc322-ripe Senior Network & Security Engineer iway AG Phone +41 43 500 1111 Josefstrasse 225 Fax +41 44 271 3535 CH-8005 Zürich http://www.iway.ch/ GnuPG 1024D/2D208250 = DBC6 65B6 7083 1029 781E 3959 B62F DF1C 2D20 8250

1 0

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 12 Jul '10

12 Jul '10

Estaré ausente de la oficina desde el 12/07/2010 y no volveré hasta el 28/07/2010. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2)o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

User + Password + AMC address group authentication
by Aaron Jansen 12 Jul '10

12 Jul '10

Dear all, I would like to do the following: For a user FreeRADIUS should check the user name, password, and the MAC address. The MAC address can be one of many in a list stored in a database. So, this is not about a single user logging in on only one device. I have taken a look at the rad(group)check table, but it seems that ALL attributes should check out alright for the user to be authenticated. So, I cannot just simply add a list of all possible user/MAC combinations. How can I best achieve this? Any help would be appreciated. Best regards, Aaeron Jansen

3 5

Simple Configuration of using passwd-like file, howto needed
by Madsen.Jan JMD 12 Jul '10

12 Jul '10

Hello All freeradius users I have been trying to get my freeradius to do authentication against a passwd-like file using the passwd module. I'm running FreeRadius 2.1.8 on a Debian 4.0 Server used lenny-backports for the installation. My specific configuration to get this working looks like this Passwd module file filename = /etc/tac-plus/passwd format = *User-Name:User-Password hashsize = 0 delimiter = : authtype = pap the password file looks like this /etc/tac-plus/passwd jmd:TLw0SiK4QfQxg:159:20::/home/jmd:/bin/bash users file DEFAULT NAS-IP-Address == 172.31.254.4 Cisco-AVPair += 'Wireless-WCS:role0=SuperUsers', Cisco-AVPair += 'Wireless-WCS:task0=Users and Groups', Cisco-AVPair += 'Wireless-WCS:task1=Audit Trails', There is no problem in stating the freeradius server The debug output look like this when I try to do an authentication using radtest command rad_recv: Access-Request packet from host 127.0.0.1 port 40466, id=179, length=55 User-Name = "jmd" User-Password = "password" NAS-IP-Address = 172.31.254.4 NAS-Port = 0 Thu Jul 8 15:02:10 2010 : Info: +- entering group authorize {...} Thu Jul 8 15:02:10 2010 : Info: ++[preprocess] returns ok Thu Jul 8 15:02:10 2010 : Info: ++[chap] returns noop Thu Jul 8 15:02:10 2010 : Info: ++[mschap] returns noop Thu Jul 8 15:02:10 2010 : Info: [suffix] No '@' in User-Name = "jmd", looking up realm NULL Thu Jul 8 15:02:10 2010 : Info: [suffix] No such realm "NULL" Thu Jul 8 15:02:10 2010 : Info: ++[suffix] returns noop Thu Jul 8 15:02:10 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jul 8 15:02:10 2010 : Info: ++[eap] returns noop Thu Jul 8 15:02:10 2010 : Info: [files] users: Matched entry DEFAULT at line 49 Thu Jul 8 15:02:10 2010 : Info: ++[files] returns ok Thu Jul 8 15:02:10 2010 : Info: ++[expiration] returns noop Thu Jul 8 15:02:10 2010 : Info: ++[logintime] returns noop Thu Jul 8 15:02:10 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Thu Jul 8 15:02:10 2010 : Info: ++[pap] returns noop Thu Jul 8 15:02:10 2010 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thu Jul 8 15:02:10 2010 : Info: Failed to authenticate the user. Thu Jul 8 15:02:10 2010 : Info: Using Post-Auth-Type Reject Thu Jul 8 15:02:10 2010 : Info: +- entering group REJECT {...} Thu Jul 8 15:02:10 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> jmd Thu Jul 8 15:02:10 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jul 8 15:02:10 2010 : Info: ++[attr_filter.access_reject] returns updated Thu Jul 8 15:02:10 2010 : Info: Delaying reject of request 19 for 1 seconds Thu Jul 8 15:02:10 2010 : Debug: Going to the next request Thu Jul 8 15:02:10 2010 : Debug: Waking up in 0.9 seconds. Thu Jul 8 15:02:11 2010 : Info: Sending delayed reject for request 19 Sending Access-Reject of id 179 to 127.0.0.1 port 40466 Thu Jul 8 15:02:11 2010 : Debug: Waking up in 4.9 seconds. Radtest command: radtest jmd password localhost 0 secret I have no clue of what I'm doing wrong !! Please help me Best regards Jan Madsen

2 6

Accounting and SQL
by David Peterson 10 Jul '10

10 Jul '10

I have accounting and SQL set up (probably broken). I see the debug showing it updating table radacct but the table remains empty. root@ubuntu:/usr/local/etc/raddb# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jun 21 2010 at 14:47:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/sites-available/dynamic-clients including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### realm WiMax.com { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dynamic { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 86400 } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server dynamic_client_server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "unl0ck" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating attr_filter.access_challenge attr_filter attr_filter.access_challenge { attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" key = "%{User-Name}" } Module: Instantiating handled always handled { rcode = "handled" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_wimax Module: Instantiating wimax wimax { delete_mppe_keys = yes } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.60.50 port 49154, id=22, length=163 server dynamic_client_server { rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 } # server dynamic_client_server - Added client 192.168.60.50 with shared secret unl0ck rad_recv: Access-Request packet from host 192.168.60.50 port 49154, id=22, length=163 User-Name = "KeepAliveUserNameAndPassword" NAS-IP-Address = 192.168.60.50 NAS-Port-Type = 27 NAS-Port = 0 Calling-Station-Id = "\000\000\000\000\000" NAS-Identifier = "001001001000032000" WiMAX-GMT-Timezone-offset = 0 Acct-Session-Id = "KeepAliveSessionId" User-Password = "KeepAliveUserNameAndPassword" +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-00-00-00-00-00 ++[wimax] returns ok [suffix] No '@' in User-Name = "KeepAliveUserNameAndPassword", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> KeepAliveUserNameAndPassword [sql] sql_set_user escaped user --> 'KeepAliveUserNameAndPassword' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'KeepAliveUserNameAndPassword' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'KeepAliveUserNameAndPassword' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'KeepAliveUserNameAndPassword' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. +- entering group post-auth {...} [sql] expand: %{User-Name} -> KeepAliveUserNameAndPassword [sql] sql_set_user escaped user --> 'KeepAliveUserNameAndPassword' [sql] expand: %{User-Password} -> KeepAliveUserNameAndPassword [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KeepAliveUserNameAndPassword', 'KeepAliveUserNameAndPassword', 'Access-Accept', '2010-07-08 16:11:46') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KeepAliveUserNameAndPassword', 'KeepAliveUserNameAndPassword', 'Access-Accept', '2010-07-08 16:11:46') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop expand: %{User-Name} -> KeepAliveUserNameAndPassword expand: %{EAP-MSK} -> ++[reply] returns noop [wimax] No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys. ++[wimax] returns noop Sending Access-Accept of id 22 to 192.168.60.50 port 49154 WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = 0x Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.60.50 port 49155, id=14, length=135 User-Name = "KeepAliveUserNameAndPassword" NAS-IP-Address = 192.168.60.50 NAS-Port-Type = 27 NAS-Port = 0 Calling-Station-Id = "\000\000\000\000\000" NAS-Identifier = "001001001000032000" WiMAX-GMT-Timezone-offset = 0 Acct-Status-Type = Stop Acct-Session-Id = "KeepAliveSessionId" +- entering group preacct {...} ++[preprocess] returns ok expand: %{Acct-Session-Time} -> ... expanding second conditional expand: %{Acct-Delay-Time} -> ... expanding second conditional expand: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0} -> 1278619906 - 0 - 0 expand: %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} -> 1278619906 ++[request] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.60.50,NAS-IP-Address = 192.168.60.50,Acct-Session-Id = "KeepAliveSessionId",User-Name = "KeepAliveUserNameAndPassword"' [acct_unique] Acct-Unique-Session-ID = "3e3e3f7489ea6051". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "KeepAliveUserNameAndPassword", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> KeepAliveUserNameAndPassword rlm_radutmp: Logout for NAS Extreme 5000 port 0, but no Login record ++[radutmp] returns ok [sql] expand: %{User-Name} -> KeepAliveUserNameAndPassword [sql] sql_set_user escaped user --> 'KeepAliveUserNameAndPassword' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-07-08 16:11:46', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: stop packet with zero session length. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> stop packet with zero session length. [user 'KeepAliveUserNameAndPassword', nas '192.168.60.50'] [sql] stop packet with zero session length. [user 'KeepAliveUserNameAndPassword', nas '192.168.60.50'] rlm_sql (sql): Released sql socket id: 3 ++[sql] returns noop ++? if (noop) ? Evaluating (noop) -> TRUE ++? if (noop) -> TRUE ++- entering if (noop) {...} +++[ok] returns ok ++- if (noop) returns ok [attr_filter.accounting_response] expand: %{User-Name} -> KeepAliveUserNameAndPassword attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 14 to 192.168.60.50 port 49155 Finished request 1. Cleaning up request 1 ID 14 with timestamp +25 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 22 with timestamp +25 Ready to process requests. David Peterson

2 3

Scripts executing in acct_users file
by Eugen Vakulenko 09 Jul '10

09 Jul '10

Hi all! I've just upgraded from 1.1.6 to 2.1.9. On the old server I'm used Start/Stop and Interim-Update in acct_users file to execute some script in this way: DEFAULT Acct-Status-Type == Start Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" DEFAULT Acct-Status-Type == Interim-Update Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" But when I try it on the new server it seems it doesnt work. exec is enabled: Optimus# less /usr/local/etc/raddb/sites-enabled/default ... post-auth { # main_pool # reply_log # sql # sql_log # ldap exec # wimax Post-Auth-Type REJECT { attr_filter.access_reject } } What is the best way to make it work?

3 2

Freeradius with LDAP backend for pptpd (via MS-CHAP)
by Daniel Gomes 09 Jul '10

09 Jul '10

Dear list, I know this is a question which has been thoroughly asked and answered, but after spending several days configuring, debugging, searching the internet, rec-configuring, etc, I still can't get my freeradius server to properly authenticate users (for a pptd server). First of all, on the pptpd server's side (which I know it's not your "jurisdiction", so I'll be fast here), I have the require-mschap-v2 and require-mppe options enabled. As for freeradius itself, a summarized sites-enabled/default reads: authorize { preprocess pap mschap ldap auth_log eap { ok = return } expiration logintime } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } My modules/ldap contains all the necessary information, and my modules/mschap has the options use_mppe, require_encryption and require_strong enabled, like most tutorials state. As for the results, radtest works fine (querying LDAP etc), but through pptd it always fails with this error: ---------------- rad_recv: Access-Request packet from host 127.0.0.1 port 39968, id=75, length=151 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "dgomes" MS-CHAP-Challenge = 0x4276ec425c25a93a22c31b2bc34cdd17 MS-CHAP2-Response = 0x48003ac4b88e3cc4c6b5819eb258c434e27a000000000000000002a4c78177ee841a98cf68cb9686085635bd3b3083707eb3 Calling-Station-Id = "193.136.136.200" NAS-IP-Address = 193.136.136.40 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [ldap] performing user authorization for dgomes WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=dgomes) expand: ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt -> ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gold.ipfn.ist.utl.pt:389, authentication 0 rlm_ldap: bind as cn=radius,ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt/passVPN to gold.ipfn.ist.utl.pt:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt, with filter (cn=dgomes) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user dgomes authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y %m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100708 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100708 expand: %t -> Thu Jul 8 14:08:34 2010 ++[auth_log] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for dgomes with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> dgomes attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request ------------------ I know that the error should be enough for me to fix it (since it's quite explanatory), but after trying many different configurations and searching through dozens of old mailing lists posts, I still haven't managed it... So yeah, of you could help me out, I'd appreciate it! All I want is pptpd to authenticate the users with a LDAP backend, via RADIUS. MS-CHAP is not even a requirement for me here, since both services are on the same machine, so there's not even the need for safe connections. So long as it works, I really don't care about any particular configuration! Thanks in advance, Daniel Gomes

4 12

Re: Scripts executing in acct_users file
by Eugen Vakulenko 09 Jul '10

09 Jul '10

Hm, I've done it but now when I'm running radiusd -X it shows: Module: Checking accounting {...} for more modules to load /usr/local/etc/raddb/sites-enabled/default[325]: Failed to load module "exe_module". /usr/local/etc/raddb/sites-enabled/default[323]: Errors parsing accounting section. After that I've tried also to create a file named exe_module in /raddb/modules with: exe_module { wait = yes program = "/usr/local/etc/raddb/aaa_pdsn.sh" input_pairs = request output_pairs = reply shell_escape = yes output = none } but than radiusd -X shows: Module: Checking accounting {...} for more modules to load /usr/local/etc/raddb/modules/exec_module[1]: Failed to link to module 'rlm_exe_module': file not found /usr/local/etc/raddb/sites-enabled/default[325]: Failed to load module "exe_module". /usr/local/etc/raddb/sites-enabled/default[323]: Errors parsing accounting section. 09.07.2010 13:13, Toure Mamadou написав(ла): > Hi, > First: create an exec module in radiusd.conf > For exemple : > exec exe_module { > wait = yes > program = "path to your prograù" > input_pairs = request > output_pairs = reply > shell_escape = yes > output = none > > } > > Second: edit the site-available/default to add the module name to accounting > section. > > accounting { > exe_module > .......... > # > # Create a 'detail'ed log of the packets. > # Note that accounting requests which are proxied > # are also logged in the detail file. > detail > ........... > } > > Hoppe it'll helpe > Regards. > > -----Message d'origine----- > De : freeradius-users-bounces+mamadou.toure=vipnet.ci(a)lists.freeradius.org > [mailto:freeradius-users-bounces+mamadou.toure=vipnet.ci@lists.freeradius.or > g] De la part de Eugen Vakulenko > Envoyé : vendredi 9 juillet 2010 08:53 > À : freeradius-users(a)lists.freeradius.org > Objet : Scripts executing in acct_users file > > Hi all! > > I've just upgraded from 1.1.6 to 2.1.9. On the old server I'm used > Start/Stop and Interim-Update in acct_users file to execute some script > in this way: > > DEFAULT Acct-Status-Type == Start > Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" > DEFAULT Acct-Status-Type == Interim-Update > Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" > DEFAULT Acct-Status-Type == Stop > Exec-Program = "/usr/local/etc/raddb/aaa_pdsn.sh" > > But when I try it on the new server it seems it doesnt work. > exec is enabled: > > Optimus# less /usr/local/etc/raddb/sites-enabled/default > ... > post-auth { > > # main_pool > # reply_log > # sql > # sql_log > # ldap > exec > # wimax > Post-Auth-Type REJECT { > attr_filter.access_reject > } > } > > What is the best way to make it work? > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

3 6