- Freeradius-Users - lists.freeradius.org

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I have to provision the DEST1 using live session information, and DEST1 only > needs the information during the current IP, but if I set up: > 1. manual Proxy from sites-enabled/default file: all ACK Packages are > delayed to the NAS, if DEST1 is not there, and the NAS possibly retries... > not good!? That's why the other virtual servers exist. > 2. if I use'copy-acct-to-home-server', I have to keep track of the packet, > to not send too old information to the DEST1. In strange cases, where DEST1 > is down for hours, I will keep sending packets of old sessions, until I went > through all left files... Uh... the server keeps track of the packet. And the whole point of accounting is to store data. i.e. to send *all* traffic, even after the home server has been down for hours. If you don't like this, you can change the proxying rules to *ignore* accounting packets that are older than X hours. See Acct-Delay-Time. > 3. I could possibly mix it: I might send START and STOP packets to DEST1. In > case DEST1 is not available, I put all STOP Packets into the > 'copy-acct-to-home-server' files. After DEST1 is back up, all previous ended > sessions will be cleared and new sessions will overwrite the possibly old > status in the DEST1 databases ..., but this might not work, as 'redundant' > does not take updates on a attribute list. That sounds complicated. > also... 'copy-acct-to-home-server' seems to delay the forwarded packet at > about 0.2 to 0.5 seconds... > I checked to use a ramdisk for this, but it did not speed up the process... > I sometimes see 0.05 but often 0.4 I don't understand why that's a problem. Do you really need millisecond resolution on accounting packets? > Again, nobody cares about start packets after the session has been > terminated, but fast delivery is critical... Why? No one else needs millisecond response time for accounting packets. Alan DeKok.

2 1

Looking for an editor for FreeRADIUS documentation
by Alan DeKok 15 Jun '10

15 Jun '10

In the interest of making the project better, we're looking for an editor for the documentation. The existing documentation is an "ad hoc" collection of files thrown together over a decade of effort, and written by many different people. We'd like to organize the documentation ("doc/" directory), and clean it up. We're looking for an editor with the following skills: - willing to do the work - can write reasonably clearly - basic knowledge of RADIUS The goal is to *organize* the documentation, not to write more. The existing documentation is basic, and could be improved through simple re-organization. No knowledge of "git" is required. Familiarity with "restructured text" would be good. We're looking to move the documentation to that format. If it matters, this is a *paid* position. We can't afford a lot, but we can afford to pay for work done. The rates will be negotiable based on quantity of work and results. Please send email to the list if you're interested. We can choose a candidate, and do the edits publicly, so people see visible progress. Alan DeKok.

10 24

authentication != authorization
by Erik Norgaard 15 Jun '10

15 Jun '10

Hi: I currently use freeradius 2.1.6 for authentication on my Wlan with WPA2-EAP-TLS. Now, I'd like to deploy multiple policies and authentication methods. As I use freeradius now, an authenticated user is authorized to whatever. I'd like to be able to differenciate this authorization such that, i.e. some users have full access, while other users have restricted access and others have no access even if authenticated successfully. Is there some way of having freeradius call a script or connect to some service, submitting the user authentication details and ip/mac address such that access can be granted according to the user privileges? More precisely, I'd like to deploy the following policies: a. If a user authenticates with a certificate I issued, I trust them with full access. b. If the user authenticates with a foreign trusted certificate I will grant web/mail access c. If the user authenticates with a temporal password, time limited access is granted to web/mail access d. If the user fails to authenticate, any web access is redirected to a web page explaining how to configure the system or request access So, even failure to authenticate should result in some sort of guest authentication without privileges. Regarding c, how can I manage temporal accounts? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818/+34.915211157 http://www.locolomo.org

1 0

Re: Send Accounting from any point in configuration
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I mean *create* an Accounting Packet, if an Access Request comes in. Use "radclient". > This is will be used to provision a HTTP Proxy Platform about the upcoming > isage of an IP address. Oh... that. The HTTP proxy is completely and totally broken. Using accounting packet to provision data is wrong. I'll go update the RADIUS specs to say that. > I will have to check any Accounting Packet for some Attributes/Values. > If a packet matches, it has to be proxied to a destination RADIUS Server. > > For instance: > if > NAS-IP-Address = 10.10.19.173 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.1.1 > > if > NAS-IP-Address = 10.10.18.120 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.100.100 > > else > do not proxy > > In that case, I have to check the attributes to decide, to which RADISU > Server I have to send the packets. See "man unlang". You can write rules that look pretty much like what you have above. > I found the section in the proxy.conf: > > # rlm_realm"). To manually proxy the request put this entry in the > # "users" file: > # > # > #DEFAULT Proxy-To-Realm := "realm_name" > # > > > Does it mean, that the lines un users file will do the work? Well... yes. That's the intent of the documentation. > DEFAULT NAS-IP-Address = 10.10.19.173, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination1" > DEFAULT NAS-IP-Address = 10.10.18.120, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination2" Except see "man users". You need to use the *correct* comparison operators. And doing this is pointless: Acct-Status-Type =* "". Just delete that check. > Is manual proxying in unlang possible, using sites-available/default ? Yes. Anything you can do in the "users" file you can do in "unlang". Alan DeKok.

1 0

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 14 Jun '10

14 Jun '10

Hi, > what version of OpenSSL have your got. what is the configuration of > eap.cofn regarding random option and does the file/link have read access > (or even exist!?)#> openssl version OpenSSL 0.9.8h 28 May 2008 The eap.conf is the default directly from the original freeradius-server-2.1.9, and all *.conf files have read access. Thanks for your help. Cheers, Henry _________________________________________________________________ Find a way to cure that travel bug MSN NZ Travel http://travel.msn.co.nz/

2 1

accounting without auth
by Omer Faruk Sen 14 Jun '10

14 Jun '10

Hi , Is it possible to configure freeradius for accounting only without authorization/authentication? Maybe by granting access to every auth request can be done but I want to hear your opinion before proceeding any further. Regards.

3 2

Re: Proxy to two RADIUS Servers
by Arran Cudbard-Bell 14 Jun '10

14 Jun '10

Use copy-acct-to-home-server, it's what it's there for. Delay is usually sub second, but it depends on the throttling values you set in the detail reader server. On 14/06/2010, Stefan A. <a.freeradius(a)premit.de> wrote: > I checked, whether I am able to manually proxy from sites-available/default, > using unlang. > It works fine, using the following commands. > > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > } > } > } > > > But I do not get it to work, if I try to proxy the same packet to two > servers: > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > Replicate-To-Realm += "DEST2" > } > } > } > > I only uses the first 'Replicate-To-Realm' entry DEST1 and does not seem to > cycle through a list or destination RADIUS Servers... > > > Is this the intended behavior? Should I go for 'copy-acct-to-home-server' ? > How much delay would this add between writing the file and sending the > packet to the home server? > > > Thank you > Stefan > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

FR 2.1.9 - segfault using status server
by John Horne 14 Jun '10

14 Jun '10

Hello, We are running FR 2.1.9 on CentOS 5, and are proxying requests to MS IAS 2003 servers. However, it seems the IAS servers do not support 'status-server' requests until a slightly later version. As such, I have configured FR to send a dummy userid/pwd instead. FR seems to receive a reply, but then segfaults. Running 'radiusd -X' shows: ============================================= Marking home server 141.163.66.101 port 1812 as zombie (it looks like it is dead). Sending Access-Request of id 168 to 141.163.66.101 port 1812 User-Name := "xxxxxx" User-Password := "xxxxxx" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.2 seconds. rad_recv: Access-Reject packet from host 141.163.66.101 port 1812, id=168, length=20 ============================================= So a reply was received, but radiusd has now died. Getting radiusd to dump a core file shows: ============================================= # gdb /usr/sbin/radiusd core.8509 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.1) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/radiusd...(no debugging symbols found)...done. Reading symbols from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /usr/lib/libltdl.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libltdl.so.3 Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/libssl.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.2 Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5.so.3 Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libcom_err.so.2 Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libk5crypto.so.3 Reading symbols from /usr/lib/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5support.so.0 Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libkeyutils.so.1 Reading symbols from /lib/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libselinux.so.1 Reading symbols from /lib/libsepol.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libsepol.so.1 Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /lib/libnss_dns.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_dns.so.2 Reading symbols from /usr/lib/freeradius/rlm_exec.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_exec.so Reading symbols from /usr/lib/freeradius/rlm_expr.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expr.so Reading symbols from /usr/lib/freeradius/rlm_expiration.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expiration.so Reading symbols from /usr/lib/freeradius/rlm_logintime.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_logintime.so Reading symbols from /usr/lib/freeradius/rlm_pap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_pap.so Reading symbols from /usr/lib/freeradius/rlm_mschap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_mschap.so Reading symbols from /usr/lib/freeradius/rlm_eap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap.so Reading symbols from /usr/lib/freeradius/libfreeradius-eap-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-eap-2.1.9.so Reading symbols from /usr/lib/freeradius/rlm_eap_tls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_tls.so Reading symbols from /usr/lib/freeradius/rlm_eap_ttls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_ttls.so Reading symbols from /usr/lib/freeradius/rlm_eap_peap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_peap.so Reading symbols from /usr/lib/freeradius/rlm_eap_mschapv2.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_mschapv2.so Reading symbols from /usr/lib/freeradius/rlm_realm.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_realm.so Reading symbols from /usr/lib/freeradius/rlm_files.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_files.so Reading symbols from /usr/lib/freeradius/rlm_radutmp.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_radutmp.so Reading symbols from /usr/lib/freeradius/rlm_attr_filter.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_attr_filter.so Reading symbols from /usr/lib/freeradius/rlm_preprocess.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_preprocess.so Reading symbols from /usr/lib/freeradius/rlm_acct_unique.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_acct_unique.so Reading symbols from /usr/lib/freeradius/rlm_detail.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_detail.so Core was generated by `/usr/sbin/radiusd -X'. Program terminated with signal 11, Segmentation fault. #0 0x0806c936 in received_proxy_response () (gdb) bt #0 0x0806c936 in received_proxy_response () #1 0x0805a041 in ?? () #2 0x0806b110 in ?? () #3 0x00ac1f0d in fr_event_loop () from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so #4 0x0806bd26 in radius_event_process () #5 0x08063f6a in main () (gdb) q ============================================= The proxy.conf part just has: ============================================= status_check = request username = xxxxxx password = xxxxxx ============================================= Has anyone else seen this problem? At the moment we are running FR with the 'status_check = status-server' enabled, since it seems better to receive no reply at all rather than having radiusd segfaulting. Thanks, John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

3 3

Re: Send Accounting from any point in configuration
by Alan DeKok 14 Jun '10

14 Jun '10

Stefan A. wrote: > I want to send RADIUS Accounting Messages to another RADIUS Server, > depending on some contents of a Packet. > > 'a Packet' in this context might be an Access or an Accounting Packet. The Access-Request && Accounting-Request packets are handled independently. If you want to change accounting behavior based on authentication packets, you will need to store information in database. > The intended Flow: > > Packet comes in ... > - for Access type, check if user might be authenticated > - if OK, try to decide to send an Accounting packet to a Server on some > attributes (in my case, VSA from downstream RADIUS Proxy Server) Do you mean *create* an accounting packet, or forward *later* accounting packets for that session? > - (possibly) don't care about the answer > - for Access type: accept/reject to Client > - for Accounting type: ACK to Client > > > As far as I understood, the proxy module does > - (only) proxy based on realm > - in proxy module, normal local Logfiles won't be used That's not true. You can proxy based on anything you want. See raddb/proxy.conf for documentation. You can proxy *and* log to detail files. Alan DeKok.

2 1

Some questions about freeradius for WiMAX
by WWF 14 Jun '10

14 Jun '10

Hi,all! I have several questions about fr 2.19 for WiMAX systems. 1. My network is a private network and does not need accounting.Then if I reply access accept with "Accounting-capabilities = 0", whether the ms can know about it and won't send accounting packets to my freeradius? 2. How to set values for these attributes: WiMAX-AAA-Session-ID = ? WiMAX-HA-RK-SPI = ? WiMAX-HA-RK-Lifetime = ? 3. How to add support for the "Error-Cause" attribute defined in rfc 3576. It seems no code for it in current implementation of 2.1.9 fr. 4. What the "disconnect request message" for? (for accounting?) I found in wiki that current implementation does not support this message. Thanks for your relpy. 2010-06-08

3 2