- Freeradius-Users - lists.freeradius.org

FreeRADIUS 1.1.7 and exec modules
by liran tal 10 May '10

10 May '10

Hey, Just to be sure I'm not banging my head around this - is it a known issue where for a defined exec module which is later used in the authorize { } section, if it returns -1 to reject the user then freeradius doesn't return an access-reject and the request simply times out? Debug log: rad_recv: Access-Request packet from host x.x.x.x:54545, id=150, length=59 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Thu May 6 18:45:00 2010 : Debug: Processing the authorize section of radiusd.conf Thu May 6 18:45:00 2010 : Debug: modcall: entering group authorize for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "preprocess" returns ok for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "chap" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "mschap" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 9 Thu May 6 18:45:00 2010 : Debug: rlm_realm: No '@' in User-Name = "test", looking up realm NULL Thu May 6 18:45:00 2010 : Debug: rlm_realm: No such realm "NULL" Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "suffix" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling files (rlm_files) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "files" returns notfound for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling auth-script (rlm_exec) for request 9 Thu May 6 18:45:00 2010 : Debug: Exec-Program output: Access-Reject Thu May 6 18:45:00 2010 : Debug: Exec-Program-Wait: plaintext: Access-Reject Thu May 6 18:45:00 2010 : Debug: Exec-Program: returned: 255 Thu May 6 18:45:00 2010 : Error: rlm_exec (auth-script): External script failed Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from auth-script (rlm_exec) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "auth-script" returns fail for request 9 Thu May 6 18:45:00 2010 : Debug: modcall: leaving group authorize (returns fail) for request 9 Thu May 6 18:45:00 2010 : Debug: Finished request 9 Thu May 6 18:45:00 2010 : Debug: Going to the next request Thu May 6 18:45:00 2010 : Debug: --- Walking the entire request list --- Regards, Liran.

2 4

Log IP address (Calling-Station-Id?) of failed authentication attempts
by Matt Hite 10 May '10

10 May '10

Hello. I would like to log the client IP of failed & successful authentications to my RADIUS-enabled switches. Right now failed/success show up like this: radiusd[13877]: Login incorrect: [xyzzy] (from client SW-2745-C1.sv4 port 0) radiusd[13877]: Login OK: [plugh] (from client SW-2745-C1.sv4 port 0) It looks like I can possibly enable auth_badpass and auth_goodpass in radiusd.conf and then set: msg_goodpass = "%{Calling-Station-Id}" msg_badpass = "%{Calling-Station-Id}" Is this going about it the right way? Also, I really don't want the failed passwords to get logged. (I don't want to see my colleagues plain-text passwords.) If I do use the aforementioned technique, am I also going to see passwords? I'm guessing yes. Thanks for your help and insight. -M

2 2

RE: freenibs
by Mark 09 May '10

09 May '10

Hello list, I'd like to find out if anyone has had the experience installing freenibs onto an existing freeradius installation on fedora. The documentation that comes with the package is sorely lacking on the installation of the package onto an existing freeradius install and the google doesn't seem to be turning up anything. Feel free to drop me an email off list regarding this issue. Thanks in adv. Mark

2 2

foreach attribute array
by Aaron Paetznick 07 May '10

07 May '10

I'm having some trouble working with attribute arrays. My Cisco NASes don't seem to always want to send their Cisco-AVPair attribute in the same order, so I can't be sure I want to reference %{Cisco-AVPair[0]}, or %{Cisco-AVPair[1]}, or other positions. So far, I've worked around this by doing things like this: if ("%{Cisco-AVPair[0]}" =~ /^client-mac-address=(.+)$/ || "%{Cisco-AVPair[1]}" =~ /^client-mac-address=(.+)$/) { update request { Client-MAC-Address := "%{1}" } } I also have other Cisco-AVPairs that I'm checking, and they are also not always coming in a guaranteed order. Is there a way to do a each, while, for, or foreach on an attribute array? Thanks! --Aaron

2 3

framedipaddress
by Paweł Pogorzelski 07 May '10

07 May '10

Hi, I have question relating to accounting packets. I have database with default freeradius schema where radius collecting data from controller to radacct table. Which parameter is resposible for user ip address ? framedipaddress? I have meru networks controller. Fields in raddacct table (those with stars are collecting) *radacctid *acctsessionid *acctuniqueid *username groupname *realm *nasipaddress *nasportid *nasporttype *acctstarttime *acctstoptime *acctsessiontime *acctauthentic *connectinfo_start *connectinfo_stop *acctinputoctets *acctoutputoctets *calledstationid *callingstationid *acctterminatecause servicetype framedprotocol framedipaddress *acctstartdelay *acctstopdelay *xascendsessionsvrkey Thanks in advance -- Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

2 1

forward accoutning packets to another radius
by Athiqur Rahman 07 May '10

07 May '10

I am using FreeRadius 2.1.8 on Centos 5. Currently my NAS is sending accouting packets to my Radius which is storing it in the mysql database. What I want to know is how do i get my Radius to forward those accounting packets to another Radius server. Ideally i want to dump accounting into my own database and forward to another server as well Do I use the proxy.conf file? In the proxy.conf file I can see that there is home_server localhost realm already there. Do I create something similar to that only give it the the details of the other Radius?

2 4

Radius freeze
by Tokie 07 May '10

07 May '10

Hi everyone, I'm using FreeRADIUS Version 1.1.7 with Mysql. I use for Hotspot system. All works fine, but after around one day without activity, the radius server don't answer. Therefore, if I restart (/etc/init.d/freeradius restart), all works ok!! I monitor with the command "ps" and just restart result: # ps ax | grep freeradius 26118 ? Ssl 0:00 /usr/sbin/freeradius Immediately after the connection of a hotspot's user: # ps ax | grep freeradius 26118 ? Ssl 0:00 /usr/sbin/freeradius 26158 ? Z 0:00 [freeradius] <defunct> What does this mean *_/[freeradius] <defunct>/_*? If hotspot's user disconnect, nothing changes!! Could you help me??

3 4

variety of errors in the case of unsuccessful authentication
by gorec2005 gorec2005 07 May '10

07 May '10

Hi! Help please: I'm using MPD as a NAS server and would like to return to the client a variety of errors in the case of unsuccessful authentication example: 646 The account is not permitted to log on at this time of day. 647 The account is disabled. 648 The password has expired. 649 The account does not have Remote Access permission. no matter what mistakes I did not send - the radius always returns 691 Access denied because username and / or password is invalid on the domain. SY gorec

1 0

Tee accounting via detail
by Pavel Levshin 07 May '10

07 May '10

Hello. I have to copy our accounting flow to multiple destinations. It can be done with multiple detail files and multiple detail readers, each proxying to one destination. But there are problems: 1. Detail reader can process one request from the file at a time. So, if we have relatively slow (in terms of round-trip-time, like satellite) link, then we cannot process packets at any reasonable speed. If RTT is 0.5s, then we cannot relay more than 2 requests per second. It is horribly slow. Did I miss something? 2. Most of our accounting traffic should be delivered in realtime. Delay in transmission is much worse than some degree of loss. Now, one undelivered request may block complete detail file for some time. 3. Even when detail reader has not been blocked, it may stuck for poll_interval seconds when processing of detail.work has been finished. Even when new detail file exists. 4. Some of the destinations may not reply at all (RADIUS sniffers behave so). We would be happy to send them a copy of each accounting request and forget it immediately. Is it possible? -- Pavel Levshin

3 2

Freeradius and Database backend use cases
by Natr Brazell 07 May '10

07 May '10

I'm looking for some useful information on integrating freeradius with a database backend (or vice-versa). Specifically: 1) What functions are able to use a database? a. User profile mapping such as nate.whoami mapping to a Juniper-Local-User-Name = "whoever" b. radius auditing such as data typically found in the radacct dir by NAS IP? I'm trying to centralize the auditing logs of multiple radius servers and looking for useful references. Thanks, Nate

2 1