- Freeradius-Users - lists.freeradius.org

Re: R: rlm_ippool: No available ip addresses in pool
by Tabacchiera Stefano 05 May '10

05 May '10

>> Ok, you're right, but in my case I know the client session can't last more than 24hrs. >> So, for me it's ok to remove all *inactive* entries older than that. >> >> But, as far as I know, this seems to be impossible with gdm pool. >> So, what the "maximum_timeout" parameter is useful for ??? > It sets the timeout when entries are expired. Your tests (so you say) >don't go for 24 hours... so that timeout doesn't apply. Alan, that's wrong. I've done my tests with an ad-hoc pool, with maximum_timeout set at 10 secs. And the results I posted came from a new test session done the day after the first test. (24 hrs >> 10 secs) Why that timeout doesn't apply? >> So I need a method to avoid my pool being filled up by missing acct-stop. > You were told a method which should work. Try it. Surely I'll switch to sql pool, but what I observe is that dbm pool are useless, if I can't set a timeout *that works* on that. ST ______________________________________________________________________________________ La presente comunicazione ed i suoi allegati e' destinata esclusivamente ai destinatari. Qualsiasi suo utilizzo, comunicazione o diffusione non autorizzata e' proibita. Se ha ricevuto questa comunicazione per errore, la preghiamo di darne immediata comunicazione al mittente e di cancellare tutte le informazioni erroneamente acquisite. (Rif. D.Lgs. 196/2003). Grazie This message and its attachments are intended only for use by the addressees. Any use, re-transmission or dissemination not authorized of it is prohibited. If you received this e-mail in error, please inform the sender immediately and delete all the material. (Rif. D.Lgs. 196/2003). Thank you.

2 1

thx 4 openSSL & one more question
by ds14.kornel 05 May '10

05 May '10

Hi Thanks for last advices with freeradius installations + peap on debian lenny Now i have no problem with enabling peap :) this time I'm asking for help with some other problem: I'm trying to enable WPA2 enterprice authentication on my accesspoints. When trying to auth my wireless client I'm getting sth like this in log : Wed May 5 15:09:25 2010 : Auth: Login incorrect: [karol/<no User-Password attribute>] (from client AP1 port 0 cli 0022431380c4) where : 0022431380c4 is my wireless mac adress (laptop) client AP1 is my Access Point client from clients.conf karol - is my user from users.conf it looks like freeradius don't want to look inside the password field and can't recognize a laptop ip (getting mac) Please give me some advices - what's next ? Here is my debug. Kill-9:/home/kornel# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = yes dead_time = 120 wake_all_if_all_dead = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } * client 172.16.0.16 { ----------------------Client ip adress* require_message_authenticator = no secret = "tajne1234" shortname = "eee" } * client 192.168.10.50 { ----------------------AP ip adress* require_message_authenticator = no secret = "tajne1234" shortname = "AP1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. *AND here is an authenticate attempt debug* rad_recv: Access-Request packet from host 192.168.10.50 port 2054, id=148, length=169 User-Name = "karol" * NAS-IP-Address = 192.168.10.50 ----------------------AP ip adress* NAS-Port = 0 * Called-Station-Id = "00265abab28d" ----------------------AP mac adress Calling-Station-Id = "0022431380c4" ----------------------Client mac adress* NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000b016d617263696e Message-Authenticator = 0x2ea50a302a451ed3b32b748a23fe00e3 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [karol/<no User-Password attribute>] (from client AP1 port 0 cli 0022431380c4) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 148 to 192.168.10.50 port 2054 Waking up in 4.9 seconds. Client's system is eeebuntu and i'm sure that's on client and on AP everything is ok because when i'm connecting to another freeradius server - it's working fine (unfortunatelly i don't have an acces to those confs) in addition - temporarily I accepted all connections from those two ip's on my firewall to have 100% sure that's not a connection issue. Thank you for your time and knowledge share. -- LAN Administrator of DS14 Kornel Kornatka room 529

2 1

radius and fail over
by Fabien COMBERNOUS 05 May '10

05 May '10

Hi there, In the freeradius wiki a page give informations about failover [1]. It explains how to setup two sql modules pointing to two dbms. But in this setup, the radius server is a single point of failure. How to setup two radius servers speaking with two dbms ? Thank you for your help. [1] http://wiki.freeradius.org/Fail-over -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

2 1

Re: R: rlm_ippool: No available ip addresses in
by Tabacchiera Stefano 05 May '10

05 May '10

>How is FreeRADIUS supposed to know when a user disconnects and frees up the >IP address from the pool if the NAS doesn't tell it? Anything else is not >exactly reliable. If you have a user with a long duration session that lasts >longer than your timeout the IP could be put back into the pool when it is >still in use. Ok, you're right, but in my case I know the client session can't last more than 24hrs. So, for me it's ok to remove all *inactive* entries older than that. But, as far as I know, this seems to be impossible with gdm pool. So, what the "maximum_timeout" parameter is useful for ??? >The best solution would be to fix the NAS to send the packets or fix the >network to make sure they get delivered. Obviously, but I can't manage over that. It's out of my control. So I need a method to avoid my pool being filled up by missing acct-stop. Thanks again. ST ______________________________________________________________________________________ La presente comunicazione ed i suoi allegati e' destinata esclusivamente ai destinatari. Qualsiasi suo utilizzo, comunicazione o diffusione non autorizzata e' proibita. Se ha ricevuto questa comunicazione per errore, la preghiamo di darne immediata comunicazione al mittente e di cancellare tutte le informazioni erroneamente acquisite. (Rif. D.Lgs. 196/2003). Grazie This message and its attachments are intended only for use by the addressees. Any use, re-transmission or dissemination not authorized of it is prohibited. If you received this e-mail in error, please inform the sender immediately and delete all the material. (Rif. D.Lgs. 196/2003). Thank you.

2 1

Set NoCat user class in Access-Accept
by Ana Gallardo 05 May '10

05 May '10

Hello, I want to send the NoCat user Class in the Access-Accept. I don't know if I can send an attribute defined by me. I have defined an attributed: # cat /etc/freeradius/dictionary $INCLUDE /usr/share/freeradius/dictionary ATTRIBUTE NoCat-User-Class 3000 string And I put this attribute in the reply list with MySQL: mysql> select * from radgroupreply; +----+-----------+------------------+----+------------------------------+ | id | groupname | attribute | op | value | +----+-----------+------------------+----+------------------------------+ | 6 | MEMBER | NoCat-User-Class | := | Member | +----+-----------+------------------+----+------------------------------+ mysql> select * from radusergroup; +----------+-----------+----------+ | username | groupname | priority | +----------+-----------+----------+ | ana | CAU1 | 0 | | ana | MEMBER | 8 | +----------+-----------+----------+ But the server don send this attribute to the user. Debug info: rad_recv: Access-Request packet from host X port 33606, id=250, length=55 User-Name = "ana" User-Password = "claveAna" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} sql_xlat expand: %{User-Name} -> ana sql_set_user escaped user --> 'ana' expand: select shortname from nas where nasname="%{Client-IP-Address}" -> select shortname from nas where nasname="X" expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: select shortname from nas where nasname="X" sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select shortname from nas where nasname="%{Client-IP-Address}"} -> pcCAU1 ++[request] returns notfound ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "ana", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> ana [sql] sql_set_user escaped user --> 'ana' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'ana' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'ana' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'ana' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'ana' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'ana' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'ana' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'CAU1' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'CAU1' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'MEMBER' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'MEMBER' ORDER BY id [sql] User found in group MEMBER [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'MEMBER' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'MEMBER' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [expiration] Checking Expiration time: '02 Dec 2010' ++[expiration] returns ok ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "claveAna" [pap] Using clear text password "claveAna" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> ana [sql] sql_set_user escaped user --> 'ana' [sql] expand: INSERT INTO radpostauth (username, mac, client, nas, reply, authdate) VALUES ( '%{User-Name}', '%{Calling-Station-Id}', '%C', '%{Nas-IP-Address}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, mac, client, nas, reply, authdate) VALUES ( 'ana', '', 'pcCAU1', '127.0.1.1', 'Access-Accept', NOW()) [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, nas, reply, authdate) VALUES ( 'ana', '', 'pcCAU1', '127.0.1.1', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, mac, client, nas, reply, authdate) VALUES ( 'ana', '', 'pcCAU1', '127.0.1.1', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Sending Access-Accept of id 250 to X port 33606 Reply-Message += "Hola Anita" Session-Timeout = 18189945 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 250 with timestamp +6 Ready to process requests. I have found the attribute Class but I think that is more complex than I need. Some sugestion?? Thank you very much and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________

1 0

Does freeRADIUS support RadSec
by John 05 May '10

05 May '10

I found this draft "draft-dekok-radext-dtls-02.txt". Does freeRADIUS support RadSec feature? Is there any guidance for RadSec feature? Best regards. John

3 2

Basic wifi config
by Philippe Schwarz 05 May '10

05 May '10

Hi, I set up the following config, tried to follow the advices of freeradius website (don't touch anything you could break in the raddb directory ;-) ) The config (in french, sorry) i used : http://www.openbsd-edu.net/index.php/FreeRadius FreeRadius OS: OpenBSD 4.5 freeradius-2.1.3 RADIUS server implementation 192.168.1.9 & 172.16.0.133 AP : Linksys WRT54G WPA Entreprise & TKIP 192.168.1.1 Client WinXP; SP2 DHCP On the server : pkg_add -v http://ftp.arcane-networks.fr/pub/OpenBSD/$(uname -r)/packages/$(uname -m)/freeradius echo "if [ -x /usr/local/sbin/radiusd ]; then install -d -o _freeradius /var/run/radiusd echo -n ' radiusd'; /usr/local/sbin/radiusd fi " >> /etc/rc.local cp radius.pem /etc/raddb/certs/server.pem chmod 744 /etc/raddb/certs/server.pem cp ca.pem /etc/raddb/certs/ca.pem chmod 744 /etc/raddb/certs/ca.pem openssl verify -verbose -CApath /etc/raddb/certs/ -CAfile /etc/raddb/certs/ca.pem /etc/raddb/certs/server.pem => /etc/raddb/certs/server.pem: OK dd if=/dev/urandom of=/etc/raddb/certs/random bs=1024 count=100 openssl dhparam -out /etc/raddb/certs/dh 1024 echo " usertest Cleartext-Password := \"password\" " >> /etc/raddb/users echo " #Nagios client Nagios { secret = SECRETNAGIOS shortname = Nagios ipaddr = @IP NAgios } #Wifi AP3 client AP3 { secret = \"SECRET_AP3\" shortname = AP3 ipaddr = @IP AP3 nastype = other } # En local client localhost { ipaddr = 127.0.0.1 secret = \"SECRETLOCAL\" require_message_authenticator = no shortname = localhost nastype = other } " > /etc/raddb/clients.conf ifconfig em0 alias 192.168.1.9 netmask 255.255.255.0 ifconfig -a =>em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 =>inet 172.16.0.223 netmask 0xffff0000 broadcast 172.16.255.255 =>inet 192.168.1.9 netmask 0xffffff00 broadcast 192.168.1.255 /usr/local/sbin/radiusd -X radtest local & radtest remote are OK for the local and Nagios clients. Let's go to the XP... When i try to use the Wifi, the radiusd -X tells : .......I paste the logs to http://networkradius.com/freeradius.html and only copied the neither white nor blue parts : WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. grep roxy * |grep -v "#" attrs.access_reject: Proxy-State =* ANY attrs.accounting_response: Proxy-State =* ANY experimental.conf: mod_preproxy = radiusd_test experimental.conf: func_preproxy = preproxy experimental.conf: mod_postproxy = radiusd_test experimental.conf: func_postproxy = postproxy proxy.conf:proxy server { radiusd.conf:proxy_requests = no What is the missing magic command which could help me ?? Thanks. Best regards. -- Lycée polyvalent Alfred Nobel, Clichy sous Bois http://www.lyceenobel.org

2 3

Allow unlimited simultanious users ?
by James Hallahan 05 May '10

05 May '10

Hi Everbdody, Right off the bat I will tell you that this is my first experience with FreeRadius. I have a customer that wants to do be able to connect their laptops to a private network where we are running Edirectory as the authentication directory. Elements include - FreeRadius 2.1.6, Edirectory 8.7.x, SLES 11, LDAP authentication, Windows XP sp3, Novell Client32 4.91 sp5 I have this working Windows XP sp3 workstation and the user is prompted for username and passowrd for network access. Import of root CA from FreeRadius Server to Windows XP (SLES 11) PEAP and MSCHAP2 configuration on Windows XP The workstations only login to Edir to authtenicate and sync their local passwords all the applications are in a Citrx farm running off a Portal and the user has to login an extra time to access the portal. (Which could be a different username / password) Actually the certificate + username and password are only giving the user an IP address, there are no rights involved. I was wondering if it is possible to get rid of the pop-up with username and password by using a predefined username and password for all the users ? This could mean (worst case) 200-300 simultanious users with same FreeRadius username-password. This shouldn't be a problem for Edirectory but I am unsure in regard to FreeRadius. I can change the passowrd on the workstation at intervals by way of software distribution. All the users will be connecting by way of 1 Cisco controller connected to the APs by way of a VPN. Any thoughts - Experience with this ? Jim

1 0

Re: R: Re: R: Re: R: rlm_ippool: No available ip addresses in pool
by Tabacchiera Stefano 04 May '10

04 May '10

>Tabacchiera Stefano wrote: >> Alan, >> here's the content of gdbm db: > > Ah... it's the DBM pools. I already stated that in the subject of my mail (did you notice the module name?). > > Well.. use "rlm_ippool_tool" to manage the pool. > Great idea! Too bad that tool allow only to cleal *all* the entries in the DBM pool. Or am I just missing something? > Or, get your NAS to send accounting stop packets. It's *supposed* to >send stop packets when a user session is cleared. As I already said, I know the NAS sometimes doesn't send acct-stop pkts, but it's out of my control. My questions (still unanswered, let me say) are: 1) is maximum_timeout useless? 2) Is there a way to keep my dbm pool safe and updated (I mean no expired addresses), even in the case some acct-stop pkt are loss? 3) Should I switch to sql pool, 'cause dbm it's actually unreliable? Thanks again. ST ______________________________________________________________________________________ La presente comunicazione ed i suoi allegati e' destinata esclusivamente ai destinatari. Qualsiasi suo utilizzo, comunicazione o diffusione non autorizzata e' proibita. Se ha ricevuto questa comunicazione per errore, la preghiamo di darne immediata comunicazione al mittente e di cancellare tutte le informazioni erroneamente acquisite. (Rif. D.Lgs. 196/2003). Grazie This message and its attachments are intended only for use by the addressees. Any use, re-transmission or dissemination not authorized of it is prohibited. If you received this e-mail in error, please inform the sender immediately and delete all the material. (Rif. D.Lgs. 196/2003). Thank you.

3 2

sqlcounter and ldap backend
by Carlos Antonio Gómez Brizulela 04 May '10

04 May '10

Hello I have installed freeradius + LDAP backend. I need to limit the connection time per user. I found sqlcounter as a solution but I have two problems: 1 - I need to take the values: Max-Daily-Session and Max-Monthly-Session from LDAP and not from mysql DB. 2 - I need to terminate the connection when it meets the maximum connection time. Best regards, Carlos A. Sorry my English, I speak Spanish.

1 0