- Freeradius-Users - lists.freeradius.org

Rejecting auth from a specific realm
by Ben Carbery 25 Nov '09

25 Nov '09

I am using freeradius to proxy eduroam requests. These could be for any number of different realms so I only have a DEFAULT realm configured. I now want to reject authentication to one specific realm (my own) but pass all others. The proxy server can't do this for me so I need to do it before proxying. I have been reading all the man pages but can't figure this out..how where is this done? B

4 9

Re: CUI
by Humberto Cardoza 25 Nov '09

25 Nov '09

Hi All I am a new user with Freeradius, now i have it configured with Mysql but, the problem that i have is that the cui table it is not pupulated with information of the active sessions. i get configured the sql/mysql/cui.conf and all the stuff that i found that is necessary, but it simply doesn't work. So i will appreciate if somebody can give a tip to make it work. Best Regards -- Eng. Humberto Cardoza

3 2

Correct net scheme
by C. Diego Raffaelli A. 24 Nov '09

24 Nov '09

hi all. I would like to apply any kind of authentication for VDSL clients. i am a ISP. i have a "3com Total control" wich provides dial up access to another users, and i think i would use PPPOE in the same 3COM to auth. the other users (VDSL) because they doesn't use a telephone line to connect to my ISP. They are coming from their home by fiber optic to my central switch. 3COM provides PPPOE on his eth interface. currently VDSL users have a bandwith managmnt by a router cisco 3640 and have no any authentication, autorization or accounting. then, i would like to apply any solution for: manage properly the bandwith (¿its ok if the router does?) take PPPOE of 3COM total control (it is a RAS) and (if its necessary), install a freeradius on debian (with mysql and a web admin interface) to create profiles to new users... - i ask: can only the router works as a radius or a RAS and ignore the 3com RAS? can anybody suggest me a better net-scheme for this, watching all the equipement? thanks a lot CDR

1 0

PEAP/SoH patch
by Phil Mayers 24 Nov '09

24 Nov '09

All, I've started to do some work on supporting the SoH messages in PEAPv0, which are supported in WinXP SP3+ and Vista/Win7 So far I've made the necessary (I believe) modifications to the PEAP state machine, and have code to generate the SoH request TLV, but the clients are choking on it. EAP Request, Identity [RFC3748] EAP Response, Identity [RFC3748] EAP Request, PEAP [Palekar] TLSv1 Client Hello EAP Request, PEAP [Palekar] EAP Response, PEAP [Palekar] EAP Request, PEAP [Palekar] EAP Response, PEAP [Palekar] TLSv1 Server Hello, Certificate, Server Hello D TLSv1 Client Key Exchange, Change Cipher Spec, TLSv1 Change Cipher Spec, Encrypted Handshake M EAP Response, PEAP [Palekar] TLSv1 Application Data TLSv1 Application Data TLSv1 Application Data ^^^ containing the SoH requests ...and everything stops Please don't bombard me with "Me too, please send me your patch" requests at this point - it doesn't work, and I can't easily publish a git tree from here anyway. What I'm looking for is help from people for review & implementation - in particular, if there's anyone out there who knows how the hell I get debugging out of WinXP SP3. Could interested and technically capable parties contact me off-list or direct me to a place more appropriate for discussion?

2 1

RE: Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 24 Nov '09

24 Nov '09

Hi, Thanks for the all the pointers, I have got the proxying and post proxy configuration working with your hints. I have one small issue that I need to address. For some of our clients they don't want us to proxy requests before our LAC forwards them. Obviosuly I can configure a default entry in the proxy config so that any domain realm that I havent configured is matched, and specified to be handled locally. The problem comes that I don't know the passwords for all of the individual users that will come thorugh, so effectively I just need to generate an Accept packet whenever I hit this default proxy config. Is there someway I can do this, would I need to configure something within the users file instead or is there something I can add within the authorization section to allow this to work? Any help you can give would be much appreciated. Dan Fisher

2 1

Re: Stripping Realms from SQL Accounting Queries
by Tim Gustafson 24 Nov '09

24 Nov '09

> Perhaps do what is suggested wherever you care to look (this > list, documentation, website, ...) - run server in debug mode > (radiusd -X). Then you will see exactly what is happening. I did that, and it didn't help. I added a realm definition back in to the config file, and here's the debug output now: > [suffix] Looking up realm "soe.ucsc.edu" for User-Name = "tjg(a)soe.ucsc.edu" > [suffix] Found realm "soe.ucsc.edu" > [suffix] Adding Stripped-User-Name = "tjg" > [suffix] Adding Realm = "soe.ucsc.edu" > [suffix] Authentication realm is LOCAL. So far so good... > [ldap] performing user authorization for tjg > [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details > [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tjg) > [ldap] expand: dc=soe,dc=ucsc,dc=edu -> dc=soe,dc=ucsc,dc=edu Depreciated syntax aside, we're still doing good... > [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details > [sql] expand: insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('%{Acct-Session-Id}', '%{Stripped-User-Name:-%{User-Name}}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%S') -> insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('0004F8C5', 'tjg(a)soe.ucsc.edu', '192.168.32.8', '0024.2b58.2f46', '2009-11-23 14:13:42') Doh, no dice! Incidentally, as I mentioned in another reply a few minutes ago, using %{SQL-User-Name} instead of %{User-Name} results in an empty string, and using only %{Stripped-User-Name} also results in an empty string. If you really would like me to, I suppose I could get you the whole debug output, but it's a few thousand lines for a single authorization. Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1

The MySQL databases for Freeradius
by Peter Carlstedt 24 Nov '09

24 Nov '09

Hello everyone! I am sitting here trying to figure out how FreeRadius works towards MySQL. It is quite hard for me to try to explain what I want to do since Im not good with MySQL but I will try anyway and hope someone will understand what I mean. =) The database "radcheck" is for a singeluser if I have understood it correctly. What I want to do is that through MS Access make a form where I can add several attributes to the same row in the table. But since radcheck only seem to work with one attribute per row for one user I dont really know how to do. What I mean is that if I have a user called "test-user" and want to have two attributes for that user, in this case "Cleartext-Password" & "NAS-Port-Id" I need to have two rows for that user. The table looks like this in Access(when i want to use two or more attributes): radcheck: ------------------------------------------------------ |id|username |attribute |op |value | |1 |user-test |Cleartext-Password|== |test-pass | |2 |user-test |NAS-Port-Id |== |raket | ------------------------------------------------------- The reason I want to make a form is because I want others than me being able to add new users and have them connected to the correct group which then will have a separate VLAN and SSID. So then I thought that if i use the table called "radusergroup" and link the user to a specific group it should work in a way that all members of this group may only connect to the network if they try to connect to the correct SSID. It seems that did not work either. I am at a loss here and dont really know what I should do. Sorry if my explaination is bad but it is quite hard for me to explain. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

3 2

RADIUS session probelm
by toqeer ali 24 Nov '09

24 Nov '09

I am configuring RADIUS with openser and CDRtool. when i dial a number it loges into in mysql of RADIUS server but it gives the following error. and when i check CDRs of CDRtool it shows all calls "inprogress". Tue Nov 24 19:47:37 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '1000@ip address', nas 'ipaddress'] -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916 -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

Re: Stripping Realms from SQL Accounting Queries
by Tim Gustafson 23 Nov '09

23 Nov '09

> ...erm, '%{%{Stripped-User-Name}:-%{User-Name}}', I think what > you have there is some really old depreated or bad syntax'ed > version. Same in your SQL queries too strangely. You will want > to make sure you use 'SQL-User-Name' instead too, and not > directly 'User-Name' (think SQL injection). Thanks for your suggestions. I tried using SQL-User-Name in the past, and it was always blank - an empty string. I tried using '%{%{Stripped-User-Name}:-%{User-Name}}' as you've suggested, but to no avail - it was still using the un-stripped user name. I've actually just changed the queries to use %{User-Name} for now to quell the warnings in the debug log about depreciated syntax. However this has not fixed my problem. :( Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

1 0

RE: Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 23 Nov '09

23 Nov '09

Hi, >> My problem is that the response I send to our LAC has to contain extra >> information depending on the domain. Is it possible to query a local >> mysql database for this extra information (these are cisco av pairs >> needed to establish the tunnels between the LAC and LNS) >Yes. See man unlang. >> and add it into >> the Access-Accept message that is returned to the LAC from the radius? >Use unlang in post-proxy. >Ivan Kalik Thanks for the guidance ivan, its given me a good starting point. I have managed to get new information into my accept requests by hard coding update reply sections in the unlang code (example below) : update reply { Tunnel-Client-Auth-ID = "fluidata" } However I am having real problems getting the mysql part working. I have tried using examples other people are using that work and they either just get treated as a string or the server wont even run in debug mode. I don't appear to be able to use the sql module itself as I get an error saying its not supported in the post-proxy configuration section. Can anyone suggest where I might be going wrong with this? Inside the post-proxy section I have: Where %{2} is the result of a regular expression to split a full username so I just have the domain to use later on. if ( "%{sql: SELECT Attribute from radreply where username ='%{2}' and attribute='Tunnel-Password'}" ) { ok } I have tried this with and without the Output looks like: WARNING: Unknown module "sql" in string expansion "%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" expand: %{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'} -> ? Evaluating ("%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" ) -> FALSE ++? if ("%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" ) -> FALSE /etc/raddb/sites-enabled/default[562]: "SQL" modules aren't allowed in 'post-proxy' sections -- they have no such method. /etc/raddb/sites-enabled/default[512]: Errors parsing post-proxy section. If anyone has any thoughts on this or whether I can obtain the same information another way that would be much appreciated. I will be having potentially hundreds of different relams going through this freeradius instance and I need to add this information for each one Dan Fisher

3 2