- Freeradius-Users - lists.freeradius.org

Manage IPv6 pools using freeradius
by Ram Akuka 09 Oct '09

09 Oct '09

Hi , I want to manage my ipv6 users using ip_pool from FreeRadius. And I have few question regarding this. 1. how can I use ip_pool to allocate ipv6 address to a users? 2. How can I assign ipv6 address to client based on the NAS he came from?(different prefix for different NAS). 3. Is there any documentation regarding this (looked in FreeRadius wiki and can't find anything useful). Thanks in advance, -- Ram

2 1

Problems with radutmp
by Gerardo Contreras 09 Oct '09

09 Oct '09

Hi. I'm having some problems with radutmp. I'm using an Aruba Mobility Controller which has radauth and radacct configured to this freeradius server. In fact, I've tried with freeradius both on centOS and ubuntu with same results. When a user logs in, a corresponding entry is added to radutmp, and indeed, nobody can log in with this user account (if I activate Simultaneous-use). But if another users logs in, the entry for the previous user gets deleted from radutmp, and a new one is added for this new user. Then, a user with the account from the first user can log in indeed. In other words, only the last logged in user gets to the radutmp file. On both boxes, using freeradius 2.1.0. Any idea? -- Gerardo Contreras NetX http://netx.com.mx/ T: +52 (614) 2010101 x 121 M: +52 (614) 2479727 Sin costo: 01800 GO2NETX

3 5

radiusExpiration attirbute declared in the LdapGroup
by aangles 09 Oct '09

09 Oct '09

Hello, I would Like to know if there is a way to define an expiration time for all those users which belong to an LDAP Group, instead of defining this attribute for each of those users? Moreover, after expiration time , RADIUS send an access-reject to the user. Is there any tool or something that send a message to the wifi users in a "windows form"? thank you very much regards albert -- View this message in context: http://www.nabble.com/radiusExpiration-attirbute-declared-in-the-LdapGroup-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 7

Adding vendor specific attributes to dictionary
by Patric 09 Oct '09

09 Oct '09

Hi all :) Hope someone can point me in the right direction once again! freeradius v 2.1.3 I am attempting to add vendor specific attributes to my dictionary without success :( I was given the following information to add: Class Number Attribute Value Type VENDORATTR 12345 Vendor-Attribute-A 1 string VENDORATTR 12345 Vendor-Attribute-A 2 string Now since VENDORATTR is not a freeradius dictionary format I assume this comes from a different RADIUS server, which I need to now implement in my freeradius dicitonary. I have had a look at the dictionary man page, and see that one can use ATTRIBUTE for this, but since the Number is the same for both attributes I would assume that I need to define a vendor specific attribute encapsulation so that I can list multiple attributes for this vendor, but this does not seem to be working for me - This is what I have done: File dictionary: ---------------- $INCLUDE /usr/share/freeradius/dictionary $INCLUDE /etc/raddb/dictionary.myvendor File dictionary.myvendor: ------------------------- VENDOR MyVendor 12345 BEGIN-VENDOR MyVendor ATTRIBUTE Vendor-Attribute-A 1 string ATTRIBUTE Vendor-Attribute-B 2 string END-VENDOR MyVendor When I attempt to start my freeradius server with this dictionary file all I get is the following message to std out: Errors reading dictionary: dict_init: /etc/raddb/dictionary.myvendor[1]: dict_init: /etc/raddb/dictionary.myvendor[1]: dict_init: /etc/ Thats it - even in debug mode no other message is printed. Any pointers would as always be very much appreciated :) Many thanks and have a great Friday, Patric

3 5

when to use exec / echo external script query
by cory＠gateway.net.au 09 Oct '09

09 Oct '09

freeradius 1.1.3-1.1 freeradius mysql Redhat Linux Fedora 6 I was looking for information on at what point i would fire an external script. What i wish to do is once a client is authenticated and a framed-ip address allocated to fire an external script to push the IP address into my postfix access table and remove it on disconnect. If anyone has suggestions and can advise on this please chime in. Cory

3 2

Help with freeradius
by Jason Berenson 08 Oct '09

08 Oct '09

Greetings, I am migrating from Solaris 8 to Solaris 10 and in the process upgrading freeradius from 0.9.3 to 2.1.7. I'm having some difficulty in getting it to work. I've pretty much copied the users and radiusd.conf files over from the old server. Here's some output with debugging turned on. This is from a cisco 7206 trying to authenticate against the new radius server. My goal is to have the radius server use getpw() to find the login since we scrapped NIS for LDAP which runs on a different server. rad_recv: Access-Request packet from host x.x.x.x port 1645, id=2, length=84 User-Name = "jason" User-Password = "test" NAS-Port = 2 NAS-Port-Id = "tty2" NAS-Port-Type = Virtual Calling-Station-Id = "y.y.y.y" NAS-IP-Address = x.x.x.x Thu Oct 8 14:12:07 2009 : Debug: +- entering group authorize {...} Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[preprocess] returns ok Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[chap] returns noop Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Thu Oct 8 14:12:07 2009 : Debug: No '@' in User-Name = "jason", looking up realm NULL Thu Oct 8 14:12:07 2009 : Debug: No such realm "NULL" Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[suffix] returns noop Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Thu Oct 8 14:12:07 2009 : Debug: users: Matched entry jason at line 14 Thu Oct 8 14:12:07 2009 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[files] returns ok Thu Oct 8 14:12:07 2009 : Debug: Found Auth-Type = System Thu Oct 8 14:12:07 2009 : Debug: +- entering group UNIX {...} Thu Oct 8 14:12:07 2009 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 1 Thu Oct 8 14:12:07 2009 : Auth: [unix] invalid password "jason" Thu Oct 8 14:12:07 2009 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 1 Thu Oct 8 14:12:07 2009 : Debug: ++[unix] returns reject Thu Oct 8 14:12:07 2009 : Debug: Failed to authenticate the user. Thu Oct 8 14:12:07 2009 : Auth: Login incorrect: [jason/test] (from client fonseca port 2 cli y.y.y.y) Thu Oct 8 14:12:07 2009 : Debug: Delaying reject of request 1 for 1 seconds Thu Oct 8 14:12:07 2009 : Debug: Going to the next request Thu Oct 8 14:12:07 2009 : Debug: Waking up in 0.9 seconds. Thu Oct 8 14:12:08 2009 : Debug: Sending delayed reject for request 1 Sending Access-Reject of id 2 to x.x.x.x port 1645 Thu Oct 8 14:12:08 2009 : Debug: Waking up in 4.9 seconds. Here's the relevant parts of the users file: DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." # # Staff users here # jason Auth-Type := System Fall-Through = Yes I've included what I think is needed from the radius.conf file. If more is needed please let me know and I'll forward it over. -Jason unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # #passwd = /usr/local/etc/raddb/passwd #shadow = /usr/local/etc/raddb/shadow #group = /usr/local/etc/raddb/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. #Auth-Type MS-CHAP { # mschap #} # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # Auth-Type UNIX { unix } # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. # eap }

2 2

Re: Memory leak or misunderstanding - rlm_perl?
by Mihail Vasiliev 08 Oct '09

08 Oct '09

Alexander Clouter > Alan DeKok <aland(a)deployingradius.com> wrote: >>> >>> I am running freeradius-2.1.6 with all AAA logick hidden in perl >>> module, >>> thus using rlm_perl. >>> >>> Having about 1000-10000 client connections per day radiusd consumes >>> about >>> 1Gb of memory per day (I restart it daily). >>> >>> The only (possibly) important thing - I am using several external >>> modules >>> in my main perl module. >> >> Perl's garbage collector isn't perfect. It may be that you really do >> need to restart to get memory cleaned up. >> > At the end of the request handling function, it might be work getting > your script to look at how much memory it has consumed[1] and then > commit Seppuku; hopefully FreeRADIUS is primed to notice the suicide and > restart the perl module from scratch. > > A trivial fix, but if you have long running state information you might > need to do some reworking to move some data into a DB file or something > (*not* an SQL database...please :) Well, I actualy already do it - I store the actual data in memcached, running as a stand-alone process. Well, thank you anyway. > > Cheers > > [1] http://www.perlmonks.org/?node_id=115098 > > -- > Alexander Clouter > .sigmonster says: Beware of a tall black man with one blond shoe. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Memory leak or misunderstanding - rlm_perl?
by Mihail Vasiliev 08 Oct '09

08 Oct '09

Hello, all. I am running freeradius-2.1.6 with all AAA logick hidden in perl module, thus using rlm_perl. Having about 1000-10000 client connections per day radiusd consumes about 1Gb of memory per day (I restart it daily). The only (possibly) important thing - I am using several external modules in my main perl module. I can supply code of perl modules, if necessary. radiusd config (with stripped off comments): prefix = /usr/local exec_prefix = /usr/local sysconfdir = /usr/local/etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = ${localstatedir}/lib/radiusd log_file = ${logdir}/radius.log libdir = /usr/local/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 listen { ipaddr = me.radius port = 1645 type = auth } listen { ipaddr = me.radius port = 1646 type = acct } log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } hostname_lookups = no allow_core_dumps = yes regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 300 } modules { chap { authtype = CHAP } unix { cache = no shadow = /etc/shadow } mschap { use_mppe = no } realm suffix { } preprocess { } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } perl { module = /etc/raddb/esdfreeradius.pm func_authenticate = esd_authenticate func_authorize = esd_authorize func_preacct = esd_preacct func_accounting = esd_accounting func_checksimul = esd_checksimul func_post_auth = esd_post_auth func_detach = esd_detach } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 10.0.1.1 range-stop = 10.0.254.254 netmask = 255.255.255.255 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess perl chap suffix } authenticate { Auth-Type CHAP { chap } Auth-Type perl { perl } } preacct { preprocess acct_unique } accounting { perl } session { perl } post-auth { } pre-proxy { } post-proxy { }

4 3

Proxying accounting to create a "tee"
by John Morrissey 07 Oct '09

07 Oct '09

I'm looking to process RADIUS accounting locally (SQL) as well as proxy it to a remote host (to some third party software that also wants to receive a copy of all accounting). Is this possible with FreeRADIUS? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

6 30

Expired unix system passwords
by James Smallacombe 07 Oct '09

07 Oct '09

Hi: We have a client running FreeRadius 2.1.6 on a Linux box authenticating against shadow passwords. I've gone over the radiusd.conf and it appears that the expire module is enabled by default in the global config (there are no virtual servers here). However, FreeRadius appears to be ignoring this attribute and authenticating users with expired passwords anyway. I tried expiring the account and that worked, but it would be much better to have it respect expired passwords. Is there something I missed? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

4 7