- Freeradius-Users - lists.freeradius.org

Weekly and daily logs
by Sergio Belkin 07 Oct '09

07 Oct '09

Sorry for the stupid question Is possible on FreeRADIUS Version 2.1.1 create log files both on daily and weekly basis? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Re: Proxy/Realm problem in 2.1.7
by Ivan Kalik 07 Oct '09

07 Oct '09

> Since upgrading FR to 2.1.7 from 2.1.3 and 2.1.1 on our 2 servers > there's been an issue with our proxy pool. > > There are three servers in the auth and acct pools, but unless I comment > two of them out (as below) I receive a 'Request Denied' message back in > response to the first access-request packet that is proxied to one of > the auth servers. > > Is this a bug in 2.1.7, or is there a difference in configuration file > format between the versions? > > # POOL Server config... > > pool_config { > test_username = 'test-user(a)remote-realm.com' > test_password = '***************' > secret0 = '***************' > secret1 = '***************' > secret2 = '***************' > } > > realm pool { > nostrip > auth_pool = pool_auth > acct_pool = pool_acct > } > > # Server Pools > server_pool pool_auth { > type = client-port-balance > # home_server = pool0 > home_server = pool1 > # home_server = pool2 > } > > server_pool pool_acct { > type = client-port-balance > # home_server = pool0 > home_server = pool1 > # home_server = pool2 > } > > home_server pool0 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server0.net > secret = ${pool_config.secret0} > port = 1812 > type = auth+acct > } > > home_server pool1 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server1.net > secret = ${pool_config.secret1} > port = 1812 > type = auth+acct > } > > home_server pool2 { > status_check = request > username = ${pool_config.test_username} > password = ${pool_config.test_password} > ipaddr = server2.net > secret = ${pool_config.secret2} > port = 1812 > type = auth+acct > } Start the server in debug mode. You will see how does home server configuration resolve and is something not as expected. Ivan Kalik Kalik Informatika ISP

1 0

Attr-Rewrite and Users File
by Anja Ruckdaeschel 07 Oct '09

07 Oct '09

Hi there! Please help.... I´m doing a attr_rewrite with an attribute in the request: attr_rewrite strip-vpn { attribute = Acct-Session-Id searchin = packet searchfor = "^[^$]+([\(])([^$]+).+$" replacewith = %{2} new_attribute = no max_matches = 1 append = no } Radius doing the rewrite seems okay to me... [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test1 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test1)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test1' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Later in the files modules I´d like to use the stripped value for checking against an ldap-group: DEFAULT User-Name =~ "^(\.*)([a-zA-Z]{3}[0-9]{5})", Huntgroup-Name == "test", ldapgroups1-Ldap-Group=="cn=%{Acct-Session-Id},o=test,c=de" So, if the user is a member of the group cn=test1,o=test,c=de he should get an access-accept, else he should be rejected. The FIRST request after RADIUS started it looks like this: expand: cn=%{Acct-Session-Id},o=test,c=de -> cn=test1,o=test,c=de rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... and it´s working as it should be. The next request from the same user but with test2 instead of test1 in the request: [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test2 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test2)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test2' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Now radius doesn´t do the expansion like it did for the first request, but the search in the group with the value used in the request before: rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... Is there some kind of caching or do I miss something? Thank you very much Anja --------------------------------------------------------------------------------------------- Anja Ruckdäschel M.A.; Rechenzentrum der Universität Regensburg; Universitätsstr.31; 93 053 Regensburg Telefon: +49 941 943 4826 ---------------------------------------------------------------------------------------------

3 5

Problem sanitising usernames in accounting
by Jonathan Gazeley 07 Oct '09

07 Oct '09

I'm seeing a problem with stripping usernames during accounting. Accounting is done on a separate physical server from the authentication (which works fine). Most of our users don't include a domain so their accounting works normally. Some users do send the domain (UOB) and this breaks the accounting because the backslash doesn't seem to get escaped. The account detail files have entries like User-Name = "UOB\\username" but when this gets inserted into the database the backslash(es) are not escaped and if the username starts with n, r or some other letters, the database sees \n, \r and inserts linebreaks and other undesirable characters. Then selecting from the database to generate statistics returns garbage, obviously. At the top of dialup.conf I replaced sql_user_name = "%{User-Name}" with sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" but Stripped-User-Name does not have a value. I'm not interested in the domain in my accounting, so does anyone have any guidance on how to safely strip/sanitise the usernames? Thanks, Jonathan -- ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless& VPN Team Information Services University of Bristol ----------------------------

2 2

Radius proxy and attribute class 25
by Ville Leinonen 07 Oct '09

07 Oct '09

Hi all, I have setup fr (2.1.6) proxy against MS NPS it works fine and even chalenge-responce works great. But now i have one problem NPS sends attribute 25 (class) back to the fr server and it's seems that fr brokes that/or dont accepts that attribute class. When class should be eg. OU=Test_users fr says something like ?=xxx?Xx++xXX (in clear text). Any suggestions? Br, Ville

3 2

radius + dhcp
by marco perugini 07 Oct '09

07 Oct '09

hi list! i've two services: radius server and dhcp server. does anyone know if i can assign static address according to realm and not to mac? thanks in advance and best regards, marco -- 4it *4IT **S.r.l. **Marco Perugini* *| system administrator** * --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 339.39.81.246 Fax +39 06 97601683 m.perugini(a)4it.it <mailto:m.perugini@4it.it> www.4it.it <http://www.4it.it/> "Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie." "This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you."

2 3

Understansding
by jon jon 06 Oct '09

06 Oct '09

Hello, I have a access point that is connected to a chillispot server, which then communicates to an external freeradius server. I have a mysql server also on the freeradius server. I am just tyring to figure out how this is all working. When a wireless client comes in they are unauthencticated users, which will be redirectedto uam homepage, located on the external radius server. The user is then brought to the hotspotlogin.cgi. Then the username and password are sent over to the radius server to check to see if the user matches the user in the mysql database. If authenticated, then the radius server sends a packet back to chillispot, saying yes accept the user, and redirect them to a web page that I specify. (is that correct?) Does the user remain connected to the freeradius server, since the pop up window that comes up is from there anyway, or is it chillispot that is then taking over. Which server is actually allowing the user onto the internet? I am thinking it is chillispot since that is handling dhcp. In the database is a table that is used to allow open and close time, that the wireless is avaible everyday, wouldn't that mean that the user would have to remain connected to the freeradius server? thanks, jon jon

2 2

Re: Cisco VPN 3000 and Simultaneous Use via checkrad
by Ivan Kalik 06 Oct '09

06 Oct '09

> In order to implement simultaneous use checking in my environment I > added a subroutine to checkrad that handles snmp checks to the Cisco > 3000 series VPN concentrators. I am happy to share my work/experience > with anyone that may have a similar environment. While we are on the subject of Cisco and checkrad.pl, I have found that sometimes trouble can be found here: if ($port < 20000) { # # The AS5350 doesn't support polling the session ID, # so we do it based on nas-port-id. This only works # for analog sessions where port < 20000. # Yes, this means that simultaneous-use on the as5350 # doesn't work for ISDN users. # $login = snmpget($ARGV[1], $pass, "$csm.2.9.2.1.18.$port"); print LOG " user at port S$port: $login\n" if ($debug); } else { $login = snmpget($ARGV[1], $pass, "$csm.9.150.1.1.3.1.2.$sess_id"); print LOG " user with session id $ARGV[4] ($sess_id): " . "$login\n" if ($debug); } There are devices that don't support that first OID. Solution is to comment out if section: # if ($port < 20000) { # # The AS5350 doesn't support polling the session ID, # so we do it based on nas-port-id. This only works # for analog sessions where port < 20000. # Yes, this means that simultaneous-use on the as5350 # doesn't work for ISDN users. # # $login = snmpget($ARGV[1], $pass, "$csm.2.9.2.1.18.$port"); # print LOG " user at port S$port: $login\n" if ($debug); # } else { $login = snmpget($ARGV[1], $pass, "$csm.9.150.1.1.3.1.2.$sess_id"); print LOG " user with session id $ARGV[4] ($sess_id): " . "$login\n" if ($debug); # } This alteration will get the script working properly for 7xxx routers that fail default check (ie. they don't support OID that checks who is on the port - instead they peek into local accounting to see if there is an active session for that accounting id). Ivan Kalik Kalik Informatika ISP

1 0

How can I output Cisco-AVPair Attributes in linelog?
by David Mitchell 06 Oct '09

06 Oct '09

Greetings, I'm playing with using the linelog module to syslog accounting records. The basics are pretty straightforward to configure, and I have them working. What I can't figure out is how to include the ssid in the linelog output. 'radiusd -X' kindly dumps the contents of the received accounting requests: rad_recv: Accounting-Request packet from host 10.2.2.2 port 1646, id=62, length=234 Acct-Session-Id = "0000004D" Called-Station-Id = "001b.d517.4080" Calling-Station-Id = "0026.4aea.ba42" Cisco-AVPair = "ssid=TEST" Cisco-AVPair = "vlan-id=228" Cisco-AVPair = "nas-location=Office" WISPr-Location-Name = "Office" User-Name = "testuser" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "301" NAS-Port = 301 Service-Type = Framed-User NAS-IP-Address = 10.2.2.2 Acct-Delay-Time = 0 The SSID is in a Cisco-AVPair. I can include them all via Start = "Connect: User: %{User-Name} ( client: %{Calling-Station-Id} location: %{WISPr-Location-Name}) %{Cisco-AVPair[*]}" or the first one by using %{Cisco-AVPair[1]}. But I have no guarantee that the ssid will be the first AV pair. I've tried using unlang constructs to pull the data out, but can't figure out the right syntax. I'm trying something like the config below, just to see if the 'if/else' clauses even fire and they don't. No matter what I put in for the regexp, SSID never gets redefined to TRUE or FALSE. It always outputs as 'Junk'. I'm sure this is doable, I just don't know the exact syntax. Any ideas? Thanks in advance. >From linelog configuration: Accounting-Request { SSID="Junk" Pairs = "%{Cisco-AVPair[0]}" if ( Pairs =~ /.*/ ) { SSID="TRUE" } else { SSID = "FALSE" } Start = "Connect: User: %{User-Name} ( client: %{Calling-Station-Id} location: %{WISPr-Location-Name}) SSID:${SSID} ${Pairs}" -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

4 6

Cisco VPN 3000 and Simultaneous Use via checkrad
by McCormick, Bill 06 Oct '09

06 Oct '09

Greetings, In order to implement simultaneous use checking in my environment I added a subroutine to checkrad that handles snmp checks to the Cisco 3000 series VPN concentrators. I am happy to share my work/experience with anyone that may have a similar environment. Sincerely, Bill McCormick

1 0