- Freeradius-Users - lists.freeradius.org

RE: Custom Logging
by Nasser Heidari 05 Oct '09

05 Oct '09

> -----Original Message----- > From: Nev [mailto:nev@watchuktv.co.uk] > Sent: 2009/10/05 02:22 > To: nasser(a)rasana.net > Subject: Custom Logging > > Hi Nasser, > > I was wondering if you could share how you configured checkval module to > allow certain users/groups to access specific NAS servers. > radiusd.conf: ... ... checkval NAS_IP { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = ipaddr nofound-reject = no } ... ... authorize { preprocess ... ... sql_auth NAS_IP ... ... } And after that you need A/V Pair for each user like this: test Auth-Type := Local, User-Password := 123321, NAS-IP-Address := 1.2.3.4 > This I'm about to start and it would save me a lot of time. > > Thx > Nev

1 0

only unix group teachers logging to freeradius should have switched-of ipcop-url-filter
by Eimo Enninga 05 Oct '09

05 Oct '09

Hello, I´m not a whole newbie in linux but really a newbie in freeradius and have to solve a little problem in the configuration of our school-net: We use the following freeradius users - file: ~~~~~~~~~~~~~~ DEFAULT Auth-Type = System, Login-Time := "Wk0600-2000" Idle-Timeout = 600, Fall-Through = 1 DEFAULT Group == "teachers" hartmagi goebelle DEFAULT Auth-Type := Reject Reply-Message = "Please get first a login-permission from your teacher." ~~~~~~~~~~~~~~ Alle teachers and some pupils with a login-permission p.e. "hartmagi" and "goebelle" are able to use the freeradius-login to ipcop-blue of our schoolserver. At ipcop an url-filter ist running for _all_ users in our ipcop-green- and ipcop-blue-wlan-net, but in the ipcop-configuration it is possible to switch of the url-filter for an internal ip-range p.e. for a part of the just used freeradius-dhcp-range 172.16.19.0 Now I search for a possibility to switching off the url-filter _only_ for the unix-group "teachers" in our ipcop-blue-net. -- Is it possible to realize that with ippool-tool of freeradius? For a configuration-tip I would be grateful. Regards Eimo Enninga, Bertha-von-Suttner-Gesamtschule, Highschool in Siegen, Germany

3 2

Client requesting group membership check
by Bob Franklin 05 Oct '09

05 Oct '09

Hello, We have a RADIUS server with a SQL backend running fine, authenticating 802.1X users to our Eduroam service. We'd like to re-use the user database for purposes other than Eduroam. We've got support for this in the SQL backend by it returning the status of different services as being group memberships for a particular user (e.g. a user who has Eduroam and dial-up access would be reported as being in those groups in the usergroup table). This all appears to work fine. However, because of the University's federated nature, individual colleges and departments may run their own RADIUS servers and proxy the requests up to ours (and possibly on to our proxies) for authentication and, possibly confirm authorisation to user a particular service. This relationship is not static and individual RADIUS clients may wish to check the same user for different services at different points, so we can't put a static configuration along the lines of 'this client is our dial-up server and so we're checking for the dial-up group'). Also, we don't wish to return the full list of enabled services with each request but allow them to merely check individual services. The way I can see to do this is allow clients to submit requests with a custom local attribute (e.g. 'UCam-Requested-Service'). If this attribute were present, we would fail the authentication if the user was not a member of the appropriate group (but otherwise authenticated OK). Before I embark on doing something along these lines, am I missing a better way to go about things, or is there some mechanism already available which would achieve this? Thanks for any help or advice, - Bob -- Bob Franklin <rcf34(a)cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service

2 1

Custom Logging
by Nasser Heidari 04 Oct '09

04 Oct '09

Dear Folks, I have added some additional radcheck options using checkval module. For example I have several NAS Servers, and I've defined which user from which NAS allowed to login. Now I want to know is it possible to configure Freeradius in a way, that when it rejects a user, it prints a custom error in log file? e.g: user test is not allowed to login via NAS 1.2.3.4, it is configured to login via 4.3.2.1 . Thanks in Advance Nasser

2 1

WiMAX HA access-request problem
by Webb Allen 04 Oct '09

04 Oct '09

Hi All, I am using the FreeRADIUS 2.1.7 for WiMAX authentication.Everything is fine in WiMAX authetication phase 1. FreeRADIUS send the Access-Accept message to ASN-GW with some required attributes as below. Sending Access-Accept of id 23 to 192.168.10.10 port 6001 MS-MPPE-Recv-Key = 0xdd32bb1bf83d56f4493782d3244f5d501011ffce043c3f5d70fb2f8ec22675c7 MS-MPPE-Send-Key = 0xd131eacf354482cec6a997bd7b25e7660f96c85f0290572af781fbe6f79e31fa EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Service-Type = Framed-User Framed-MTU = 1400 WiMAX-HA-RK-Lifetime = 172788 WiMAX-hHA-IP-MIP4 = 172.16.10.10 WiMAX-HA-RK-Key = 0xe3004e23455fd2e998b8def4dfe9ddaa34528742 WiMAX-HA-RK-SPI = 283734 WiMAX-FA-RK-Key = 0x85dd1a75f40398fe0168602b3a200a235db058fd WiMAX-MSK = 0xdd32bb1bf83d56f4493782d3244f5d501011ffce043c3f5d70fb2f8ec22675c7d131eacf354482cec6a997bd7b25e7660f96c85f0290572af781fbe6f79e31fa WiMAX-AAA-Session-Id = 0xc4e88757e4a7773cb7868674d19199e4 WiMAX-Capability = 0x020301 WiMAX-Packet-Flow-Descriptor = 0x01040001030600000002040303050307060301 WiMAX-DNS-Server = 172.16.1.1 Session-Timeout = 43200 Termination-Action = RADIUS-Request Chargeable-User-Identity = "test(a)testwimax.com" WiMAX-MN-hHA-MIP4-Key = 0x58c32ecc237cdc44474cc0a32b4203e511c6d569 WiMAX-MN-hHA-MIP4-SPI = 571665657 WiMAX-FA-RK-SPI = 571665656 In phase 2, ASN-GW send the MobileIP registration request to Home Agent. The Home Agent will check this MIP RRQ is valid or not by sending a radius request to AAA. FreeRADIUS received the request as below: rad_recv: Access-Request packet from host 172.16.10.10 port 52511, id=10, length=213 Packet-Type = Access-Request User-Name = "test(a)testwimax.com" NAS-IP-Address = 172.16.10.10 NAS-Identifier = "HA_1" WiMAX-HA-RK-SPI = 283734 Framed-IP-Address = 0.0.0.0 WiMAX-MN-HA-MIP4-SPI = 571665657 WiMAX-hHA-IP-MIP4 = 172.16.10.10 Vendor-Specific = 0x00001fe4180600000003 Vendor-Specific = 0x00001fe4a906d34f3f31 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = 3 WiMAX-GMT-Timezone-offset = 28800 Service-Type = Framed-User Event-Timestamp = "Sep 30 2009 15:21:22 CST" Message-Authenticator = 0x30f398da4df2f3673568f56b36063a2b Chargeable-User-Identity = "NUL" I set the FreeRADIUS to send the Home Agent the Access-accept packet with some attribute(WiMAX-HA-RK-SPI,WiMAX-HA-RK-Key) with fixed value. But the FreeRADIUS can not generate the WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI for that request. so Home Agent fail to validate the MIP RRQ because short of the attribute(WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI). Is that any configurations for FreeRADIUS to generate the original WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI for Home Agent Authentication request, or can the FreeRADIUS cache the keys been generated in phase 1 and for use in phase 2 authentication? Thanks and Regards, Allen Web

2 1

FreeRADIUS with LDAP backend (PAP works but CHAP or any other modules does not work), help please
by Ryaz Khan 04 Oct '09

04 Oct '09

Hi Guys, I am glad to say that I was able to setup FreeRADIUS ver. 2.1.7 with LDAP (slapd) authentication after a continuous research of a whole week. I can authenticate user via LDAP but it only works for PAP, radtest tool works, NTRadPing works but only when using PAP (un-checking CHAP). I tried every possible option/combination I can think of, but unfortunately none of them worked. I would appreciate if some of you can help me with that or can guide me to the right path Thx guys Ryaz Khan

3 2

Freeradius as a proxy converting EAP to non EAP radius Request
by Jacques FOUCHER 04 Oct '09

04 Oct '09

Hi, I have stil the same problem since a week and I don't understand why. Probably because I discover freeradius product, i did a basic error for somebody who know it. I reinstall Debian in the last stable version, i reinstall freeradius after that and the problem is exactly the same . In attach files, you'll find result of compiling/make, raddb configurations files and debug file when i start radiusd and when EAP response is done from radius client This is what I want to do do for those who don't know : I use eap to authenticate Wireless users on an radius server wich don't know EAP protocol. It seems that is possible to do that using a proxy freeradius. The architecture should be : Access Point as a NAS Freeradius as a proxy Radius server without EAP 192.168.0.250 192.168.0.128 192.168.0.252 The idea is to convert an EAP Response/Identity to a radius Access-Request without EAP inside As the first radius i use freeradius Version 2.1.7 As the second one, i use IAS (just to test, but in the final configuration, it will not) I modified these files: eap.conf (peap function), proxy.conf (add realm jacques.net) clients.conf (add 192.168.0.250) sites-enabled/proxy-inner.conf (modify Proxy-to-Realm) sites-enabled/default (comment suffix) remove enabled/proxy-inner.conf Nothing else ! I hope somebody could help me. Jacques

4 15

extra user attributes
by srg 03 Oct '09

03 Oct '09

Hi: I have freeradius working fine with users file in mysql instead of the "normal" users file (/etc/raddb/users). I need to have some custom user attributes for each user (lets call it custom1 and custom2 attributes and both are strings). Anybody knows what are the "best practices" to store those new custom attributes in the mysql tables? I am thinking simply to add more rows to the radcheck table having "username: user1, attribute: custom1, op:+=, value: val1". Thanks and best regards

2 1

freeradius-snmp.pl
by Jens Link 03 Oct '09

03 Oct '09

Hi all, what is the status of freeradius-snmp.pl? README says it's still alpha. Anybody still working on that? cheers Jens -- ------------------------------------------------------------------------- | Foelderichstr. 40 | 13595 Berlin, Germany | +49-151-18721264 | | http://www.quux.de | http://blog.quux.de | jabber: jenslink(a)guug.de | -------------------------------------------------------------------------

4 6

EAP/TTLS + virtual_server woes
by Alexander Clouter 02 Oct '09

02 Oct '09

Hi, Okay, I munched over the source code and I'm guessing I'm being a crettin, but I'm hoping you can tell me what I'm doing wrong. If you use the 'virtual_server' functionality in the ttls{} section of eap.conf, everything works great if you get an Access-Accept from the inner virtual server ('auth' for me). When I say "works great", I mean the 'post-auth' section of the EAP calling ('auth-eap') virtual server is munched through. However, if 'Access-Reject' is returned then 'post-auth' is not parsed and it bombs immediently back out to the to outer virtual server's ('dot1x') post-proxy section. My convoluted (for reasons of 'code' reuse) virtual server approach is: dot1x -> auth-eap -> auth Down in 'auth' is where all the LDAP magic to check user credentials is done, 'auth-eap' is dead simple: ---- server auth-eap { authorize { eap } authenticate { eap } post-auth { # if 'eap' fails, post-auth does not get run # and we have no way to get User-Name/Reply-Message :( # probably a bug I should report at some stage #Post-Auth-Type Reject { #} # slip some goodies upstream (goes into 'control' so # we can get the original request username if need be) update outer.control { User-Name := "%{reply:User-Name}" } # if we put this into 'control' then we get two # Auth-Type's (although it works), if we put it # into 'reply' it gets filtered update outer.request { Auth-Type := "%{%{reply:Auth-Type}:-%{Auth-Type}}" EAP-Type := "%{EAP-Type}" } } } ---- Any suggestions, it would be nice if on Access-Reject that post-auth section was passed in 'auth-eap'. Of course if you want config files and/or logs, do ask. Cheers -- Alexander Clouter .sigmonster says: Pushing 30 is exercise enough.

4 5