- Freeradius-Users - lists.freeradius.org

Hi guys,
by Kamil Semavi 28 Sep '09

28 Sep '09

I am trying to write user disconnections or every login to the sql. Can someone help me how can I do this? Thanks, K.

2 2

Re:
by Thor Spruyt 28 Sep '09

28 Sep '09

Hi, I tried to get this working also and I found that if you let the ldap module *not* check the password_header, then the password incl. the header is put in the User-Password attribute. If you then use auto_header = yes for the pap module, it should figure out automatically to do crypt... unless the uppercase CRYPT is causing issues... Here's some sample debug output to check your setup: [ldap] Password header not found in password {crypt}XXXXXXXXXXX for user test [ldap] Added User-Password = {crypt}XXXXXXXXXXX in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap] returns ok ++- group returns ok ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "xxxx" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok Regards, Thor. >----- Oorspronkelijk bericht ----- >Van : wessam seleem [mailto:wessam.seleem@gmail.com] >Verzonden : donderdag , september 24, 2009 02:16 PM >Aan : tnt(a)kalik.net, 'FreeRadius users mailing list' >Onderwerp : Re: "known good" error > >Thanks Ivan for your reply. Here is the ldap configuration section: > >ldap { >server = "x.x.x.x" >identity = "cn=username" >password = password >basedn = "ou=email,o=data,c=eg" >filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" >password_header = "{CRYPT}" >ldap_connections_number = 100 >timeout = 15 >timelimit = 10 >net_timeout = 5 > >tls { >start_tls = no >} > >profile_attribute = "radiusProfileDn" > access_attr = "dialupAccess" >dictionary_mapping = ${confdir}/ldap.attrmap >password_attribute = radiususerPassword >} > > > >and here is the debug message > > >++[ldap] returns ok >Found Auth-Type = PAP >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Replacing User-Password in config items with Cleartext-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Please update your configuration so that the "known good" >!!! >!!! clear text password is in Cleartext-Password, and not in User-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >+- entering group PAP {...} >[pap] login attempt with password "123456" >[pap] Using clear text password "&^%$%$%JGjgjg(&%%^njahjahs" >[pap] Passwords don't match >++[pap] returns reject >Failed to authenticate the user. >Using Post-Auth-Type Reject >+- entering group REJECT {...} >[attr_filter.access_reject] expand: %{User-Name} -> username > attr_filter: Matched entry DEFAULT at line 11 >++[attr_filter.access_reject] returns updated >Delaying reject of request 0 for 1 seconds >Going to the next request >Waking up in 0.9 seconds. >Sending delayed reject for request 0 > > > >Thanks for your support. >Wessam > > >On Thu, Sep 24, 2009 at 1:37 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >> > I decided to install free radius 2.1.6-2 to test it and then to >> upgrade >> > my existing versions in my servers. I configured my free radius to use >> > ldap. >> > When I tried to authenticate from the new radius it gave me the following >> > message "from radius -X". >> > >> > Replacing User-Password in config items with Cleartext-Password. !!! >> > >> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> > !!! Please update your configuration so that the "known good" >> > !!! >> > !!! clear text password is in Cleartext-Password, and not in >> > User-Password. >> > !!! >> > >> > >> > Note that when I wrote the password encrypted "like >> > *%@&ksjd%@sdgsadgjhsb" >> > I was able to login but when I wrote the password in clear text "like >> > test" >> > I failed to login. >> >> Password in ldap probably has a header. You can ignore the message then, >> because server will convert User-Password to appropriate password >> attribute on it's own (Crypt-Password for {crypt}, SHA-Password for {sha} >> etc.) if auto-header is enabled. Post the whole debug. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

4 5

need help for cisco vrf /ip address radius config
by Yagnesh Dave 28 Sep '09

28 Sep '09

Hi, I am trying to create a dynamic interface for the dail-up users assign it to a vrf and then configure the ip address. The config that I have done in the users file is as; tcl Cleartext-Password := "tcl" #tcl(a)cisco1.com Cleartext-Password := "tcl" Service-Type = Framed-User, Framed-Protocol = PPP, # Cisco-AVpair = "lcp:interface-config=ip vrf forwarding RWCustomer-A\n ip add 10.110.11.2 255.255.255.252", Cisco-AVpair += "lcp:interface-config=ip vrf forwarding \ RWCustomer-A", Framed-IP-Address = 10.110.11.1, Framed-IP-Netmask = 255.255.255.252, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP With this I am not able to see as expected from the radius server. I have also made an entry in proxy.conf file for realm cisco1.com Any inputs or guidance on this will be a appreciated. Thanks in Advance. Regards, Yagnesh Dave.

2 1

Setting up a virtual server to handle incoming proxied requests
by Patric 28 Sep '09

28 Sep '09

Hi again all :) I have a primary and secondary server, each of which receive accounting requests from multiple NAS servers. Both my servers proxy these requests to each other to stay in sync. I would like to setup a virtual server on my secondary to handle the incoming proxy requests from the primary. My secondary is running freeradius 2.1.3 I have read the sites-available/README documentation and have a few questions. First I include my current configuration for your consideration. radiusd.conf ------------ listen { ipaddr = * port = 0 # Use /etc/services for ports type = auth } listen { ipaddr = * port = 0 # Use /etc/services for ports type = acct } proxy_requests = yes $INCLUDE proxy.conf ... clients.conf ------------ Nothing proxy.conf ---------- home_server copy-acct-to-home-server { type = acct ipaddr = primary_server_ip port = 1813 secret = shared_key response_window = 20 zombie_period = 40 revive_interval = 120 } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } Currently my clients reside in the nas table in my database. With the above config I have listen sections for auth and acct. Do I understand the documentation correctly if I add this to the above existing config: client primary_server { ipaddr = primary_server_ip secret = shared_secret require_message_authenticator = no nastype = other virtual_server = requests_from_primary } server requests_from_primary { listen { ipaddr = * port = 0 type = acct } proxy_requests = no # Can this be done here? If not how would I disable proxying for this virtual server? # Do I just exclude my detail-radrelay in the accounting section? # Since this is just processing accounting requests do I still need to define the authorize, authenticate & other sections? preacct { preprocess acct_unique } accounting { detail sql # detail-radrelay - Exclude this so that these requests are not proxied? } } I *think* Im on the right track but would appreciate any pointers :) Many thanks Patric

3 8

freeradius problem
by matthew wyath 27 Sep '09

27 Sep '09

Hi All, I am trying to configure my freeradius to work with FortiMail antispam/antivir solution (so that people can automatically log into their webmail quarantine). Fortimail part is done and it was easy. Then I moved to freeradius and I came across problems. Just to clarify freeradius was installed on the same server where the postfix server resides and I want to authenticated my users through their linux credentials. clients.confs client 192.168.20.2 { secret = zgadnij123 shortname = FORTIMAIL nastype = other } users (default, nothing was changed) DEFAULT Auth-Type = System Fall-Through = 1 What I can see in the output from radiusd -X : ********************************* Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.2:33990, id=175, length=44 User-Name = "test" User-Password = "testtest" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 <------ HERE modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [test/testtest] (from client FORTIMAIL port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 175 to 192.168.20.2 port 33990 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 175 with timestamp 4abddee7 Nothing to do. Sleeping until we see a request. ******************************** All the password are stored in /etc/shadow. Can anybody help me why module "unix" returns reject ? regards, mw

4 5

descrition tables and atributes
by Nelson Acero Fino 27 Sep '09

27 Sep '09

Hi, Where can i found information and description about tables and atributes of radius database ?? Thanks :) !

3 2

Re:
by Thor Spruyt 27 Sep '09

27 Sep '09

>----- Oorspronkelijk bericht ----- >Van : wessam seleem [mailto:wessam.seleem@gmail.com] >Verzonden : zondag , september 27, 2009 02:34 PM >Aan : 'FreeRadius users mailing list' >Onderwerp : Re: > >Dear Thor and Ivan, > Thanks for your support. I would like to notice that I have the >same configuration in a server that has freeradius-1.1.7-1 installed and it >is working fine. I want to upgrade. That is why I am testing >freeradius-2.1.6-2. I want to ask is there is any difference between 1.1.7-1 >and 2.1.6-2 configuration files that I should put it in my consideration? > > >Thor, >I don't have the same output in the debug mode. I have what you can see >below: > > >++[ldap] returns ok >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Replacing User-Password in config items with Cleartext-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Please update your configuration so that the "known good" >!!! >!!! clear text password is in Cleartext-Password, and not in User-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >+- entering group PAP {...} >[pap] login attempt with password "password" >[pap] Using clear text password "$5@Hfgusllj%$#kasjs" >[pap] Passwords don't match >++[pap] returns reject >Failed to authenticate the user. >Using Post-Auth-Type Reject >+- entering group REJECT {...} >[attr_filter.access_reject] expand: %{User-Name} -> username > attr_filter: Matched entry DEFAULT at line 11 >++[attr_filter.access_reject] returns updated > >Dear Ivan and Thor, > >As you can see the problem that I am sending a clear text password and the >radius doesn't convert it to encrypted one. I want my radius to take a >clear >text password and encrypt it then compare it with the encrypted one in my >ldap. Please let me know if I should clarify more or if you need more info. > >Thanks again for your support. >Regards, > I'm not saying that how I got it working is *the* way to do it, I just got it working this way... I'm using 2.1.7, but I guess 2.1.6 has exactly the same behaviour. In your ldap module configuration, remove this: password_header = "{CRYPT}" Then the ldap module will not remove {CRYPT} from User-Password and the server will not complain about the attributes... The pap module configuration should only have the following line: auto_header = yes This will make the PAP authentication step recognize that the password retrieved from ldap is crypted and do the correct password comparison. Regards, Thor.

1 0

Accounting copying to specific systems
by Joe Maimon 27 Sep '09

27 Sep '09

Certain systems need copies of accounting data, but I only want to send a subset of accounting to the appropriate system. I dont want to change the way the server updates the sql accounting and local detail files. I want something like this acct.hints DEFAULT Client-IP-Address == "1.2.3.4", Hint := "FILTER-1" DEFAULT Client-IP-Address == "1.2.3.5", Hint := "FILTER-1" DEFAULT Client-IP-Address == "5.6.7.8", Hint := "FILTER-2" DEFAULT Client-IP-Address == "5.6.7.9", Hint := "FILTER-2" acct.users DEFAULT Hint == "FILTER-1", Copy-To := "filter-1-system" DEFAULT Hint == "FILTER-2", Copy-To := "filter-2-system" Where both filter-1-system and filter-2-system are defined in proxy.conf and obviously Copy-To is wishful thinking. Am I headed in the right direction or is there a better way to do this? Thanks, Joe

3 18

ASSERT FAILED event.c in 2.1.7
by Maja Wolniewicz 26 Sep '09

26 Sep '09

After the upgrade from 2.1.6 to 2.1.7 my two servers died 3-4 times daily with the following error: Thu Sep 24 19:07:13 2009 : Error: Received conflicting packet from client AP-8 port 32777 - ID: 240 due to unfinished request 2396. Giving up on old request. Thu Sep 24 19:07:13 2009 : Error: ASSERT FAILED event.c[2682]: request->ev != NULL I have to return to 2.1.6, which works smoothly. Greetings, Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl PGP key: http://www.home.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

3 3

account expiration attribute
by Rakotomandimby Mihamina 26 Sep '09

26 Sep '09

Hi all, What RADIUS attribute would suit to account expiration? the context: - prepaid users must regularily add credit to his account - big credit -> big validity extension - small credit -> small validity extension - no account removal, just auth reject if validity date passed Credit adding and account validity extension is not managed by the RADIUS stuff, it's about a manual external insert What we just need is the right RADIUS attribute to be checked during auth, in order to reject if the date is passed. Thanks for any help. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

3 7