- Freeradius-Users - lists.freeradius.org

(no subject)
by jon jon 25 Sep '09

25 Sep '09

hello, I am running slackware 12.1 as my OS. I am running freeradius version 2.1.4. I am also running Mysql as a backend server to freeradius. I made changed to the Msql database on what times the wireless internet will be available to clients. I wanted to test to see if the times that I set are working correctly, how would I do this? I thought about going to different sites and see if I could log in at the times I have set to not allow wireless clients not to be able to use it. Is there something I am missing here, how could I test this from one location? Thanks, jon

3 3

Re: Mimic lower_user in FR2
by Thor Spruyt 25 Sep '09

25 Sep '09

>----- Oorspronkelijk bericht ----- >Van : Alexander Clouter [mailto:alex@digriz.org.uk] >Verzonden : donderdag , september 24, 2009 05:24 PM >Aan : freeradius-users(a)lists.freeradius.org >Onderwerp : Re: Mimic lower_user in FR2 > >Thor Spruyt <thor.spruyt(a)telenet.be> wrote: >> >> Since lower_user doesn't exist anymore in FR2, I was thinking of doing >> the following in FR2 to mimic the behaviour, which seems to be working >> correctly: >> >> In "hints" file: >> >> DEFAULT User-Name !~ /^$/ >> User-Name := `%{exec:/opt/tolower %{User-Name}}`, >> Fall-Through = Yes >> >> DEFAULT Stripped-User-Name !~ /^$/ >> Stripped-User-Name := `%{exec:/opt/tolower %{Stripped-User-Name}}`, >> Fall-Through = Yes >> >> >> Content of "/opt/tolower": >> >> #!/bin/sh >> >> echo -n "$1" | tr '[A-Z]' '[a-z]' >> >> Is there any reason why I should not do this or why it's not recommended? >> The servers on which I want to do this is not heavily loaded (<1req/s). >> >Well although the load is not a problem, I mean you should feel *really* >dirty that every time a packet goes through your box, you system() out >twice. > >Hell I feel dirty enough when doing the following for the not-often >upstream proxying requests we do: >---- >update proxy-request { > NAS-IP-Address := `/bin/hostname -i` > NAS-Identifier := `/bin/hostname -f` >} >---- > >This however is just me being lazy until I patch FreeRADIUS to give me >some static runtime variable action :) > >You should do this with Perl if you really want or alternatively I'll >start sending your RADIUS server something like the following as you do >no validation at all (you get the idea, might work, probably won't, but >why risk it?): >---- >User-Name = '\"; rm -rf /; echo \"' >---- > >Cheers > >-- >Alexander Clouter >.sigmonster says: The best things in life go on sale sooner or later. > I would indeed tighten the script, but I was wondering if changing the 2 attributes in this way could cause problems in later processing. Or maybe there's a better way which I don't know about to get the same result... Regards, Thor.

2 1

AUTO: Out of the Office (returning 09/28/2009)
by bdehn＠oreillyauto.com 25 Sep '09

25 Sep '09

I am out of the office until 09/28/2009. Please contact Rob Bodenhamer with any urgent issues. Note: This is an automated response to your message "Freeradius-Users Digest, Vol 53, Issue 104" sent on 9/25/09 8:20:21. This is the only notification you will receive while this person is away.

1 0

intermediate certificate handling
by Alan Buxey 25 Sep '09

25 Sep '09

hi, not really covered on the WIKI and there is some stuff on the mailing list archives so it would be good for some clarification. if a RADIUS server has a certificate that has been signed by an intermediate certificate, what is the corretc process to ensure that the client is happy with the RADIUS cert. I believed that the process is something like certificate_file = server.crt where server.crt contains the server cert, the intermediate cert and then the root cert all concatenated together ..and then CA_file which isnt used at all for PEAP or EAP-TTLS can then be just ignored. I , personally, have a self signed cert as per recommendation but is the above generally correct alan

1 0

Reply with certain name servers
by Irina 25 Sep '09

25 Sep '09

Hello, Is there a way to send back certain name servers as Reply attribute? For some users it will be one set of name server, for other users it will be another set of name servers. Thank you for your help in advance. Irina

4 3

Failed to link to module "rlm_ldap"
by José Johnny RANDRIAMAMPIONONA 24 Sep '09

24 Sep '09

I tried to upgrade freeradius-server-2.1.6 to freeradius-server-2.1.7 and it worked well (in localhost) without ldap.Then I tried to use the old version (2.1.6) but it doesn't work anymore: *Thu Sep 24 13:32:16 2009 : Error: /usr/local/freeradius-server-2.1.6//etc/raddb/ modules/ldap[29]: Failed to link to module 'rlm_ldap': libldap_r-2.3.so.0: canno t open shared object file: No such file or directory Thu Sep 24 13:32:16 2009 : Error: /usr/local/freeradius-server-2.1.6//etc/raddb/ sites-enabled/default[286]: Failed to find module "ldap". Thu Sep 24 13:32:16 2009 : Error: /usr/local/freeradius-server-2.1.6//etc/raddb/ sites-enabled/default[286]: Failed to parse "ldap" entry. Thu Sep 24 13:32:16 2009 : Error: Errors initializing modules* I rebuild it and ( ./configure --prefix=/usr/local/freeradius-server.2.1.6/) and it seems that there is library problem(I had this kind of problem in the past, but I forgot what I did to fix it). * configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer. config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r ldap.h. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: MySQL headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r mysql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h.* -- JJohnny RANDRIAMAMPIONONA Phone: +212663682554, +212533158575 National School of Applied Sciences ZIP 1818 TANGIER 90000 ---------Morocco ---------------

3 3

Accounting doesn't increase Daily's count.
by Pablo Zanitti 24 Sep '09

24 Sep '09

Good day. I'm having problems with rlm_counter on FreeRADIUS Version 1.1.7. I've set my NAS to send Stop/Start packets every minute, but it only refreshes count once. That means once an user is logged in, it will count his first minute but then he will be able to access indefinitely. My user ----------------- Prueba3 User-Password == "a", Simultaneous-Use += 5, Max-Daily-Session := 300 Session-Timeout := 60 ----------------- My conf ----------------- prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 192.168.63.1 port = 1892 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session cache-size = 5000 } counter weekly { filename = ${raddbdir}/db.weekly key = User-Name count-attribute = Acct-Session-Time reset = weekly counter-name = Weekly-Session-Time check-name = Max-Weekly-Session cache-size = 5000 } counter monthly { filename = ${raddbdir}/db.monthly key = User-Name count-attribute = Acct-Session-Time reset = monthly counter-name = Monthly-Session-Time check-name = Max-Monthly-Session cache-size = 5000 } counter forever { filename = ${raddbdir}/db.forever key = User-Name count-attribute = Acct-Session-Time reset = never counter-name = Forever-Session-Time check-name = Max-Forever-Session cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } } instantiate { daily weekly monthly forever } authorize { preprocess chap files daily weekly monthly forever } authenticate { Auth-Type CHAP { chap } } preacct { preprocess acct_unique files } accounting { detail daily weekly monthly forever radutmp } session { radutmp #sql } post-auth { } ----------------- Here is it starting: ------------------ Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1892 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.63.1 IP address [192.168.63.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded Counter counter: filename = "/usr/local/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1253750400 [2009-09-24 00:00:00] Module: Instantiated counter (daily) counter: filename = "/usr/local/etc/raddb/db.weekly" counter: key = "User-Name" counter: reset = "weekly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Weekly-Session-Time" counter: check-name = "Max-Weekly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Weekly-Session-Time is number 1832 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1254009600 [2009-09-27 00:00:00] Module: Instantiated counter (weekly) counter: filename = "/usr/local/etc/raddb/db.monthly" counter: key = "User-Name" counter: reset = "monthly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Monthly-Session-Time" counter: check-name = "Max-Monthly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Monthly-Session-Time is number 1834 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1254355200 [2009-10-01 00:00:00] Module: Instantiated counter (monthly) counter: filename = "/usr/local/etc/raddb/db.forever" counter: key = "User-Name" counter: reset = "never" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Forever-Session-Time" counter: check-name = "Max-Forever-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Forever-Session-Time is number 1836 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 0 [2009-09-23 18:00:00] Module: Instantiated counter (forever) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 192.168.63.1:1892 Listening on accounting 192.168.63.1:1893 Ready to process requests. ------------------ Here is it logging in fine ------------------ rad_recv: Access-Request packet from host 192.168.63.1:3422, id=172, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 22 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=22 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=278 modcall[authorize]: module "daily" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 0 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 0 modcall: leaving group session (returns ok) for request 0 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 172 to 192.168.63.1 port 3422 Session-Timeout := 60 Finished request 0 ------------------------ Here it is complaining it only works with Stop/Start ------------------------ rad_recv: Accounting-Request packet from host 192.168.63.1:12908, id=175, length=142 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Start Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "daily" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "weekly" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "monthly" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "forever" returns noop for request 1 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 175 to 192.168.63.1 port 12908 Finished request 1 ------------------------ Here is it updating counters on the first Stop/Start ------------------------ rad_recv: Accounting-Request packet from host 192.168.63.1:24160, id=190, length=196 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Stop Acct-Session-Time = 39 Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Acct-Input-Packets = 84 Acct-Input-Octets = 6610 Acct-Input-Gigawords = 0 Acct-Output-Packets = 103 Acct-Output-Octets = 140013 Acct-Output-Gigawords = 0 Acct-Session-Time = 39 Acct-Terminate-Cause = NAS-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall[preacct]: module "files" returns noop for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=22. rlm_counter: User=Prueba3, New Counter=61. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "daily" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "weekly" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "monthly" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "forever" returns ok for request 2 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[accounting]: module "radutmp" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 190 to 192.168.63.1 port 24160 Finished request 2 ---------------------------- Here it is refusing to update on Stop/Start ---------------------------- rad_recv: Access-Request packet from host 192.168.63.1:28882, id=33, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 4 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 61 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=61 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=239 modcall[authorize]: module "daily" returns ok for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 4 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 4 modcall: leaving group session (returns ok) for request 4 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 33 to 192.168.63.1 port 28882 Session-Timeout := 60 Finished request 4 ---------------------- And after that, on every reauthentication, the count value remains the same, so count will never be larger than 300. ---------------------- rad_recv: Access-Request packet from host 192.168.63.1:18612, id=32, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 7 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 61 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=61 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=239 modcall[authorize]: module "daily" returns ok for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 7 modcall: leaving group authorize (returns ok) for request 7 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 7 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 7 modcall: leaving group session (returns ok) for request 7 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 32 to 192.168.63.1 port 18612 Session-Timeout := 60 Finished request 7

2 2

Mimic lower_user in FR2
by Thor Spruyt 24 Sep '09

24 Sep '09

Hi, Since lower_user doesn't exist anymore in FR2, I was thinking of doing the following in FR2 to mimic the behaviour, which seems to be working correctly: In "hints" file: DEFAULT User-Name !~ /^$/ User-Name := `%{exec:/opt/tolower %{User-Name}}`, Fall-Through = Yes DEFAULT Stripped-User-Name !~ /^$/ Stripped-User-Name := `%{exec:/opt/tolower %{Stripped-User-Name}}`, Fall-Through = Yes Content of "/opt/tolower": #!/bin/sh echo -n "$1" | tr '[A-Z]' '[a-z]' Is there any reason why I should not do this or why it's not recommended? The servers on which I want to do this is not heavily loaded (<1req/s). Regards, Thor.

3 2

"known good" error
by wessam seleem 24 Sep '09

24 Sep '09

Hi, I decided to install free radius 2.1.6-2 to test it and then to upgrade my existing versions in my servers. I configured my free radius to use ldap. When I tried to authenticate from the new radius it gave me the following message "from radius -X". Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Note that when I wrote the password encrypted "like *%@&ksjd%@sdgsadgjhsb" I was able to login but when I wrote the password in clear text "like test" I failed to login. I tried to search in the internet about this message but I didn't find a suitable solution for it.. Any Ideas regarding this message?? Regards, Wessam

4 6

Allow users from a specific AD group
by Free2009 24 Sep '09

24 Sep '09

Hi, I spent some time trying to put working together FR+AD and presently i'm using ntlm to authenticate users through mschap against the AD. It is working. Next step is try to allow access only to specific users belonging to a Group from the AD, but it is not working. I post here the important i have configured untill now: 1. users file: DEFAULT Ldap-Group != "wireless", Auth-Type := Reject 2. /usr/local/etc/raddb/sites-enabled/inner-tunnel and default: # uncommented ldap from authorize function 3. /modules/ldap: server = "192.168.1.10" port = 389 identity = "cn=Administrator,cn=users,dc=DOT1X,dc=local" password = 123456 basedn = "dc=DOT1X,dc=local" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf Do you have any idea what can be missing? I send also the debub: ldap_chase_v3referral: msgid 15, url "ldap://dot1x.local/CN=Configuration,DC=dot1x,DC=local" ldap_send_server_request ldap_new_connection 0 1 1 ldap_int_open_connection ldap_connect_to_host: TCP dot1x.local:389 ldap_new_socket: 15 ldap_prepare_socket: 15 ldap_connect_to_host: Trying 192.168.1.10:389 ldap_pvt_connect: fd: 15 tm: 1 async: 0 ldap_ndelay_on: 15 ldap_int_poll: fd: 15 tm: 1 ldap_is_sock_ready: 15 ldap_ndelay_off: 15 ldap_pvt_connect: 0 anonymous rebind via ldap_sasl_bind("") ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result ld 0x818f1f8 msgid 25 wait4msg ld 0x818f1f8 msgid 25 (timeout 100000 usec) wait4msg continue ld 0x818f1f8 msgid 25 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 rebind in progress queue is empty * host: DomainDnsZones.dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 25, origid 25, status InProgress outstanding referrals 0, parent count 0 * msgid 22, origid 15, status InProgress outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 2, parent count 3 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 25 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 25 all 1 read1msg: ld 0x818f1f8 msgid 25 message type bind read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 25 request done: ld 0x818f1f8 msgid 25 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 25, msgid 25) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree read1msg: search ref chased, mark request chasing refs, id = 15 adding response ld 0x818f1f8 msgid 15 type 115: wait4msg ld 0x818f1f8 3 s 972321 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: DomainDnsZones.dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status InProgress outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 2, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 22 message type search-result ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 22 read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 22 merged parent (id 15) error info: result errno 1, error <>, matched <> ldap_free_connection 0 1 ldap_send_unbind ldap_free_connection: actually freed wait4msg ld 0x818f1f8 3 s 972094 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status RequestCompleted outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 1, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 15 message type search-result read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 15 ldap_free_connection 0 1 ldap_free_connection: refcnt 1 wait4msg ld 0x818f1f8 3 s 971737 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status RequestCompleted outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status RequestCompleted outstanding referrals 1, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 24 message type search-result ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 24 read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 24 merged parent (id 15) error info: result errno 1, error <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, matched <> request done: ld 0x818f1f8 msgid 15 res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <> ldap_free_request (origid 15, msgid 15) ldap_free_request (origid 15, msgid 24) ldap_free_request (origid 15, msgid 22) ldap_free_request (origid 15, msgid 18) ldap_free_request (origid 15, msgid 16) ldap_free_connection 0 1 ldap_send_unbind ldap_free_connection: actually freed adding response ld 0x818f1f8 msgid 15 type 101: ldap_parse_result ldap_err2string rlm_ldap: ldap_search() failed: Operations error ldap_msgfree [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> dot1x\user3 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 66 to 192.168.1.7 port 1645 Waking up in 4.9 seconds -- View this message in context: http://www.nabble.com/Allow-users-from-a-specific-AD-group-tp25540156p25540… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1