- Freeradius-Users - lists.freeradius.org

Using realms without proxying
by James Wu 03 Sep '09

03 Sep '09

Hi everyone, I'm using freeradius-2.1.4 with MySQL and would like to set up realms without proxying. The reason is that I'd like to keep all the requests to a single Radius server, however would like to separate the users' radreplies based on their username/groups. I know that I can use groupnames to have group based policies but I would like to have the groupname as part of the login name, hence the realms. The main reason for wanting to set up realms is so that I can have a username with username@groupname format and use the variables %{Realm} and %{Stripped-User-Name}. When I do set up realms, it seems that I have to proxy. Is there another way of accomplishing this? James

2 1

Could not find Pool-Name attribute.
by amritap sinha 03 Sep '09

03 Sep '09

Dear Freeradius-user, I have faceing some problem---->Could not find Pool-Name attribute. have any solution. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "System" rlm_eap: Loaded and initialized type gtc rlm_eap: Unable to load EAP-Type/ttls, as EAP-Type/TLS is required first. radiusd.conf[9]: eap: Module instantiation failed. hotradius:~ # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/etc/raddb/db.ippool" ippool: ip-index = "/etc/raddb/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.80:8504, id=188, length=65 User-Name = "amritap" User-Password = "amritap" Service-Type = Framed-User NAS-IP-Address = 192.168.1.80 NAS-Port = 4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "amritap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry amritap at line 100 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 188 to 192.168.1.80:8504 Service-Type = Callback-Login-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 188 with timestamp 4a9fbc96 Nothing to do. Sleeping until we see a request. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Exiting... hotradius:~ # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/etc/raddb/db.ippool" ippool: ip-index = "/etc/raddb/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.80:8504, id=189, length=65 User-Name = "amritap" User-Password = "amritap" Service-Type = Framed-User NAS-IP-Address = 192.168.1.80 NAS-Port = 4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "amritap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry amritap at line 100 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 189 to 192.168.1.80:8504 Service-Type = Callback-Login-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 189 with timestamp 4a9fbe95 Nothing to do. Sleeping until we see a request. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request.

5 9

RE: Sanity check, example in users man page
by Ivan Kalik 03 Sep '09

03 Sep '09

You do. Current documentation should be in man 5 users. Ivan Kalik Kalik Informatika ISP > v2.1.6. AFAIK FR was never installed on this box - it's fairly new - so > I don't think it could've been some legacy doc that didn't get > overwritten when 2.1.6 was installed. > > > -----Original Message----- > From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or > g] On Behalf Of Alan Buxey > Sent: Thursday, September 03, 2009 1:33 PM > To: FreeRadius users mailing list > Subject: Re: Sanity check, example in users man page > > Hi, >> >From users man page: >> >> EXAMPLES >> bob User-Password == "hello" >> >> Requests containing the User-Name attribute, with value "bob", >> will be authenticated using the password "bob". There are no >> reply items, so the reply will be empty. >> >> >> Surely this is incorrect - right? Should this not read: >> "... will be authenticated using the password "hello". >> >> >> Assuming I'm correct, this is my excuse for taking so long to grasp > some >> of the concepts of FR, unlang, etc. I think there are several doc >> errors / typos that are confusing me.... > > > what version are you actually looking at? your example predates > 2.x of the code....and only 2.x of the code has unlang etc. > > the current doc (man 5 users) states > > bob Cleartext-Password := "hello" > > Requests containing the User-Name attribute, with value > "bob", will be authenticated > using the "known good" password "hello". There are no > reply items, so the reply will > be empty. > > > but yes - the text you have is wrong..... it is, indeed password "hello" > - its > fairly obvious. > > from the text i'd say you've got a document that came with version 1.0.2 > of the code? > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 2

Re: freeradius2.1.6| buffered-sql | acctstoptime problems
by ramesh p 03 Sep '09

03 Sep '09

Thanks Ivan for quick responses. I calculated it correctly in dialup.conf file and restarted radius process and it looks like it's not catching up from the point before restart. Instead of that it's reading full detail.work file? why is like that? Any bug in my code? Thanks, Rams. > How to interpret AcctStopDelay filed? It's the delay in seconds. > Is there any SQL query readily > available to update acctstoptimes correctly in FR? please suggest. You subtract the delay from the time. For MySQL: http://dev.mysql.com/doc/refman/5.1/en/date-and-time-functions.html#functio… Ivan Kalik Kalik Informatika ISP

5 11

Re: Freeradius-Users Digest, Vol 53, Issue 11
by ramesh p 03 Sep '09

03 Sep '09

Thanks Ivan. How to increase the speed at which detail reader works. Can you suggest? Thanks. Ivan Kalik Thu, 03 Sep 2009 04:19:06 -0700 > I deactivated buffered-sql and logging directly to mysql by deafult > module. > Just one basic question : > Buffered_SQL is single threaded module? and does not make use of available > mysql threads to complete the jobs in parallel? No, but near enough. Detail reader deliberately reads packets at a reduced rate. Authentication queries are fast - about 10x faster than accounting queries. On top of that you should aim to complete authentication as quick as possible, while if there is a delay in processing accounting data of a few seconds it's hardly going to get noticed. Imagine authentication queries as fast cars and acconting queries as a slow lorries. The idea of buffered-sql is to separate out lorries into a slow lane and leave motorway clear for fast cars to wizz by. You can increase the speed at which detail reader works but the effect of that would be to spread out lorries all over the motorway, slowing the cars down. Even if the reader gets stuck and lane with the lorries stops, the authentication will still work, and new lorries will pile up at the back of the slow lane. Once you get the lane working again, lorries will be on their way, again with no impact to authentication (cars). Ivan Kalik Kalik Informatika ISP

2 1

Cleartext-Password not found + CHAP and LDAP
by ouioui.bambin 03 Sep '09

03 Sep '09

Hi there I'm trying to configure my Freeradius (v 1.272) to work with an LDAP server (for a mac-based authentication). Unfortunately, switchs of the LAN send only Access-request to the RADIUS with a CHAP password, so I have to choose CHAP authentication. I get the mac address from the LDAP and I map it in Cleartext-Password for the CHAP authentication. LDAP mac addresses are like this "ethernet 00:11:22:33:44" so I have to modify Cleartext-Password before the authentication. To do this, I have the following configuration: ldap.attrmap: ... checkItem Cleartext-Password dhcpHWAddress ... (dhcpHWAddress being the attribute wich contains the mac-address in the LDAP) ------------------------------------------------------------------------------ sites-enabled/default: authorize{ chap ldap ...} anthenticate{ ... Auth-Type CHAP { #update control { # Cleartext-Password := "%{User-Name}" #} if ( Cleartext-Password =~ /ethernet ([1-9a-zA-Z:]*)/i ) { update control { Cleartext-Password := "%{1}" } } chap }... And the right configuration in the radiusd.conf. My problem is the Cleartext-Password is unknow ("not found") when I want to modify it, but after, during the anthentication, it has its value. Here is the debug (by freeradius -X): ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=XXX,dc=fr, with filter (XXXXX) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute dhcpHWAddress as RADIUS attribute Cleartext-Password == "ethernet 00:11:XX:XX:XX:XX" rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute dhcpVlan as RADIUS attribute Tunnel-Private-Group-Id:0 = "XXX" rlm_ldap: user 00:11:XX:XX:XX:XX authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP ++? if (Cleartext-Password =~ /ethernet ([1-9a-ZA-Z:]*)/i ) (Attribute Cleartext-Password was not found) rlm_chap: login attempt by "00:11:XX:XX:XX:XX" with CHAP password rlm_chap: Using clear text password "ethernet 00:11:XX:XX:XX:XX" for user 00:11:XX:XX:XX:XX authentication. rlm_chap: Password check failed ... Of course if I remove the # before: #update control { # Cleartext-Password := "%{User-Name}" #} Cleartext-Password takes a new value and all is fine... I don't understand why the Cleartext-Password take a value from the LDAP, then is not found, and finally contains the value from the LDAP for the authentication... Could you help me, please? Thanks pfaf ---------------------------------------------------------------------------- Laposte.net fête ses 10 ans ! Gratuite, garantie à vie et déjà utilisée par des millions d'internautes... vous aussi, pour votre adresse e-mail, choisissez laposte.net. Laposte.net, bien + qu'une messagerie ----------------------------------------------------------------------------

5 4

Out and into tunnel log files
by Sergio Belkin 03 Sep '09

03 Sep '09

Hi, I have configured three virtual servers: "default", "inner" (uses eap-ttls), "inner-peap" (uses eap-peap). I guess that "out of tunnel" attempts go to "default server" log files. cron performs a daily task that more or less perform something like that: grep OK /var/log/radius/radiusd-*-$date.log | awk '{print $10}' | sort -fu | wc -l That way I get how many users could get an Access-Accept. Well I've found that that is not right. Because some supplicant can send different identities into and out of tunnel. So I'd like to use: grep OK /var/log/radius/radiusd-inner*-$date.log | awk '{print $10}' | sort -fu | wc -l But I've found that some "OK" are sent to default server log file. So I can't get right statistic. Please could you help to do it? Below are debug info: FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Oct 21 2008 at 15:14:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap group = radiusd user = radiusd including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client supernoc { require_message_authenticator = no secret = "testing123" shortname = "spectrum.sarlanga.edu" } client 10.128.255.100 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-PB" } client 10.128.255.10 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-SS" } client 10.128.255.11 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-1" } client 10.128.255.254 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "Transitional" } client 10.128.255.12 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-2" } client 10.128.255.13 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-3" } client 10.128.255.14 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-4" } client 10.128.255.15 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "sarlanga2-5" } client 10.128.255.158 { require_message_authenticator = no secret = "sarlangalad0-Red-3-road" shortname = "sarlanga-SS" } client 10.128.255.80 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-PB" } client 10.128.255.89 { require_message_authenticator = no secret = "akantilad0-Black-58" shortname = "oficina" } client 10.128.255.81 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-I" } client 10.128.255.82 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-II" } client 10.128.255.83 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-III" } client 10.128.255.84 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-IV" } client 10.128.255.128 { require_message_authenticator = no secret = "sarlangalad0-Red-3" shortname = "testing" } client 10.128.255.181 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-I_bis" } client 10.128.255.86 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-VI" } client 10.128.255.87 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-VII" } client 10.128.255.85 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-V" } client 10.128.255.88 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-VIII" } client 10.128.255.199 { require_message_authenticator = no secret = "sarlanga" shortname = "UP-Jojojo" } client 192.168.2.53 { require_message_authenticator = no secret = "akantilad0-Green-22" shortname = "sarlanga3" } client 192.168.45 { require_message_authenticator = no secret = "sarlangalad0-black-54" shortname = "sarlanga4" } client 192.168.3.201 { require_message_authenticator = no secret = "sarlangalad0-blue-246692" shortname = "sarlanga7" } client 192.168.4 { require_message_authenticator = no secret = "sarlangalad0-Red-3" shortname = "UP-Ecuador" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ldap.sarlanga.edu" port = 636 password = "sarlanga" identity = "cn=freeradius,ou=applications,dc=sarlanga,dc=edu" net_timeout = 10 timeout = 20 timelimit = 20 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/cacert.pem" randfile = "/dev/urandom" require_cert = "demand" } basedn = "ou=people,dc=sarlanga,dc=edu" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "radiusAllowed" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 10 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusPassword mapped to RADIUS Cleartext-Password conns: 0xa5c3270 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 600 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.pem" certificate_file = "/etc/pki/tls/certs/ips-spectrum-crt.pem" CA_file = "/etc/pki/tls/certs/ips-ca-bundle.crt" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = yes lifetime = 6 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel-peap" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating post_proxy_log detail post_proxy_log { detailfile = "/usr/local/var/log/radius/radacct/postproxy/%{Client-IP-Address}/post-proxy-detail-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/replies/%{Client-IP-Address}/reply-detail-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server inner-tunnel-peap { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Instantiating auth_log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/requests/%{Client-IP-Address}/auth-detail-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.5 port = 0 } listen { type = "acct" ipaddr = 192.168.1.5 port = 0 } Listening on authentication address 192.168.1.5 port 1812 Listening on accounting address 192.168.1.5 port 1813 Ready to process requests. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4

Re: Freeradius-Users Digest, Vol 53, Issue 11
by ramesh p 03 Sep '09

03 Sep '09

I deactivated buffered-sql and logging directly to mysql by deafult module. Just one basic question : Buffered_SQL is single threaded module? and does not make use of available mysql threads to complete the jobs in parallel? Thanks, Rams. > Message: 5 > Date: Thu, 03 Sep 2009 05:32:53 +0100 > From: Arran Cudbard-Bell <a.cudbard-bell(a)sussex.ac.uk> > Subject: Re: freeradius2.1.6| buffered-sql | acctstoptime problems > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A9F46F5.7060806(a)sussex.ac.uk> > Content-Type: text/plain; charset="utf-8" > > Alan DeKok wrote: > > Ivan Kalik wrote: > > > >> Counter? Write detail.work.counter onto the disk, increment it every > time > >> packet is processed and return to zero when detail.work is deleted. It > >> will say how many packets to skip when radiusd is restarted. > >> > > > > Hmm... OK. Or slightly differently: the offset in the file of where > > it last read a packet. > > > > > Yep that's a good option. > > Maybe for 2.1.8. > > > > > This is pretty much a none issue. Just have the detail file writer start > a new file every minute/hour, then the number of repeated entries is > very small. It's only when you have it start a new file every day, or > use one monolithic detail file that you run into problems. > > -Arran > >

3 2

Re: freeradius2.1.6| buffered-sql | acctstoptime problems
by ramesh p 03 Sep '09

03 Sep '09

> this means that slow SQL system will kill your AAA capabilities > - hence detail file, buffered-sql etc Am doing only accounting. Kindly clarify: fre Is Buffered_SQL is single threaded module? and does not make use of available mysql threads to complete the job in parallel? Hi, > I deactivated buffered-sql and logging directly to mysql by deafult module. > Just one basic question : this means that slow SQL system will kill your AAA capabilities - hence detail file, buffered-sql etc alan

1 0

Help with multiple LDAP servers
by AJ 02 Sep '09

02 Sep '09

Hi, I know this has been discussed before on the list and there is documentation for this, but I have literally spent days on this and I cannot get the result that I am looking for. I am hoping someone can share a configuration with me that works. Basically, I am looking to have radius authenticate to two LDAP servers one after the other. It is not a true failover or load balance situation, as both servers need to be queried at the same time. Basically, I want the first LDAP server to be queried for a username/password, then if the user is not found, try the second one. I did not extend the schema on either LDAP server, and I do not really want to do that if at all possible, since I am just using freeradius for authentication. One a side note, if I just use one LDAP server in the configuration, it works fine. I can authenticate to both LDAP servers if I only list one. What seems to happen with this configuration is that it only trys the first LDAP server, and if the user does not exist, it quits right there and does not try the second (ad_ldap). Any help would be greatly appreciated. I am running the following version of freeradius: radiusd -v: radiusd: FreeRADIUS Version 1.1.3 rpm -qa | grep freeradius: freeradius-1.1.3-1.2.el5 Here are the relevant parts of my config: $sysconfdir/raddb/radiusd.conf: modules { ldap rhds_ldap { server = "xxx.xxx.com" identity = "cn=ciscoap,ou=System,dc=xx,dc=xx,dc=xx" password = "xxxx" basedn = "dc=xx,dc=xx,dc=xx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=DUser)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ldap ad_ldap { server = "yyy.yyy.com" identity = "CN=CiscoAP,CN=Users,DC=yy,DC=yy" password = "yyyy" basedn = "dc=yy,dc=yy" filter = "(samAccountName=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=person)" start_tls = no access_attr = "samAccountName" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { redundant { rhds_ldap rhds_ldap notfound = reject } } authenticate { Auth-Type LDAP { rhds_ldap ad_ldap } } $sysconfdir/raddb/users: (added) DEFAULT Auth-Type := LDAP Fall-Through = Yes $sysconfdir/raddb/ldap.attrmap: (added) checkItem User-Password userPassword

3 11