- Freeradius-Users - lists.freeradius.org

Where to place a client.p12 to use as a "computer certificate" under windows XP/sp2?
by john 30 Jun '09

30 Jun '09

Hi all, Hopefully an easy one. I want to use certificates for some of the computers on the domain. I want the cert to be available for any user of the computer. I am not sure where to put it though. I've successfully installed a client.p12 under an individual profile but I need this to be available to everybody. I opened the certificate management console using certmgr.msc and I am looking around trying to figure out where this thing should go. Any ideas? Thanks! John

1 0

First Session-Timeout response error
by Guillaume Brenaut 30 Jun '09

30 Jun '09

Hello, after looking for a solution in different forums and on this mailing list without any success I decide to post my problem here. I'm having trouble to get the good Session-Timeout at the first request. Example: one user with Max-All-Session:=900 try to connect: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 197 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=197, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 2537321 But the next request give the good answer: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 174 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=174, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 886 I heard about a conflict problem with authorize parameters but I haven't figured out how to fix it. Here is my config: sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = "Max-All-Session" sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } #############AUHTORIZE SECTION#################### instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec # # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # So the module needs to be instantiated, but CANNOT be # listed in any other section. See 'doc/rlm_expr' for expr noresetcounter expiration logintime } authorize { preprocess suffix chap mschap sql files noresetcounter hourlycounter dailycounter monthlycounter weeklycounter yearlycounter totaloctetyearlycounter totaloctetmonthlycounter totaloctethourlycounter totaloctetdaylycounter outputyearlycounter outputmonthlycounter outputhourlycounter outputdaylycounter inputyearlycounter inputmonthlycounter inputhourlycounter inputdaylycounter } Thanks for your help

2 2

Multiple Services - Single Login
by Nick Huanca 30 Jun '09

30 Jun '09

Hi, I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service? Thanks, -- Nick Huanca

4 7

set absolute lifetimes
by Sebastian Wieseler 30 Jun '09

30 Jun '09

Hello guys, I've got a problem with the accounting of freeradius. The counter and sqlcounter are made for scenarios where people'll get a number of hours and can take them where ever they want to... I would like to setup a scenario where people can login for 1/2/3/4/... days. Let's say somebody is allowed to login for one day...then he shouldn't be able to login half a day today and half a day tomorrow. I would like to make "one day" absolute - to end at the end of day1. Into "radcheck" I would like to write something like Current-Time <= a value you set while creating the "ticket". Let's suppose everything to be in Unix Time format... I tried to write in the radius config in the modules part: sqlcounter maxlifetimecouter { counter-name = Max-End-Lifetime-Counter check-name = Current-Time sqlmod-inst = sql key = User-Name reset = never query = "SELECT UNIX_TIMESTAMP();" } But it didn't work out. To have got a cron job that will delete expired accounts (like [1]) isn't an option either... Can you please help me? :-( [1] http://github.com/italpro/ChilliGrid/blob/2ef3cd1dd342468ed195fef8ba82d2244… Kind Regards, Sebastian Wieseler - IT - _________________________________________________________________________ undbitte entertainment GmbH, Medienproduktion Von-Hünefeld-Str. 81, 50829 Köln Phone: +49 221 801307-0 Fax: +49 221 801307-18 Internet: http://www.undbitte.tv E-Mail: s.wieseler(a)undbitte.tv undbitte entertainment GmbH, Geschäftsführung: Anke Tesdorpf Sitz der Gesellschaft: Köln, Handelsregister: HRB 34500, Amtsgericht Köln

2 1

Old password 'grace period'
by John Kane 30 Jun '09

30 Jun '09

I've been asked to implement freeradius on a proprietary system that uses the concept of a password 'grace period', a brief time period during which both the old and new passwords should be allowed. Is this possible with freeradius? The system uses pptp client access (MS-CHAP) with user/passwords in a (proprietary) postgres DB. We are working with freeradius version 1.1.3. Thanks in advance, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

4 18

cisco-avpair
by Martin Badie 29 Jun '09

29 Jun '09

Hi, Is it possible if I use only one cisco-avpair like: Cisco-AVPair = "lcp:interface-config=ip vrf forwarding pool;lcp:interface-config=ip unnumbered loopback 5;lcp:interface-config=peer default ip address pool poolxxx" and also Framed-Route = "123.123.134.111 255.255.255.255 172.40.0.25 200; 10.245.52.1 255.255.255.255 172.40.0.25 200" or do I have to use += for every ; value? I am not sure how cisco interprets it so I am asking that to here. radreply returns all values but on the cisco side i am not sure. Regards.

2 1

Accounting Start Queries getting lost
by Henk Kleynhans 29 Jun '09

29 Jun '09

Hi, We are having an issue where, in some sessions, an Authentication Request is sent successfully (and inserted into RADPOSTAUTH table), but the Accounting Start Query is never run/received. Subsequently, Accounting Update Queries come through, but fail due to the fact that a relevant RADACCT session has not been inserted to begin with. It only happens in a small amount of cases, < 1% of sessions, but nonetheless opens us to loss of data that is not being billed for properly. Is this a known issue? Is there a workaround? We're looking at changing the Acct Update Query to insert a new session if it cannot find an existing one. Any help will be appreciated. henk -- Henk Kleynhans CTO & Founder Skyrove (Pty) Ltd Technology Top 100 - Most Promising Emerging Enterprise 2006 Tel: +27 (21) 4488843 Cell: +27 (84) 3073451 Fax: +27 (86) 6204077 henk(a)skyrove.com blog: www.geekrebel.com ------ "A person with ubuntu is open and available to others, affirming of others, does not feel threatened that others are able and good, for he or she has a proper self-assurance that comes from knowing that he or she belongs in a greater whole and is diminished when others are humiliated or diminished, when others are tortured or oppressed." - Desmond Tutu

3 2

Re: groupcmp fails during tunneled request
by Matthieu Lazaro 29 Jun '09

29 Jun '09

Ivan Kalik a écrit : >> Content of my huntgroup file. >> WIFI NAS-Identifier == "accessPoint-Manager" >> Ldap-Group == wireless, >> Ldap-Group == wireless2, >> REM NAS-IP-Address == 10.44.12.2 >> Ldap-Group == REM >> >> > > OK. > > >> Content of my user file: >> DEFAULT Framed-Protocol == PPP >> Framed-Protocol = PPP, >> Framed-Compression = Van-Jacobson-TCP-IP >> DEFAULT Hint == "CSLIP" >> Framed-Protocol = SLIP, >> Framed-Compression = Van-Jacobson-TCP-IP >> DEFAULT Hint == "SLIP" >> Framed-Protocol = SLIP >> DEFAULT Ldap-Group == BANNED , Auth-Type := Reject >> Reply-Message = "Account disabled. Please call the helpdesk." >> DEFAULT Huntgroup-Name == WIFI, Auth-Type = eap >> Fall-Through = no, >> > > That should match (remove that Auth-Type from this and REM entry). But ... > > >> DEFAULT Huntgroup-Name == REM, Auth-Type = ldap >> Fall-Through = no, >> DEFAULT Auth-Type := Reject >> Reply-Message = "Please call the helpdesk." >> >> > ... > >> server inner-tunnel { >> +- entering group authorize {...} >> ++[mschap] returns noop >> [suffix] No '@' in User-Name = "alicebob", looking up realm NULL >> [suffix] No such realm "NULL" >> ++[suffix] returns noop >> [eap] EAP packet type response id 7 length 11 >> [eap] No EAP Start, assuming it's an on-going EAP conversation >> ++[eap] returns updated >> rlm_ldap: Entering ldap_groupcmp() >> [files] expand: dc=companyname,dc=com -> dc=companyname,dc=com >> > > ... you haven't enabled preprocess in inner-tunnel server. Huntgroups are > processed in preprocess. > > Ivan Kalik > Kalik Informatika ISP > > Hello Again, I am having an issue with the groups again..... WIFI NAS-Identifier == "accessPoint-Manager" Ldap-Group == wireless, Ldap-Group == wireless2, When I have the attribute wireless it works without a flaw, if I have both, it's ok, if I have *ONLY* wireless2 it says "no huntgroup " and I'm rejected. Any ideas? Best Regards, Matthew

2 2

one more try to migrate radius proxy to 2.x
by Evgeniy Kozhuhovskiy 29 Jun '09

29 Jun '09

Hi, all! My first try to migrate our radius proxy from 1.1.7 to 2.x was when 2.0.4 just released :) All works ok, the only one problem was that home server sometimes become dead (one time in 5 mins). Configuration is near default, the only one difference is that i have some unlang code that fixes NAS-IP-Address (in 1.1.7 config this was done via rlm_attr_rewrite). diff -ur between folder with freeradius sources and raddb dir says that files that i've modified are: 1) clients.conf (i've added our NAS'es here) 2) proxy.conf, here is it: proxy server { default_fallback = no } home_server cboss { type = auth+acct ipaddr = xx.xx.xx.xx port = 1812 secret = ourcoolsecret require_message_authenticator = no response_window = 40 zombie_period = 60 revive_interval = 120 # Allowed values: none, status-server, request status_check = none # username = "test_user_please_reject_me" # password = "this is really secret" check_interval = 30 num_answers_to_alive = 3 } home_server guest { type = auth+acct ipaddr = 127.0.0.1 port = 1921 secret = megasecret require_message_authenticator = no response_window = 20 zombie_period = 120 revive_interval = 120 # Allowed values: none, status-server, request status_check = none # username = "test_user_please_reject_me" # password = "this is really secret" check_interval = 30 num_answers_to_alive = 3 } home_server_pool main_pool { type = fail-over home_server = cboss } home_server_pool guest_pool { type = fail-over home_server = guest } realm our_isp_realm.com { auth_pool = main_pool nostrip } realm guest { auth_pool = guest_pool nostrip } realm LOCAL { } Also, there is some changes to radius.conf: -max_requests = 1024 +max_requests = 1024000 -regular_expressions = yes -extended_expressions = yes +regular_expressions = no +extended_expressions = no - auth = no + auth = yes - reject_delay = 1 + reject_delay = 2 - status_server = yes + status_server = no - start_servers = 5 + start_servers = 25 - max_servers = 32 + max_servers = 64 - max_spare_servers = 10 + max_spare_servers = 15 - $INCLUDE eap.conf +# $INCLUDE eap.conf - exec +# exec - expr +# expr - expiration - logintime +# expiration +# logintime - eap { - ok = return - } +# eap { +# ok = return +# } - eap + #eap in preproxy: + $INCLUDE ${sysconfdir}/raddb/fixup.conf - eap + #eap deb240:/usr/local/freeradius2.1.6/etc# cat raddb/fixup.conf #nas1 if (NAS-IP-Address == 1.1.1.1) { update proxy-request { NAS-IP-Address := 2.2.2.1 } } #nas2 if (NAS-IP-Address == 1.1.1.2) { update proxy-request { NAS-IP-Address := 2.2.2.2 } } and so on, for 10 nas'es And, logs! :) deb240:/usr/local/freeradius2.1.6/var/log/radius# cat radius.log |grep zomb |head -1; cat radius.log |grep zomb | tail -1; cat radius.log |grep zomb | wc -l Mon Jun 29 17:09:40 2009 : Error: PROXY: Marking home server 172.26.0.31 port 1812 as zombie (it looks like it is dead). Mon Jun 29 17:17:57 2009 : Error: PROXY: Marking home server 172.26.0.31 port 1813 as zombie (it looks like it is dead). 284 Ofcourse, on 1.1.7 (at the same machine) all works fine -- With best regards, Evgeniy Kozhuhovskiy Leader, Services team Minsk State Phone Network, RUE Beltelecom.

1 0

Issue when freeRadius is accessed using JRadius Client.
by kpani 29 Jun '09

29 Jun '09

Hi, I am using JRadius Client with freeRadius server for user authentication. The following code is used to access freeRadius server: ---------------------------------------------------------------------- AttributeFactory.loadAttributeDictionary("net.jradius.dictionary.AttributeDictionaryImpl"); InetAddress addr = InetAddress.getByName(radiusServerAddress); RadiusClient radiusClient = new RadiusClient(addr, secretKey); AttributeList attributeList = new AttributeList(); attributeList.add(new Attr_UserName(userName)); attributeList.add(new Attr_NASPortType(Attr_NASPortType.Ethernet)); attributeList.add(new Attr_NASPort(new Long(1))); AccessRequest request = new AccessRequest(radiusClient, attributeList); request.addAttribute(new Attr_UserPassword(password)); RadiusPacket reply = radiusClient.authenticate(request, new PAPAuthenticator(), 0); System.out.println("Received: " + reply.toString()); ------------------------------------------------------------------------ The server authenticates the user successfully but the response message is printed as follows. So I couldn't read the response values. Unknown-Attribute(6) = [Binary Data (length=4)] Unknown-Attribute(7) = [Binary Data (length=4)] The /usr/local/etc/raddb/users configuration is as follows : dave Cleartext-Password := "public" Service-Type = Framed-User, Framed-Protocol = PPP, Please help me to resolve this issue. Am I missing anything? Thanks in advance. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Issue-when-freeRadius-is-accessed-using-JRadius-Clien… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2