- Freeradius-Users - lists.freeradius.org

timestamp in radpostauth and radacct
by liran tal 01 Jul '09

01 Jul '09

Hey, To include information about the NAS in a listing of the radpostauth (which doesn't have an entry regarding the nas from which the request originated from) I am joining the tables based on the radacct.acctstarttime = radpostauth.date which works "part" of the time. Meaning, for most of my tests it works just fine but I've seen logs where the timestamp in both of these tables differ (for the same request ofcourse). I was hoping someone can clear this issue, what's a normal behavior here? are the timestamp supposed to be the same/different and why. Regards, Liran.

1 0

ldap double bind (rebind) problem
by Joerg Spatschil 01 Jul '09

01 Jul '09

I run FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu and testing FreeRADIUS Version 2.1.3 both on gentoo systems, I want to peap authenticate, authorize and set VLANs on a Cisco Cat 4500 according to a ldap Attribute. * What does work already: I can authenticate peap using certificates from an XP machine store as well as from the user store. Adding the machine and user to users file DEFAULT Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6 # Tunnel-Private-Group-Id = 101 user@domain Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 101 sets the VLAN correctly on the Cisco; removing user uses DEFAULT and works as well when the Tunnel-Private-Group-Id is enabled. * What does not work: removing the users entry and setting up ldpa: sites-enabled/MySite authorize { preprocess mschap eap { ok = return } files Autz-Type LDAP1 { ldap_client1 } ldap_client1 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest pam unix Auth-Type LDAP1{ ldap_client1 } eap } modules/ldap ldap ldap_client1 { server = "ldapserver" identity = "cn=ldapuser,ou=users,...." password = "password" basedn = "dc=ad,..." dictionary_mapping = ${raddbdir}/ldap.attrmap filter = "(userPrincipalName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 ldap_debug = 0xFFFF } ldap.attrmap checkItem Tunnel-Private-Group-Id comment My VLAN is in the comment Attribute: ldapsearch -h ldaserver -b "dc=casedn" -D "ldapuser@ldaserver" -w "password" -x '(userPrincipalName=user@domain)' comment --> .... comment: 101 Major problem in the debug: new result: res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772>, res_matched: <> read1msg: ld 0x81c1068 0 new referrals In tcpdump from ldapsearch there is one bind + one searchRequest In tcpdump from radiusd there is one bind + one searchRequest with searchResDone ... vals 101 - This is perfect. But right thereafter is an anonymous bind which uses the searchResRef and issues the same query again and fails, as it is not allowed for anonymous bind. Is there any idea how to resolve this or how to use ldap differently. Thanks Joerg

2 2

simple test,, how to go on?
by Rakotomandimby Mihamina 01 Jul '09

01 Jul '09

Hi, - Freeradius 2.0.4, packaged by Ubuntu 9.04 Jaunty, on "radius20" host. In users: [...] mihamina Cleartext-Password := "{clear}mihamina" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP [...] "clients.conf" already allows the client I launch radtest from. "radiusd.conf" is attached. When I launch $ radtest mihamina mihamina radius20 10 testing123 or $ radtest mihamina {clear}mihamina radius20 10 testing123 I get the answer: Access-Reject packet from host 41.204.103.216 port 1812 On the server, lauched with -X flag: rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 User-Name = "mihamina" User-Password = "mihamina" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "mihamina", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry mihamina at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "mihamina" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [mihamina/mihamina] (from client quarante_un_deux_cent_quatre port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> mihamina attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 4 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 Waiting to send Access-Reject to client quarante_un_deux_cent_quatre port 54132 - ID: 132 Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 132 to 41.204.104.9 port 54132 Waking up in 4.9 seconds. Cleaning up request 0 ID 132 with timestamp +29 -- Architecte Informatique Gulfsat/Blueline: Administration Système, Recherche et Développement Mob: +261 33 11 207 36 Penser à l'environnement avant d'imprimer ce message

3 3

Sending Access Accept when Request comes from a particular IP
by Mauro Iorio - Smart Soft s.r.l. 01 Jul '09

01 Jul '09

Is it possible to send an Access Accept Packet every time an Access Request is sent from a specified source ip only??? Is there an example configuration I can read? Thanks, Mauro Iorio Smart Soft s.r.l.

3 2

Nortel Dictionary update
by David Hobley 01 Jul '09

01 Jul '09

Hello, Here is an updated dictionary.nortel file, it contains the Radius attributes to be able to authenticate against their BCM platform. I wasn't certain how to submit it formally, so thought I would send it here. -- Cheers, David

2 1

about Cisco-AVPair attribute
by Tseveendorj 01 Jul '09

01 Jul '09

Hello, Sorry for asking cisco related thing. What kind of Cisco-AVPair attribute's value to known for policy based shaping. Currently I'm using following configuration with known Cisco-AVPair attribute's value ip:sub-policy-Out=1024Kbps, ip:sub-policy-In=1024Kbps policy-map 1Mbps class Match-Any-Packet police cir 1024000 bc 72000 conform-action transmit exceed-action drop So, I need to change the police to shape like below Router(config)# *policy-map shape-cbwfq * Router(config-pmap)# *class cust1 * Router(config-pmap-c)# *shape average 384000 * Router(config-pmap-c)# *bandwidth 256 * But I don't know what is the Cisco-AVPair attribute's value of shape ? Sincerely, Tseveen.

1 0

freeradius2 Proxy fail-over issues
by Emmett Culley 30 Jun '09

30 Jun '09

I just upgraded one of our CentOS 5 systems from FreeRadius 1.x to FreeRadius 2.1.6. It was all working before the upgrade and I have it working on the new version. That is, by using the deprecated authhost and accthost variables in the realm definition I can successfully authenticate and process accounting with the new version. However, as soon as I attempt to define a set of main and backup servers, then use the auth_pool and acct_pool variables I get the following error: "Ignoring spoofed proxy reply. Signature is invalid" Here is a status query that results in the error, like any other query: Sending Access-Request of id 136 to x.x.x.x port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. rad_recv: Access-Reject packet from host x.x.x.x port 1812, id=136, length=64 Ignoring spoofed proxy reply. Signature is invalid Of course, the main reason I upgraded at all was to be able to define a pool of servers. I've searched Google and cannot find any references to this issue. Here is the proxy.conf lines that matter: home_server my_rlm_auth { ipaddr = x.x.x.x port = 1812 type = "auth" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server my_rlm_acct { ipaddr = x.x.x.x port = 1813 type = "acct" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } server_pool my_rlm_auth_pool { type = fail-over home_server = my_rlm_auth # home_server = Primary_my_rlm_auth # home_server = Secondary_my_rlm_auth } server_pool my_rlm_acct_pool { type = fail-over home_server = my_rl_acct # home_server = Primary_my_rlm_acct # home_server = Secondary_my_rlm_acct } realm my_rlm { nostrip auth_pool = my_rlm_auth_pool acct_pool = my_rlm_acct_pool # authhost = x.x.x.x:1812 # accthost = x.x.x.x:1813 # secret = "bignewsecret" type = radius } Any ideas or pointers? Regards, Emmett

3 9

Accounting help please
by David Hobley 30 Jun '09

30 Jun '09

Hello, I have freeradius2 configured and authenticating properly. I would like to be able to get radwho and radlast working properly, but for some reason the files do not get created (permission are correct in that directory). I thought I have set up accounting correctly, but obviously haven't. I have attached the output from radiusd -X, any pointers anyone could give me, I would appreciate. The output I get from radwho and radlast is: [root@samba raddb]# radwho radwho: Error reading /var/log/radius/radutmp: No such file or directory [root@samba raddb]# radlast last: /var/log/radius/radwtmp: No such file or directory Thanks! -- Cheers, David

2 1

Where to place a client.p12 to use as a "computer certificate" under windows XP/sp2?
by john 30 Jun '09

30 Jun '09

Hi all, Hopefully an easy one. I want to use certificates for some of the computers on the domain. I want the cert to be available for any user of the computer. I am not sure where to put it though. I've successfully installed a client.p12 under an individual profile but I need this to be available to everybody. I opened the certificate management console using certmgr.msc and I am looking around trying to figure out where this thing should go. Any ideas? Thanks! John

1 0

First Session-Timeout response error
by Guillaume Brenaut 30 Jun '09

30 Jun '09

Hello, after looking for a solution in different forums and on this mailing list without any success I decide to post my problem here. I'm having trouble to get the good Session-Timeout at the first request. Example: one user with Max-All-Session:=900 try to connect: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 197 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=197, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 2537321 But the next request give the good answer: root@server:~# radtest jalmjdm nqbnmwcp 127.0.0.1 1812 secret Sending Access-Request of id 174 to 127.0.0.1 port 1812 User-Name = "jalmjdm" User-Password = "nqbnmwcp" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=174, length=78 WISPr-Redirection-URL = "http://www.google.ca" WISPr-Bandwidth-Max-Up = 128000 WISPr-Bandwidth-Max-Down = 512000 Session-Timeout = 886 I heard about a conflict problem with authorize parameters but I haven't figured out how to fix it. Here is my config: sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = "Max-All-Session" sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } #############AUHTORIZE SECTION#################### instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec # # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # So the module needs to be instantiated, but CANNOT be # listed in any other section. See 'doc/rlm_expr' for expr noresetcounter expiration logintime } authorize { preprocess suffix chap mschap sql files noresetcounter hourlycounter dailycounter monthlycounter weeklycounter yearlycounter totaloctetyearlycounter totaloctetmonthlycounter totaloctethourlycounter totaloctetdaylycounter outputyearlycounter outputmonthlycounter outputhourlycounter outputdaylycounter inputyearlycounter inputmonthlycounter inputhourlycounter inputdaylycounter } Thanks for your help

2 2