- Freeradius-Users - lists.freeradius.org

Building a test tool
by Vinit Karandikar 01 Jun '09

01 Jun '09

Hello folks, I'm new to Free Radius and would like to use it to build a test tool for testing a AAA server. I'd like the test tool to simulate (say) 10 network elements that talk to a AAA server - using threads on different ports that are controlled by the main thread. Some of these will initiate traffic to the AAA server (like the one simulating the PDSN). Others will receive traffic and talk back to the AAA server (like the one simulating the Pre-paid Server). I'm sure I'm not going to find something like this in the wild. So I'm planning to write code to do the above. I was wondering if there are bits of code that I can shamelessly pilfer from or use as a starting point. Any tips are plenty welcome... Thanks in advance to all, -Vinit

2 1

conditional acct proxy?
by Fajar A. Nugraha 01 Jun '09

01 Jun '09

Is it possible to proxy certain acct packets only? For example, I want to forward acct start and stop packets to another radius server, but I don't want to forward interim-update packets. -- Fajar

1 0

Members of two groups
by Andrew Paternoster 01 Jun '09

01 Jun '09

Hi List Sorry if this is a simple problem i have been pulling my hair out for 3 days. I running Freeradius 2.1.6 and its all working great. Ecept for my users that are members of 2 groups. I have been reading on the net and it looks like it can be done but for the life of me i can not get it to work The only grop that applies is the lowest priorty. The system just seems to ingor the rest of the list. The strange this is that if i run the SQL querys it looks like it pulling the right data back but not adding each attibute to the logon only the first one. I have moved the prioritys around and it works will all of them but only one at a time and only the lowest priority. Can anyone point out what i'm missing Thanks Andrew Paternoster Mon Jun 1 22:24:46 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'andrew.home(a)gpknet.com.au' ORDER BY id Mon Jun 1 22:24:46 2009 : Info: [sql] User found in radcheck table Mon Jun 1 22:24:46 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'andrew.home(a)gpknet.com.au' ORDER BY id Mon Jun 1 22:24:46 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'andrew.home(a)gpknet.com.au' ORDER BY priority Mon Jun 1 22:24:46 2009 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '8M Download' ORDER BY id Mon Jun 1 22:24:46 2009 : Info: [sql] User found in group 8M Download Mon Jun 1 22:24:46 2009 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '8M Download' ORDER BY id

1 0

around radius - printers, ip phones and others
by Bartosz Chodzinski 01 Jun '09

01 Jun '09

Hi, What do you suggest to do with printers, ip phones and other network devices wchich can not support 802.1x ? What are you doing to secure this backdoor? One idea is to identify such devices by MAC but I think it should be something else - cause someone can disconnect fi printer - change mac addres on pc on the same as printer and welcome home :). any suggestions? Bartosz Chodzinski.

2 1

Problems authenticating with freeRADIUS and LEAP
by smaaland 01 Jun '09

01 Jun '09

Hi! I have set up a freeradius server, which are pointed to by my Linksys WRT54GL router. Everything seems to work with LEAP authentication, such as radtest from localhost and also from my laptop (When router is running WPA2 Personal, and i can connect to the network). The problem comes when i switch to WPA2 Enterprise. I try to connect with my user credentials to the access point, and the radius server gets the request, authenricates and sends a "Access-Accept" message back to the AP. But my laptop never gets connected completely. It just says that it is "trying to authenticate", and seems to send more access requests to the AP, and the radiusserver reponds to them with more Access-Accept, but it never works. I have tried with both a laptop running Linux Mint, and a macbook, and the same thing happens at both of them. Does anyone have an idea please? -- View this message in context: http://www.nabble.com/Problems-authenticating-with-freeRADIUS-and-LEAP-tp23… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 4

freeradius-users@lists.freeradius.org
by Just E. Mail 29 May '09

29 May '09

Is there any way to setup freeRADIUS to connect to "my_db" instead of "radius" database? I have setup freeRADIUS successfully to connect to a backend PostgreSQL database. My original TEST setup is done by following the standard instruction bt creating a "radius" database & "radius" role/User. sql.con has the following instructions,which I believe make this connection; database = postgres server = "pg1" login = "radius" password = "radpass" When I start the RADIUS in the DEBUG mode, I see this line; radius@pg1:/radius and it connects & no error is displayed. -------------------- No I want to change the database to"my_db" & a Schema "radius". PostgreSQL is both of them created. I changed "sql.conf" to: database = postgres server = "pg1" login = "my_db" password = "radpass" This does not work. --------------------- Is there any way to further change the freeRADIUS configuration to have it connect to"my_db" & "radius" Schema? Is it possible that freeRADIUS software is hard coded that it will only connect to a "radius" Database with "radius" Schema?

2 2

FreeRadius with Novell
by Magnus Larsson 29 May '09

29 May '09

Hi, I'm using FreeRadius as a "radius proxy" to authenticate wireless users and send which VLAN ID they should be using. The authentication server is two Novell servers with two different trees. Now to the problem .. I can't use context less login since the FreeRadius first need to authenticate to place the user on a VLAN and then the client logs in to the Novell server. Is it possible somehow to have FreeRadius hardcoded with all possible contexts to search for the user or somehow first give a temporary VLAN to the user and then move the user to the real VLAN after the context less authentication? I hope you understand what I mean Best Regards, Magnus Larsson MCE, CWSP, BCCPP, WCSE+, CICSP _________________________________________________________________________ AddPro AB Stubbengatan 2, SE-703 44 Örebro Mobile: +46 (0)70 417 45 02 Direct: +46 (0)19 760 45 02 magnus.larsson(a)addpro.se<mailto:magnus.larsson@addpro.se> | www.addpro.se<http://www.addpro.se/> AddPro_Signatur

3 2

problem with rlm_counter module when reset option is set to never
by Ahmed Nifaz Faizabadi 29 May '09

29 May '09

Hi all, Here is the issue I am facing with rlm_counter module. I am using freeradius-server-2.1.4 and configuring Max session time for each user. for example: user1 Max-Session-Time := 1800, Auth-Type := Reject Reply-Message = "Your time limit is used" user2 Max-Session-Time := 3600, Auth-Type := Reject Reply-Message = "Your time limit is used" and rlm_counter options are : counter daily { counter-name = Max-All-Session-Time check-name = Max-All-Session key = User-Name reset = never } I am observing that the user accounting record is not deleted from rlm_counter module once the user has used his allocated time. For example when user1 has used 1800 seconds allocated to him then I will be deleting the user from users config and then add the same user back. I am getting the "Your time limit is used" message :(. Does somebody has information about how to delete the records from rlm_counter module once they are expired with reset-option set to never. Regards Ahmed Nifaz

4 11

new to freeradius, securing LAN
by ldap.lippogeneral.com 29 May '09

29 May '09

Hello All, I am very new to FreeRadius, some of users are already knew our LAN IPs ... so they can manually configure an interface on their PC and completely bypass our DHCP server.. can I solve this by using FreeRadius? I thought this can be done by checking its MAC address, so although they use valid IP address but if their MAC address not recognized by our server then they must be denied and they cannot go anywhere and cannot do anything in our LAN.. I need advise.. many thanks in advance *********************** Our outgoing mail has been scanned by MSS. ***********-***********

4 6

rlm eap problem
by Michael Ziemann 29 May '09

29 May '09

Hi folks, Now I got a new problem with rlm_eap and the server doesn't start anymore. You were right, I commented $INCLUDE sites-enabled/ in radiusd.conf. So what can I do now? Best regards Michael FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Mar 26 2009 at 14:24:27 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /mypath/freeradius/etc/raddb/radiusd.conf including configuration file /mypath/freeradius/etc/raddb/proxy.conf including configuration file /mypath/freeradius/etc/raddb/clients.conf including files in directory /mypath/freeradius/etc/raddb/modules/ including configuration file /mypath/freeradius/etc/raddb/modules/chap including configuration file /mypath/freeradius/etc/raddb/modules/acct_unique including configuration file /mypath/freeradius/etc/raddb/modules/always including configuration file /mypath/freeradius/etc/raddb/modules/attr_filter including configuration file /mypath/freeradius/etc/raddb/modules/attr_rewrite including configuration file /mypath/freeradius/etc/raddb/modules/checkval including configuration file /mypath/freeradius/etc/raddb/modules/counter including configuration file /mypath/freeradius/etc/raddb/modules/detail including configuration file /mypath/freeradius/etc/raddb/modules/detail.example.com including configuration file /mypath/freeradius/etc/raddb/modules/detail.log including configuration file /mypath/freeradius/etc/raddb/modules/digest including configuration file /mypath/freeradius/etc/raddb/modules/echo including configuration file /mypath/freeradius/etc/raddb/modules/etc_group including configuration file /mypath/freeradius/etc/raddb/modules/exec including configuration file /mypath/freeradius/etc/raddb/modules/expiration including configuration file /mypath/freeradius/etc/raddb/modules/expr including configuration file /mypath/freeradius/etc/raddb/modules/files including configuration file /mypath/freeradius/etc/raddb/modules/inner-eap including configuration file /mypath/freeradius/etc/raddb/modules/ippool including configuration file /mypath/freeradius/etc/raddb/modules/krb5 including configuration file /mypath/freeradius/etc/raddb/modules/ldap including configuration file /mypath/freeradius/etc/raddb/modules/linelog including configuration file /mypath/freeradius/etc/raddb/modules/logintime including configuration file /mypath/freeradius/etc/raddb/modules/mac2ip including configuration file /mypath/freeradius/etc/raddb/modules/mac2vlan including configuration file /mypath/freeradius/etc/raddb/modules/mschap including configuration file /mypath/freeradius/etc/raddb/modules/otp including configuration file /mypath/freeradius/etc/raddb/modules/pam including configuration file /mypath/freeradius/etc/raddb/modules/pap including configuration file /mypath/freeradius/etc/raddb/modules/passwd including configuration file /mypath/freeradius/etc/raddb/modules/perl including configuration file /mypath/freeradius/etc/raddb/modules/policy including configuration file /mypath/freeradius/etc/raddb/modules/preprocess including configuration file /mypath/freeradius/etc/raddb/modules/radutmp including configuration file /mypath/freeradius/etc/raddb/modules/realm including configuration file /mypath/freeradius/etc/raddb/modules/smbpasswd including configuration file /mypath/freeradius/etc/raddb/modules/smsotp including configuration file /mypath/freeradius/etc/raddb/modules/sql_log including configuration file /mypath/freeradius/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /mypath/freeradius/etc/raddb/modules/sradutmp including configuration file /mypath/freeradius/etc/raddb/modules/unix including configuration file /mypath/freeradius/etc/raddb/modules/wimax including configuration file /mypath/freeradius/etc/raddb/eap.conf including configuration file /mypath/freeradius/etc/raddb/sql.conf including configuration file /mypath/freeradius/etc/raddb/sql/mysql/dialup.conf including configuration file /mypath/freeradius/etc/raddb/policy.conf including files in directory /mypath/freeradius/etc/raddb/sites-enabled/ including configuration file /mypath/freeradius/etc/raddb/sites-enabled/default including configuration file /mypath/freeradius/etc/raddb/sites-enabled/inner-tunnel including configuration file /mypath/freeradius/etc/raddb/sites-enabled/control-socket including dictionary file /mypath/freeradius/etc/raddb/dictionary main { prefix = "/mypath/freeradius" localstatedir = "/mypath/freeradius/var" logdir = "/mypath/freeradius/var/log/radius" libdir = "/mypath/freeradius/lib" radacctdir = "/mypath/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/mypath/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/mypath/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 91.50.12.116 { require_message_authenticator = no secret = "test" shortname = "91.50.12.116" } client 91.50.53.68 { require_message_authenticator = no secret = "test" shortname = "91.50.53.68" } client 127.0.0.1 { require_message_authenticator = no secret = "test" shortname = "127.0.0.1" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/mypath/freeradius/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/mypath/freeradius/etc/raddb/certs/server.pem" certificate_file = "/mypath/freeradius/etc/raddb/certs/server.pem" CA_file = "/mypath/freeradius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/mypath/freeradius/etc/raddb/certs/dh" random_file = "/mypath/freeradius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/mypath/freeradius/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading Trusted root CA list /mypath/freeradius/etc/raddb/certs/ca.pem rlm_eap: Failed to initialize type tls /mypath/freeradius/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /mypath/freeradius/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /mypath/freeradius/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Errors initializing modules

4 5