- Freeradius-Users - lists.freeradius.org

cisco: time-based reply attributes set
by Ruslan A Dautkhanov 25 May '09

25 May '09

Hello, How to link reply attributes set with time of day (and possibly time of week) ? We need to leverage shaping at Cisco twice at night. Up to Cisco documentation, Cisco-Avpair += PPW00:00:00:127 Cisco-Service-Info += QU;128000;16000;32000;D;128000;16000;32000 Cisco-Avpair += PPW08:00:00:127 Cisco-Service-Info += QU;256000;32000;64000;D;256000;32000;64000 for example, is used to deal with this demand. As far as I understand, Cisco re-authorize at specified time without droppping user's session, so you can reapply some attributes, e.g. Cisco-Service-Info with different shaping. How to link reply attributes set with time of day (and possibly time of week) ? Is any module to deal with it, or it's core's due? Thank you, Ruslan

2 1

external script doesn't add the attributes it prints out
by Stun Box 25 May '09

25 May '09

Hi all, I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply } and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2) But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug : ... [GETVLAN] expand: %{User-Name} -> nobody Exec-Program output: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program-Wait: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program: returned: 3 ++[GETVLAN] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.3.125 port 48956 EAP-Message = 0x0109002b190017030100206a5e995dedc28425eadd6f6b92faa22efdc1a93ab3a26a000df6f49744b8b392 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f8b9f59174286e5556aa2fa4357052a Finished request 8. Going to the next request .... Regards, G.

3 5

Huntgroup problem
by Parashar Singh 25 May '09

25 May '09

Hi I am new to freeradius. I want to implement huntgroup for associating a user name with particular NAS device. I am performing username authentication with Auth-Type = LDAP If my NAS devices are cisco routes, with IP A.B.C.D, and I want to authenticate this device with user1/***** in LDAP, can some one pls provide what are configuration needed to modified in which files. If I am doing following in /etc/raddb/users file: kmcuser Auth-Type = LDAP, Huntgroup-Name == "kmc1" Fall-Through = Yes and following lines in /etc/raddb/huntgroup file: kmc1 NAS-IP-Address == 172.16.0.150 After restarting radius server with radiusd -X, Now if I am trying to logon to NAS device, it is unsuccessfull with following messages: rad_recv: Access-Request packet from host 172.16.0.150:47715, id=31, length=65 NAS-IP-Address = 172.16.0.155 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "kmcuser" User-Password = "kmcnet" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "kmcuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Login incorrect: [kmcuser] (from client private-network-1 port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 172.16.0.150 port 47715 Waking up in 4 seconds... so pls tell me how shall I solve this problem?/

3 2

freeRadius 1.1.6 ldap inner and outer identity
by Daniel Daza Muñoz 25 May '09

25 May '09

Hello, We use freeRadius v 1.1.6 and EAP-TTLS for our WiFi network. FreeRadius uses LDAP for users autentication. It is querying LDAP about inner identities and outer identities (anonymous usually). Is there any way to stop freeRadius from querying LDAP about outer identities? Thanks. -- "En el principio Dios creo * desde la línea de comandos" Daniel Daza Muñoz Responsable de programación. Área de Comunicaciones. Servicio de Informática y Comunicaciones. UNIVERSIDAD DE SEVILLA. Campus de Reina Mercedes. Edificio Rojo. Despacho 3.26 Avenida de Reina Mercedes, s/n 41012 Sevilla ESPAÑA KML de localización geográfica: https://jade.us.es/publico/ArCo.kml Web : http://www.us.es/servicios/sic/ Tlf : 95 455 11 97 Fax : 95 455 65 45 Mail: daniel(a)us.es Clave PGP: http://pgp.rediris.es:11371/pks/lookup?op=vindex&search=0xF7D11DDD97D2AEF5

3 2

Re: usr-hiper and freeradius 2.1.5 accounting problem
by haries fajar nugroho 25 May '09

25 May '09

Thanks for replying.. haries fajar nugroho wrote: >> I wanna migrate my radius server from icradius to freeradius 2.1.5.' > 2.1.6. [root@rina2 haries]# /usr/local/freeradius/sbin/radiusd -v radiusd: FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr 15 2009 at 13:33:02 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. >> In my freeradius debugging mode, the error message was : >> rad_recv: Accounting-Request packet from host x.x.x.x (* encrypted ip) >> port 1646, id=63, length=405 >> Received Accounting-Request packet from x.x.x.x (* encrypted ip) with >> invalid signature! (Shared secret is incorrect.) Dropping packet >> without response. > Well... the shared secret is wrong. There really isn't much else to say. But what i am wondering is, why the authentication sections run normally. My user can be authenticated, but the accounting cannot be logged. When i use the same settings with another ras modem, the AAA runs correctly. >> 2. I've tried to use default freeradius secret at the freeradius side >> with testing123 without changing the secret at the ras modem. But >> still failed. > That won't work. >> Do you have another solution ? > Re-enter the shared secret on both the NAS && FreeRADIUS. > Alan DeKok. Thanks :)

3 2

Re: question about windows users
by Bartosz Chodzinski 25 May '09

25 May '09

I am using a standard settings of eap.conf when I change eap.conf to: # default_eap_type = md5 default_eap_type = peap I have similar communicate Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=242, length=147 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "user_certificate" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501757365725f6365727469666963617465 Message-Authenticator = 0x4fea88a60594825de9229268206fb02d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user_certificate", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 242 to 192.168.5.206 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x54cef72d54cfee66f11829ca8f9f95d7 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 242 with timestamp +37 Ready to process requests. On Wed, May 20, 2009 at 3:51 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > > [eap] processing type md5 > > rlm_eap_md5: Issuing Challenge > > Hm, you are saying you want to do EAP-TLS but your server reports that it > has got EAP-MD5 request. Check connection settings on Windows machine. > > Ivan Kalik > Kalik Informatika ISP > >

2 2

Freeradius LDAP weird login issue
by cktan 25 May '09

25 May '09

Hi all, I'm using freeradius+LDAP for the PPPoE dialup access control for a while. Lately I noticed there is weird issue whereby an user login with username as "user=5C=5C=5C=5Cuser@domain" and surprisingly freeradius allow it to login although the actual username should be "user@domain". I've run radius in -X mode and capture the log for your reference as below. In radiusd -X, we noticed server received Access-Request with username "user=5C=5C=5C=5Cuser@domain" but when reach to radius_xlat, the uid will become "user" only and when it query my LDAP the account for "user" is available and it will accept the access request. The question is why "user=5C=5C=5C=5Cuser" = "user"? We try the username with xC (i.e. 1C, 2C, 3C and so on...) and all are able to login because radius will take as user@domain. After login, the username in radacct will become "user=5C=5C=5C=5Cuser@domain" instead of "user@domain". As the consequence, the smart user may have multiple logins (by using user=1C/2C/3C....) and the records in radacct is different and therefore we will out of control for multiple login with single account. Any idea to fix this? rad_recv: Access-Request packet from host 127.0.0.1:32877, id=87, length=93 User-Name = *"user=5C=5C=5C=5Cuser@domain"* User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: performing user authorization for *user=5c=5c=5c=5cuser* radius_xlat: * '(uid=user)'* Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 5

Create Database/Tables -PostgreSQL
by Just E. Mail 24 May '09

24 May '09

I am trying to create pgsql database/tables for freeRADIUS. I notice that PostgreSQL has a schema for freeRADUS. Is there any procedure to create the DB/Tables from this schema or I have to type all the lines to create table manually?

4 5

Re: Re: freeRADIUS + POPTOP
by Neville 24 May '09

24 May '09

>> I've search the INTERNET for 5 days now and late into the evening, but >> I'm >> totally stumped in resolving my problem, so I would appreciate any >> guidance from the experts. I've configured as per the many guides I've >> found and have a basic understanding of how this all works, but there is >> no information anywhere on how to setup the Users / Client details for >> freeRADIUS. > > Did you try reading comments in users file and clients.conf ie. files you > were about to change? First THANKS for replying... I did, but still cannot work out what I'm doing wrong on this as there is so many guides and different ways of doing things, or thats how it seems. Everything authenticates ok and the correct IP is allocated now, but I'm not able to BROWSE any sites and cannot even ping the ip address given to the PPP adatper. I can only access the VPN, but none of the traffice seems to be routing correctly. Can you offer any further supports, please. Windows IP Configuration PPP adapter testvpn Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . . : 10.0.0.168 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 C:\Users\Nev>ping 10.0.0.168 Pinging 10.0.0.168 with 32 bytes of data: General failure. General failure. General failure. General failure. Ping statistics for 10.0.0.168: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), ppp0 Link encap:Point-to-Point Protocol inet addr:10.0.0.1 P-t-P:10.0.0.168 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1 RX packets:3890 errors:0 dropped:0 overruns:0 frame:0 TX packets:1731 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:442107 (431.7 KiB) TX bytes:108501 (105.9 KiB) Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 10.0.0.0/24 anywhere [root log]# cat /etc/sysctl.conf # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 1 [root log]# cat /proc/sys/net/ipv4/ip_forward 1 RADIUS LOG.. +- entering group post-auth {...} [test_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 127.0.0.1 0 [test_pool] MD5 on 'key' directive maps to: ee0282d57992a30bce29ea43d092ac16 [test_pool] Searching for an entry for key: 'ee0282d57992a30bce29ea43d092ac16' rlm_ippool: Allocating ip to key: 'ee0282d57992a30bce29ea43d092ac16' [test_pool] num: 1 [test_pool] Allocated ip 10.0.0.168 to client key: ee0282d57992a30bce29ea43d092ac16 ++[test_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 95 to 127.0.0.1 port 51514 Service-Type = Framed-User Session-Timeout = 65000 Framed-Protocol = PPP Framed-MTU = 1400 MS-CHAP2-Success = 0xf2533d35303143344543324435364631324646424434313043314445303236314244324642323145323238 MS-MPPE-Recv-Key = 0x39c2ccda839a57b64583b1f3a55ed07e MS-MPPE-Send-Key = 0xeaa3b2169241344554880f6e3a6f956b MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 10.0.0.168 Framed-IP-Netmask = 255.255.255.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 40285, id=96, length=97 Acct-Session-Id = "4A1897253C3400" User-Name = "test1" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.168 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4A1897253C3400",User-Name = "test1"' [acct_unique] Acct-Unique-Session-ID = "2855668f1c6c9940". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090524 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090524 [detail] expand: %t -> Sun May 24 00:39:01 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok [test_pool] This is not an Accounting-Stop. Return NOOP. ++[test_pool] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 96 to 127.0.0.1 port 40285 Finished request 1. Cleaning up request 1 ID 96 with timestamp +56 Going to the next request Waking up in 3.0 seconds. Cleaning up request 0 ID 95 with timestamp +54 Ready to process requests. >> The problem, I'm facing is the allocation of IP address / GW / DNS by >> freeRADIUS for the VPN connections coming onto my server. >> >> my service PrivateIP address is 19x.xxx.xxx.190 >> >> I've iptables setup to forward all NAT traffic through the PRIVATEIP, but >> allocation of a GW of 10.0.0.1 and a Client IP of 10.0.0.200 >> >> However, when I connect and freeRADIUS authenticates me SUCCESSFULLY. I >> get given a IP of 192.168.2.82 from the test_pool, but pool range-start = >> 10.0.0.100 range-stop = 10.0.0.199 which is totally different to the >> address allocated by the pool. ANY IDEAS? > > Was test_pool once upon a time in 192.168.2.x range? When you change the > IP range you need to delete db files. This is clearly stated in the ippool > module ie. the file you have changed. I did not delete this, as this was the first time test_pool was used, however this proved to be the issues and I thank you for that. So it must have come in as part of the RPM.

2 1

Unable to implement huntgroups--pls help
by Parashar Singh 23 May '09

23 May '09

I want to implement huntgroup for Radius server. In this respect I want to give access to user name test1, which authenticated via LDAP, to only one NAS with IP 172.16.0.150. For this I have modified /etc/raddb/users file with following data: kmcuser Auth-Type :=LDAP, Huntgroup-Name == "kmc1" Fall-Through = Yes DEFAULT Auth-Type = LDAP Fall-Through = 1 And I have modified /etc/raddb/huntgroups file with following data: kmc1 NAS-IP-Address == 172.16.0.150 User-Name = kmcuser But It is not working, with username kmcuser, I am able to login to other NAS as well, not having IP 172.16.0.150. Please suggest some solution, Thanks

2 1