- Freeradius-Users - lists.freeradius.org

freeRADIUS - New Install testing!
by Just E. Mail 21 May '09

21 May '09

Installed freeradius-2.2.1 (RPM). Installation & configuration went well. RADIUS starts with no problem. "radiusd -XC" output shows no errors. Now I want to do some preliminary testing. In the older versions, I used to run the command: radtest <User> <P/W> localhost <Port> <Secret-Key> and see the output to verify that RADIUS server was up and running. After I did the above install, "radtest" command is not included. How does one test a new freeRADIUS installation? Is "radtest" replaced by another command? Is there any GUI testing tool for RADIUS?

2 2

RE: Freeradius-Users Digest, Vol 49, Issue 95
by Ivan Kalik 21 May '09

21 May '09

> 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) > > ____________________________________________________________________________ > >> Radius Client --> Radius Proxy > >> 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > >> 192.168.24.3 --> IPS2(192.168.24.4) > > ____________________________________________________________________________ > > You say: > >>>Yes. Proxy server will change NAS-IP-Address from the original NAS >>> >>address into it's own. That is OK. > > > > It not works. In my scenario I have two different NAS-IP-Address(a > NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). > That's because that can't work: # Note: "type = proxy" lets you control the source IP used for # proxying packets, with some limitations: # # * Only ONE proxy listener can be defined. # * A proxy listener CANNOT be used in a virtual server section. # * You should probably set "port = 0". # * Any "clients" configuration will be ignored. You can't define two IPs on which to proxy. You need two proxy servers for that: proxy1 gets requests from NAS -> if it's for isp1 proxy to 192.168.14.4 from 192.168.14.3 if it's for isp2, proxy to proxy2 (also from 192.168.14.3) proxy2 will have 192.168.24.3 configured as proxy port and proxy to 192.168.24.4 (isp2) You can even have proxy1 and proxy2 on the same machine, one listening on 1812+ ports and other on 1645+ ports. They just can't be the same radiusd process. Ivan Kalik Kalik Informatika ISP

2 1

RE: Freeradius-Users Digest, Vol 49, Issue 95
by Marco De Magistris 21 May '09

21 May '09

Hi Ivan, 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) ____________________________________________________________________________ You say: >>Yes. Proxy server will change NAS-IP-Address from the original NAS >>address into it's own. That is OK. It not works. In my scenario I have two different NAS-IP-Address(a NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). Radius Proxy sees 3 different ip address: - 192.168.1.3: ipaddress client side. - 192.168.14.3: ipaddress for isp1 - 192.168.14.3: ipaddress for isp2 In my opinion the packet (received from Radius Client) is sent towards the default gateway. The following link describes the same scenario: http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org… They introduce proxyip = 10.10.10.10 in proxy.conf. Thanks again. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 15.55 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 95 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: question about windows users (Bartosz Chodzinski) 2. Re: R: Sql Counter reads only the first 4 digits (Alan DeKok) 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) 4. R: R: Sql Counter reads only the first 4 digits (Mauro Iorio - Smart Soft s.r.l.) 5. Re: question about windows users (Bartosz Chodzinski) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 15:23:22 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: Re: question about windows users To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1f06c2db0905200623k5e90f148naaadaf7402c82c16(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" ok I changed it to default proxy_requests = yes $INCLUDE proxy.conf /etc/freeradius/certs/Makefile was #client.crt: client.csr server.crt server.key index.txt serial # openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf is now: client.crt: client.csr ca.pem ca.key index.txt serial openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf changes in client.cnf was: certificate = $dir/server.pem serial = $dir/serial private_key = $dir/server.key commonName = user(a)example.com is now: certificate = $dir/ca.pem serial = $dir/serial private_key = $dir/ca.key commonName = user_certificate now after instalation ca.der and client.p12 in windows everything in certificate stores seams to be ok. there is no exclamation mark on user_certificate, and certification path is ok back to the server: Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=240, length=147 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "user_certificate" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501757365725f6365727469666963617465 Message-Authenticator = 0x0d65a52fd78035c3c828c30d2a2442d9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user_certificate", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 240 to 192.168.5.206 port 1812 EAP-Message = 0x0101001604100c91af03e9cd5c25126407d36f22684a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5a5cfd0b5a4cb20491e5ee122e4a622 Finished request 0. Going to the next request On Wed, May 20, 2009 at 2:39 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >>> The steps you took show that you are NOT following the guide. > >>> Good luck. You clearly are *not* interested in solving the problem. > > > > the guide in radiusd.conf says: > > #The server has proxying turned on by default. If your system is NOT > > # set up to proxy requests to another server, then you can turn proxying > > # off here. This will save a small amount of resources on the server. > > I tried to read carefully with undrestanding, I dont use proxy, my system > > not sending request to another server, so I turned it off. > > You might not want to, but you *are* proxying your requests. You have > created client certificate with predefined data in client.cnf - which is > part of the proxy demonstration setup. So, leave proxy settings alone and > concentrate on doing what you have been advised - changing data in > client.cnf so created client certificate won't have @example.com as part > of the username. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

Version 2.0.4 We use "digest" authentication. It works properly. (with a little problem I will ask in another thread) The essential part of the debug: Thu May 21 09:41:17 2009 : Debug: ++[digest] returns ok Thu May 21 09:41:17 2009 : Auth: Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10) The reply message get at "client 10.14.1.5" but our system expects in the reply the "Session-Timeout". How to insert "Session-Timeout" into the reply message? I've read thoughtfully all parts of the configs where that parameter is mentioned. I've tried many - syntactically good an bad - config line without any success. Have I problem with reading? Ludwig M.

3 2

Interim Accouting
by Ming-Ching Tiew 21 May '09

21 May '09

May I know the common practise of radius accounting, it is common to expect the radius client to provide "interim" accounting, ie it sends accounting info every so many seconds interval before the session is closed ? I just checked Coova chilli, it does it for the clients session based on a configurable interval. But for the administrative account of the NAS itself, it does not do any interim accounting. Please comment. Regards.

4 3

Re: insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

>Post the output of radiusd -X and your user entry. The relevant part of the freeradius output is: ----------------------------------- rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "tequet" Digest-Nonce = "4a1527742cb58a911390a13daeab535c71b92a74" Digest-URI = "sip:" Digest-Method = "INVITE" Digest-CNonce = "1242900340" Digest-Nonce-Count = "00000001" Digest-QOP = "auth" Digest-User-Name = "user8" A1 = user8:tequet:pass8 A2 = INVITE:sip: H(A1) = 1a2bb1fd4713741dbc8dcd841b2754c5 H(A2) = 4c2df2005737eb44dbf0c9993285dc46 KD = 1a2bb1fd4713741dbc8dcd841b2754c5:4a1527742cb58a911390a13daeab535c71b92a74:00000001:1242900340:a uth:4c2df2005737eb44dbf0c9993285dc46 EXPECTED 10c0611670df125d841de06019a0ecd7 RECEIVED 10c0611670df125d841de06019a0ecd7 ++[digest] returns ok Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10 ) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 199 to 10.14.1.5 port 40646 Finished request 0. Going to the next request -------------------------------------- The end of the "users" file (its other part is unchanged) --------------------------------------- user0 Cleartext-Password := "pass0" "user8" Cleartext-Password := "pass8" "599(a)10.14.2.10" Cleartext-Password := "pass8" ------------------------------------- Ludwig M.

1 0

Sql Counter reads only the first 4 digits
by Mauro Iorio - Smart Soft s.r.l. 21 May '09

21 May '09

Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

4 11

Realms issues
by EMP 21 May '09

21 May '09

Hi all I have an issue where i'm trying to use realms to determine what LDAP server to authenticate a user against. What seems to happen is that the realm in my users file is never matched and hence the authentication fails. Any help would be greatly appreciated. My users file is - DEFAULT Realm == "NULL", Auth-Type := ldap-default, Autz-Type := ldap-default DEFAULT Realm == "test.com", Auth-Type :=test.com, Autz-Type := test.com DEFAULT Auth-Type := Reject my proxy.conf has the following - realm test.com { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } The radius.conf is - prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = /etc/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run log_file = ${logdir}/radiusd.log pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd libdir = /usr/lib/freeradius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 256 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 1 max_servers = 4 min_spare_servers = 1 max_spare_servers = 3 max_requests_per_server = 0 } modules { pap { #auto_header = yes encryption_scheme = crypt } chap { authtype = CHAP } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes authtype = MS-CHAP # with_ntdomain_hack = yes } files { usersfile = ${confdir}/users compat = no } ### Added ldap test.com { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxx" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ldap ldap-default { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxl" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ### // realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } ### Added Auth-Type test.com { test.com } Auth-Type ldap-default { ldap-default } ### // eap } authorize { chap mschap eap files ### Added Autz-Type test.com { test.com } Autz-Type ldap-default { ldap-default } ### // } post-auth { ldap-default Post-Auth-Type REJECT { ldap-default } } I then see the following - rad_recv: Access-Request packet from host xxx:40485, id=38, length=63 User-Name = "auto(a)test.com" User-Password = "xx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 9 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [auto(a)test.com/xxx] (from client xxx port 0) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 2 modcall[post-auth]: module "ldap-default" returns noop for request 2 modcall: leaving group REJECT (returns noop) for request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list ---

2 1

Re: Interim Accounting
by Ming-Ching Tiew 21 May '09

21 May '09

--- On Thu, 5/21/09, Ivan Kalik <tnt(a)kalik.net> wrote: > > > I just checked Coova chilli, it does it for the > clients session > > based on a configurable interval. But for the > administrative > > account of the NAS itself, it does not do any interim > > accounting. > > Why on Earth would it? Are you going to charge > administrators for using > your equipment? Or do you actually pay them to do that? > I did not say it does not make sense, did I ? I just put forward my observations. :) However, now that you are talking about it, I think it's not totally unreasonable to want to get accounting update on the 'administrator' account. There maybe cases where the accounting need to be done on ensamble basis of the traffic coming in/out of the whole box. Any agreement or objection ? :)

1 0

FreeRADIUS 2.1.6 RPM's for Fedora, RHEL 5, CentOS 5
by John Dennis 20 May '09

20 May '09

The new 2.1.6 FreeRADIUS has been built into a set of RPM's for Fedora, RHEL 5, and CentOS 5. For Fedora the rpm's are in the updates-testing repository for F-9 and F-10. The next release of Fedora is F-11 and is due out shortly, it is currently in the process of being composed for release and is locked preventing updates. F-11 still has the 2.1.3 version, but as soon as F-11 is released and the update channel opens for F-11 I will push a 2.1.6 update for F-11. The updates will likely stay in testing for two weeks, if there are no problems they'll be promoted to stable. Feedback on the Fedora 2.1.6 updates is welcome, this helps determine if the packages can be promoted to stable. Please report your experience with the package at the Fedora updates site: https://admin.fedoraproject.org/updates/search/freeradius Locate the package you installed, click on it, scroll to the bottom and add a comment. As promised current pre-built FreeRADIUS RPM's are now available for download on a tech preview basis, refer to the information here: http://wiki.freeradius.org/Red_Hat_FAQ The download site is: http://people.redhat.com/jdennis/freeradius-rhel-centos -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0