- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 49, Issue 93
by Ivan Kalik 20 May '09

20 May '09

> >>What does that mean? IP of the original NAS packet? > > I have 2 interfaces towards the network. > > ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) > ____________________________________________________________________________ > > Steps: > 1)Radius Client ---> Send packet with NAS-IP-Address = 192.168.1.2 > towards Radius Proxy. > 2)Radius Proxy changes NAS-IP-Address with 192.168.14.3 for IPS1(or > 192.168.24.3 for IPS2) and sends it. > > > You say that changing NAS-IP-Address the packet is transmitted correctly. > Right? > > From 192.168.14.3 to IPS1(192.168.14.4) if NAS-IP-Address = > 192.168.14.3 > From 192.168.24.3 to IPS1(192.168.24.4) if NAS-IP-Address = > 192.168.24.3 > Yes. Proxy server will change NAS-IP-Address from the original NAS address into it's own. That is OK. >> That's in internal attribute Packet-Src-IP-Address. > > Should I modify this attribute or FreeRadius associates > Packet-Src-IP-Address = NAS-IP-Address. No, Packet-Src-IP-Address has the originating IP address for the radius packet (in your case it will be 192.168.1.2). If ISP needs to know the original NAS IP they should look in Packet-Src-IP-Address. Ivan Kalik Kalik Informatika ISP

1 0

question about windows users
by Bartosz Chodzinski 20 May '09

20 May '09

Hi, I have freeradius with eap support on debian etch, radius v1.1.3 "everthing" working fine but I'd like to have much more simple configuration only by certificate and nothing more, so I have few question: 1. fragment of my log first, before question Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206:1812, id=182, length=159 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "PC-01\\Administrator" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001b014e4c504c2d4943455c41646d696e6973747261746f72 Message-Authenticator = 0xe0b4e2966553f890137d9e56bebd0b3d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "PC-01\Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 my users file contain: "PC-01\\Administrator" User-Password == "passwd" how can I avoid this value PC-01 ?, its really annoying, I would like to have only real user, PC-01 is "my computer -> properties -> computer name -> full computer name". I would like to have only username (with no matter of case sensitive). sth like "administrator" User-Password == "passwd" 2. I would like to use only certificate to check wheter or not some computer should have network connection, I dont care about login or password, if client has a valid cacert.pem installed on pc (windows xp) it should grant acces to network, is it possible to do that? I tried do sth like: users: DEFAULT Auth-Type := Accept but it didn't work the perfect way for me is possiblity to set up something in radiusd.conf and live file users empty 3. when I read log from freeradius -X I see that one pc need to have 7requests in freeradius and in 8-th request is accepted, is it ok? modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 193 to 192.168.5.206 port 1812 MS-MPPE-Recv-Key = 0xc349694508a365a56e56e085069e36270cb13b60c3cc7847129b2386a7062dde MS-MPPE-Send-Key = 0xf93f6de4f455056df7f1d88aa3d12a26cd1a71994fdf6c31bb726612eaf2f038 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "PC-01\\Administrator" Finished request 8 ----------------------------------------------- my configuration files: eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/freeradius/eap/newkey.pem certificate_file = /etc/freeradius/eap/newcert.pem CA_file = /etc/freeradius/eap/eapCA/cacert.pem dh_file = /etc/freeradius/eap/dh random_file = /etc/freeradius/eap/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

4 43

RE: Freeradius-Users Digest, Vol 49, Issue 93
by Marco De Magistris 20 May '09

20 May '09

>What does that mean? IP of the original NAS packet? I have 2 interfaces towards the network. ____________________________________________________________________________ Radius Client --> Radius Proxy 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) 192.168.24.3 --> IPS2(192.168.24.4) ____________________________________________________________________________ Steps: 1)Radius Client ---> Send packet with NAS-IP-Address = 192.168.1.2 towards Radius Proxy. 2)Radius Proxy changes NAS-IP-Address with 192.168.14.3 for IPS1(or 192.168.24.3 for IPS2) and sends it. You say that changing NAS-IP-Address the packet is transmitted correctly. Right? From 192.168.14.3 to IPS1(192.168.14.4) if NAS-IP-Address = 192.168.14.3 From 192.168.24.3 to IPS1(192.168.24.4) if NAS-IP-Address = 192.168.24.3 > That's in internal attribute Packet-Src-IP-Address. Should I modify this attribute or FreeRadius associates Packet-Src-IP-Address = NAS-IP-Address. Thanks again Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 14.12 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 93 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Freeradius-Users Digest, Vol 49, Issue 89 (Ivan Kalik) 2. Re: Long attribute name (Alan DeKok) 3. Sql Counter reads only the first 4 digits (Mauro Iorio - Smart Soft s.r.l.) 4. Re: question about windows users (Bartosz Chodzinski) 5. Re: Sql Counter reads only the first 4 digits (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 12:44:28 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Freeradius-Users Digest, Vol 49, Issue 89 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <41583.194.176.105.44.1242819868.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > The problem is the following: > > The customers ask me if possible send them the packets from an > interface defined. What does that mean? IP of the original NAS packet? That's in internal attribute Packet-Src-IP-Address. > My Radius proxy listen on an IP address (i.e. 192.168.1.3) for > authentication packet and forwarding them towards two different networks > (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 2 Date: Wed, 20 May 2009 13:50:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Long attribute name To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13EE8B.1000301(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ming-Ching Tiew wrote: > > I know it's almost trivial to go an alter the table column size, but for users convenience, the sql attribute length should be increased. Currently the schema.sql which comes with the distribution is varchar(32). One of the motorola wimax attributes is 39 characters, Motorola-WiMAX-Maximum-Commit-Bandwidth. And I notice the mysql silently truncate the inserted string. That's reasonable. Alan DeKok. ------------------------------ Message: 3 Date: Wed, 20 May 2009 13:58:32 +0200 From: "Mauro Iorio - Smart Soft s.r.l." <m.iorio(a)smartsoft.it> Subject: Sql Counter reads only the first 4 digits To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <370DA20735BC482C80A4249BF39468B5@zuccherino> Content-Type: text/plain; charset="us-ascii" Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

1 0

OTP PAM FreeRadius module supporting challenge-respons
by Jayal1972 20 May '09

20 May '09

Hi all! Do anyone know about a FreeRadius module supporting OTP PAM challenge-respons. I know about the OTP module in FreeRadius but it´s supporting a built in database. I have configured Freeradius to use the PAM module and OTP software is supporting PAM as well. But it is using a challenge-respons mechanism so the message i.e. "Enter OTP Password" is not reaching the user (after the username have been confirmed). The FreeRadius is then sending the authentication details "username/password" again and the OTP software is only seeing the "username" part of the "username/password". Do anyone had a similar issue? Sincerely Joakim -- View this message in context: http://www.nabble.com/OTP-PAM-FreeRadius-module-supporting-challenge-respon… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Long attribute name
by Ming-Ching Tiew 20 May '09

20 May '09

I know it's almost trivial to go an alter the table column size, but for users convenience, the sql attribute length should be increased. Currently the schema.sql which comes with the distribution is varchar(32). One of the motorola wimax attributes is 39 characters, Motorola-WiMAX-Maximum-Commit-Bandwidth. And I notice the mysql silently truncate the inserted string. Regards.

2 1

RE: Freeradius-Users Digest, Vol 49, Issue 89
by Ivan Kalik 20 May '09

20 May '09

> The problem is the following: > > The customers ask me if possible send them the packets from an > interface defined. What does that mean? IP of the original NAS packet? That's in internal attribute Packet-Src-IP-Address. > My Radius proxy listen on an IP address (i.e. 192.168.1.3) for > authentication packet and forwarding them towards two different networks > (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Ivan Kalik Kalik Informatika ISP

1 0

(no subject)
by Mauro Iorio - Smart Soft s.r.l. 20 May '09

20 May '09

Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

1 0

Common error on sql_counter on Ver 2.1.5
by Mauro Iorio - Smart Soft s.r.l. 20 May '09

20 May '09

Hi all, I recently installed freeradius Ver. 2.1.5 and I'm trying to configure it to work as a previous installation of Ver. 1.1.x. I'm stuck at sql counter module. On 1.1.x I use the common sessioncounter counter with sql module, but with 2.1.5 I got the message "rlm_sqlcounter: Could not find Check item value pair". I believe the configurations are indentical for both versions of freeradius, but I'm obviously missing something. Can someone help me to find where can be the error? I think it's a trivial one, but I'm stuck since 3 days. Thank You for interest. Mauro Iorio

3 8

RE: Freeradius-Users Digest, Vol 49, Issue 89
by Marco De Magistris 20 May '09

20 May '09

Hi Ivan, > 4. RE: Freeradius-Users Digest, Vol 49, Issue 87 (Ivan Kalik) >And how will you know to which ISP does the user belong to? Normally they >enter names like user@ISP1 and user@ISP2. That way you know to which home >server to proxy to. The ISP is identified using @ISP1 in User-Name attribute. The problem is the following: The customers ask me if possible send them the packets from an interface defined. My Radius proxy listen on an IP address (i.e. 192.168.1.3) for authentication packet and forwarding them towards two different networks (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Thanks Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 12.00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 89 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Dynamic clients and NAS-Identifier (Alan DeKok) 2. Re: question about windows users (Ivan Kalik) 3. Re: Is it possible to share bandwidth or maximum downloaded bytes (Ivan Kalik) 4. RE: Freeradius-Users Digest, Vol 49, Issue 87 (Ivan Kalik) 5. Freeradius LDAP weird login issue (cktan) 6. RE: Dynamic clients and NAS-Identifier (Santiago Balaguer Garc?a) 7. Re: Dynamic clients and NAS-Identifier (Ivan Kalik) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 11:04:52 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Dynamic clients and NAS-Identifier To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13C7B4.2070803(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Johan Meiring wrote: > I realise, i've asked for the before, and it is on your todo list, but > I'd like to make a case again for maybe getting it moved up higher onto > the list. My "to do" list right now is: - consulting work (my *only* source of income is FreeRADIUS) - 3 IETF documents that I'm author / co-author - White paper for a linux conference > The current "clients" structure identify the NAS's by ip address. > While this is perfect for corporate environments, it is not so perfect > for the hotspot environment in which we operate. RADIUS was never designed to work that way. It's insecure. One of the documents I'm writing involves leveraging SSL to allow that capability. But implementations are a long ways out. > We need to somehow authenticate the nas, so someone can not send "rough" > accounting info to radius. You could always write a simple RADIUS proxy that did those checks. It likely could be done in ~200-300 lines of Perl. > I'm sure that I'm not the only one that have NAS's behind dynamic IPs, > and this would make radius traffic from such NAS's much more secure. Maybe... Alan DeKok. ------------------------------ Message: 2 Date: Wed, 20 May 2009 10:38:45 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: question about windows users To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <30072.194.176.105.43.1242812325.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > could you give me good freeradius guide for dummies - I think I need it :) > Guide: don't make any changes to the default configuration unless you know what you are doing. That's it. Server is configured by default to handle EAP-TLS. There is nothing that you need to do to make it happen. Now, about your problem: freeradius uses fake realm example.com - for examples. Of proxying, fail-over home servers, use of vitual servers etc. Why are *you* using it as well? These examples are not what you want to do. Use your own domain. For EAP-TLS - no modification needed. I have seen you going on about PEAP as well. If those users are also using format user@your_domain, then create local realm your_domain - it won't interfere with EAP-TLS and will create Stripped-User-Name that can be used for authentication. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Wed, 20 May 2009 10:43:21 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Is it possible to share bandwidth or maximum downloaded bytes To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <10246.194.176.105.43.1242812601.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > I have 3 users and I want to give them 1Mbps/256Kbps bandwidth. They must > not have this bandwidth individually but must share it. Is it possible to > do > with freeRADIUS. If so can you help me on what I have to do. No, radius can't do that. But you can fix their IPs or make them a small pool and then limit that IP range as a bundle on your router. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Wed, 20 May 2009 10:47:08 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Freeradius-Users Digest, Vol 49, Issue 87 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <47671.194.176.105.43.1242812828.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Hi Alan, > > > >> 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > >> to 192.168.1.3) > >> 2. Radius proxy listen on 192.168.1.3 for authentication packet and > >> forwarding them towards two different network (192.168.14.4 and > >> 192.168.24.4) > > > > 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. > > 192.168.14.4: Radius Server for IPS 1. > > 192.168.24.4: Radius Server for IPS 2. > > > > I need send the packets towards ISP1 using VLAN1 and towards ISP2 using > VLAN2. > And how will you know to which ISP does the user belong to? Normally they enter names like user@ISP1 and user@ISP2. That way you know to which home server to proxy to. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 5 Date: Wed, 20 May 2009 17:48:52 +0800 From: cktan <cktan(a)ocesb.com.my> Subject: Freeradius LDAP weird login issue To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13D204.1080706(a)ocesb.com.my> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Hi all, I'm using freeradius+LDAP for the PPPoE dialup access control for a while. Lately I noticed there is weird issue whereby an user login with username as "user=5C=5C=5C=5Cuser@domain" and surprisingly freeradius allow it to login although the actual username should be "user@domain". I've run radius in -X mode and capture the log for your reference as below. In radiusd -X, we noticed server received Access-Request with username "user=5C=5C=5C=5Cuser@domain" but when reach to radius_xlat, the uid will become "user" only and when it query my LDAP the account for "user" is available and it will accept the access request. The question is why "user=5C=5C=5C=5Cuser" = "user"? We try the username with xC (i.e. 1C, 2C, 3C and so on...) and all are able to login because radius will take as user@domain. After login, the username in radacct will become "user=5C=5C=5C=5Cuser@domain" instead of "user@domain". As the consequence, the smart user may have multiple logins (by using user=1C/2C/3C....) and the records in radacct is different and therefore we will out of control for multiple login with single account. Any idea to fix this? rad_recv: Access-Request packet from host 127.0.0.1:32877, id=87, length=93 User-Name = *"user=5C=5C=5C=5Cuser@domain"* User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: performing user authorization for *user=5c=5c=5c=5cuser* radius_xlat: * '(uid=user)'* Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Dynamic clients and NAS-Identifier
by Johan Meiring 20 May '09

20 May '09

Hi Alan, I realise, i've asked for the before, and it is on your todo list, but I'd like to make a case again for maybe getting it moved up higher onto the list. The current "clients" structure identify the NAS's by ip address. While this is perfect for corporate environments, it is not so perfect for the hotspot environment in which we operate. We have a central radius server for many different hotspot owners. Hotspots are running chillispot. We need to somehow authenticate the nas, so someone can not send "rough" accounting info to radius. The only way to currently identify a NAS is by IP address. You can then lookup the NAS, and create a "radius secret" based on the IP address. This is done using the dynamic_clients virtual server. The problem is that the hotspots can be anywhere. They are mostly behind ADSL lines. The source ip address of the radius packet is therefore not predictable. The only other way I can thing of is identifying the nas by the NAS-Identifier. To sum up. Currently a nas is "authenticated" by ip address/radius secret. I feel that being able to "authenticate" a nas by nas identifier/radius secret is a very good enhancement. I'm sure that I'm not the only one that have NAS's behind dynamic IPs, and this would make radius traffic from such NAS's much more secure. I'm prepared to do it myself, but by c skills really suck. I can only do "copy and paste" type editing. I've spent a few hours looking at the code, and it seems that (in listen.c) you need to create the "value pairs" somehow before sending the packet to module_authorize, but I have no clue how to even attempt this. I'm fully prepared to try and contribute somehow, but this is way out of my league. Anyway, end of long story. I simply hope to get this maybe moved a bit higher up on the todo list. Thanks!!! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

4 4