- Freeradius-Users - lists.freeradius.org

radius help
by jon jon 14 May '09

14 May '09

I have am using slackware 12.1 and installed freeradius version 2.1.5. I have read the Install and the Readme me file. I am trying the radtest program out and I start the radius server in debugging mode in one virtual screen and do a "radtest test test localhost 0 testing123" from another virtual screen, I get a access reject of my packets. So the good thing is that my radius server is receiving the packets. Now I move on to see if I create a user called bob in the users file. I put this at the top of the file: bob Cleartext-Password := "hello" and run radtest again using "radtest bob hello localhost 0 testing123" and still get access reject message. So I know that my server is up and running, but the user is being rejected because of the password not matching, right?

3 4

help on OpenSUSE installation
by mx5450 14 May '09

14 May '09

Team, I'm trying to set up freeradius 2.1.4 in a AMD 64 X2 system with an OpenSUSE 11.1 (x86_64.iso) OS. I must tell you that I'm new to Linux and Freeradius. According to the instructions on freeradius.org/radiusd/install I can either: 1. Get a pre-installed binary package (Peter Nixon) 2. get the FreeRADIUS tarball When I try to get the binary package (http://download.opensuse.org/repositories/network:/aaa/openSUSE_11.1/) I get a list of files/folders which I dont know what to do with them: i586/ network:aaa.repo repodata/ src/ x86_64/ As I got stuck, I tried to "build it" (? new term to me), by placing the tarball in usr/src/packages/SOURCES; extracting the freeradius.spec and placing it in usr/src/packages/SPECS. Then I run from the terminal prompt: rpmbuild -ba usr/src/packages/SPECS/ freeradius.spec However I got the message: marcos@win-219e0010bba:~> rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: db-devel is needed by freeradius-server-2.1.4-0.x86_64 e2fsprogs-devel is needed by freeradius-server-2.1.4-0.x86_64 gcc-c++ is needed by freeradius-server-2.1.4-0.x86_64 gdbm-devel is needed by freeradius-server-2.1.4-0.x86_64 gettext-devel is needed by freeradius-server-2.1.4-0.x86_64 glibc-devel is needed by freeradius-server-2.1.4-0.x86_64 libtool is needed by freeradius-server-2.1.4-0.x86_64 ncurses-devel is needed by freeradius-server-2.1.4-0.x86_64 openldap2-devel is needed by freeradius-server-2.1.4-0.x86_64 openssl-devel is needed by freeradius-server-2.1.4-0.x86_64 pam-devel is needed by freeradius-server-2.1.4-0.x86_64 postgresql-devel is needed by freeradius-server-2.1.4-0.x86_64 python-devel is needed by freeradius-server-2.1.4-0.x86_64 unixODBC-devel is needed by freeradius-server-2.1.4-0.x86_64 zlib-devel is needed by freeradius-server-2.1.4-0.x86_64 apache2-devel is needed by freeradius-server-2.1.4-0.x86_64 cyrus-sasl-devel is needed by freeradius-server-2.1.4-0.x86_64 krb5-devel is needed by freeradius-server-2.1.4-0.x86_64 libapr1-devel is needed by freeradius-server-2.1.4-0.x86_64 libmysqlclient-devel is needed by freeradius-server-2.1.4-0.x86_64 marcos@win-219e0010bba:~> I read about this and regarding the dependencies it seems that some "features" are not installed and that I need the OpenSUSE disk to load them from the YAST. However I can not seem to find what the "sh: apxs2-prefork: command not found" message is about or how to fix that. I'm stuck again. Could you help with this? Thanks in advance

3 2

FreeRADIUS Active Directory Integration
by Davies, Mike 14 May '09

14 May '09

We're not able to get the user authenticated. [root@u701radius02 raddb]# wbinfo -a dw68406a%garrett05 plaintext password authentication succeeded challenge/response password authentication succeeded [root@u701radius02 raddb]# ntlm_auth --request-nt-key --domain=dom002 --username=dw68406a --password=garrett05 NT_STATUS_OK: Success (0x0) [root@u701radius02 raddb]# radiusd -X FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 172.18.134.248 { require_message_authenticator = no secret = "testing123" shortname = "172.18.134.248" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOM002 --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 172.18.134.36 port = 0 } listen { type = "acct" ipaddr = 172.18.134.36 port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address 172.18.134.36 port 1812 Listening on accounting address 172.18.134.36 port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address 172.18.134.36 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.18.134.248 port 1025, id=216, length=227 Framed-MTU = 1466 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "Puyallup_5412a" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 9 NAS-Port-Type = Ethernet NAS-Port-Id = "A9" Called-Station-Id = "00-1f-28-39-c5-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" EAP-Message = 0x0201001401444f4d3030325c4457363834303641 Message-Authenticator = 0xb3953b3cb40087233b51cc35bde7b183 +- entering group authorize {...} ++[preprocess] returns ok [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=DW68406A [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> DOM002\DW68406A attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 216 to 172.18.134.248 port 1025 Waking up in 4.9 seconds. Cleaning up request 0 ID 216 with timestamp +20 Ready to process requests. ^C [root@u701radius02 raddb]# Thanks, Mike Davies Network Engineer Fred Meyer 503-797-7753 ________________________________ This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 3

Proposed release of 2.1.6
by Alan DeKok 14 May '09

14 May '09

We plan on releasing 2.1.6 this week. Please test the pre release at: http://git.freeradius.org/pre/ If there are any concerns, problems, errors, etc., please let us know before we release the final version. Alan DeKok.

7 22

update disconnect
by Ming-Ching Tiew 14 May '09

14 May '09

I am trying to get the 'update disconnect' to work putting this into the preacct section :- --------------------------------------------------------- if ( "%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) { update disconnect { Reply-Message = "You have been disconnected by the administrator!" } #%{exec:/usr/local/dialup_admin/bin/disconnect.sh %{User-Name} %{Acct-Session-Id} %{NAS-IP-Address} %{Packet-Src-Port} } "%{sql:DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" } --------------------------cut---------------------------- The update disconnect did not work but the (commented) exec using a script based on radclient works, What's wrong ? Though the exec method works but I have to open up the port, which means the firewall thinks that's a separate connection, which is lousy. The update disconnect did not work but the (commented) exec using a script based on radclient works, What's wrong ? Though the exec method works but I have to open up the port, which means the firewall thinks that's a separate connection, which is lousy. Secondly, the sql DELETE, seems to be executed twice, here is the log :- ----------------------------cut------------------------------------ expand: %{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'} -> 1 ? Evaluating ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) -> TRUE ++? if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) -> TRUE ++- entering if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) {...} +++[disconnect] returns noop sql_xlat expand: %{User-Name} -> test1 sql_set_user escaped user --> 'test1' expand: DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now' -> DELETE FROM radcheck WHERE UserName = 'test1' and attribute = 'Acct-Logout-Now' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): failed after re-connect SQL query did not succeed rlm_sql (sql): Released sql socket id: 3 expand: %{sql:DELETE FROM radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'} -> +++[expand] returns noop ++- if ("%{sql:SELECT value from radcheck WHERE UserName = '%{User-Name}' and attribute = 'Acct-Logout-Now'}" ) returns noop ---------------------------cut-------------------------------------- If I understand the log correctly, the second sql access is displayed first, that's why there is a failure, whereas the first sql access is displayed later, but it's a noop. Any comments ?

2 1

Building rlm_sql_oracle
by Maxim Denisov 14 May '09

14 May '09

Hi! Has enybody successfully built freeradius 2.1.4 with instant client? I have installed oracle instant client basic 10.2.0.4 + sqlplus + sdk for linux x86_64, everything from rpm. I can successfully connect with sqlplus64, paths are correct but when I execute configure in rlm_sql_oracle I am getting checking for oracle_init in -loracleclient... no configure: WARNING: oracle libraries not found. Use --with-oracle-lib-dir=<path>. I've unsuccessfully tried to specify correct paths in --with-oracle-lib-dir, $CFLAGS and $LDFLAGS but can't find whare oracle_init() located. Can anybody say where this function located? I have the folliwing rpms installed: [root@truba rlm_sql_oracle]# rpm -qa | grep oracle oracle-instantclient-sqlplus-10.2.0.4-1 oracle-instantclient-basic-10.2.0.4-1 oracle-logos-1.1.1-3 oracle-instantclient-odbc-10.2.0.4-1 oracle-instantclient-devel-10.2.0.4-1 glade2-2.6.0-1.oracle Should I install anything else? - Regards, Maxim S. Denisov IP Studio, Inc.

3 6

undefined symbol: sql_get_socket
by Цэвээндорж ЖиМэйл 14 May '09

14 May '09

Hello, Today I've changed my OS and install FreeRADIUS 1.1.7. I got following error when I enabled sqlippool. Freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool.so: undefined symbol: sql_get_socket How do I do ? Sincerely, Tseveendorj

3 2

Log IP of RADIUS to database
by Sebastian Heil 14 May '09

14 May '09

Hello, is there an easy way to log the ip of the radius-server together with the accounting and radpostauth queries to the database. Of course it would be necessary to extend the database schema (should be now problem), but which internal variable or variable out of request can be used to be written in the database? Thanks. kind regards Sebastian -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dslspecial.gmx.de/freedsl-surfflat/?ac=OM.AD.PD003K11308T4569a

3 2

PEAP - Intermediate CA
by CJ O 14 May '09

14 May '09

Good Afternoon - I am having an issue where FreeRadius is not handing the intermediate CA to a windows WPA2 client. We are in the process of deploying WPA2/AES with PEAP. So we purchased a certificate from a company that has a Trusted Root CA in Windows, Mac OSX, and Linux. However, it was signed with there intermediate CA, so the OS will not vailded the certificate during authentication. The only solution seems to be installing the intermediate CA certifcate on all my clients (2,000-3,000). If it possible to chain the certificates together like you can in Apache? Thanks CJ

4 4

Need Log For Acces Request, access Accept and Access Reject
by Sanhenra Sinaga 14 May '09

14 May '09

Dear all, As the subject, i need the log that i said in the subject. Help me please...! ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Thursday, 14 May, 2009 5:33:33 PM GMT +07:00 Bangkok, Hanoi, Jakarta Subject: Freeradius-Users Digest, Vol 49, Issue 53 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Release 2.1.6 will be on Monday (Alan DeKok) 2. Re: rlm_perl to authenticate against data in ldap (Ivan Kalik) 3. question about windows users (Bartosz Chodzinski) ---------------------------------------------------------------------- Message: 1 Date: Thu, 14 May 2009 12:12:57 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Release 2.1.6 will be on Monday To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BEEA9.8000209(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Unless any last-minute panics come up. The release candidate is available on: http://git.freeradius.org/pre/ If there are no other comments, that "tar" file will become the official 2.1.6 release. Alan DeKok. ------------------------------ Message: 2 Date: Thu, 14 May 2009 11:33:05 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: rlm_perl to authenticate against data in ldap To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <61037.194.176.105.43.1242297185.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > I browsed the mailing list for possible solutions to the problem I have > but unfortunately I didn't find any (or something I missed I dunno) > > We have this Cisco ISG 7301 router that we are using that are passing the > Remote-ID av pair as its User-Name (just a copy not that it matters) > Now, the remote ID format is ascii in format but hexadecimal in meaning > 0000079d010100660000000000000000000050544e55544147303033000705000064 > > We would only want to authenticate the part after the 20 zeroes > "50544e55544147303033000705000064". By the way the length before this > substring is always fixed (18 bytes) so we only want the part after 18 > bytes. > > is it possible to parse this string in perl then passing the result string > to ldap for authentication? Yes, it will be passed as $RAD_REQUEST{'User-Name'}. Rewrite the username to what you think it should be in perl. Just list perl before ldap in authorize. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Thu, 14 May 2009 12:33:24 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: question about windows users To: Freeradius-Users(a)lists.freeradius.org Message-ID: <1f06c2db0905140333od4725cap9991b8a752510a46(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I have freeradius with eap support on debian etch, radius v1.1.3 "everthing" working fine but I'd like to have much more simple configuration only by certificate and nothing more, so I have few question: 1. fragment of my log first, before question Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206:1812, id=182, length=159 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "PC-01\\Administrator" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001b014e4c504c2d4943455c41646d696e6973747261746f72 Message-Authenticator = 0xe0b4e2966553f890137d9e56bebd0b3d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "PC-01\Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 my users file contain: "PC-01\\Administrator" User-Password == "passwd" how can I avoid this value PC-01 ?, its really annoying, I would like to have only real user, PC-01 is "my computer -> properties -> computer name -> full computer name". I would like to have only username (with no matter of case sensitive). sth like "administrator" User-Password == "passwd" 2. I would like to use only certificate to check wheter or not some computer should have network connection, I dont care about login or password, if client has a valid cacert.pem installed on pc (windows xp) it should grant acces to network, is it possible to do that? I tried do sth like: users: DEFAULT Auth-Type := Accept but it didn't work the perfect way for me is possiblity to set up something in radiusd.conf and live file users empty 3. when I read log from freeradius -X I see that one pc need to have 7requests in freeradius and in 8-th request is accepted, is it ok? modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 193 to 192.168.5.206 port 1812 MS-MPPE-Recv-Key = 0xc349694508a365a56e56e085069e36270cb13b60c3cc7847129b2386a7062dde MS-MPPE-Send-Key = 0xf93f6de4f455056df7f1d88aa3d12a26cd1a71994fdf6c31bb726612eaf2f038 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "PC-01\\Administrator" Finished request 8 ----------------------------------------------- my configuration files: eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/freeradius/eap/newkey.pem certificate_file = /etc/freeradius/eap/newcert.pem CA_file = /etc/freeradius/eap/eapCA/cacert.pem dh_file = /etc/freeradius/eap/dh random_file = /etc/freeradius/eap/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 1