- Freeradius-Users - lists.freeradius.org

Please help me ...thanks in advance
by praveen saxena 05 May '09

05 May '09

Hi , I am a newbie in Radius field. I have a Linux machine which has RHEL WS 4 Update 5 OS loaded. I have installed freeRadius server version 2.1.5. in another machine. I want to authenticate the linux machine login through Radius server. I have tried several ways to configure the linux machine as published in several groups but did not work.Tried through PAM module. If some body can help me out in this matter or point to some good links,will be helpful to me. Best Regards Praveen

2 1

buffered-sql doesn't make sense to me
by Kanwar Ranbir Sandhu 04 May '09

04 May '09

Hi All, I'm trying to set up buffered-sql on my test freeradius server. I've been reading the example config files, but I'm confused because the buffered-sql example seems to be incomplete. The example "buffered-sql" file says to use one virtual server to log to the detail file, and another virtual server to read from it. But, there is no example config file supplied for logging to the detail file. The only example given is the one for reading from it (i.e. the buffered-sql file) How do I configure buffered-sql? Also, decoupled-accounting appears to me to be very similar to buffered-sql. If it's not, how is it different? Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 15:25:10 up 20 days, 15:21, 4 users, load average: 1.09, 1.13, 0.83

2 3

how to change "comp_name\\uid" to JUST uid?
by Burak Sarrafi 04 May '09

04 May '09

Hello, I've a question for completing my job.. I hope any one can help me... I'm using radius auth. at our wireless connections and wanna using windows logon name and password autımatically. But It doesn't work when checked "automatically use my windows logon name and password" section when configuring client pc. Also, when i uncheck and manually typing the my user/pass when connecting same SSID, it's working fine. Here is log for all sentence: *When "automatically use my windows logon name and password" checked:* modcall: entering group authenticate for request 36 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 36 modcall: group authenticate returns invalid for request 36 auth: Failed to validate the user. *Login incorrect *(rlm_ldap: User not found): [*BURAK_S3\\sarrafi*/<no User-Password attribute>] (from client it_netsysnew/10.250.1.3 port 7017 cli 00:1B:9E:2A:A4:13) *When "automatically use my windows logon name and password" unchecked:* modcall: group authorize returns updated for request 46 rad_check_password: Found Auth-Type eap auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 46 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 46 modcall: group authenticate returns ok for request 46 *Login OK*: [*sarrafi*/<no User-Password attribute>] (from client it_netsysnew/10.250.1.3 port 7018 cli 00:1B:9E:2A:A4:13) ---- My computer name is *BURAK_S3 *My user name at ldap: *sarrafi *I wanna to know why my computer name has been sent when clicked *"automatically use my windows logon name and password" ??* Because there is no uid found at ldap like BURAK_S3\\sarrafi and i wanna remove it when search string... Any help?? Thanks from now.... -- Burak Sarrafi <sarrafi(a)sabanciuniv.edu> Network Specialist Sabanci University / IT Dept. Tel:+90-216-4839180 Fax:+90-216-4839186

2 1

Re :checking authorization in the duration of connection
by Eric 03 May '09

03 May '09

NAS sends accounting update packets in periodic times. I want freeradius use this updates and check my online users periodically and send Disconnect packet if user's traffic is above my limit. How can it do this? any document about config ? Eric wrote: Hi, My radius server use ldap server for authorize and authentication.I set an attribute in ldap server that is the check-name in sqlcounter to limit users Input traffic. I want when user traffic reaches to this amount the user become stop but radius checks ldap attributes only at the first of connection not in the middle. How can I set radius server check users traffic with the amount of this attribute in ldap server in the duration of connection? The radius server steps out of the way once authentication and authorization is complete, nor does it have the ability to disconnect a user from a NAS. You need to have the NAS disconnect the user itself when a threshold is reached. This is accomplished by returning a vendor specific attribute specifying the limit for the session which the NAS then maintains. Once the limit on the NAS is reached the NAS terminates the session. You'll have to check your NAS documentation for a traffic limiting parameter. In the other common case of disconnect after a time duration it's handled by computing the session length during authorization and returning attribute 194 with the maximum number of seconds for the connection. This attribute is understood by comon NAS devices and is known variously as Ascend-Maximum-Time, Cisco-Maximum-Time or Lucent-Maximum-Time. You'll need to apply the same logic for data volume.

4 3

RE: rlm_perl DBI problems
by Alexander Kosykh 02 May '09

02 May '09

Hi. Back to my problem with perl Then I comment my own module rejectlog in sites-enable/mysite FR begin to work fine at least 18 hours. Some ideas why it can bring an error in DBI if it's sub function in perl don't use DBI at all? Any other offers how to log reject users in special format? I don't want log rejected user in radius.log file. In my case it for radius system log - not for users. I've try to turn on log only badpassword users but it log all good and bad password users L bug in FR? Thers part of my config log { destination = files file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } radiusd: FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd6.2, built on Apr 10 2009 at 12:18:46

3 3

Cisco Privileges
by Derek Bodner 01 May '09

01 May '09

I'm sure this question has been asked 5,000 times, and I apologize for asking it a 5001st. I'm trying to setup radius to authenticate our switches off of, which is a mixture of cisco catalysts's and force10 s50's. I've tried using the setup described here: http://wiki.freeradius.org/Cisco#Per_User_Privilege_Level I've been trying this: DEFAULT Ldap-Group == "cn=admin,ou=radius,ou=WebAuth,dc=ourgroup,dc=com", Auth-Type := Accept Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" This works as expected on the force10's. Users in this group get dropped into privilege 15. I also have a read only group (cn=readonly,ou=radious), and those users get dropped into privilege 1. however, on the cisco's all users are being dropped into privilege 1, in which case we have to have the enable password as well. Let me know if more info is needed. Any ideas are appreciated. Thanks. -- Derek Bodner subscribedlists(a)derekbodner.com

2 1

Possible bug in rlm_perl
by Josh Hiner 01 May '09

01 May '09

I think I may have found a bug in rlm_perl? I have written script with the aid of another freeradius list member that checks to see if a user is in a certain samba windows group. If they are not in the group (the wireless group) the module rejects the login. The module works perfectly except for those users who's usernames begin with a letter t. For instance ISD\josh will succeed but ISD\\ted will fail. I have done much testing and cant find my script to be the issue. Look below for debug output for the perl module. Notice that right after the ++[files] line I print out the radius items for debugging. Notice the User-Name value is correct going into the perl script. Notice on the exit of the perl script on each debug that the username is correct. Then notice later in each debug where these lines are: Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel) but when the username begins with a "t" it fails here like this: Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via TLS tunnel) Notice only one backslash. I have tried to make it succeed by adding backslashes (for users that start with t) but no success. It will do ISD\\\tbraun and ISD\tbraun but never ISD\\tbraun. Therefore, with users that start with "t" I always get User-name does not match eap identity failure. Thanks for any help. At the very bottom after the debug output you will find my simple perl script that is well commented. -Josh ------- Successful attempt -------- ++[files] returns noop They key is User-Name and the value is ISD\\josh.They key is EAP-Message and the value is 0x020900061a03.They key is EAP-Type and the value is MS-CHAP-V2.They key is State and the value is 0xfeecb38bffe5a965a0ca1cd92ce6c42b.They key is FreeRADIUS-Proxied-To and the value is 127.0.0.1. rlm_perl: Added pair User-Name = ISD\josh rlm_perl: Added pair EAP-Message = 0x020900061a03 rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair State = 0xfeecb38bffe5a965a0ca1cd92ce6c42b rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL ++[perl] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ISD\\josh" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ISD\\josh" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later --------- End snip of successful attempt --------- --------- Failed attempt from user who's username begins with a "t" (tbraun) --------- ++[files] returns noop They key is User-Name and the value is ISD\\tbraun.They key is EAP-Message and the value is 0x0207000f014953445c74627261756e.They key is EAP-Type and the value is Identity.They key is FreeRADIUS-Proxied-To and the value is 127.0.0.1.rlm_perl: Added pair User-Name = ISD\tbraun rlm_perl: Added pair EAP-Message = 0x0207000f014953445c74627261756e rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 ++[perl] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ----------- End of snip of failed attempt ---------------- ----------- Begin paste of perl script ------------------ #!/usr/bin/perl -w use strict; # use ... use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { my $sambagroup = "10007"; #This is the numeric ID of the samba group my $domain = "ISD"; #Testing stuff to print out all radius attributes from hash my $key = ""; my $value = ""; while (($key, $value) = each (%RAD_REQUEST)){ print "They key is $key and the value is $value."; } #End of testing my $auth_user = $RAD_REQUEST{'User-Name'}; #Windows adds host/ to the begining of every machine name during login. #The following block of code cleans off host/ and replaces it with #the login domain and tags a $ at the end for wbinfo group query. if ($auth_user =~ /\bhost\b/ ) { $auth_user =~ s/^host\/// ; $auth_user = "$auth_user\$"; } #Here I add the domain to the beginning of the username if the domain doesnt exist there #already. if ( $auth_user !~ /^\b$domain\b/ ) { $auth_user = "$domain\\\\$auth_user"; } #End of username/machine name cleanup. #The next line is the wbinfo query to see what samba groups the user is a member of. my @resultArray = qx(wbinfo -r $auth_user); my $arraySize = scalar @resultArray; my $groupID = ""; if ($arraySize != 0) { foreach $groupID (@resultArray) { if ($groupID == $sambagroup) { #The below line re-writes the value stored in #the radius user-name attribute in the rad_request #hash. For some reason freeradius feeds in #DOMAIN\\\\username instead of DOMAIN\\username. #This causes the eap module to fail because the #returned value from this module doesnt match the EAP #identity. #this is from testing --> $RAD_REQUEST{'User-Name'} = "ISD\\\\tbraun" #The following line cleans two of the slashes "\\" out of the user-name before we return from the #perl module. These two slashes get added in. I'm not sure how or why. $RAD_REQUEST{'User-Name'} =~ s/^$domain\\/$domain/; #Here I exit the subroutine and tell FreeRadius I updated #some junk. return RLM_MODULE_UPDATED; # return RLM_MODULE_OK; } } } else { #user not in the required group. return RLM_MODULE_REJECT; #YOU have been denied.... } }

5 7

Simultaneous-Use
by Tseveendorj 01 May '09

01 May '09

Hello, I'm back on Simultaneous-Use. I think the problem comes from NAS because NAS-Port gives 0 value in the Access-Request. You can see following log Apr 30 18:17:22.353 GMT: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Apr 30 18:17:22.353 GMT: RADIUS: NAS-Port [5] 6 0 Apr 30 18:17:22.353 GMT: RADIUS: NAS-Port-Id [87] 10 "0/0/0/11" all requests same. How to solve this ? Sincerely, Tseveen

2 1

freeradius upgrade help
by ramesh p 01 May '09

01 May '09

Appreciate if some one can please forward any docs/details about the upgrade from old freeradius version 1.1.6 to 2.1.4 in linux. Thanks, Ramesh.

4 4

Debug log not logging date/time/epoch
by John Horne 30 Apr '09

30 Apr '09

Hello, Not sure if this is a simple request or not. I am currently running FreeRadius 2.0.5 in debug mode ('-X') and recording all the output into a log file. The problem is the debug output seems to show no indication of the date/time (or epoch time) at all. I'm trying to track down a local problem, and have users telling me when the problem occurs, but without the date/time being logged I am not getting too far. Is it possible to get FR to log the date/time or epoch time when using '-X'? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 587001

2 2