- Freeradius-Users - lists.freeradius.org

want to change one module in freeradius
by new conf 29 Apr '09

29 Apr '09

Dear all; If I have to change the module in FreeRadius that uses EAP-TLS to communicate with clients(to use it with other way then openSSL (ssl will generate keys and certficate seperately in another form) ).. the function I have to delete or change is-it *rlm_eap.c* ? thank you for help :)

1 0

radiusd only sending a NAK after a retransmission
by Jeremy M. Guthrie 29 Apr '09

29 Apr '09

We are having an issue with failed logins with FreeRADIUS. The problem is that FreeRADIUS doesn't appear to actually send a RADIUS Reject until the second authentication request comes in. I have an IOS Router authenticating ssh logins against freeradius. The example packets above I am using a static username/password in the users file. I see that if I enter the wrong password, radiusd doesn't send a NAK until the IOS router transmits the request. There are not any delay issues with ACKs coming out of freeradius. TCP Dump output: 10:38:22.703456 IP 172.16.1.8.1645 > 172.16.2.60.1645: RADIUS, Access Request (1), id: 0xf1 length: 103 10:38:38.008371 IP 172.16.1.8.1645 > 172.16.2.60.1645: RADIUS, Access Request (1), id: 0xf1 length: 103 10:38:38.008588 IP 172.16.2.60.1645 > 172.16.1.8.1645: RADIUS, Access Reject (3), id: 0xf1 length: 20 Does this sound familiar to anyone? Ideas? -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)cdw.com Hosting and Managed Services Managed Cisco Security Services Technical Architect Phone: 608-298-1061 CDW Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711 NOC Email: hmshelp(a)cdw.com

2 3

Looking for client configurations for dynamic client
by Fabián Omar Franzotti 29 Apr '09

29 Apr '09

Hi guys I'm running Debian lenny... in production server I have installed freeradius 1.x and in client.conf i have seted client 0.0.0.0/0 { secret = mySecret shortname = everyone } In Debian lenny is available freeradius 2.0.4 in this version that setting for client is not available. Some time ago Alan told me that use 2.0.5 version to this settings, I did try to build a .pkg to install in my server but never can done it, because i did have some errors and my knowledge are not enought. Well I want to know if some one can tell me how i can have clients that don't have static IP's if I don't allow access to every world, because nas database is loaded only at startup time. I think i can use dynDNS or something like that, so I can declare the host.name and not IP address, but I want to know if exists some way to handle this case. Ah the clientes can be added by it self with a register page. Any Idea? Thanks guys... ----- Fabián Omar Franzotti Resistencia - Chaco - Argentina Tel Arg.: 54-(372)-243-8710 / 54-(372)-257-0347 USA Phone: 1-(321)-284-3865

3 2

Vendor Specified Attribute
by Tseveendorj 29 Apr '09

29 Apr '09

Hello, Can I put one attribute in database like following 256Kbps Cisco-AVPair := ip:sub-policy-Out=256Kbps 256Kbps Cisco-AVPair := ip:sub-policy-In=256Kbps If not. How do I define bandwidth shape both in and out ? Sincerely, Tseveen

2 2

freeradius upgrade help
by ramesh p 29 Apr '09

29 Apr '09

I'm currently using freeradius version 1.1.6, planning to upgrdate to a stable version. Please suggest a version which is stable. My radius box running linux. Thanks in advance. Regards, Rams.

2 1

groupcmp fails during tunneled request
by Matthieu Lazaro 28 Apr '09

28 Apr '09

Hello list, I'm having an issue with the group check (ldap_groupcmp). Everything is fine until the request is tunnelled, and I can't find out why my user is rejected there.... It seems that he ends in this section during this phase: DEFAULT Ldap-Group == BANNED , Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." Even if he has the correct group in the LDAP. This was working on my test bed. The configuration seems to be the same, the only change is the NAS type ( I have tested that on HP switches, and now it's using a Cisco Wireless controller). It was working perfectly before I introduced the group check using the huntgroups. I'm using version 2.1.1 of freeradius on an Debian etch box. Here is the part of the debug where it fails. Sending tunneled request EAP-Message = 0x020f000b01676269676f74 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "alicebob" Calling-Station-Id = "00-13-02-25-FF-40" Called-Station-Id = "00-1E-13-1D-85-70:WiFi-TEST" NAS-Port = 1 NAS-IP-Address = 192.168.226.8 NAS-Identifier = "accessPoint-Manager" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "502" server inner-tunnel { Tue Apr 28 11:42:35 2009 : Info: +- entering group authorize {...} Tue Apr 28 11:42:35 2009 : Info: ++[mschap] returns noop Tue Apr 28 11:42:35 2009 : Info: [suffix] No '@' in User-Name = "alicebob", looking up realm NULL Tue Apr 28 11:42:35 2009 : Info: [suffix] No such realm "NULL" Tue Apr 28 11:42:35 2009 : Info: ++[suffix] returns noop Tue Apr 28 11:42:35 2009 : Info: [eap] EAP packet type response id 15 length 11 Tue Apr 28 11:42:35 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Apr 28 11:42:35 2009 : Info: ++[eap] returns updated Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: Entering ldap_groupcmp() Tue Apr 28 11:42:35 2009 : Info: [files] expand: dc=companyname,dc=com -> dc=companyname,dc=com Tue Apr 28 11:42:35 2009 : Info: [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Tue Apr 28 11:42:35 2009 : Info: [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=alicebob) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in dc=companyname,dc=com, with filter (uid=alicebob) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in dc=companyname,dc=com, with filter (&(radiusGroupName=BANNED)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: object not found or got ambiguous search result Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in uid=alicebob,ou=people,dc=companyname,dc=com, with filter (objectclass=*) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap::groupcmp: Group BANNED not found or user not a member Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Info: [files] users: Matched entry DEFAULT at line 15 Tue Apr 28 11:42:35 2009 : Info: ++[files] returns ok Tell me if you need more debug output... Best regards, Matt

2 2

cange username in mysql auth
by Trujillo Carmona, Antonio 28 Apr '09

28 Apr '09

Hello and thank for all your work. Right now I'm try to use freeradius to validate access to our net throw a MAC auth. Our problem is that we have a inventory (in mysql) of printers with a field named MACADDR and we want check this field in order to grant access to the printers. How can we change the the sql query to check "MACADDR" instead of "username"? -- Por favor, NO utilice formatos de archivo propietarios para el intercambio de documentos, como DOC y XLS, sino HTML, RTF, TXT, CSV o cualquier otro que no obligue a utilizar un programa de un fabricante concreto para tratar la información contenida en él. SALUD.

2 1

problems with some libraires
by Ernesto Cadiz 28 Apr '09

28 Apr '09

hi there, my name is Ernesto from Chile and i'm doing my final project using a RADIUS server. I'm writing because i have some troubles to start the server. I use Debian Lenny and the output of the debug is this: *casa:/usr/local/etc/raddb# radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.5.so: cannot open shared object file: No such file or directory* i know that i have to point to the right directions of where are the libraries, but i don't have so much experience using linux, and if you could give me some info to fix the problem it would be nice. Best regards and thanks for the help. Ernesto Cádiz Lara.

5 6

mac-based authentification fail
by sserre 28 Apr '09

28 Apr '09

Hello gentlemen's, After one week search the web for a solution, i come to this maling list. I have to set up a mac-based authentication system (pretty simple) with HP procurve swtichs. I have see lot of tutorials, buy a book, download more, but it still don't work (access-request denied). I hope somebody can look at my basic problem a few minute. User is reconized (found at line X), but freeradius don't know how to interprete the password (I think). I have see that the CHAP-password attribute send by the client (HP Procurve 2800), is not the same heach time. Is it normal (I don't think). The switch look like he is well configured (running-config in attachement). In attachement, you will find initialisation of freeradius (radius_init), an acces-request from the client (acces-request), the entry of my test user (users), and the running config of the HP Procurve. I hope somebody know this problem. Kind regards Sébastien Serre -- Service informatique IBGC CNRS 1 rue Camille Saint Saens 33077 BORDEAUX CEDEX Tel. +33 (0)5 56 99 90 04 Fax. +33 (0)5 56 99 90 59 http://www.ibgc.cnrs.fr

3 3

RE: Adding vendor specefic attributes
by anoop c 28 Apr '09

28 Apr '09

Hi Thanks for the response. I am using free RADIUS version 1.1.7.I just require MAC authentication alone. Is anything wrong in the 'users' file NAS will support the VSA in this case. Vendor has given the following details Network Access Server Vendor- (Code for the specific vendor) Vendor Assigned Attribute number-1 (for Input/Uplink) 2 (for Output/Downlink) Attribute format decimal Attribute value-(Desired Input/Output bandwidth) How I can configure this attribte? Thanks and regards Anoop -----Original Message----- From: freeradius-users-bounces+anoop_c=sifycorp.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+anoop_c=sifycorp.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, April 27, 2009 10:57 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 48, Issue 114 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help (A.L.M.Buxey(a)lboro.ac.uk) 2. Re: [Wimax TTLS with Alcatel - Lucent ASN GW] (Ivan Kalik) 3. RE: Adding vendor specefic attributes (Ivan Kalik) 4. Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help (Borislav Dimitrov) 5. freeradius with active directory (David N'DAKPAZE) 6. Re: radpostauth sql logging of bad passwords (Guy Fraser) 7. Re: freeradius with active directory (bastardinho69) 8. Re: radpostauth sql logging of bad passwords (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Mon, 27 Apr 2009 13:41:38 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090427124138.GC7926(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Same box. and you do live accounting database insertions? This sounds to me very much like the classic 'tables have now grown just too big' - everything works fine then barfs one day. the request isnt getting serviced in time therefore its marking as dead..check your query times...remove wrong/unused indexes or move to 'out of band' accounting inserts - very easy with 2.1.x alan ------------------------------ Message: 2 Date: Mon, 27 Apr 2009 14:36:54 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: [Wimax TTLS with Alcatel - Lucent ASN GW] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <57087.194.176.105.43.1240839414.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Anyway If I may reask a new question about adding multiple attribute to > reply on the radius that proxy. > > The solution you gave me, (eg use users file and match the Realm > Attribute, > DEFAULT Realm == whatever) is ok for a "ISP" radius (eg end radius), not > for a "Wholesale" radius (eg radius that proxy). > According to what I saw in debug, Realm attribute is only use in the > request (eg add by the proxy radius), but even if I force it in the reply > of the end radius, it won't be consider in the reply by the proxy radius. > > So that I can not add the wanted attribute as I would like too. > > For now what I do, is use the attrs file for first attribute, then use > unlang in post auth to add the second attribute. > Files module supports use of files in post-auth and post-proxy. Add this to raddb/modules/files: postproxy_usersfile = ${confdir}/postproxy_users Then create postproxy_users in raddb directory (where other users files are) and list that DEAFAULT entry there. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Mon, 27 Apr 2009 14:43:25 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Adding vendor specefic attributes To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <64565.194.176.105.44.1240839805.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Is it possible to configure vendor specific attributes in Free RADIUS. > Please guide where can I edit the configuration. Nowhere. > I am using MAC authentication by editing the user file shown below. > > '020a6-5a7fd9 Auth-Type:=Local,User-Password=="secret" > There is so much wrong with this unless you are using a very, very, very old server version. > > MAC authentication is working and I would like to add a vendor specific > attribute. > You add vendor specific attributes - just like any other. Just make sure that you have the dictionary for that vendor in your installation (it's a text file share/dictionary.vendor_name) and that that dictionary contains attribute you want to use. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Mon, 27 Apr 2009 17:44:10 +0300 From: Borislav Dimitrov <b.dimitrov(a)ngsystems.net> Subject: Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <618820F7-3340-4483-BEBB-7937BB8B5C62(a)ngsystems.net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Hi, As far as I can see, the people on the list have provided you with a lot of very useful suggestions on what could cause the problem. As I said earlier (let me clarify) and to help you narrow things a little bit - it's probably due to the RADIUS response timing out hence the NAS complains the server is dead and later when it responds finally it marks it as alive again. The reasons can be different depending on your setup - slow network, database, custom module (like rlm_perl/ python etc) or as I suggested (from my personal experiences) improperly configured concurrence settings of FR itself. See which component of your setup is causing the slow responds (it can be the backend, or messed up FR configuration) and fix it. Just for completeness check your NASs manuals - most have these settings configurable - response timeouts, retransmits, marking the server as dead etc but playing with the NAS while possibly useful is probably not the main issue in your setup - check what is slowing things down. On 27.04.2009, at 15:41, A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, >> Same box. > > and you do live accounting database insertions? This sounds > to me very much like the classic 'tables have now grown just too > big' - everything works fine then barfs one day. the > request isnt getting serviced in time therefore its marking > as dead..check your query times...remove wrong/unused indexes > or move to 'out of band' accounting inserts - very easy with 2.1.x > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 5 Date: Mon, 27 Apr 2009 16:50:14 +0000 From: "David N'DAKPAZE" <lndakpaze(a)gmail.com> Subject: freeradius with active directory To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <16ad49990904270950v1fb0855bnff32138292a50585(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" hello, I am configuring freeradius for authentication with active directory.I've used http://deployingradius.com/documents/configuration/active_directory but freeradius reject all the requests because of no known password.It what i have when i make a request: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 51084, id=198, length=61 User-Name = "azerty" User-Password = "uiop" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "azerty", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [azerty/uiop] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> azerty attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 127.0.0.1 port 51084 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +27 Thanks for your help

2 1