- Freeradius-Users - lists.freeradius.org

Exec-Program-Wait w/ FreeRADIUS 2.1.3
by Jeremiah Millay 28 Mar '09

28 Mar '09

I'm having trouble getting FreeRADIUS to run programs called by Exec-Program-Wait in the newest version of FreeRADIUS (version 2.1.3). I'm using a custom C script that used to work with all versions of FreeRADIUS prior to version 2. I have an entry like this in the users file which is matching my access-requests: DEFAULT Suffix == "@test.net", Auth-Type := Accept Exec-Program-Wait = "/usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password}", Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Fall-Through = No Here is my debugging output when I attempt to authenticate (doesn't appear to execute my program): Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 49411, id=74, length=76 User-Name = "jmillay(a)test.net" User-Password = "blah" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] expand: %t -> Tue Mar 17 13:58:23 2009 ++[auth_log] returns ok [suffix] Looking up realm "test.net" for User-Name = "jmillay(a)test.net" [suffix] Found realm "test.net" [suffix] Adding Stripped-User-Name = "jmillay" [suffix] Adding Realm = "test.net" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 26 [files] expand: /usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password} -> /usr/local/sbin/checkradacct jmillay blah ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [jmillay(a)test.net] (from client 10.1.1.1 port 0) Sending Access-Accept of id 74 to 10.1.1.1 port 49411 Ascend-Data-Filter += "ip in forward tcp est" Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp" Ascend-Data-Filter += "ip in drop tcp dstport = 25" Ascend-Data-Filter += "ip in forward 0" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 74 with timestamp +21 Any suggestions? I read in the docs that Exec-Program and Exec-Program-Wait are deprecated but I haven't found any clear documentation on how to configure rlm_exec to duplicate what I am trying to do. Thanks in advance, Jeremiah

4 4

EAP/TLS -- FreeRadius -- 802.1x
by phil lemelin 27 Mar '09

27 Mar '09

Good morning FreeRadius users. I'm going forward with my attempt to configure freeradius and 802.1x to try to secure part of a wired network. I have been reading about FreeRadius, 802.1x, EAP/TLS and XSupplicant. I came accross a link that doesnt work in the freeradius wiki about exactly those subject but I found something on the linux documentation project ( http://tldp.org/HOWTO/html_single/8021X-HOWTO/ ) which seems to cover this subject. I was wondering if users here have experience with this subject and have more documentation on the subject. My main concern being that most documents on the subject date back to 2004 and I dont know if they are still valid with the freeradius version i'm using ( 1.1.3 -> CentOS install ). Thank you in advance. -- Philippe-Alexandre Lemelin

3 11

Re: same user on different service
by "Николай Г. Петров" 27 Mar '09

27 Mar '09

Thanks for help!! It's work!! , but now have a problem from cisco. From aaa server console mode all it's OK: $ echo "User-Name=user100,User-Password=pass,Service-Type=NAS-Prompt-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 31, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0" $ echo "User-Name=user100,User-Password=pass,Service-Type=Framed-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 33, code 2, length = 68 Called-Station-Id = "1133" Service-Type = Framed-User Framed-Protocol = PPP Cisco-AVPair = "ip:addr-pool=dynpool" file "users" usr100 User-Password := "pass", Service-Type == NAS-Prompt-User Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=0" usr100 Auth-Type := Local, User-Password := "pass" Called-Station-Id == "1133", Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair ="ip:addr-pool=dynpool" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Auth-Type := Reject Reply-Message = "%{User-Name}, don't have access!" User 'user100' try to login to cisco shell: Line has invalid autocommand " ppp negotiate"Connection closed by foreign host. radiusd -X rad_recv: Access-Request packet from host 192.168.10.100:1812, id=19, length=79 NAS-IP-Address = 192.168.10.100 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "user100" Calling-Station-Id = "192.168.10.120" User-Password = "pass" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user100", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry user100 at line 641 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 19 to 192.168.10.100 port 1812 Called-Station-Id == "1133" Service-Type = Framed-User Framed-Protocol = PPP Cisco-AVPair = "ip:addr-pool=dynpool" Finished request 0 Going to the next request View this debug log, think problem to side a cisco, not a freeradius??? Cisco some how send wrong attribute, know you how to relove the problem?

2 1

Re: same user on different service
by "Николай Г. Петров" 27 Mar '09

27 Mar '09

Ok, thank you about answer!! Please, I have a yet a question: every time when I try to login from same username with same password, successfully login user which is first meet in a users file. How can I delineate this users over Service-Type which include a aaa packet??? - from cisco console (NAS-Prompt-User) -from dialup (Framed-User) file "hint" DEFAULT Suffix == ".ppp", Strip-User-Name = Yes Hint = "HNT", Service-Type = Framed-User, Framed-Protocol = PPP file "users" usr100 User-Password := "pass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=0" usr100 Auth-Type := Local, User-Password := "pass" Called-Station-Id == "1133", Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair ="ip:addr-pool=dynpool" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Auth-Type := Reject Reply-Message = "%{User-Name}, don't have access!" $ echo "User-Name=usr100,User-Password=pass,Service-Type=NAS-Prompt-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 244, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0" $ echo "User-Name=usr100,User-Password=pass,Service-Type=Framed-User" | radclient 127.0.0.1:1812 auth testing123 Received response ID 244, code 2, length = 50 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=0"

2 1

using a database for CRL management
by Aníbal Pacheco 26 Mar '09

26 Mar '09

hello all! any possibility to use a database for CRL management? imho there is no way since I think FR uses directly openssl commands and it needs the crl and the revoked certs as files inside the CA_path directory? right? I'm thinking to use a database filesystem like DBI-Fuse or something like that. thank you. tom.

1 0

proxy questions
by Sebastien Boucher 26 Mar '09

26 Mar '09

i don't know if this was asked before but here it goes : we are currently using FreeRADIUS Version 1.1.1 that authenticates local users via LDAP I am trying to setup an IPASS realm for another company and can't get any success .. here is what i have done so far: i have the following in radiusd.conf realm IPASS { format = prefix delimiter = "/" ignore_default = yes ignore_null = yes } i also uncommented IPASS in authorize and preacct and this is what i have in proxy.conf realm IPASS { type = radius authhost = server.ip.here:1812 accthost = server.ip.here:1813 secret = **** retry_delay = 10 retry_count = 3 dead_time = 1 nostrip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } this what i get when i run radiusd in debug : rad_recv: Access-Request packet from host nas.ip.address:1645, id=82, length=168 Framed-Protocol = PPP User-Name = "IPASS/user(a)company.com" User-Password = "somepassword" Called-Station-Id = "5143174746" Calling-Station-Id = "5148776026" Cisco-NAS-Port = "Async1/8/97" NAS-Port = 3013 NAS-Port-Type = Async Service-Type = Framed-User NAS-IP-Address = nas.ip.address Acct-Session-Id = "0017A2FD" NAS-Identifier = "NAS01.MTLCNDS." rlm_ldap: Entering ldap_groupcmp() rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for IPASS/user(a)company.com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 Sending Access-Reject of id 82 to 206.80.253.252 port 1645 i am sure i am missing something .. if i understand radius is trying to validate it in LDAP before sending the proxy request to the other server any help would be very appreciated thanks seb

4 6

rlm_sql_getvpdata: database query error
by Delcamp, Christopher D CTR SPAWAR SSC LANT, 50DE 26 Mar '09

26 Mar '09

We are implementing 802.1x authentication with MAB (Mac Address Bypass) on our Cisco switches and are getting some freeradius errors. Just as a note, when using MAB the username and password given to radius is the MAC address of the device (workstation, server, printer, etc) that is attempting to connect to the network. The authentication succeeds, but I'm wondering what these errors mean and if they can be fixed. Here is a sample of the radius.log. Thu Mar 26 09:08:08 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:08:08 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:08:08 2009 : Auth: Login OK: [001b63933f59/001b63933f59] (from client technet port 50232 cli 00-1B-63-93-3F-59) Thu Mar 26 09:16:03 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:16:03 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:16:03 2009 : Auth: Login OK: [000c29604a22/000c29604a22] (from client technet port 50246 cli 00-0C-29-60-4A-22) Thu Mar 26 09:19:35 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:19:35 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:19:35 2009 : Auth: Login OK: [00188b0251ba/00188b0251ba] (from client technet port 50246 cli 00-18-8B-02-51-BA) Thanks in advance for any help I can get. Chris Delcamp

4 5

Problems starting radius daemon
by Sanz Malagón, Jorge 26 Mar '09

26 Mar '09

Hi every body, My name is Jorge Sanz, from Spain, and this is my first mail in this list. I'm working with a Freeradius installed over OpenSUSE 11.0. It was working properly until I tryed to add a new client in /etc/raddb/clients.conf I add the new client like this client xxx.xxx.xxx.xxx{ secret = xxx shortname = xxx nastype = cisco } Alter that, I restart the service like this /etc/init.d/freeradius restart and I get this error since then Starting RADIUS daemon radiusd: pthread_mutex_lock.c:115: __pthread_mutex_lock: Assertion `mutex->__data.__owner == 0' failed. failed I have checked there is no other freeradius process in memory. I have comment the new lines, and try to put it up again with the same error. Does anybody know something about this? I have been surfing in google and appears similar errors with other applications (pidgin, galeon...) but nothing with freeradius. Thanks in advance Jorge Sanz Malagón Unidad de Redes Departamento de ingenieria Pº Club Deportivo, 1 Edificio 4, Planta Baja 28223 - Pozuelo de Alarcon (Madrid) España M +34 685102456 jsanzma(a)indra.es www.indra.es

3 3

Simple authentication by users file.
by Michel GAUDET 26 Mar '09

26 Mar '09

Hello Everybody ! Sorry for my english : the french people are known to be bad in other langage than french ! To make my (new) experience with freeRADIUS I try to authenticate with simple User-name and password in the users file. Sorry for the long post but I want to give all is necessary to understand. My conf is following (some big extract) : modules { pap { auto_header = no } chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } pam { pam_auth = radiusd } always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } } server ensmp { authorize { files } authenticate { # I don't know what is mandatory here } } Client.conf file : client 1.2.3.4 { secret = XXXX shortname = Linux nastype = other } users file : myself Auth-Type := Accept,User-Password == "YYYYYY" And I try to access with a radius client (radexample) : Linux# radexample login: myself Password: "myself" RADIUS Authentication failure (RC=2) My server in launch in debug mode ( /usr/sbin/freeradius -Xxx) without errors at the moment of my try : Thu Mar 26 18:13:01 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 1.2.3.4 port 48655, id=88, length=65 User-Name = "myself" User-Password = "YYYYYY" Service-Type = Authenticate-Only NAS-Port = 0 NAS-IP-Address = 10.3.5.136 Thu Mar 26 18:13:18 2009 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejectig the user Thu Mar 26 18:13:18 2009 : Debug: auth: Failed to validate the user. Thu Mar 26 18:13:18 2009 : Auth: Login incorrect: [mgaudet/ifqj1cf5] (from client turing port 0) Thu Mar 26 18:13:18 2009 : Debug: Delaying reject of request 0 for 1 seconds Thu Mar 26 18:13:18 2009 : Debug: Going to the next request Thu Mar 26 18:13:18 2009 : Debug: Waking up in 0.9 seconds. Thu Mar 26 18:13:19 2009 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 88 to 10.3.5.136 port 48655 Thu Mar 26 18:13:19 2009 : Debug: Waking up in 4.9 seconds. Thu Mar 26 18:13:24 2009 : Debug: Cleaning up request 0 ID 88 with timestamp +17 The request have been received and acknowledge but rejected because missing Auth-Type. I don't understand WHAT AND WHERE to put Auth-Type elsewhere in my conf. Some ideas ? Thank's in advance. Regards. Michel. -- Michel GAUDET Centre de Calcul et des Systèmes d'Information Ecole Nationale Supérieure des Mines de Paris 60-62, Boulevard Saint Michel 75272 PARIS cedex 06 FRANCE Tel : 01.40.51.92.03 Fax : 01.40.51.93 01 mail : michel.gaudet(a)mines-paristech.fr

2 1

Account preProcessing
by Larry Ross 26 Mar '09

26 Mar '09

Good Afternoon All; Currently my institution allows for registered users to create guest accounts for visitors to enable wireless access for the guest users (Wireless access is controlled via Captive Portal/PAP with a Kerberos Directory backend). Registered users create the guest accounts using the guest users eMail address, such as Jdoe(a)gmail.com jdoe(a)hotmail.com etc etc etc. This poses a slight problem though as the "@" sign is a reserved character for Kerberos and thus principles with the "@" cannot be created within our KDC. To solve this problem the account generation application substitutes the "@" for a "+" (so kerberos principles are created in the form jdoe+gmail.com jdoe+hotmail.com) If guest users remember to sub a "+" for their "@" all is well, however often times people forget this and get stuck wondering why their username jdoe(a)gmail.com is failing when they have been assured all is well. To completely eradicate this situation we would like to place a Freeradius instance in place of our proprietary radius solution and have it perform the substitution during authentication, so neither the Guest or registered user need concern themselves with the whole "@" "+" thing (so from their standpoint the principle is jdoe(a)gmail.com nice and easy... for them ;) I have been trying to determine the best way to accomplish this and would greatly appreciate any ideas as to how this may be completed. Thank you much. Larry

2 2