- Freeradius-Users - lists.freeradius.org

Retrieve an user attribute from AD for vlan assignment in PEAP auth
by Frad 26 Mar '09

26 Mar '09

Hi everyone, I am configuring a freeradius server with authentication PEAP/Mschap with an Active Directory. The authentication works :) There is my question: I have on my AD an attribute for each user such as "vlanId = 12" and I would like to get this value to assign the user authenticated on this VLAN. Any idea ? Thanks, Frad -- View this message in context: http://www.nabble.com/Retrieve-an-user-attribute-from-AD-for-vlan-assignmen… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Problem with attribute transfer to an external script
by Dmitry Lyubimkov 26 Mar '09

26 Mar '09

Hello. We use FreeRADIUS as an intermediate server (proxy) between commercial billing system and radius clients (NAS, servers, etc). In this case it is a question about SIPProxy. The billing system sends some additional attributes. Here a example from FreeRADIUS log: rad_recv: Access-Reject packet from host 172.16.2.9 port 1812, id=99, length=70 Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" We receive this from billing system. And we should transmit to the RADIUS-client the same plus additional attribute, calculated from h323-return-code. Approximately so: Sending Access-Reject of id 164 to 172.16.2.6 port 42424 SIP-AVP := "AUTHCODE:3" Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" I have described the application in a radiusd.conf exec siph323code { wait = yes input_pairs = reply output_pairs = reply packet_type = Access-Reject program = "/usr/bin/python -u /usr/sbin/radscripts/siph323code.py %{h323-return-code} } Also add it in section post-proxy { .... siph323code .... The application is started, attribute SIP-AVP is added. But there is a problem. Value of {h323-return-code} attribute is not transferred to this application. FreeRADIUS declares: rlm_exec (siph323code): WARNING! Input pairs are empty. No attributes will be passed to the script expand: %{h323-return-code} -> I.e.it cannot substitute value of h323-return-code attribute. But if I write on this place any attribute from initial request, for example %{Cisco-AVPair} that its value is substituted. Questions: 1. How correctly to describe my application. What value of output_pairs and input_pairs fields I should use? 2. In what section I should start this application (post-proxy, pre-proxy, post-auth...)? 3. Why it is not substituted attribute % {h323-return-code}? Thanks. Dmitry

1 0

Get fail [MS-CHAP2-Response is incorrect] while proxy the mschapv2 between two Freeradius 2.1.4
by Jacky Chan 26 Mar '09

26 Mar '09

Hi all, I installed two freeradius, one for home server(x.x.x.239/24) and one for proxy purpose, the home server is working normally with LEAP with mschapv1, WPA2 and PEAP with mschapv2. For other purpose, I need to established one more freeradius and work as proxy radius server(x.x.x.238/24) to proxy all request to other home radius that including the existing home freeradius server mention above, but after test, PAP and LEAP are proxyed successfully but PEAP/WPA2 with mschapv2 always get fail, the following is the debug log from these two freeradius 2.1.4 Freeradius (home server) x.x.x.239 rad_recv: Access-Request packet from host x.x.x.238 port 1814, id=58, length=179 NAS-IP-Address = x.x.x.21 (NAS for testing) NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test33", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry test33 at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test33 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [test33/<via Auth-Type = mschap>] (from client fd-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 58 to x.x.x.238 port 1814 Proxy-State = 0x3134 Waking up in 4.9 seconds. Cleaning up request 0 ID 58 with timestamp +13 Ready to process requests. Freeradius (proxy server) x.x.x.238 rad_recv: Access-Request packet from host x.x.x.21 port 32846, id=14, length=191 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33(a)aaa.com" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "aaa.com" for User-Name = "test33(a)aaa.com" [suffix] Found realm "aaa.com" [suffix] Adding Stripped-User-Name = "test33" [suffix] Adding Realm = "aaa.com" [suffix] Proxying request from user test33 to realm aaa.com [suffix] Preparing to proxy authentication request to realm "aaa.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Proxying request 10 to home server x.x.x.239 port 1812 Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. rad_recv: Access-Reject packet from host x.x.x.239 port 1812, id=58, length=24 Proxy-State = 0x3134 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Login incorrect (Home Server says so): [test33(a)aaa.com/<via Auth-Type = mschap>] (from client Controller-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33(a)aaa.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 14 to x.x.x.21 port 32846 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 14 with timestamp +9947 Waking up in 17.2 seconds. Sending Status-Server of id 70 to 127.0.0.1 port 1812 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" You can see that the MS-CHAP-Challenge and the MS-CHAP2-Response are same within two server, but why home server said that the password is wrong? Can anyone help me to check whether there are something wrong in my configuration, thanks. The following is the EAP and the mschap module of these two server: mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } -- View this message in context: http://www.nabble.com/Get-fail--MS-CHAP2-Response-is-incorrect--while-proxy… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

same user on different service
by "Николай Г. Петров" 26 Mar '09

26 Mar '09

Hello! I have a question about same 'username' from different services. Task: 1) Troublefree login users with same username, from different places(therefore different attribute) at the same time: - cisco console login(radius for cisco); - ppp(radius for dialup). 2) In some way delineate radius log for cisco from ppp radius log. aaa must be done on single freeradius server(...we have a one aaa server). May be use a different group or realm? Please, I'd like to listen our recommendation or link that this explained. [freeradius version 1.1.3, latest I can't,only this!!!] Thanks!

2 1

API
by David N'DAKPAZE 26 Mar '09

26 Mar '09

Hello, I'd like to know how to create an API which will permit me to create or delete a user on freeradius. Thank you for your help

4 5

Cdv D has sent you a private message
by Cdv D 26 Mar '09

26 Mar '09

1 0

Cdv D has sent you a private message
by Cdv D 26 Mar '09

26 Mar '09

1 0

undefined reference to `lt_preloaded_symbols'
by Nick Jones 25 Mar '09

25 Mar '09

I am running Ubuntu 8.10 and trying to build the debian package for FreeRADIUS 2.1.4 as described on the FreeRADIUS web site. When I issue the command: fakeroot dpkg-buildpackage -b -uc The process starts but at some point along the way, I get this error message: libtool: link: gcc .libs/radiusdS.o -Wl,-Bsymbolic-functions -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/parsond/Desktop/freeradius-server-2.1.4/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto -Wl,-rpath -Wl,/usr/lib/freeradius .libs/modules.o: In function `setup_modules': /home/parsond/Desktop/freeradius-server-2.1.4/src/main/modules.c:1039: undefined reference to `lt_preloaded_symbols' collect2: ld returned 1 exit status make[5]: *** [radiusd] Error 1 make[5]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src/main' make[4]: *** [common] Error 2 make[4]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 I have searched online for fixes to the 'undefined reference to lt_preloaded_symbols', I know it is related to the libtool I am using, but I don't know where to begin to get this resolved. I hope someone can help! I am have libtool 2.2.4 and libltdl7 2.2.4 installed, if this helps.

2 1

Two Simultaneous-Use on Same NAS Port
by Smith, Mark J 25 Mar '09

25 Mar '09

I'm trying to limit a single username to logon 2 times on the same NAS Port/NAS Port ID. Our test environment consists of a single FreeRadius Server (Version 2.1.5/4), MySQL Server 5.0.45, and a Cisco 7200VXR with IOS 12.2(31)SB13. The main issue now is that a single user name with Simultaneous-Use set too 2 is able to login an unlimited number of times on the same NAS Port/NAS Port ID. However, if the same user logon through a different NAS Port/NAS Port ID, Simultaneous-Use checks work as expected. Please, note the following radwho and radiusd -X outputs. radwho -R Output after first user logged in: User-Name = "test1" Acct-Session-Id = "00003377" NAS-IP-Address = X.X.X.X NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = X.X.X.X radwho -R Output after second user logged in: User-Name = "test1" Acct-Session-Id = "00003378" NAS-IP-Address = X.X.X.X NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = X.X.X.X Acct-Session-Time = 72 **Note the lack of the first user identified by Acct-Session-ID 00003377. radwho -R Output with second user logged in through a different NAS Port/NAS Port ID: User-Name = "test1" Acct-Session-Id = "00003378" NAS-IP-Address = 66.109.238.133 NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 66.216.191.36 Acct-Session-Time = 476 User-Name = "test1" Acct-Session-Id = "00003379" NAS-IP-Address = 66.109.238.133 NAS-Port = 1610625913 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 66.216.191.37 Acct-Session-Time = 70 Acct-Session-Id 00003377 radiusd -X output: +- entering group session {...} [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok rad_recv: Accounting-Request packet from host 66.109.238.133 port 1646, id=88, length=136 Acct-Session-Id = "00003377" Framed-Protocol = PPP Framed-Route = "255.255.255.0" Framed-Route = "255.255.255.0" Framed-IP-Address = X.X.X.X User-Name = "test1" X-Ascend-Connect-Progress = LAN-Session-Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = 32 NAS-Port = 2097152 NAS-Port-Id = "0/0/2/0" Service-Type = Framed-User NAS-IP-Address = X.X.X.X Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok Acct-Session-Id 00003378 radiusd -X output: +- entering group session {...} [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok rad_recv: Accounting-Request packet from host 66.109.238.133 port 1646, id=89, length=136 Acct-Session-Id = "00003378" Framed-Protocol = PPP Framed-Route = "255.255.255.0" Framed-Route = "255.255.255.0" Framed-IP-Address = X.X.X.X User-Name = "test1" X-Ascend-Connect-Progress = LAN-Session-Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = 32 NAS-Port = 2097152 NAS-Port-Id = "0/0/2/0" Service-Type = Framed-User NAS-IP-Address = X.X.X.X Acct-Delay-Time = 0 +- entering group preacct {...} Cisco Radius Configuration: aaa authentication login default local group tacacs+ aaa authentication enable default group tacacs+ enable aaa authentication ppp default local group radius aaa authorization exec default local group tacacs+ aaa authorization commands 1 default local group tacacs+ aaa authorization commands 15 default local group tacacs+ aaa authorization network default local group radius aaa accounting delay-start vrf default aaa accounting delay-start all aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group radius aaa accounting system default start-stop broadcast group radius group tacacs+ radius-server attribute nas-port format e SSSSAPPPUUUUUUUUUUUUUUUUUUUUUUUU radius-server attribute nas-port format e SSSSAPPPIIIIIIIICCCCCCCCCCCCCCCC type 30 radius-server attribute nas-port format e SSSSAPPPIIIIIIIICCCCCCCCCCCCCCCC type 31 radius-server attribute nas-port format e SSSSAAAAPPPPVVVVVVVVVVVVVVVVVVVV type 32 radius-server attribute nas-port format e SSSSAPPPVVVVVVVVVVVVVVVVVVVVVVVV type 33 radius-server attribute nas-port format e SSSSAPPPQQQQQQQQQQQQVVVVVVVVVVVV type 34 radius-server attribute 61 extended radius-server host X.X.X.X auth-port 1812 acct-port 1813 non-standard key Please, let me know if any additional information is needed. Thank you, Mark **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

2 1

Problem with SQL and LDAP
by Sebastian Heil 25 Mar '09

25 Mar '09

Hello everybody, It seems, as if we have the same issue as described here: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg51505.… Is there already a patch/solution available to use the Ldap-Group as attribute? Sebastian -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 2