- Freeradius-Users - lists.freeradius.org

Huntgroups and Network of Clients
by HRZ Konten 12 Mar '09

12 Mar '09

Hi all, I use Freeradius 1.1.7 (yes, sorry I know it is a little bit old but there is no time to upgrade :( I want that the requests from some servers are checked and authenticated through LDAP-Groups for example Requests from IP x.x.x.x should be authenticate only if the user is in ldap-group employee, tha same for IP y.y.y.y . Then I have some other servers with requests that don't need LDAP authorisation. I used the Huntgroups to define the first two servers als huntgroup "testldap" and the rest as huntgroup "all". That functions great for IP Addresses. The list ist long, but still ok. Only if I want to do that for network of clients this doesn't work. The problem is that I must list all of the servers that should gain access and I have a lot of PC-Pools which use radius to authenticate. In the client.conf they are written with the network addresses, that doesn't work in huntgroups file. I don't want to list all of the PC-Pool members in the Huntgroups because there are too many... Does Huntgroup support only IP-Addresses or I can fill up Network Addresses too? Or there is another workaround? Or maybe this issue is already changed in the new version 2.3.1? users -------- DEFAULT Huntgroup-Name==testldap, Ldap-Group == employee, Auth-Type := Pam Fall-Through = no DEFAULT Huntgroup-Name==all, Auth-Type := Pam Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." huntgroups ----------------- #Test LDAP testldap NAS-IP-Address == x.x.x.x testldap NAS-IP-Address == y.y.y.y #All Users all NAS-IP-Address == a.a.a.a .... all NAS-IP-Address == z.z.z.z/26 Greets, Meyes

2 5

Winbind errors
by Mike Diggins 12 Mar '09

12 Mar '09

Freeradius 2.1.3 winbindd version 3.0.33-3.7.el5 RedHat Linux 5, release 2 fully patched I know this isn't a FreeRadius issue, but is related. Has anyone running FreeRadius with Winbindd for windows authentication, found a solution to these error messages in the samba.log? [root@prad01 log]# tail samba.log [2009/03/12 09:28:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:38:35, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. I get several a minute. I've found many posts with the same complaint, but no solution. Is upgrading (or downgrading) likely to stop it? It seems to be a purely cosmetic issue, but I'd still like to find a solution. -Mike

1 0

How to allow nas'es to serve only groups of clients?
by Alexander Yu. Solodukhin 12 Mar '09

12 Mar '09

Hi. I have two types of nases: 1) hotspots 2) vpn servers. I need vpn nases authorize only vpn users and hotspot nases authorize only hotspot users. How can i divide users into several groups and reject vpn accounts to login through hotspot and vice versa? I think i must use huntgroups and unlang, but not cleanly understand how. -- ISP CrIS, Softwarium

5 9

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

------------------------------ > > Message: 7 > Date: Thu, 12 Mar 2009 12:17:56 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090312121756.GD28045(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). > > if it doesnt mention it, how do you know it can do it? > > you're only real choice is to sniff ALL the traffic on the wire > from the zinwell and see what the heck its sending. if it doesnt > send any accounting then theres nothing magical that FreeRADIUS > (or any other RADIUS server) can do - as the RADIUS server > doesnt tell the NAS to 'oi, send me stuff!' - the NAS is configured > to do accounting and then where to send it. if its good, the NAS > sends accounting packets as per the RFCs.....but from personal > experience 90% of devices out there break accounting in wierd > and wonderful ways..be it cisco, hp, 3com, zyxel, hauwei etc. Could you dive me Model? ex: DWL-2100ap... etc. Thanks > > once you DO get accounting packets to the RADIUS server, then thats > when the real fun begins! ("oh, but i wanted unique per client > sessions that could be matched to the real user!" argggh! ;-) ) > > alan _________________________________________________________________ Drag n’ drop—Get easy photo sharing with Windows Live™ Photos. http://www.microsoft.com/windows/windowslive/products/photos.aspx

1 0

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

Hi Ivan, The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). Could you tell me thar have to be another think at GroupReply and suggest some nas devices? Thanks. > Date: Thu, 12 Mar 2009 00:11:44 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <9kef2EDk.1236813104.0870720.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. > > > > So read Zinwell documentation about enabling accounting. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

4 3

Version 2.1.4 has been released
by Alan DeKok 12 Mar '09

12 Mar '09

This version comes 3 months after 2.1.3, which is a bit more of a delay than we would like. However, it includes a number of minor bug fixes, and some interesting new features. The best new feature is one that has been needed for a long time. The (easy) ability to see debugging output from a "live" server. You can now do this via the "raddebug" command. FreeRADIUS 2.1.4 Thu Dec 25 17:40:00 CEST 2008; , urgency=medium Feature improvements * Permit multiple "-e" in radmin. * Add support for originating CoA-Request and Disconnect-Request. See raddb/sites-available/originate-coa. * Added "lifetime" and "max_queries" to raddb/sql.conf. This helps address the problem of hung SQL sockets. * Allow packets to be injected via radmin. See "inject help" in radmin. * Answer VMPS reconfirmation request. Patch from Hermann Lauer. * Sample logrotate script in scripts/logrotate.freeradius * Add configurable poll interval for "detail" listeners * New "raddebug" command. This prints debugging information from a running server. See "man raddebug. * Add "require_message_authenticator" configuration to home_server configuration. This makes the server add Message-Authenticator to all outgoing Access-Request packets. * Added smsotp module, as contributed by Siemens. * Enabled the administration socket in the default install. See raddb/sites-available/control-socket, and "man radmin" * Handle duplicate clients, such as with replicated or load-balanced SQL servers and "readclients = yes" Bug fixes * Clean up control sockets when they are closed, so that we don't leak memory. * Define SUN_LEN for systems that don't have it. * Correct some boundary conditions in the conditional checker ("if") in "unlang". Bug noted by Arran Cudbard-Bell. * Work around minor building issues in gmake. This should only have affected developers. * Change how we manage unprivileged user/group, so that we do not create control sockets owned by root. * Fixed more minor issues found by Coverity. * Allow raddb/certs/bootstrap to run when there is no "make" command installed. * In radiusd.conf, run_dir depends on the name of the program, and isn't hard-coded to "..../radiusd" * Check for EOF in more places in the "detail" file reader. * Added Freeswitch dictionary. * Chop ethernet frames in VMPS, rather than droppping packets. * Fix EAP-TLS bug. Patch from Arnaud Ebalard * Don't lose string for regex-compares in the "users" file. * Expose more functions in rlm_sql to rlm_sqlippool, which helps on systems where RTLD_GLOBAL is off. * Fix typos in MySQL schemas for ippools. * Remove macro that was causing build issues on some platforms. * Fixed issues with dead home servers. Bug noted by Chris Moules. * Fixed "access after free" with some dynamic clients.

10 25

Running an external script
by Jonathan Gazeley 12 Mar '09

12 Mar '09

In my my inner-tunnel virtual server, authorize section, I have some code like this, for sorting users into vlans: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } This was put together in a hurry and is pretty undesirable, as the perl script (which queries a slow database) is executed twice. Of course in any other language, one would simply save the return value of the script in a variable and reference it twice - but quoting "man unlang": " Note that unlike C, there is no way to declare variables". So is there a way to store the return value such that I can execute the script only once? Or how about something like: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := %{control.Tunnel-Private-Group-Id} } Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

3 3

Config. Help please - ldap and Active Directory
by Leighton Man 12 Mar '09

12 Mar '09

Hi, I'm new to freeradius (3 weeks experience) and mailing lists (second attempt) so please have patience. I have freeradius 1.1.7 (prebuilt package) on Solaris 10 configured to authenticate against Active Directory using ntlm-auth. All working OK. Now I'm trying to return different reply attributes depending on Active Directory group membership and restrict which groups can authenticate. Ldap lookups against the active directory root fail with operation error. Reconfiguring Active Directory is not a viable option so I have to specify an OU=xxxx in the query. I have configured two instances of the ldap module for authorisation, one to query the staff ou and the other to query the student ou. Both work OK for valid queries but if the user does not exist in the ou the server still authenticates the username/password and grants access if valid. Relevant debug output: rlm_ldap: performing search in ou=students, dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=stafftest) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_student" returns notfound for request 8 modcall: leaving group student (returns notfound) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list ............................... rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 104 to 10.127.240.217 port 1645 Relevant bits of radiusd.conf: ldap ldap_student{ server = "server.hud.ac.uk" identity = "cn=user,ou=Specials,ou=Staff,dc=ad,dc=hud,dc=ac,dc=uk" password = secret port = 636 basedn = "ou=students, dc=ad, dc=hud, dc=ac, dc=uk" filter = "(sAMAccountName=%{mschap:User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } ........................................ instantiate { exec expr ldap_staff ldap_student } authorize { preprocess mschap suffix eap Autz-Type staff{ ldap_staff } Autz-Type student{ ldap_student } files } authenticate { Auth-Type MS-CHAP { mschap } eap } I want to reject the user if they are not in the relevant ou. I must be missing something obvious. Can anyone help please? Thanks in advance, Leighton

4 17

bugs.freeradius.org unavailable?
by Bjørn Mork 12 Mar '09

12 Mar '09

Is it just me, or has bugs.freeradius.org died? I've tried from two different local ISPs without any luck. bjorn@canardo:~$ telnet bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 ti0036a380-l1.ti.telenor.net (88.88.0.180) 8.133 ms 10.113 ms 12.467 ms 2 ti0001d320-ge0-1-4-10.ti.telenor.net (146.172.83.41) 15.125 ms 17.632 ms 20.250 ms 3 ti0001c310-xe7-1-1.ti.telenor.net (146.172.98.145) 70.634 ms 71.198 ms 71.574 ms 4 ti3004c310-ae5-0.ti.telenor.net (146.172.100.53) 65.706 ms 68.951 ms 71.912 ms 5 ti3003c310-ae4-0.ti.telenor.net (146.172.100.46) 73.231 ms 75.950 ms 78.359 ms 6 ti9002b300-ae0-0.ti.telenor.net (146.172.105.38) 80.615 ms 75.509 ms 76.336 ms 7 xe-0-3-0.cr1.lhr1.uk.nlayer.net (195.66.224.37) 76.788 ms 76.429 ms 76.588 ms 8 xe-2-2-0.cr1.nyc3.us.nlayer.net (69.22.142.9) 140.652 ms 104.673 ms 105.095 ms 9 xe-2-1-0.cr2.ord1.us.nlayer.net (69.22.142.6) 125.930 ms 165.239 ms 165.139 ms 10 111.xe-3-3-0.cr2.ord1.us.scnet.net (216.246.88.146) 132.910 ms 134.031 ms 133.772 ms 11 v21.ar1.ord1.us.scnet.net (216.246.95.243) 135.433 ms 135.307 ms 135.239 ms 12 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 136.447 ms 135.575 ms 135.738 ms 13 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 137.034 ms 126.885 ms 127.757 ms 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 *^C bjorn@canardo:~$ telnet -b 84.215.114.143 bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute -s 84.215.114.143 bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 10.234.0.1 (10.234.0.1) 91.665 ms 91.640 ms 92.866 ms 2 cm-84.208.4.126.getinternet.no (84.208.4.126) 92.968 ms 95.435 ms 95.529 ms 3 cm-84.208.26.1.getinternet.no (84.208.26.1) 95.505 ms 95.551 ms 95.544 ms 4 cm-84.208.26.6.getinternet.no (84.208.26.6) 92.866 ms 92.827 ms 95.060 ms 5 64.213.76.97 (64.213.76.97) 99.490 ms 100.178 ms 100.262 ms 6 xe-4-0-0.cr1.nyc2.us.nlayer.net (69.31.95.229) 202.685 ms 118.586 ms 118.625 ms 7 xe-4-2-0.cr1.ord1.us.nlayer.net (69.22.142.85) 159.379 ms 150.007 ms 150.088 ms 8 111.xe-3-3-0.cr1.ord1.us.scnet.net (216.246.88.162) 137.391 ms 138.172 ms 138.256 ms 9 v21.ar1.ord1.us.scnet.net (216.246.95.243) 138.306 ms 138.322 ms 138.260 ms 10 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 138.349 ms 142.180 ms 142.210 ms 11 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 142.238 ms 142.226 ms 142.263 ms 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 *^C The reason for wanting to access bugs.freeradius.org is a small dictionary patch I have. I assume the correct procedure still is opening a bug and attaching the patch? Bjørn

2 1

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 11 Mar '09

11 Mar '09

Hi Ivan, I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. Below are informations from my Zinwell G220 Plus, but away, o receibe an error as you see. Do you know what mean? Jan 1 18:55:16 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:55:17 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:55:27 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:55:28 wlan0: Open and authenticated Jan 1 18:56:47 wlan0: A wireless client is deauthenticated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:57:09 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:57:10 wlan0: Open and authenticated Here is my radius . rad_recv: Access-Request packet from host 192.168.1.20:1024, id=114, length=229 User-Name = "leo" NAS-IP-Address = 192.168.1.20 NAS-Port = 0 Called-Station-Id = "00059e887861" Calling-Station-Id = "0016cfb3814e" NAS-Identifier = "ZPlus AP" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700501900170301002087c1a68cee5e03e609b11b139ced4a1e1aac47b5519ace27d5598fa118de8177170301002019b9c21c89dac32bc991955f2eef609c8b1080b69fcb1adff8c5573546fc6cb7 State = 0xfa58367a8e0b8dd7abe16b9498e1d636 Message-Authenticator = 0x3f71351c1f04c73b0a85847aa94352b8 Thanks > >So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. > > First run freeradius in debug mode (radiusd -X). If you don't see > accounting packets use wireshark. If wireshark can't see them check if > you have enabled accounting on your AP. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

2 1