- Freeradius-Users - lists.freeradius.org

Fall-Through attribute, reply or configure item?
by Damjan 16 Feb '09

16 Feb '09

I'm reading the documentation of freeradius 2.1.3 (I've not gone through it all yet) and I find that "Fall-Through = Yes" is always specified as a reply attribute. But it isn't a real reply attribute isn't it? It's more of a configure attribute like Cleartext-Password, right? So it should be used in a check line with := (or radcheck DB table). I understand that changing this will probably mean to much work for FR administrators, I'm only asking to make things clearer to me. ps. is there a list of the special configure attributes that freeradius works with? -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

3 3

using Calling-Station-Id to give ippool name to vpn server
by Eric 16 Feb '09

16 Feb '09

Hi. there is a radius server with VPN server as its nas. radius server use ldap server in back end for authentication and authorization. we want if Calling-Station-Id of user is valid radius could give ippool number=1 in access reply to vpn server and if Calling-Station-Id of user is invalid could give ippool number=2. how radius can do this compare? my user file configuration: DEFAULT Client-IP-Address == 192.168.200.123, Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn and in client.conf: client 192.168.200.123{ secret = newvpnsecret shortname = vpn }

2 1

sql problem
by tincboy 16 Feb '09

16 Feb '09

Hi, I've just configured my new freeradius installation with mysql, but the output of my test command is Rejected. radtest home home 127.0.0.1 1812 testing123 radius -x output is: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32866, id=176, length=56 User-Name = "home" User-Password = "home" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rad_recv: Access-Request packet from host 127.0.0.1:32866, id=176, length=56 Sending Access-Reject of id 176 to 127.0.0.1 port 32866 ------------------------------------------------------------ I've found out nothing from this output, why it's not sending any sql command to mysql?

2 1

Freeradius is crashing in krb auth
by Lisa Besko 16 Feb '09

16 Feb '09

Freeradius keeps crashing on us. I finally put it in debug mode and this is the tail end of the messages I get before it dies: -------------------------------- users: Matched entry DEFAULT at line 5 modcall[authorize]: module "files" returns ok for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns ok) for request 9 rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" Processing the authenticate section of radiusd.conf modcall: entering group kerberos for request 9 Segmentation fault (core dumped) ------------------------------- Part of what is frustrating is I've been running this same configuration on another system and it's fine. I just moved it to a production system and I'm having issues. They are both running FreeRadius 1.1.7_3 and MIT Kerberos 1.6.3_5. The setup that works well is running FreeBSD 7.0 Stable on an i386 system. The one that keeps crashing is running FreeBSD 7.1 PreRelease on an AMD system. Anyone have any ideas about what is happening here? LB -- Lisa Besko Systems Administrator Network Management Academic Technology Services

2 3

Re: Session-timeout problem
by Will D. Spann 16 Feb '09

16 Feb '09

Mitul, >I have tried this configuration and it's working fine with radtest but Glad to hear you have this working with radtest. This means you have this functionality properly configured on the FreeRADIUS side now. >Ever i am getting session time out value on AP side also but during the change request time . actually i want the session time out in >accept-access time. >is it the normal scenario? >can you help me in this case? With the configuration I showed, FreeRADIUS will send the Session-Timeout attribute to the AP in an Access-Accept packet, in response to the AP sending an Access-Request packet to FreeRADIUS that is accepted. I'm not sure what you're referring to when you say change request time. Can you elaborate? It sounds like you may have a configuration issue on the AP side. Unfortunately, if this is an AP configuration issue, I doubt I'd be of much help. On the AP side, I've only worked with the ChilliSpot network access server (used for WiFi hotpots). Regards, Will D. Spann

1 0

Re: Session-timeout problem
by Will D. Spann 16 Feb '09

16 Feb '09

>i have tried this thing but when i am doing so its taking this as a default entry and giving error for user name and password >i have entered username and cleartext-password in user file. Could you post your users file (with any non-testing passwords starred out of course)? My apologies; let me add a clarification. If your user entries in the users file don't have the "Fall-Through = Yes" attribute set, putting the DEFAULT section at the end of the file won't apply the Session-Timeout to the users. However, it shouldn't cause an error. Have you tried testing without the DEFAULT section, using a user with Cleartext-Password? I've tested the following configuration on FreeRADIUS 2.1.1 with success. test Cleartext-Password := "testing" Fall-Through = Yes DEFAULT Session-Timeout = 60 Try testing this with radtest, such as the following, where "testing123" is your shared secret and the server is running on localhost. This should return an Access-Accept message with Session-Timeout specified. (I assume you're also running the server with debug output, as "radiusd -X".) radtest test testing localhost 0 testing123 If you don't want to add the Fall-Through attribute to each of your user entries, you could instead use the following modified DEFAULT section near the top of the users file, before all the authorized user entries. I've also tested this configuration. (Note the comma.) DEFAULT Session-Timeout = <timeout>, Fall-Through = Yes >also i have configured the mysql database for authentication and accounting. so at that time i am getting error "no User-password or >CHAP-password" in request. Are you using both the users file and MySQL for authentication, or are you testing each setup separately? I'd recommend getting FreeRADIUS working with the users file alone before setting up database-based authentication. Will D. Spann

1 0

Grouping different kinds of clients and returning different attributes
by David Bailey 16 Feb '09

16 Feb '09

I'm new to FreeRadius, so please understand that my understanding of the vocabulary and structures are limited. I've read through the documentation and I'm trying to do something that may be obvious to some. I'm trying to configure FreeRadius to do administrator authentication from a series of switches, routers, and firewalls. Some are Cisco IOS, some HP Procurve, and some Juniper. I've got it working so that all are properly authenticating. The back-end authentication is LDAP. The problem is that there are roughly 250 units on various IP addresses across the WAN. I'd like to redirect them all to the same RADIUS server. The problem is that although I have some 250 client definitions in clients.conf, I'd rather avoid using 250 definitions in users. I'm trying to find a way to categorize the RADIUS clients into Cisco, HP, etc. What I was trying to do was to give each client a name: client Cisco_IOS.host-10.1.2.3 { ipaddr = 10.1.2.3 secret = supersecret } client HP_Procurve.host-10.3.2.1 { ipaddr = 10.3.2.1 secret = alsoverysecret } And then build something to refer to them in the users file along the lines of: DEFAULT Client-Shortname =~ "Cisco_IOS.*", User-Name := "someadmin", Cleartext-Password := "goodpassword" Service-Type = NAS-Prompt-User DEFAULT Client-Shortname =~ "HP_Procurve.*", User-Name := "anotheradmin", Cleartext-Password := "greatpassword" Service-Type = 6 of maybe DEFAULT Client-Shortname =~ "Somethingelse.*", Auth-Type := Pam (or LDAP) Service-Type = (something else), Other-attributes = XXXXXXX I'm having some problems, so I'm either missing something, or I'm going down an entirely wrong path. I got the "Client-Shortname" from the Run-time variables page in the Wiki, but I suspect it isn't evaluating like I think it ought to. Thank you for your time. -- View this message in context: http://www.nabble.com/Grouping-different-kinds-of-clients-and-returning-dif… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Segfault in module accessing custom attributes fields
by D'AVELLA STEFANO 16 Feb '09

16 Feb '09

Hi all, I am having some problems in trying to write a little module to handle some custom attributes. Because I have a project regarding very specific requirements I preferred to write a module instead of trying to use the existing ones, so I can know in a better way where to go to change things when I want a different behaviour. What I am doing right now is trying to have a testbed with a client, a proxy and a server, exchanging some custom attributes saved in the users file of the server and transmitted with auth-accept messages. The proxy should intercept these new attributes and save them in a specific syntax in a local file. I managed to create and transfer successfully the custom attributes and to have them saved in a local file by the proxy. The problem is that if these attributes have a string as a value, there is no problem in reading it using the field vp_strvalue. If these attributes have the attribute ipv6address, when I try to access to them using vp_ipv6address I get a segFault. The values are correctly stored in the packets because I can see them with wireshark and the client receives them successfully. In the documentation (the wiki) there is written to access the attributes through request->packet->vps but I managed to do it only with request->reply->vps. (initially I wanted to save this local file using the post-proxy section because I was thinking that it was the best place to do it (it's an action to do when the proxy receives the reply from the server) but I couldn't access the right packet through the API and so I found out that I could do it in the post-auth phase) I would not want to disturb you too much but the problem is that it seems to me that there is a bit of lack in the documentation regarding how write modules in the newer versions of freeradius and so I didn't know other places to look (I have been looking at the source code for all the day but maybe I can do it faster if pointed into the right direction) Thank you in advance for any answer, Best regards, D'Avella Stefano Bell Labs Alcatel-Lucent Centre de Villarceaux Route de Villejust 91625 NOZAY

2 1

Restrict access to certain groups
by kevin leblanc 16 Feb '09

16 Feb '09

Hi I have a Freeradius which checks if an user has right to connect to a network equipment via LDAP. For security reasons, i want to restrict access to certain users (network administrator). At the beginning, I wanted to do it by adding host attribute to a user, it will contain all allowed hosts he can connect : I don't find a solution. But, i found another way : in my schema I added an OU which contains all computers in the network, and to allow a user to connect to one of them, I make it "member of" this host. So, I want to check if the user is "member of" the host he try to connect, to give him corresponding access. I don't know if it's possible and how to do this (if it's possible). May I change users file ? radiusd.conf ? cleints.conf ? I'm lost whereas I'm on it since the last week :( thanx for all possible solutions -- KeV

1 2

Re: Session-timeout problem
by Mitul Modi 16 Feb '09

16 Feb '09

hi will, I have tried this configuration and it's working fine with radtest but Ever i am getting session time out value on AP side also but during the change request time . actually i want the session time out in accept-access time. is it the normal scenario? can you help me in this case? thanks, Mitul Modi On Fri, Feb 13, 2009 at 3:23 PM, Will D. Spann <willdspann(a)yahoo.com> wrote: > Mitul, > > >i have tried this thing but when i am doing so its taking this as a > default entry and giving error for user name and password > > >i have entered username and cleartext-password in user file. > > Could you post your users file (with any non-testing passwords starred out > of course)? > > My apologies; let me add a clarification. If your user entries in the > users file don't have the "Fall-Through = Yes" attribute set, putting the > DEFAULT section at the end of the file won't apply the Session-Timeout to > the users. However, it shouldn't cause an error. Have you tried testing > without the DEFAULT section, using a user with Cleartext-Password? I've > tested the following configuration on FreeRADIUS 2.1.1 with success. > > test Cleartext-Password := "testing" > Fall-Through = Yes > > DEFAULT > Session-Timeout = 60 > > Try testing this with radtest, such as the following, where "testing123" is > your shared secret and the server is running on localhost. This should > return an Access-Accept message with Session-Timeout specified. (I assume > you're also running the server with debug output, as "radiusd -X".) > > radtest test testing localhost 0 testing123 > > If you don't want to add the Fall-Through attribute to each of your user > entries, you could instead use the following modified DEFAULT section near > the top of the users file, before all the authorized user entries. I've > also tested this configuration. (Note the comma.) > > DEFAULT > Session-Timeout = <timeout>, > Fall-Through = Yes > > > >also i have configured the mysql database for authentication and > accounting. so at that time i am getting error "no User-password or > >CHAP-password" in request. > > Are you using both the users file and MySQL for authentication, or are you > testing each setup separately? I'd recommend getting FreeRADIUS working > with the users file alone before setting up database-based authentication. > > Will D. Spann > > >

1 0