- Freeradius-Users - lists.freeradius.org

command autho. is it possible?
by Hegedus Gabor 06 Feb '09

06 Feb '09

Hi all! I have read a lot of manual, example and post, but I still don't know what is the solutions. I have newest freeradius, and cisco devices(now AP). I want the user authentication to the cisco device by fr, It works, I configure the users file like this: test Cleadtext-Password := "test" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" The user get the level what i set. The enable level ( $enalXX$) works too. But don't know how can I set the command authorization, on the freeradius and cisco. The cisco commands what I set: aaa group server radius Radius-Servers server 10.10.10.10 auth-port 1812 acct-port 1813 aaa authentication login default group Radius-Servers aaa authentication enable default group Radius-Servers enable aaa authorization console aaa authorization exec default group Radius-Servers if-authenticated aaa authorization network default group Radius-Servers if-authenticated aaa session-id common In fact, at first time I just want set show running-config but disable configure command. using privilege levels is not good, both commands are on the same level(15). What is the solutions? I don't want use 2 server (tacacs+ and fr) for this. I saw something tacacs+ integration into freeradius but I don't know this is a good solution, an how can I configure. Thank you, Best regards Gabor

3 2

Matching Realms and Group-Membership
by Robert Borz 05 Feb '09

05 Feb '09

Hi, I've successfully set up freeradius and till now it is doing what I want - checking realms and prefixes and uses a postgres database backend. ;) Now I want to implement a check, that verifies if a user authenticating with 10000(a)realma.com is also in the group "realmA" and reject the request if this is not the case. This way I want to implement a "user X purchased product Y?" Already tried this: Adding in the radusergroup table: +------------------+-----------+-----------+ | username | groupname | priority | +------------------+-----------+-----------+ | 10000(a)realmA.com | realmA | 10 | +------------------+-----------+-----------+ And in the radgroupcheck table: +----+-----------+-----------+----+------------+ | id | groupname | attribute | op | value | |----+-----------+-----------+----+------------+ | 1 | realmA | Realm | != | realma.com | +----+-----------+-----------+----+------------+ And finally in the radgroupreply table: +----+-----------+---------------+----+-----------------------+ | id | groupname | attribute | op | value | +----+-----------+---------------+----+-----------------------+ | 1 | realmA | Auth-Type | := | Reject | +----+-----------+---------------+----+-----------------------+ And of course, my debug output says: rlm_realm: Adding Realm = "~^realmA.com$" I also tried adding "~^realmA.com$" as value in the radgroupcheck table with no success. I thought to already understood this concept... but adding "Auth-Type := Reject" in the radgroupcheck table works?! My expression in radgroupcheck also works - I verified this by adding "Reply-Message += Is this working?" within radgroupreply and the reply-message is added to the response. If anybody could assist me with this or just give me a hint it'd be great! Regards, Robert Borz.

2 1

FreeRADIUS without Universal Password
by Jason C Brown 05 Feb '09

05 Feb '09

Is there a way to integrate FreeRADIUS without having to use the universal password in Novell? Jason Brown - RHCT, Security+, Linux+, Network+ Systems Administrator Enterprise Technology Services Ferris State University (231) 591-2687

6 12

Cannot get value of config item with \\
by Matej Vadnjal 05 Feb '09

05 Feb '09

Hello I'm having trouble getting the value of auth_pool of a realm. Realms are defined as regular expressions matched by suffix module against the domain portion of users username. The problem is when the realm regex contains \\ (eg: "~^example\\.com$") the config variable is not found: ++? if ("%{config:realm[%{Realm}].auth_pool}" =~ /%{client-shortname}/i) expand: realm[%{Realm}].auth_pool -> realm[~^example\\.com$].auth_pool WARNING: No such configuration item realm[~^example\\.com$].auth_pool expand: %{config:realm[%{Realm}].auth_pool} -> expand: %{client-shortname} -> idp If I change the realm regex so it has no \\ (eg: "~^example.com$") it is found correctly: ++? if ("%{config:realm[%{Realm}].auth_pool}" =~ /%{client-shortname}/i) expand: realm[%{Realm}].auth_pool -> realm[~^example.com$].auth_pool expand: %{config:realm[%{Realm}].auth_pool} -> idp_pool expand: %{client-shortname} -> idp My config looks something like this: sites-enabled/default: authorize { preprocess suffix # Sets Realm variable files if ("%{config:realm[%{Realm}].auth_pool}" =~ /%{client-shortname}/i) { reject } } ... proxy.conf: home_server idp { type = auth ipaddr = 10.0.99.110 port = 1812 secret = secret response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool idp_pool { type = client-balance home_server = idp } realm "~^example\\.com$" { nostrip auth_pool = idp_pool } clients.conf: client 10.0.99.110 { secret = secret shortname = idp nastype = other } Is this a bug or a safety feature (preventing some sort of injection attacks)? I tried all sorts of combination of single quites, double quotes, no quotes, but to no avail. Am I missing something obvious? Any ideas would be appreciated. -- Matej Vadnjal ANRES

4 14

Affect Static IP by Freeradius/ASA5510
by Phibee Network Operation Center 04 Feb '09

04 Feb '09

Hi Sorry to restart the same subject, but actually i am search .. i am search .... but i don't see any solution ... I use: FreeRadius with a Perl Script A Cisco ASA5510 IOS 8.0 In debug i have: When a user don't have IP, use "Pool" : ============================================================== rad_recv: Access-Request packet from host 10.218.7.243:1025, id=31, length=166 User-Name = "vpn001(a)xx.fr" User-Password = "XXX" NAS-Port = 1658880 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "62.XX.XX.XX" Calling-Station-Id = "88.XX.XX.XX" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "88.XX.XX.XX" NAS-IP-Address = 10.218.7.243 Cisco-AVPair = "ip:source-ip=88.XX.XX.XXy\223" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "xx.fr" for User-Name = "vpn001(a)xx.fr" rlm_realm: No such realm "xx.fr" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 0 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair h323-credit-amount = 100 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 0 modcall: leaving group Perl (returns ok) for request 0 Login OK: [vpn001(a)xx.fr/XXX] (from client 10.218.7.243 port 1658880 cli 88.XX.XX.XX) Sending Access-Accept of id 31 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP h323-credit-amount = "100" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 4989aa4d Nothing to do. Sleeping until we see a request. ================================================ No problems, the user connect and have a IP of the Pool When i use a user with static IP: ================================================ rad_recv: Access-Request packet from host 10.218.7.243:1025, id=32, length=166 User-Name = "vpn006(a)xx.fr" User-Password = "XXX" NAS-Port = 1662976 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "62.23.17.71" Calling-Station-Id = "88.XX.XX.XX" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "88.XX.XX.XX" NAS-IP-Address = 10.218.7.243 Cisco-AVPair = "ip:source-ip=88.XX.XX.XXy\223" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "xx.fr" for User-Name = "vpn006(a)xx.fr" rlm_realm: No such realm "xx.fr" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 154 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 1 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 10.218.3.41 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 1 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair h323-credit-amount = 100 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 10.218.3.41 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 1 modcall: leaving group Perl (returns ok) for request 1 Login OK: [vpn006(a)xx.fr/XXX] (from client 10.218.7.243 port 1662976 cli 88.XX.XX.XX) Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP h323-credit-amount = "100" Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 32 with timestamp 4989aa74 Nothing to do. Sleeping until we see a request. ============================================= I see "Framed-IP-Address = 10.218.3.41" but at the end of the logs he have: "Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254" Why he sending 255.255.255.254 ..... It's because i use a client type "cisco" ? because my perl script use "RLM_MODULE_OK" at authenticate and accounting ? Thanks for your help

3 5

dialup admin config
by Mr Little Crazzy 04 Feb '09

04 Feb '09

Hi users i have installed diualup admin i like it! I am traying to configure but my problem are that not list online users conected ,failed loging , and etc. I have been installed the net-snmp. I could create an user an conect but not the other thing like i said in the up lines. what is wrong ?? I read a lot of articles but not explain very good for newbie people. Someone have a How to ?? or a webpage ?? thz _________________________________________________________________ Permanece actualizado con MSN Noticias. Clic aquí http://noticias.cl.msn.com/

1 0

Query on Acct-Status-Type
by ramesh p 04 Feb '09

04 Feb '09

Hi all, I need to store packets with "Acct-Status-Type := Stop" only in db 'radacct', rest of the packets needs to be ignored. How to proceed. Plz give suggestion. Note: am using freeradius1.1.6 version. Regards, Ramesh.

2 6

accounting only client?
by ST Wong (ITSC) 04 Feb '09

04 Feb '09

Hi all, Can I setup clients.conf so that some clients are allowed to send accounting packet only ? I'm using 2.1.3. Thanks a lot. /ST Wong

2 1

Re: Problem with only some users. Monowall - Freeradius
by Daniel Bojczuk 04 Feb '09

04 Feb '09

Sorry I didn't understand. I executed freeradius on debug mode, then I used the radtest command. The message is almost the same, but the proxy (@dialup,usp.br - another radius server in another city) returns OK. Why using radtest it returns OK and using monowall it retorns Reject? Thanks, sorry about my english. Daniel 2009/2/3 SDamron <sdamron(a)gmail.com> Looks like some kind of problem with your database. It clears when > you auth against the radtest, but when you try to use a user in the > database, it fails. > > On Tue, Feb 3, 2009 at 6:45 PM, Daniel Bojczuk <daniel(a)cirp.usp.br> wrote: > > Hi!! > > > > I have a Monowall athorizing and accounting on a Freeradius 2.1.1 > > > > When I execute: > > radtest nbatista(a)dialup.usp.br ******* 123.123.123.123 0 's3mf!o/' > > I get the folowing answer: > > Sending Access-Request of id 177 to 123.123.123.123 port 1812 > > User-Name = "nbatista(a)dialup.usp.br" > > User-Password = "nat6672" > > NAS-IP-Address = 123.123.123.123 > > NAS-Port = 0 > > rad_recv: Access-Accept packet from host 123.123.123.123 port 1812, > > id=177, length=68 > > Framed-IP-Address = 255.255.255.254 > > Framed-MTU = 1500 > > Service-Type = Framed-User > > Framed-Protocol = PPP > > Framed-Compression = Van-Jacobson-TCP-IP > > Session-Timeout = 86400 > > Framed-IP-Netmask = 255.255.255.0 > > Idle-Timeout = 3600 > > > > Everything works fine. But when I try to login using Monowall login page > on > > debug mode I have this: > > > > > ___________________________________________________________________________________________________________________________ > > > > rad_recv: Access-Request packet from host 124.124.124.124 port 63026, > > id=166, length=150 > > NAS-IP-Address = 124.124.124.124 > > NAS-Identifier = "gwrp.semfio.usp.br" > > User-Name = "nbatista(a)dialup.usp.br" > > User-Password = "*******" > > Service-Type = Login-User > > NAS-Port-Type = Ethernet > > NAS-Port = 83 > > Framed-IP-Address = 125.125.125.125 > > Called-Station-Id = "00:11:2f:75:81:7c" > > Calling-Station-Id = "00:1b:77:b5:34:9d" > > +- entering group authorize {...} > > ++[preprocess] returns ok > > [auth_log] expand: > > /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > -> > > /usr/local/var/log/radius/radacct/143.107.192.54/auth-detail-20090203 > > [auth_log] > > /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > > expands to > > /usr/local/var/log/radius/radacct/143.107.192.54/auth-detail-20090203 > > [auth_log] expand: %t -> Tue Feb 3 17:30:54 2009 > > ++[auth_log] returns ok > > [suffix] Looking up realm "dialup.usp.br" for User-Name = > > "nbatista(a)dialup.usp.br" > > [suffix] Found realm "dialup.usp.br" > > [suffix] Adding Realm = "dialup.usp.br" > > [suffix] Proxying request from user nbatista to realm dialup.usp.br > > [suffix] Preparing to proxy authentication request to realm " > dialup.usp.br" > > ++[suffix] returns updated > > [sql] expand: %{User-Name} -> nbatista(a)dialup.usp.br > > [sql] sql_set_user escaped user --> 'nbatista(a)dialup.usp.br' > > rlm_sql (sql): Reserving sql socket id: 6 > > [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck > > WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, > > Attribute, Value, Op FROM radcheck WHERE Username = > > 'nbatista(a)dialup.usp.br' ORDER BY id > > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > > rlm_sql_postgresql: query affected rows = 0 , fields = 5 > > [sql] expand: SELECT GroupName FROM radusergroup WHERE > > UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM > > radusergroup WHERE UserName='nbatista(a)dialup.usp.br' ORDER BY priority > > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > > rlm_sql_postgresql: query affected rows = 0 , fields = 1 > > rlm_sql (sql): Released sql socket id: 6 > > [sql] User nbatista(a)dialup.usp.br not found > > ++[sql] returns notfound > > ++[pap] returns noop > > Sending Access-Request of id 239 to 126.126.126.126 port 1812 > > NAS-IP-Address = 124.124.124.124 > > NAS-Identifier = "gwrp.semfio.usp.br" > > User-Name = "nbatista(a)dialup.usp.br" > > User-Password = "*******" > > Service-Type = Login-User > > NAS-Port-Type = Ethernet > > NAS-Port = 83 > > Framed-IP-Address = 125.125.125.125 > > Called-Station-Id = "00:11:2f:75:81:7c" > > Calling-Station-Id = "00:1b:77:b5:34:Sending Access-Request of id > > 239 to 143.107.253.10 port 1812 > > NAS-IP-Address = 124.124.124.124 > > NAS-Identifier = "gwrp.semfio.usp.br" > > User-Name = "nbatista(a)dialup.usp.br" > > User-Password = "*******" > > Service-Type = Login-User > > NAS-Port-Type = Ethernet > > NAS-Port = 83 > > Framed-IP-Address = 125.125.125.125 > > Called-Station-Id = "00:11:2f:75:81:7c" > > Calling-Station-Id = "00:1b:77:b5:34:9d" > > Proxy-State = 0x313636 > > Going to the next request > > Waking up in 0.8 seconds. > > Cleaning up request 5 ID 194 with timestamp +9 > > Waking up in 0.1 seconds. > > Waking up in 13.0 seconds. > > rad_recv: Access-Reject packet from host 126.126.126.126 port 1812, > id=239, > > length=82 > > Reply-Message = "\r\nYou are already logged in 2 times - access > > denied\r\n\n" > > Proxy-State = 0x313636 > > +- entering group post-proxy {...} > > [eap] No pre-existing handler found > > ++[eap] returns noop > > Login incorrect (Home Server says so): [nbatista(a)dialup.usp.br] (from > client > > gwrp port 83 cli 00:1b:77:b5:34:9d) > > Using Post-Auth-Type Reject > > WARNING: Unknown value specified for Post-Auth-Type. Cannot perform > > requested action. > > Sending Access-Reject of id 166 to 123.123.123.123 port 63026 > > Reply-Message = "\r\nYou are already logged in 2 times - access > > denied\r\n\n" > > Finished request 6. > > Going to the next request > > Waking up in 4.9 seconds. > > > ____________________________________________________________________________________________________________________ > > > > I understood that there are 2 sessions opened. am I correct? If I am how > can > > I close these sessions? > > And why does radtest work? > > > > > > Thanks! > > > > Sorry about my English. > > > > Daniel Bojczuk > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

3 2

RE: Variable for Secret in Request?
by Eric Geier 04 Feb '09

04 Feb '09

Great, thanks! If sql xlat won't work in the clients file, do you recommend to check something in particular? I also can't get the mac authentication working with Calling-Station-ID in the radcheck table...maybe I have something wrong with my sql on the freeradius machine or with the SQL server. -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, February 03, 2009 1:47 PM To: FreeRadius users mailing list Subject: Re: Variable for Secret in Request? Eric Geier wrote: > Is there a Variable for the shared secret used in the request packets? %{client:secret} *Anything* in the client section can be referenced this way: clients.conf: client foo { ipaddr = 1.2.3.4 secret = testing123 the_beatles = cool } authorize, etc.: if ("%{client:the_beatles}" == "cool") { ... } Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html No virus found in this incoming message. Checked by AVG - http://www.avg.com Version: 8.0.176 / Virus Database: 270.10.16/1930 - Release Date: 2/2/2009 7:21 PM

3 3