- Freeradius-Users - lists.freeradius.org

IP-Assignment with sqlippool based on nas-ip-address
by Sebastian Heil 02 Feb '09

02 Feb '09

Hello, we are using freeradius 2.1.1 on suse linux enterprise server 10. We have different Network Access Servers, which are located in different locations. The users, which login to this NAS, will be assigned an ip-address by the sqlippool-module. I read a lot of the documentation and tried a lot of different things, but i don't know, how to configure the sqlippool-module to assign an ipaddress based on the nas, on the which the users logs in. So for example, if the users logs in on nas1, he will get an ip out of the pool 10.1.1.1 - 10.1.10.255, if he logs in on nas2, he will get an ip out of the pool 10.200.1.1 - 10.200.10.255. The authentication information and the ippoolinformation will be stored in mysql. Can you give me an example where i have to configure this? Thanks. Sebastian -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

3 19

feature request
by Hans-Peter Fuchs 02 Feb '09

02 Feb '09

Hello Alan, today I upgraded from freeradius-2.1.1 to 2.1.3 and stumbled because freeradius does not erase the socket file in /var/run/radiusd. -- Mit freundlichen Grüßen Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 3

tag support in Free Radius
by Marlon Duksa 02 Feb '09

02 Feb '09

Hi - does anyone know how send taged attributes from FreeRadius. I'm including the tag number with a colon after the attribute but not sure if this is correct (the last two attributes): DEFAULT User-Name =~ "([a-z]+):([0-9]+)[^a-z]+([a-z]+):([0-9]+)$", Auth-Type := Local, User-Password == "usrpass" Framed-Pool := "4", ERX-Ingress-Policy-Name := "ingressFilter", ERX-Egress-Policy-Name := "egressFilter", ERX-CoS-Parameter-Type:1 = "basic_sch", ERX-CoS-Parameter-Type:2 += "8m" And this is how the attribute is defined in dictionary: ATTRIBUTE ERX-CoS-Parameter-Type 108 string has_tag But Juniper is complaining about wrong Tag-characters. Feb 1 07:41:38 Vendor-Id: 4874 Attribute Type:ERX-CoS-Parameter-Type(108) Value:string-type Length:10 Feb 1 07:41:38 authd_radius_parse_message:juniper-BRAS type:108 Feb 1 07:41:38 parse_tag_based_vsa: Tag based VSA contains the wrong Tag-character Feb 1 07:41:38 Tag-based VSA parsing failed vendor-id: 4874 type: 108 Feb 1 07:41:38 Vendor-Id: 4874 Attribute Type:ERX-CoS-Parameter-Type(108) Value:string-type Length:3 Feb 1 07:41:38 authd_radius_parse_message:juniper-BRAS type:108 Feb 1 07:41:38 parse_tag_based_vsa: Tag based VSA contains the wrong Tag-character Feb 1 07:41:38 Tag-based VSA parsing failed vendor-id: 4874 type: 108 Feb 1 07:41:38 authd_radius_parse_message: Error parsing ERX avps Feb 1 07:41:38 Framework - module(radius) return: ADMIN CANCELLED Is this above the correct way to send tagged attributes in FreeRadius? Thanks, Marlon

2 1

Freeradius integration
by Nick Owen 01 Feb '09

01 Feb '09

On Thu, Jan 29, 2009 at 2:26 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > Amy Hawke wrote: >> We would like to get two factor authentication working using the >> username/password from our current LDAP directories and then >> username/RSA token code. > > That will likely *not* work. The NAS has to support this behavior, > and usually doesn't. > >> The RSA product is unable to connect to our >> current directories, so if possible we would like to perform the first >> step using FreeRADIUS and then proxy the second part of the request >> through to the RSA Authentication manager. > > We're currently working to get FreeRADIUS integrated with the RSA > token libraries. There are licensing restrictions, so the resulting > code will likely not be part of the "official" release. But it should > be available. We're interested in getting libraries integrated with Freeradius and there would be no licensing issues - we can do a complete opensource offering. What's the best way to get this started? What are the programming requirements? One concern is that while we have support for java, python, C#, PHP and Ruby, we do not have any C libraries. Is it of interest? -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication

2 2

Problem with udpfromto in version 2.1.1 - please help
by Will D. Spann 01 Feb '09

01 Feb '09

Hello all, I'm running FreeRADIUS 2.1.1 on openSUSE 11.1 (x64), and although the server runs without errors in debug mode, I'm getting an error when I run radtest w/ the recommended first test settings: "radtest test test localhost 0 testing123". My RADIUS secret is set to "testing123" currently. The error it gives me is as follows. radclient: socket: cannot initialize udpfromto: Function not implemented I should note that in my radiusd.conf file, I'm not including "eap.conf" nor "sites-enabled/", but other than that I have all default settings. Any help resolving this issue would be greatly appreciated. Thanks. Regards, Will My "radiusd -X" ouput is as follows, if it helps. FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Dec 3 2008 at 13:57:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### modules { } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

2 1

reply message to rejected users
by Alex M 30 Jan '09

30 Jan '09

i'm trying to display reply message to users whos passwords get rejected. so I setup the group and added my test user there. then i went to groupreply table and added reply message there. Now when I do my testing is password is ok the message is displayed BUT if password is incorrect the message is not displayed. I'm sure i did something wrong. So the question is: how do i display message to the user if their username gets rejected by any reason? thanks for help!

2 2

Access based on eDirectory and Accounting
by Martin Potgieter 30 Jan '09

30 Jan '09

Hello list, I am looking for a solution that will allow a captive portal to authenticate against eDirectory but also check the accounting database to ensure a user has not exceeded their bandwidth allocation. I would prefer not to import the eDirectory users into a SQL database but rather keep the actual users in eDirectory but I am not sure if Freeradius can authenticate off of eDirectory and also check accounting information in a SQL db before allowing access. I have used a pure SQL backend and it worked great but need advise on the above. Can anyone tell me if this would require source hacking or if this is a straight forward configuration. And if anyone knows of a web management front end for Freeradius besides the following that I have already looked at, that would be great: Dialup Admin, ARA and Radius Manager. Commercial solutions aswell. Thanks, Martin

2 3

rlm_sql errors
by qrt 30 Jan '09

30 Jan '09

Hi everyone, I use freeradius (FreeRADIUS Version 1.1.4, with security changes through 1.1.7, for host apple.com, built on Sep 23 2007 at 22:52:08) on Mac OS X Server 10.5.6. My problem is that I get messages that I do not understand in the log file It looks like this: > Thu Jan 29 16:10:41 2009 : Auth: rlm_opendirectory: User > <vorname_nachname> is authorized. > Thu Jan 29 16:10:41 2009 : Auth: Login OK: [vorname_nachname/<no > User-Password attribute>] (from client Cisco 4402 port 29 cli 00-17- > F2-E8-74-76) > Thu Jan 29 16:10:42 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #1 > Thu Jan 29 16:10:42 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:10:42 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:10:42 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting ALIVE record - (null) > Thu Jan 29 16:10:48 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #0 > Thu Jan 29 16:10:48 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:10:48 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:10:48 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting ALIVE record - (null) > Thu Jan 29 16:13:44 2009 : Error: rlm_radutmp: Logout entry for NAS > Cisco 4402 port 29 has wrong ID > Thu Jan 29 16:13:44 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #4 > Thu Jan 29 16:13:44 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:13:44 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:13:44 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting STOP record - (null) > Thu Jan 29 16:13:50 2009 : Error: rlm_radutmp: Logout entry for NAS > Cisco 4402 port 29 has wrong ID > Thu Jan 29 16:13:50 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #3 > Thu Jan 29 16:13:50 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:13:50 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:13:50 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting STOP record - (null) > Could someone please tell me what this means? What consequences does this have? What can I do to make this baby running right? Thanks Qrt

3 2

what is this ?
by Freeradius Mail List 30 Jan '09

30 Jan '09

Have some error in freeradius log: Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Can anybody talk what is this ? What is the reason and how to solve ? Thx.

1 1

attribute filter prior to prxy
by Alexandre Chapellon 29 Jan '09

29 Jan '09

Hello, I want to remove all attributes from packets to proxy except some of them i do say are allowed... I thought the following would do the job in the pre-proxy section, but when i check what the freeradius proxies (using tcpdump) i see the filter.... just filters nothing DEFAULT Acct-Status-Type =* ANY, User-Name =* ANY, Framed-IP-Address =* ANY, Qos-Policy-Metering =* ANY, Ip_Address_Pool_Name =* ANY, Class =* ANY

1 1