- Freeradius-Users - lists.freeradius.org

Framed-IP-Address override NAS pool?
by up＠3.am 07 Jan '09

07 Jan '09

Hi: In my years running a dialup ISP, I used Cistron Radius and Cisco and Lucent NAS's. I am no using FreeRadius and a Cisco router to authenticate pptp VPN users. The default IP address pool is defined in the Cisco like this (parsed): interface Virtual-Template1 peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ! ip local pool vpnpool 192.168.0.1 192.168.0.254 That works fine authenticating unix system users using this raddb/users config (one of the supplied samples): DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP I now want to assign a few users different, static IPs using this: testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement). Is there something else that needs to be done to allow this? Thanks in advance! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 6

unsubscribe
by Milan Holub 07 Jan '09

07 Jan '09

unsuscribe

1 0

EAP-TLS
by Brian Ertel 07 Jan '09

07 Jan '09

Hi, I've modified the eap.conf, clients.conf, and users respectfully but am getting the below error when started radius: Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: No EAP type configured, module cannot do anything. radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. The following are the config's I made. Please let me know if you see anything that needs to change just to get radius start. eap.conf default_eap_type =tls tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random clients.conf client 148.85.0.0/16 { # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 31 characters in length. # secret = XXXXXXX # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # shortname = WAPS users DEFAULT Auth-Type :=EAP Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "300", Thanks, Brian

2 1

NAS-Identifier and radgroupcheck table
by Arrigo Savio 07 Jan '09

07 Jan '09

6 14

Re: rlm_perl - dbi - freetds works on radiusd -X but fails to sql connect in background
by nes pa 07 Jan '09

07 Jan '09

selinux was the culprit, thank you very much! On Wed, Jan 7, 2009 at 2:22 PM, nes pa <nespala(a)gmail.com> wrote: > I've changed the example.pl perl script so it 'use DBI;' to query a Sybase > server via freetds. > > Any hints welcome for solution or better tools to debug/strace into the > perl script. > > > > > > >

1 0

rlm_perl - dbi - freetds works on radiusd -X but fails to sql connect in background
by nes pa 07 Jan '09

07 Jan '09

I've changed the example.pl perl script so it 'use DBI;' to query a Sybase server via freetds. It works fine when running in foreground "radiusd -X" while testing. However, if ran in background, the perl script gets triggered, but the dbi connect fails: my $dbh = DBI->connect("dbi:Sybase:server=*****", $user, $passwd, {PrintError => 0}); Error: rlm_perl: perl_embed:: module = /etc/raddb/myperlscript.pm , func = authenticate exit status= Unable for connect to server OpenClient message: LAYER = (0) ORIGIN = (0) SEVERITY = (78) NUMBER = (41) Server ******, database Message String: Server is unavailable or does not exist. * Tethereal shows that there is no network activity towards the Sybase server. * At first I guessed using user radiusd instead of root would sabotage access to /etc/freetds.conf and/or freetds libraries, but changing radiusd.conf so it keep root priviledges didn't help. * I've been checking environment parameters between foreground and background, but could not find a discriminator. * Assuming some chroot'ing getting done by radiusd I have moved freetds.conf inside /etc/raddb ( and /etc/raddb/etc ) to no avail. * I have ran strace -f -p <pid> in the hope to see what the perlscript tries to do when invoked by a radius request, but I only see it writing the error to the /var/log/radius/radius.log * Changed the hostname towards ip address in /etc/freetds.conf to avoid a failing name resolving. Any hints welcome for solution or better tools to debug/strace into the perl script.

2 1

Digest authentication and perl authorization
by Luciano Afranllie 07 Jan '09

07 Jan '09

Hi, I have a test deployment with a sip proxy (kamailio) and a back to back user agent (sippy b2bua) pointing to freeradius. SIP proxy is making digest authentication of users and that is working fine. My plan is to use b2bua for prepaid calls authorization and call dropping (sip proxy forward calls from prepaid users to b2bua) so, I want b2bua to make just authorization of calls (this is, balance check). I am thinking in something like this: - Radius client (b2bua) sends an access-request with Service_type = "Authorize-Only" - Adding perl module to authorization section. - In authorize function of perl module check if the balance is enough to make the call. if yes add an attribute to the reply with granted credit time and return return RLM_MODULE_OK. If no, return RLM_MODULE_REJECT. My questions are: how is the best way of making authorization without authentication? - Should perl module set Auth-Type := Accept if the user is authorized? - What should I need to add in the users file for this to work, something like this? DEFAULT Auth-Type := Accept, Service-Type == "Authorize-Only" Thanks for your time. Regards Luciano

3 3

Freeradius process dies with some (bad?!) EAP requests
by Nelson Vale 07 Jan '09

07 Jan '09

Hi all, We have several machines running freeradius 2.0.2 as authentication server, and we're facing a strange and very critical problem. Occasionally radius server just dies with no apparent reason. When I look at the logs, the last lines I see before it happens are like: "... Error: rlm_eap: No EAPsession matching the State variable. Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request ..." ** I've googled for problems like this and I found some simillar occurrences, but no solutions provided... Is this a known problem that is fixed in a recent version? This is a big issue for us because this causes several thousands of users to complain about it, so we would appreciate your help... Thx, Nelson Vale

4 3

FreeRadius with radiusclient-ng and Cisco h323 VoIP attributes
by Dean Elwood 07 Jan '09

07 Jan '09

Hi there, I'm having real trouble getting FreeRadius and radiusclient-ng to talk to each other with Cisco h323 attributes. I believe I have set up FreeRadius correctly. I can connect using radiusclient-ng and do standard AUTH commands and all works fine. As soon as I try to add an attribute like:- h323-conf-id = '78FF6EBC 2F74D29E 4F400B22 8B4AA1C1' I get this parse error from radiusclient-ng:- : can't parse AV pair I assumed that this meant that radiusclient-ng didn't recognise the h323-conf-id attribute, so I included in the radiusclient-ng *client* dictionary the following:- VENDOR Cisco 9 ATTRIBUTE Cisco-AVPair 1 string Cisco ATTRIBUTE h323-call-origin 26 string Cisco ATTRIBUTE h323-remote-address 23 string Cisco ATTRIBUTE h323-conf-id 24 string Cisco ATTRIBUTE h323-setup-time 25 string Cisco ATTRIBUTE h323-call-origin 26 string Cisco ATTRIBUTE h323-call-type 27 string Cisco ATTRIBUTE h323-connect-time 28 string Cisco ATTRIBUTE h323-disconnect-time 29 string Cisco ATTRIBUTE h323-disconnect-cause 30 string Cisco ATTRIBUTE h323-voice-quality 31 string Cisco ATTRIBUTE h323-gw-id 33 string Cisco ATTRIBUTE h323-incoming-conf-id 35 string Cisco The client appears to be happy with this dictionary file (at least the client runs and still does standard AUTH's ok), but I still get the parse error on the h323 vars. The fact that the parse error states an error parsing "AV pair" makes me think that these attributes need to be formatted in a particular way. Could that be it? Any assistance or pointers in the right direction would be much appreciated.... Thanks, Dean

2 2

Radius (freeradius) server integrated with openldap for user authentication
by Aravind Arjunan 07 Jan '09

07 Jan '09

hi Radius(freeradius) server has configured and integrated with Openldap server for user authentication. Using radtest, NTRadPing and Radiustest (Utility) it is working fine. I got Access-Acept by using this utility. When i try from enduser through Wireless access point i may not able to authenticate. Wireless access point is configured with WPA for security. >From the radius debug level log and slapd log i can able to see that it can able to fetch username and it was successful but in the case of userPassword authetication was getting failed. Am attaching the radius debug level log or your reference rad_recv: Access-Request packet from host 192.168.1.100:1645, id=45, length=130 * User-Name = "sivaji"* Framed-MTU = 1400 Called-Station-Id = "0023.045c.3f20" Calling-Station-Id = "001f.3c78.503a" Service-Type = Login-User Message-Authenticator = 0xd56b1bff210c624ccf5b1d5c56285f10 EAP-Message = 0x0202000b01736976616a69 NAS-Port-Type = Wireless-802.11 NAS-Port = 542 NAS-Port-Id = "542" NAS-IP-Address = 192.168.1.100 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 *rlm_realm: No '@' in User-Name = "sivaji", looking up realm NULL* * rlm_realm: No such realm "NULL"* modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 157 * modcall[authorize]: module "files" returns ok for request 0* rlm_ldap: - authorize rlm_ldap: performing user authorization for sivaji *radius_xlat: '(uid=sivaji)'* *radius_xlat: 'dc=rgipt,dc=in'* rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 *rlm_ldap: bind as / to localhost:389* *rlm_ldap: waiting for bind result ...* *rlm_ldap: Bind was successful* *rlm_ldap: performing search in dc=rgipt,dc=in, with filter (uid=sivaji)* rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... *rlm_ldap: user sivaji authorized to use remote access* rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 *rlm_ldap: - authenticate* *rlm_ldap: Attribute "User-Password" is required for authentication.* * * * modcall[authenticate]: module "ldap" returns invalid for request 0* *modcall: leaving group LDAP (returns invalid) for request 0* *auth: Failed to validate the user.* *Login incorrect: [sivaji] (from client AP port 542 cli 001f.3c78.503a)* *Delaying request 0 for 1 seconds* *Finished request 0* Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 45 to 192.168.1.100 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 45 with timestamp 4960b0d2 Nothing to do. Sleeping until we see a request.

1 0