- Freeradius-Users - lists.freeradius.org

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 25 Dec '08

25 Dec '08

Estaré ausente de la oficina desde el 2008-12-24 y no volveré hasta el 2009-01-02. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Jose Manuel Gomez Perez o Juan Orea Hernandez. Felices fiestas y próspero año nuevo. ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

Some help in Freeradius
by Enrique Acosta 24 Dec '08

24 Dec '08

Hello Alan an members of the list, We are using freeradius and we have the following situation authenticating in wireless access A single user have records on radcheck of Password and Calling-Station-Id but when this user try to logging the server response : Fri Dec 19 13:24:41 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Fri Dec 19 13:24:41 2008 : Auth: Login incorrect: [jvidal/<no User-Password attribute>] (from client radius-server port 0) Fri Dec 19 13:24:41 2008 : Auth: Login incorrect: [jvidal/<no User-Password attribute>] (from client red-Wifi-FCMC1 port 1 cli 00-18-4D-66-60-24) Although in radcheck this user has the following information: +-----+----------+--------------------+----+-------------------+ | id | UserName | Attribute | op | Value | | +-----+----------+--------------------+----+-------------------+ | 116 | jvidal | User-Password | := | xxx | | 117 | jvidal | Calling-Station-Id | == | 0:18:4d:66:60:24) Can you give some ideas of the reason of why the authentication is failing. Thanks -- Enrique Acosta Figueredo Adm. de Red en Nodo Infosur, Cfgos, Cuba(Network Administrator at Infosur Node, Cfgos, Cuba) Est modus in rebus Linux User # 301079 http://counter.li.org --------------------------------------- Red Telematica de Salud - Cuba CNICM - Infomed

3 13

EAP Access-Accept for all authentication requests?
by Raymond Carr 24 Dec '08

24 Dec '08

Hi, I'm trying to set my server up to authenticate everyone in an 802.1x/PEAP environment without regard to the credentials they provide. Can this be done with FreeRadius? I'm on version 2.1.3. Thanks!

2 3

rlm_ldap and multiple ldap calls?
by JR Mayberry 23 Dec '08

23 Dec '08

I'm not really sure if I'm doing this right, maybe someone can provide guidance. I have two problems a) how to structure my directory and b) how to do two lookups in rlm_ldap. But, effectively, LDAP is our authorization store and I'm proxying RADIUS to an RSA server for authentication only. We're removing all authorization from RSA. So, I've got devices in ou=Hosts,dc=blah,dc=com that are following the ipHost objectClass. Basically, I need a mechanism to put those devices into 'groupOfIpHosts' - which isn't a real concept. So, I use the 'seeAlso' attribute to reference a group of systems for that particular ipHost. Then, I lookup that group and check if the user authenticating is a uniqueMember in that group. So, I'm basically doing two ldap lookups. Right now, I'm doing it in an rlm_perl module which has obvious disadvantages (ldap persistence). So a) is there a better way to structure my directory? b) can I do multiple ldap lookups using rlm_ldap to achieve same end goal? LDAP calls looks like this now 1) get the hosts group $mesg = $ldap->search( base => "ou=Hosts,dc=comcast,dc=com", filter => "(&(ipHostNumber=$ipaddress))", attrs => ["seeAlso"], ); ## returns group membership into $group 2) verify user in group $mesg = $ldap->search ( base => $group, filter => qq{(&(uniqueMember=uid=$username,ou=users,dc=comcast,dc=com))}, attrs => ["uniqueMember"], );

3 2

Attributes Bandwidth in radgrouprepy table
by "Belén Colmenar (Grupo GOWEX)" 23 Dec '08

23 Dec '08

Hi everyone, I have a problem when I want to pass attributes for radgroupreply to the NAS. My NAS is a Linksys with chillispot installed, and I've installed Freeradius-2.1.3 with his dictionary: # The filename given here should be an absolute path. # $INCLUDE /usr/local/freeradius/share/freeradius/dictionary $INCLUDE /usr/local/freeradius/share/freeradius/dictionary.mikrotik $INCLUDE /usr/local/freeradius/share/freeradius/dictionary.chillispot ** The same problem is having with Mikrotik NAS. The conecction is ok except in this point. User can to connect to internet with nas after authenticate in my radius server but my freeradius is not sending these attributes to NAS in Access-Accept +----+-----------+--------------------------+----+--------+------+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+--------------------------+----+--------+------+ | 11 | pruebas | Idle-Timeout | := | 300 | 0 | | 12 | pruebas | Max-Session-Time | := | 5 | 0 | | 13 | pruebas | WISPr-Bandwidth-Max-Up | := | 128000 | 0 | | 17 | pruebas | WISPr-Bandwidth-Max-Down | := | 128000 | 0 | | 18 | pruebas | Session-Timeout | := | 259199 | 0 | +----+-----------+--------------------------+----+--------+------+ Anyone knows why??? I've also seen in debug by radiusd -X the next: [sql] expand: %{User-Name} -> pepe(a)dominio.com [sql] sql_set_user escaped user --> 'pepe(a)dominio.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pepe(a)dominio.com' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok It's checking the query in radcheck but not in radgroupreply. And I've tested the query in dialup.conf and seems correct authorize_group_reply_query = "SELECT ${groupreply_table}.id, ${groupreply_table}.GroupName,${groupreply_table}.Attribute, ${groupreply_table}.Value,${groupreply_table}.op FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" Thanks in advance

3 10

Your Industry profile
by VOIP Expert 23 Dec '08

23 Dec '08

3 3

Exec-Program in acct_users file
by Anton Borisov 23 Dec '08

23 Dec '08

Good day! Does everyone know about Exec-Program in acct_users in Freeradius 2.1.1? I upgrade my from 1.1.7 to 2.1.1 and do not see exec in debug. I used Start and Stop in accounting for some DNS registrations of my clients, like this: ~# cat acct_users ... ... DEFAULT Realm == 'dyndns', Acct-Status-Type == Start, Acct-Type := BILL Exec-Program = "/opt/fr/bin/dyndns.acctstart.pl" DEFAULT Realm == 'dyndns', Acct-Status-Type == Stop, Acct-Type := BILL Exec-Program = "/opt/fr/bin/dyndns.acctstop.pl" and this works in 1.1.7 ! But for 2.1.1 - this does not work. Mon Dec 22 18:19:19 2008 : Info: ++[preprocess] returns ok Mon Dec 22 18:19:19 2008 : Info: [suffix] Looking up realm "dyndns" for User-Name = "12345@dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Found realm "dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Adding Stripped-User-Name = "12345" Mon Dec 22 18:19:19 2008 : Info: [suffix] Adding Realm = "dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Accounting realm is LOCAL. Mon Dec 22 18:19:19 2008 : Info: ++[suffix] returns ok Mon Dec 22 18:19:19 2008 : Info: [files] expand: %{NAS-IP-Address} -> 212.119.106.21 Mon Dec 22 18:19:19 2008 : Info: [files] acct_users: Matched entry DEFAULT at line 32 in this point (32 line - Realm == 'dyndns', 33 line Exec-Program = "blabla" in acct_users) doesn not work. Mon Dec 22 18:19:19 2008 : Info: ++[files] returns ok Mon Dec 22 18:19:19 2008 : Debug: Found Acct-Type BILL Mon Dec 22 18:19:19 2008 : Info: +- entering group BILL {...} Tue Dec 23 10:40:52 2008 : Info: [acct_unique] Hashing 'NAS-IP-Address = 212.119.106.21,Acct-Session-Id = "D4776A151004A3344"' Tue Dec 23 10:40:52 2008 : Info: [acct_unique] Acct-Unique-Session-ID = "eddc8ecb616eae58". Tue Dec 23 10:40:52 2008 : Info: ++[acct_unique] returns ok Tue Dec 23 10:40:52 2008 : Info: [BILL] expand: /opt/fr2/radacct/files/cdr.%Y%m%d.%H -> /opt/fr2/radacct/files/cdr.20081223.10 Tue Dec 23 10:40:52 2008 : Info: [BILL] /opt/fr2/radacct/files/cdr.%Y%m%d.%H expands to /opt/fr2/radacct/files/cdr.20081223.10 Tue Dec 23 10:40:52 2008 : Info: [BILL] Acquired filelock, tried 1 time(s) Tue Dec 23 10:40:52 2008 : Info: [BILL] expand: %t -> Tue Dec 23 10:40:52 2008 Tue Dec 23 10:40:52 2008 : Info: [BILL] Released filelock Tue Dec 23 10:40:52 2008 : Info: ++[BILL] returns ok Sending Accounting-Response of id 66 to 128.1.134.55 port 50812 in this point does not work again... Tue Dec 23 10:40:52 2008 : Info: Finished request 0. Tue Dec 23 10:40:52 2008 : Info: Cleaning up request 0 ID 66 with timestamp +3 Tue Dec 23 10:40:52 2008 : Debug: Going to the next request in 1.1.7 Tue Dec 23 10:28:56 2008 : Debug: rlm_acct_unique: Acct-Unique-Session-ID = "fd9494068cfbfd81". Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: returned from acct_unique (rlm_acct_unique) for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall[accounting]: module "acct_unique" returns ok for request 1 Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: calling BILL (rlm_detail) for request 1 Tue Dec 23 10:28:56 2008 : Debug: radius_xlat: '/opt/fr/radacct/files/cdr.20081223.10' Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: /opt/fr/radacct/files/cdr.%Y%m%d.%H expands to /opt/fr/radacct/files/cdr.20081223.10 Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: Acquired filelock, tried 1 time(s) Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: Released filelock Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: returned from BILL (rlm_detail) for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall[accounting]: module "BILL" returns ok for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall: leaving group BILL (returns ok) for request 1 in this point my script is working. Sending Accounting-Response of id 232 to 128.1.134.55 port 33228 Tue Dec 23 10:28:56 2008 : Debug: Finished request 1 Tue Dec 23 10:28:56 2008 : Debug: Going to the next request -- Yours faithfully, Anton Borisov.

3 3

Re: Unknown value specified for Autz-Type, freeradius 2.1.3
by Kent Nasveschuk 23 Dec '08

23 Dec '08

I added: authorize { ... Autz-Type DEVICES { devices } ... } to sites-available/default and everything now works, MAC authentication from one device and 802.1x from other. The configuration is complex to say the least but works great! Kent Kent L. Nasveschuk Systems Administrator ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543 ----- Original Message ----- From: tnt(a)kalik.net To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, December 22, 2008 4:28:55 PM GMT -05:00 US/Canada Eastern Subject: Re: Unknown value specified for Autz-Type, freeradius 2.1.3 >Having a little problem with "Unknown value specified for Autz-Type". >OS CentOS 5 >Freeradius version 2.1.3 latest >I have this working on a 1.1.3 version that ships with CentOS 5 but having a little problem here. > .. >raddb/sites-enabled/inner-tunnel: .. .. >Ready to process requests. >rad_recv: Access-Request packet from host 192.168.1.15 port 49152, id=62, length=146 > User-Name = "00-11-24-80-40-7A" > Service-Type = Framed-User > Called-Station-Id = "00-01-F4-5C-97-80" > Calling-Station-Id = "00-11-24-80-40-7A" > NAS-IP-Address = 192.168.1.15 > NAS-Port = 17 > NAS-Port-Type = Ethernet > NAS-Port-Id = "ge.1.17" > User-Password = "xxxxxxx" > Message-Authenticator = 0x21da3669c869a962c6270f0cee3d3bac >+- entering group authorize {...} >++[preprocess] returns ok >++[chap] returns noop >++[mschap] returns noop >[suffix] No '@' in User-Name = "00-11-24-80-40-7A", looking up realm NULL >[suffix] No such realm "NULL" >++[suffix] returns noop >[eap] No EAP-Message, not doing EAP >++[eap] returns noop >++[unix] returns notfound >[files] expand: %{Client-IP-Address} -> 192.168.1.15 >[files] expand: %{Client-IP-Address} -> 192.168.1.15 >[files] users: Matched entry DEFAULT at line 5 >++[files] returns ok >++[expiration] returns noop >++[logintime] returns noop >[pap] Found existing Auth-Type, not changing it. >++[pap] returns noop >Using Autz-Type DEVICES > WARNING: Unknown value specified for Autz-Type. Cannot perform requested action. This is default virtual server now. Add the additional types to it as well. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

external script reply
by Hegedus Gabor 23 Dec '08

23 Dec '08

Hi, I have a question, I use external php script to get informations from the ldap. exec getdata { program = .../sg.php %{User-Name} ..?.. } post-auth { getdata } in the php script I do an ldap query with the argument, and take the important data (three word) into variables. How can I take this 3 data back to the Tunnel-Type, Tunnel-Medium-type and Tunnel-Private-Group-Id items of the freeRadius. like: $RAD_REPLY{'Reply-Message'}= 'salala' in perl (form wiki) please help thanks Gabor

2 11

Re: Restricting dialup users to certain client definitions only
by Todd R. 23 Dec '08

23 Dec '08

Can't post now but, yes I do see the groups table being queried ------Original Message------ From: tnt(a)kalik.net Sender: freeradius-users-bounces+tjrlist=lightwavetech.com(a)lists.freeradius.org To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Subject: RE: Restricting dialup users to certain client definitions only Sent: Dec 19, 2008 8:29 PM >Just a clarification on my earlier response. I mentioned that I put the rule >in radcheck when in fact I was putting it in radgroupcheck. > >Thing is, when I put it in radcheck it works. When I put the same rule in >radgroupcheck, it fails. > Are groups processed? Post the debug. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Sent via BlackBerry by AT&T

2 6