- Freeradius-Users - lists.freeradius.org

Unknown value specified for Autz-Type, freeradius 2.1.3
by Kent Nasveschuk 22 Dec '08

22 Dec '08

Hello, Having a little problem with "Unknown value specified for Autz-Type". OS CentOS 5 Freeradius version 2.1.3 latest I have this working on a 1.1.3 version that ships with CentOS 5 but having a little problem here. I actually have 2 LDAP sources for testing. One source is used for the switch (Enterasys) that does MAC authentication the other does 802.1x. The records are in different parts of the LDAP tree. The 802.1x works fine. The error message at the bottom is the one I get from the MAC authentication. raddb/modules/ldap: ... ldap devices { server = "192.168.1.12" identity = "uid=xxxx,ou=xxxx,dc=mbl,dc=edu" password = xxxxxx basedn = "ou=devices,ou=network,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" tls { start_tls = no } tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no dictionary_mapping = ${confdir}/ldap.attrmap access_attr = "radiusFilterId" set_auth_type = yes } ... raddb/sites-enabled/inner-tunnel: ... authorize { Autz-Type DEVICES { devices } ... } ... authenticate { Auth-Type DEVICES { devices } ... } raddb/sites-enabled/users: # TEST C2 MAC DEFAULT Auth-Type := DEVICES, Auth-Type := ACCEPT, Autz-Type := DEVICES, Client-IP-Address == "192.168.1.15" Filter-Id := "Enterasys:version=1:policy=D-Unregistered", Fall-Through = yes radiusd -X (MAC authentication failure): ... Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.15 port 49152, id=62, length=146 User-Name = "00-11-24-80-40-7A" Service-Type = Framed-User Called-Station-Id = "00-01-F4-5C-97-80" Calling-Station-Id = "00-11-24-80-40-7A" NAS-IP-Address = 192.168.1.15 NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "ge.1.17" User-Password = "xxxxxxx" Message-Authenticator = 0x21da3669c869a962c6270f0cee3d3bac +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "00-11-24-80-40-7A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{Client-IP-Address} -> 192.168.1.15 [files] expand: %{Client-IP-Address} -> 192.168.1.15 [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Using Autz-Type DEVICES WARNING: Unknown value specified for Autz-Type. Cannot perform requested action. Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 62 to 192.168.1.15 port 49152 Filter-Id := "Enterasys:version=1:policy=D-Unregistered" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 62 with timestamp +2 Ready to process requests. Any help wold be appreciated. Kent Kent L. Nasveschuk Systems Administrator ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543

2 1

Issue when login name and password configured in UTF-8 format
by Elayaraja Prabhakaran 22 Dec '08

22 Dec '08

Dear freeradius-users list members, I am testing on freeradius server with X-Supplicant and PostgreSQL. The client_encoding in DB is set to UTF-8 by default. When configuring login name and password in english text, authentication is successfully completed. However, when i use UTF-8 characters as login name, freeradius server is dropping the packets and the error message i found in server is login name is incorrect. But the loginname configured in xsupplicant and freeradius are same (UTF-8 format). I guess the FreeRadius does not support UTF-8 chars and hence, passes some junk (letters converted into DECIMAL with "=" prefix). Below is the log of Freeradius when run in DEBUG mode. ********************************************************************************************** Mon Dec 22 19:46:38 2008 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 19 Mon Dec 22 19:46:38 2008 : Debug: expand: %{User-Name} -> Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£?? Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£??' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Mon Dec 22 19:46:38 2008 : Debug: expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' ORDER BY id Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' ORDER BY id Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 5 Mon Dec 22 19:46:38 2008 : Debug: expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query: SELECT GroupName FROM usergroup WHERE UserName='=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 1 Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): Released sql socket id: 0 Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): User Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£?? not found Mon Dec 22 19:46:38 2008 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 19 Mon Dec 22 19:46:38 2008 : Debug: ++[sql] returns notfound ********************************************************************************************** Is there any way to achieve UTF-8 support only with postgresql queries (some kind of conversion to binary and then can be compared with radcheck and radreply) or is there any tweak with Freeradius? Regards Elayaraja P ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Status counters
by Anders Holm 21 Dec '08

21 Dec '08

Hi folks. Looking a tad at the counters and how they get incremented I see the following: Sending Access-Accept of id 20 to 127.0.0.1 port 32772 FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 36 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 36 This is on a test server, which currently is only getting requests for status. Shouldn't the Access-Requests also be incremented? I mean, if the Access-Accept is incremented, we must have had a request to being with. Also, using these counters for monitoring, it would be nice to see deltas from the previous Status request. Though, if I would go ahead and clear the counters (haven't even checked if it is possible tbh) I might have requests arriving between my last Status request packet and my clearing the counter, meaning my metrics would be incorrect. Would it be trivial to add some form of delta-since-last-status-request, or is it preferred to keep that in an external script? Just trying to figure out which would be the best route, and what others think of the idea. Might be useful for others here, so ... //anders

2 10

[Wimax with Alcatel Base Station]
by Thomas Fagart 21 Dec '08

21 Dec '08

Hello, After being able to produce great statistics with the new status server feature, being able to do nice debug on production server with radmin, (thanks again for this great features !), i'm also trying to do wimax authentication with freeradius 2.1.3. Here are some questions : 1. Using radmin and the debug and even after reading man unlang, i'm still not able to filter requests based on client IP (this is easier then I'll be able to get only requests coming from the BS) 2. Having read the lasts posts on Wimax saying we should use the last stable release, it seems that the stable release is not available from http, then I use the git, but I'm only able to get the development release (2.2.0) using the following command portable-bsd# git clone git://git.freeradius.org/freeradius-server.git radiusd Initialized empty Git repository in /usr/home/tom/radiusd/.git/ remote: Counting objects: 60339, done. remote: Compressing objects: 100% (15102/15102), done. remote: Total 60339 (delta 46934), reused 57865 (delta 45104) Receiving objects: 100% (60339/60339), 11.50 MiB | 2655 KiB/s, done. Resolving deltas: 100% (46934/46934), done. I guess I'm not using the correct URL for stable, but I was not able to find the good one on docs ? 3. Using 2.1.3 I got the following output between BS and radius http://www.brozs.net/log/radius.log It seems EAP never says it's ok (might be Base Station Related but I've got no access to check) www1# more /usr/home/tom/radius.log | grep eaptls Sun Dec 21 00:36:18 2008 : Debug: [tls] eaptls_verify returned 7 Sun Dec 21 00:36:18 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:19 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_verify returned 7 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_process returned 13 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_verify returned 1 Sun Dec 21 00:36:21 2008 : Debug: [tls] eaptls_process returned 13 Thanks Thomas

2 2

1.1.7 to 2.X Upgrade ?
by manIP 21 Dec '08

21 Dec '08

Hi all, I have installed freeradius last year (October 2007) on a debian and after reading the post on freeradius.org, I am wondering if it is really necessary to upgrade to the last version (because of some security bugs). Any advice? Also, anyone could give me a hint on how to upgrade easily without getting complications? (FYI, I've made a debian package from the source code) Thanks again Khalid

2 3

Help Regarding SQL Counter
by pushpraj nimbalkar 20 Dec '08

20 Dec '08

Hello All; I just installed freeradius on fedora 10. freeradius version is "freeradius-2.1.1-2.fc10.i386" i also installed radius mysql packages. After basic set up I configured radius with mysql. All thing are working fine but i am not able to resolve sqlcounter issue. I have defined counters in counter.conf file and included those counters in /etc/raddb/sites-enabled/default file. When i create user with 30 minutes session time(Max-All-Session). Then user should be able to login only for 30 minutes. But what is happening is when user connects he can be online as much time as he can. That 30 mintutes counter dosent wotks. But when same user first logins for 5 minutes and logs off and again logins then counter works perfectly means user can be online only for remaining time i.e. for 25 minutes. So i think sqlcounter works only when there is accounting records for loging user inside radacct table but when user first time logins then there will not be any records inside radacct table. Same thing happening with octate account. Please Help. Thanks, Pushpraj N.

3 9

libradiusclient 64-bit
by J Santos 20 Dec '08

20 Dec '08

Hi all, does anybody know where can I find the libradiusclient 64-bit ? I am using CentOs 64 bits and after googling around I couldn't find it. thanks J Santos

2 1

Why the DEFAULT everywhere?
by Todd R. 20 Dec '08

20 Dec '08

Can someone explain to me why it always seems that the word DEFAULT is before many lines or rules etc. within all the FR configs? Since I am trying to learn as much as possible about FR, I just thought I would ask this question I am sure most of you will consider a really stupid question :) Thanks for any insight on this. Regards, Todd R.

2 1

Restricting dialup users to certain client definitions only
by Todd R. 20 Dec '08

20 Dec '08

In a nutshell here is what I need to do, the long story is after the short version if you are interested. ########Short version########## I want to restrict dialup users or a group of dialup users living within my MySQL tables to certain clients or list of clients. So when a user who is only allowed access when coming from clients 1 and 2 dials in and the request comes from client 3 he is denied access. I already do this with the crappy Windows based radius solution we have been stuck on for years, surely I can accomplish the same with FR. Any help in a language which a total FR novice can understand would be appreciated. ######end short version######## ########Long Version########### I have read the docs, the archives, the readmes, the examples etc. So far, I can't get a good handle on how to accomplish the following so I am again asking for some guidance from the list. Here is my situation and what I need to accomplish, any help in getting this done would be most appreciated. I don't mind doing the footwork, research etc. to build a solution that will work but please keep in mind that I am a total FR Newb and need this in dufus language :) For the last 8 years or so we have been using a dreaded windows based Radius solution that we just couldn't get away from due to how much code we have written around this horrible solution. Finally, it's time to just do it and deal with the pain. What we have right now is several dialup wholesale networks/carriers/aggregators who proxy the radius request to us, we then decide to accept or deny the dialup user based on many things but of course username/pass etc.. One of the things we use to determine if they get access or not is which client they came from meaning which of our wholesale dialup network's radius server (client) sent us the request. So, in short I need to accomplish the same thing on FR. Let's say I have 5 clients, their short names and IPs configured in my FR clients file. I need to somehow decide within FR when the request comes in from client #1 that this user (in Mysql table) is allowed to have access to that dialup network. So: Joeuser from client1 = OK (allow user) Joeuser from client2 = Not OK (deny user) I am guessing I should do something with groups within the SQL tables such as assign joeuser to dialgroup1 which is then somehow allowed from client1 or for that fact clients 1, 3 and 5 but not allowed to client2. I researched huntgroups but can't find much documentation on that, not sure if that's were I need to go or?? Regards, Todd R.

4 5

Help with "extending logging" ...
by al pat 20 Dec '08

20 Dec '08

Hi, I am trying to parse accounting logs of cablelabs format. Some of the attributes are octet strings which in itself contain detailed information that is printed as a octet string by freeradius. e.g.: CableLabs-Event-Message = 0x484153482830783833326632306329 CableLabs-Related-Call-Billing-Crl-ID += 0x494b8dc32020202020202032302b3 0303030303000000040 CableLabs-Related-Call-Billing-Crl-ID += 0x494b8dc32020202020202032302b3 030303030300000003f Acct-Session-Id = "IK\215\303 20+000000\000\000\000?" ..... other avps' ... With help of members on this list, I have been able to write a perl module to parse these octet strings, but am not able to log them in proper place. I need to log all the standard attributes (typically logged in .../Client-IP-Addr/detail-<date> file) as well as these extra parsed attributes in one place. These are all in the accounting messages - need to achieve a consolidated log for accounting messages - does not matter in which file it is. How to achieve that? Do I need to make a code change - if so where? Do I need to make a change to the config files - if so which? Do I need to use a specific log mechanism in the perl module - if so what? Any other input/guidance to help achieve that? Thank You -a

2 4