- Freeradius-Users - lists.freeradius.org

rlm_ldap and multiple ldap calls?
by JR Mayberry 23 Dec '08

23 Dec '08

I'm not really sure if I'm doing this right, maybe someone can provide guidance. I have two problems a) how to structure my directory and b) how to do two lookups in rlm_ldap. But, effectively, LDAP is our authorization store and I'm proxying RADIUS to an RSA server for authentication only. We're removing all authorization from RSA. So, I've got devices in ou=Hosts,dc=blah,dc=com that are following the ipHost objectClass. Basically, I need a mechanism to put those devices into 'groupOfIpHosts' - which isn't a real concept. So, I use the 'seeAlso' attribute to reference a group of systems for that particular ipHost. Then, I lookup that group and check if the user authenticating is a uniqueMember in that group. So, I'm basically doing two ldap lookups. Right now, I'm doing it in an rlm_perl module which has obvious disadvantages (ldap persistence). So a) is there a better way to structure my directory? b) can I do multiple ldap lookups using rlm_ldap to achieve same end goal? LDAP calls looks like this now 1) get the hosts group $mesg = $ldap->search( base => "ou=Hosts,dc=comcast,dc=com", filter => "(&(ipHostNumber=$ipaddress))", attrs => ["seeAlso"], ); ## returns group membership into $group 2) verify user in group $mesg = $ldap->search ( base => $group, filter => qq{(&(uniqueMember=uid=$username,ou=users,dc=comcast,dc=com))}, attrs => ["uniqueMember"], );

3 2

Attributes Bandwidth in radgrouprepy table
by "Belén Colmenar (Grupo GOWEX)" 23 Dec '08

23 Dec '08

Hi everyone, I have a problem when I want to pass attributes for radgroupreply to the NAS. My NAS is a Linksys with chillispot installed, and I've installed Freeradius-2.1.3 with his dictionary: # The filename given here should be an absolute path. # $INCLUDE /usr/local/freeradius/share/freeradius/dictionary $INCLUDE /usr/local/freeradius/share/freeradius/dictionary.mikrotik $INCLUDE /usr/local/freeradius/share/freeradius/dictionary.chillispot ** The same problem is having with Mikrotik NAS. The conecction is ok except in this point. User can to connect to internet with nas after authenticate in my radius server but my freeradius is not sending these attributes to NAS in Access-Accept +----+-----------+--------------------------+----+--------+------+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+--------------------------+----+--------+------+ | 11 | pruebas | Idle-Timeout | := | 300 | 0 | | 12 | pruebas | Max-Session-Time | := | 5 | 0 | | 13 | pruebas | WISPr-Bandwidth-Max-Up | := | 128000 | 0 | | 17 | pruebas | WISPr-Bandwidth-Max-Down | := | 128000 | 0 | | 18 | pruebas | Session-Timeout | := | 259199 | 0 | +----+-----------+--------------------------+----+--------+------+ Anyone knows why??? I've also seen in debug by radiusd -X the next: [sql] expand: %{User-Name} -> pepe(a)dominio.com [sql] sql_set_user escaped user --> 'pepe(a)dominio.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pepe(a)dominio.com' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok It's checking the query in radcheck but not in radgroupreply. And I've tested the query in dialup.conf and seems correct authorize_group_reply_query = "SELECT ${groupreply_table}.id, ${groupreply_table}.GroupName,${groupreply_table}.Attribute, ${groupreply_table}.Value,${groupreply_table}.op FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" Thanks in advance

3 10

Your Industry profile
by VOIP Expert 23 Dec '08

23 Dec '08

3 3

Exec-Program in acct_users file
by Anton Borisov 23 Dec '08

23 Dec '08

Good day! Does everyone know about Exec-Program in acct_users in Freeradius 2.1.1? I upgrade my from 1.1.7 to 2.1.1 and do not see exec in debug. I used Start and Stop in accounting for some DNS registrations of my clients, like this: ~# cat acct_users ... ... DEFAULT Realm == 'dyndns', Acct-Status-Type == Start, Acct-Type := BILL Exec-Program = "/opt/fr/bin/dyndns.acctstart.pl" DEFAULT Realm == 'dyndns', Acct-Status-Type == Stop, Acct-Type := BILL Exec-Program = "/opt/fr/bin/dyndns.acctstop.pl" and this works in 1.1.7 ! But for 2.1.1 - this does not work. Mon Dec 22 18:19:19 2008 : Info: ++[preprocess] returns ok Mon Dec 22 18:19:19 2008 : Info: [suffix] Looking up realm "dyndns" for User-Name = "12345@dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Found realm "dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Adding Stripped-User-Name = "12345" Mon Dec 22 18:19:19 2008 : Info: [suffix] Adding Realm = "dyndns" Mon Dec 22 18:19:19 2008 : Info: [suffix] Accounting realm is LOCAL. Mon Dec 22 18:19:19 2008 : Info: ++[suffix] returns ok Mon Dec 22 18:19:19 2008 : Info: [files] expand: %{NAS-IP-Address} -> 212.119.106.21 Mon Dec 22 18:19:19 2008 : Info: [files] acct_users: Matched entry DEFAULT at line 32 in this point (32 line - Realm == 'dyndns', 33 line Exec-Program = "blabla" in acct_users) doesn not work. Mon Dec 22 18:19:19 2008 : Info: ++[files] returns ok Mon Dec 22 18:19:19 2008 : Debug: Found Acct-Type BILL Mon Dec 22 18:19:19 2008 : Info: +- entering group BILL {...} Tue Dec 23 10:40:52 2008 : Info: [acct_unique] Hashing 'NAS-IP-Address = 212.119.106.21,Acct-Session-Id = "D4776A151004A3344"' Tue Dec 23 10:40:52 2008 : Info: [acct_unique] Acct-Unique-Session-ID = "eddc8ecb616eae58". Tue Dec 23 10:40:52 2008 : Info: ++[acct_unique] returns ok Tue Dec 23 10:40:52 2008 : Info: [BILL] expand: /opt/fr2/radacct/files/cdr.%Y%m%d.%H -> /opt/fr2/radacct/files/cdr.20081223.10 Tue Dec 23 10:40:52 2008 : Info: [BILL] /opt/fr2/radacct/files/cdr.%Y%m%d.%H expands to /opt/fr2/radacct/files/cdr.20081223.10 Tue Dec 23 10:40:52 2008 : Info: [BILL] Acquired filelock, tried 1 time(s) Tue Dec 23 10:40:52 2008 : Info: [BILL] expand: %t -> Tue Dec 23 10:40:52 2008 Tue Dec 23 10:40:52 2008 : Info: [BILL] Released filelock Tue Dec 23 10:40:52 2008 : Info: ++[BILL] returns ok Sending Accounting-Response of id 66 to 128.1.134.55 port 50812 in this point does not work again... Tue Dec 23 10:40:52 2008 : Info: Finished request 0. Tue Dec 23 10:40:52 2008 : Info: Cleaning up request 0 ID 66 with timestamp +3 Tue Dec 23 10:40:52 2008 : Debug: Going to the next request in 1.1.7 Tue Dec 23 10:28:56 2008 : Debug: rlm_acct_unique: Acct-Unique-Session-ID = "fd9494068cfbfd81". Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: returned from acct_unique (rlm_acct_unique) for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall[accounting]: module "acct_unique" returns ok for request 1 Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: calling BILL (rlm_detail) for request 1 Tue Dec 23 10:28:56 2008 : Debug: radius_xlat: '/opt/fr/radacct/files/cdr.20081223.10' Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: /opt/fr/radacct/files/cdr.%Y%m%d.%H expands to /opt/fr/radacct/files/cdr.20081223.10 Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: Acquired filelock, tried 1 time(s) Tue Dec 23 10:28:56 2008 : Debug: rlm_detail: Released filelock Tue Dec 23 10:28:56 2008 : Debug: modsingle[accounting]: returned from BILL (rlm_detail) for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall[accounting]: module "BILL" returns ok for request 1 Tue Dec 23 10:28:56 2008 : Debug: modcall: leaving group BILL (returns ok) for request 1 in this point my script is working. Sending Accounting-Response of id 232 to 128.1.134.55 port 33228 Tue Dec 23 10:28:56 2008 : Debug: Finished request 1 Tue Dec 23 10:28:56 2008 : Debug: Going to the next request -- Yours faithfully, Anton Borisov.

3 3

Re: Unknown value specified for Autz-Type, freeradius 2.1.3
by Kent Nasveschuk 23 Dec '08

23 Dec '08

I added: authorize { ... Autz-Type DEVICES { devices } ... } to sites-available/default and everything now works, MAC authentication from one device and 802.1x from other. The configuration is complex to say the least but works great! Kent Kent L. Nasveschuk Systems Administrator ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543 ----- Original Message ----- From: tnt(a)kalik.net To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, December 22, 2008 4:28:55 PM GMT -05:00 US/Canada Eastern Subject: Re: Unknown value specified for Autz-Type, freeradius 2.1.3 >Having a little problem with "Unknown value specified for Autz-Type". >OS CentOS 5 >Freeradius version 2.1.3 latest >I have this working on a 1.1.3 version that ships with CentOS 5 but having a little problem here. > .. >raddb/sites-enabled/inner-tunnel: .. .. >Ready to process requests. >rad_recv: Access-Request packet from host 192.168.1.15 port 49152, id=62, length=146 > User-Name = "00-11-24-80-40-7A" > Service-Type = Framed-User > Called-Station-Id = "00-01-F4-5C-97-80" > Calling-Station-Id = "00-11-24-80-40-7A" > NAS-IP-Address = 192.168.1.15 > NAS-Port = 17 > NAS-Port-Type = Ethernet > NAS-Port-Id = "ge.1.17" > User-Password = "xxxxxxx" > Message-Authenticator = 0x21da3669c869a962c6270f0cee3d3bac >+- entering group authorize {...} >++[preprocess] returns ok >++[chap] returns noop >++[mschap] returns noop >[suffix] No '@' in User-Name = "00-11-24-80-40-7A", looking up realm NULL >[suffix] No such realm "NULL" >++[suffix] returns noop >[eap] No EAP-Message, not doing EAP >++[eap] returns noop >++[unix] returns notfound >[files] expand: %{Client-IP-Address} -> 192.168.1.15 >[files] expand: %{Client-IP-Address} -> 192.168.1.15 >[files] users: Matched entry DEFAULT at line 5 >++[files] returns ok >++[expiration] returns noop >++[logintime] returns noop >[pap] Found existing Auth-Type, not changing it. >++[pap] returns noop >Using Autz-Type DEVICES > WARNING: Unknown value specified for Autz-Type. Cannot perform requested action. This is default virtual server now. Add the additional types to it as well. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

external script reply
by Hegedus Gabor 23 Dec '08

23 Dec '08

Hi, I have a question, I use external php script to get informations from the ldap. exec getdata { program = .../sg.php %{User-Name} ..?.. } post-auth { getdata } in the php script I do an ldap query with the argument, and take the important data (three word) into variables. How can I take this 3 data back to the Tunnel-Type, Tunnel-Medium-type and Tunnel-Private-Group-Id items of the freeRadius. like: $RAD_REPLY{'Reply-Message'}= 'salala' in perl (form wiki) please help thanks Gabor

2 11

Re: Restricting dialup users to certain client definitions only
by Todd R. 23 Dec '08

23 Dec '08

Can't post now but, yes I do see the groups table being queried ------Original Message------ From: tnt(a)kalik.net Sender: freeradius-users-bounces+tjrlist=lightwavetech.com(a)lists.freeradius.org To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Subject: RE: Restricting dialup users to certain client definitions only Sent: Dec 19, 2008 8:29 PM >Just a clarification on my earlier response. I mentioned that I put the rule >in radcheck when in fact I was putting it in radgroupcheck. > >Thing is, when I put it in radcheck it works. When I put the same rule in >radgroupcheck, it fails. > Are groups processed? Post the debug. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Sent via BlackBerry by AT&T

2 6

Unknown value specified for Autz-Type, freeradius 2.1.3
by Kent Nasveschuk 22 Dec '08

22 Dec '08

Hello, Having a little problem with "Unknown value specified for Autz-Type". OS CentOS 5 Freeradius version 2.1.3 latest I have this working on a 1.1.3 version that ships with CentOS 5 but having a little problem here. I actually have 2 LDAP sources for testing. One source is used for the switch (Enterasys) that does MAC authentication the other does 802.1x. The records are in different parts of the LDAP tree. The 802.1x works fine. The error message at the bottom is the one I get from the MAC authentication. raddb/modules/ldap: ... ldap devices { server = "192.168.1.12" identity = "uid=xxxx,ou=xxxx,dc=mbl,dc=edu" password = xxxxxx basedn = "ou=devices,ou=network,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" tls { start_tls = no } tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no dictionary_mapping = ${confdir}/ldap.attrmap access_attr = "radiusFilterId" set_auth_type = yes } ... raddb/sites-enabled/inner-tunnel: ... authorize { Autz-Type DEVICES { devices } ... } ... authenticate { Auth-Type DEVICES { devices } ... } raddb/sites-enabled/users: # TEST C2 MAC DEFAULT Auth-Type := DEVICES, Auth-Type := ACCEPT, Autz-Type := DEVICES, Client-IP-Address == "192.168.1.15" Filter-Id := "Enterasys:version=1:policy=D-Unregistered", Fall-Through = yes radiusd -X (MAC authentication failure): ... Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.15 port 49152, id=62, length=146 User-Name = "00-11-24-80-40-7A" Service-Type = Framed-User Called-Station-Id = "00-01-F4-5C-97-80" Calling-Station-Id = "00-11-24-80-40-7A" NAS-IP-Address = 192.168.1.15 NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "ge.1.17" User-Password = "xxxxxxx" Message-Authenticator = 0x21da3669c869a962c6270f0cee3d3bac +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "00-11-24-80-40-7A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{Client-IP-Address} -> 192.168.1.15 [files] expand: %{Client-IP-Address} -> 192.168.1.15 [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Using Autz-Type DEVICES WARNING: Unknown value specified for Autz-Type. Cannot perform requested action. Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 62 to 192.168.1.15 port 49152 Filter-Id := "Enterasys:version=1:policy=D-Unregistered" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 62 with timestamp +2 Ready to process requests. Any help wold be appreciated. Kent Kent L. Nasveschuk Systems Administrator ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543

2 1

Issue when login name and password configured in UTF-8 format
by Elayaraja Prabhakaran 22 Dec '08

22 Dec '08

Dear freeradius-users list members, I am testing on freeradius server with X-Supplicant and PostgreSQL. The client_encoding in DB is set to UTF-8 by default. When configuring login name and password in english text, authentication is successfully completed. However, when i use UTF-8 characters as login name, freeradius server is dropping the packets and the error message i found in server is login name is incorrect. But the loginname configured in xsupplicant and freeradius are same (UTF-8 format). I guess the FreeRadius does not support UTF-8 chars and hence, passes some junk (letters converted into DECIMAL with "=" prefix). Below is the log of Freeradius when run in DEBUG mode. ********************************************************************************************** Mon Dec 22 19:46:38 2008 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 19 Mon Dec 22 19:46:38 2008 : Debug: expand: %{User-Name} -> Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£?? Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£??' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Mon Dec 22 19:46:38 2008 : Debug: expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' ORDER BY id Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' ORDER BY id Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 5 Mon Dec 22 19:46:38 2008 : Debug: expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query: SELECT GroupName FROM usergroup WHERE UserName='=EF=BB=BF=E3=83=86=E3=82=B9=E3=83=88=E3=81=8C=E8=B5=B7=E3=81=93=E3=81=A3=E3=81=A6=E3=81=84=E3=82=8B' Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Dec 22 19:46:38 2008 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 1 Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): Released sql socket id: 0 Mon Dec 22 19:46:38 2008 : Debug: rlm_sql (sql): User Ã¯Â»Â¿Ã£??Ã£?Â¹Ã£??Ã£??Ã¨ÂµÂ·Ã£??Ã£?Â£Ã£?Â¦Ã£??Ã£?? not found Mon Dec 22 19:46:38 2008 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 19 Mon Dec 22 19:46:38 2008 : Debug: ++[sql] returns notfound ********************************************************************************************** Is there any way to achieve UTF-8 support only with postgresql queries (some kind of conversion to binary and then can be compared with radcheck and radreply) or is there any tweak with Freeradius? Regards Elayaraja P ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Status counters
by Anders Holm 21 Dec '08

21 Dec '08

Hi folks. Looking a tad at the counters and how they get incremented I see the following: Sending Access-Accept of id 20 to 127.0.0.1 port 32772 FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 36 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 36 This is on a test server, which currently is only getting requests for status. Shouldn't the Access-Requests also be incremented? I mean, if the Access-Accept is incremented, we must have had a request to being with. Also, using these counters for monitoring, it would be nice to see deltas from the previous Status request. Though, if I would go ahead and clear the counters (haven't even checked if it is possible tbh) I might have requests arriving between my last Status request packet and my clearing the counter, meaning my metrics would be incorrect. Would it be trivial to add some form of delta-since-last-status-request, or is it preferred to keep that in an external script? Just trying to figure out which would be the best route, and what others think of the idea. Might be useful for others here, so ... //anders

2 10