- Freeradius-Users - lists.freeradius.org

None
by Ray Stell 15 Dec '08

15 Dec '08

unsubscribe

4 4

Logging authentication attempts while TLS session resumption (caching) is enabled
by Jason Wittlin-Cohen 15 Dec '08

15 Dec '08

When authenticating via PEAP or TTLS with an anonymous identity, the log shows both the anonymous identity and the real identity tunneled through the TLS tunnel. However, when TLS session resumption (caching) is enabled, only the anonymous identity is logged. This is presumably due to the fact that the user is not actually sending the real ID and password through the tunnel; rather the saved session is being used. However, being that the tunneled username is still available, and obtained from the cache, it should be available to log. Is this the intended behavior? It would seem that logging authentication attempts would be more useful if the real username was provided in addition to the anonymous identity. Caching disabled: Fri Dec 12 17:35:38 2008 : Auth: Login OK: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) Fri Dec 12 17:35:38 2008 : Auth: Login OK: [Anonymous] (from client Wireless port 55 cli 0013e87d571d) Caching enabled: Fri Dec 12 17:35:56 2008 : Auth: Login OK: [Anonymous] (from client Wireless port 55 cli 0013e87d571d) However, the tunneled username does seem to be available. It's obtained from the cache and added to the Access-Accept message: [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] Adding cached attributes to the reply: User-Name = "Jason Wittlin-Cohen" Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

2 1

Need Help: 'Simultaneous-Use' don't work !!! =/ version 1.1.7 !
by Diogo Teixeira 15 Dec '08

15 Dec '08

Hi, I have a problem =/ I create this Querys: INSERT INTO radcheck(UserName, Attribute, op, Value) VALUES('cliente1', 'MD5-Password', ':=', MD5('projecto08')); INSERT INTO radgroupcheck (groupname, attribute, op, value) VALUES ('sessaounica', 'Simultaneous-Use', ':=', 1); INSERT INTO usergroup (username, groupname) VALUES ('cliente1','sessaounica'); But two different clients (PCs) whit the same pair user/password can do success login. =/ What i have done wrong ? I want that only one client have access to the network. And if one client are logged, another user with same pair user/pass don't have access until the user logged do the logoff. Very thanks for your pacience, Best Regards, Diogo Teixeira

4 11

Space after exec module - is it a bug?
by Lech Karol Pawłaszek 15 Dec '08

15 Dec '08

Hello. I've encountered a weird problem. Tested on the newest stable (2.1.3) too. Well it's not a problem anymore since I found out a way to make my unlangish things work but: I wanted to check some things in post-auth. I am passing some arguments to my script and I want to do something based on the script's output switch "%{exec:/script %{User-Name} %{outer.request:Calling-Station-Id}" { case 0 { update reply { Tunnel-Private-Group-Id := "2000" } } case "1" { update reply { Tunnel-Private-Group-Id := "1999" } } case "2 " { update reply { Tunnel-Private-Group-Id := "999" } } } As you can see it's not a rocket science. script prints a number 0, 1 or 2 and exits. What's weird is that only the last case example will work. Is this intentional that there has to be a space in case expression? The same applies to this situation: if ("%{Calling-Station-Id} " == "%{exec:/script2 %{Calling-Station-Id}") { $do_anything } when script2 only prints the argument. Why there is a need for a space? It won't work with this expression: if ("%{Calling-Station-Id}" == "%{exec:/script2 %{Calling-Station-Id}") { $never_here } Kind regards, PS script2 looks like this: #!/usr/bin/python import sys if __name__ == "__main__": print sys.argv[1] -- Lech Karol Pawłaszek <ike> "You will never see me fall from grace" [KoRn]

3 3

freeradius and IP pools
by Arrigo Savio 15 Dec '08

15 Dec '08

Hi. I need to use freeradius in multiple ways. I mean: based on realm, I need to assign or not an IP address. For example: user@with_ip has to receive an IP from configured RADIPPOOL table user@without_ip has only to be authenticated (a user who log to a portal, for example). How can I make it possibile? Where can I setup this behaviuor? Thanks. Arrigo.

3 6

radius with with login-time
by jerry kwajaffa 15 Dec '08

15 Dec '08

i m trying to set up freeradius 2.1.1 for wireless authentication with login time but it ignores the time span. what did i do wrong, below is the radiusd -X output and /raddb/users attr eeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Dec 3 2008 at 19:20:03 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } [/usr/local/etc/raddb/users]:76 WARNING! Check item "Login-Time" found in reply item list for user "steve". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:76 WARNING! Check item "Expiration" found in reply item list for user "steve". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:76 WARNING! Check item "Simultaneous-Use" found in reply item list for user "steve". This attribute MUST go on the first line with the other check items Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. /raddb/users steve Cleartext-Password := "testing" Login-Time = "Al1900-2000", Expiration := "23 Dec 2008", Session-Timeout <= 200, Simultaneous-Use = 1, Service-Type = Framed-User, # Framed-Protocol = PPP,

3 2

rlm_perl help required
by Saeed Akhtar 15 Dec '08

15 Dec '08

Hi all, I want to use perl for authorize and accounting function in freeradius. I have successfully configured perl. Now I have a little problem, I don't know how to tell freeradius that reply with Access-Accept message. Because rlm_module_ok tells that this module executed successfully. Now I want to ask how will I tell freeradius that reply with Access-Accept. Because if I just give a message in RAD_REPLY{'Reply-Message'} and then end my function with return RLM_MODULE_OK, freeradius sends Access-Reject packet with my Reply-Message. Can anybody please help me. Thanks Regards, Saeed Akhtar

2 1

Need Help on Radius - accounting respond
by Do Nguyen Ha 15 Dec '08

15 Dec '08

Hi all the FR receive the accounting request: rad_recv: Accounting-Request packet from host 172.26.0.8 port 1645, id=186, length=399 User-Name = "0873000001" NAS-IP-Address = 0.0.0.0 Service-Type = Dialout-Framed-User Class = 0x436c6173733d333030 Cisco-AVPair = "h323-incoming-conf-id=b97aff16 c99911dd 8125d127 98296413 " h323-conf-id = "h323-conf-id=b97aff16 c99911dd 8125d127 98296413 " h323-setup-time = "h323-setup-time= 4:43:17.000 UTC Mon Dec 15 2008" h323-connect-time = "h323-connect-time= 4:43:21.000 UTC Mon Dec 15 2008" h323-call-type = "h323-call-type=VOIP" Called-Station-Id = "0873000012" Calling-Station-Id = "0873000001" Acct-Status-Type = Start Acct-Session-Id = "b97aff16 c99911dd 8125d127 98296413 " Event-Timestamp = "Dec 15 2008 11:43:21 ICT" NAS-Port-Type = Ethernet then FR should send accounting respond : h323-credit-amount=customer balance at the time of authentication h323-return-code=0(accept)/2(reject) h323-billing-model=2 but FR send: Sending Accounting-Response of id 192 to 172.26.0.8 port 1645 can the FR do that? if yes, where should i edit if i want to send response to NAS i should add the attribute in the attrs.accounting-response : h323-credit-amount=* ANY h323-return-code=* ANY h323-billing-model=* ANY i check the attrs.accounting-reponse: # # Configuration file for the rlm_attr_filter module. # Please see rlm_attr_filter(5) manpage for more information. # # $Id$ # # This configuration file is used to remove almost all of the attributes # From an Accounting-Response message. The RFC's say that an # Accounting-Response packet can contain only a few attributes. # We enforce that here. # DEFAULT Vendor-Specific =* ANY, Message-Authenticator =* ANY, Proxy-State =* ANY, 1 more question: i read the man unlang times but cannot figure out how to use it could you give the example for specific case such as Access Reject/ update the Access Reject/Accept Thanks Ha`

2 1

Re: Is it possible to use FreeRADIUS as AAA in a Cellular Network?
by Aldo Zavala 15 Dec '08

15 Dec '08

Thanks Ranil Santhis and Luis Carlos Toledo for your reply, I have read in the PDSN GUI help that the interface for AAA must be a logic interface, then I looked in the PDSN configuration and I found two PI (logical) interfaces, here the part of PDSN config that I think is AAA related: [conf] # interface Piif3/0/0 ip address 192.168.1.2 255.255.255.255 # interface Rpif3/0/0 ip address 192.168.1.1 255.255.255.255 # a11 enable pcf 192.168.0.200 192.168.1.1 256 skey 1234567891234567 # construct domain huawei domain enable domain AAAclientsig 1 domain address-group huawei 0 0 10.0.0.51 50 domain dns huawei 0 209.145.204.26 bip 209.145.204.20 # charge enable weekday 6 1 weekday 5 0 weekday 4 0 weekday 3 0 weekday 2 0 weekday 1 0 weekday 0 1 # [/conf] - Can please tell me if this is what I need to co nfigure the PDSN with the FreeRADIUS? - What should I start configuring in the FreeRADIUS side? - Also, I was googling and didnt found what A11 is and why we need it here, can please tellme something about that? Thanks again guys.

2 1

Is it possible to use FreeRADIUS as AAA in a Cellular Network?
by Aldo Zavala 14 Dec '08

14 Dec '08

Hello to all, is it possible to use FreeRADIUS as AAA for EVDO and other Data sevices in a Cellular Network? Thanks, Aldo Zavala Mobile (760) 556-5050 GTalk: aldo.zavala(a)gmail.com

3 6