- Freeradius-Users - lists.freeradius.org

Spaces inside usernames
by Mark J Elkins 14 Oct '08

14 Oct '08

This is on FreeRADIUS Version 1.1.7. I use 'mysql' to authenticate users. I had one customer use a name something like "fred @domain.dom" - ie - there is a space after 'fred' and before the '@' sign. This was being logged in my 'radacct' table with the space intact. I've since managed to find the customer and fix the 'space'. I've also changed radiusd.conf ... nospace_user = before nospace_pass = before (nospace_pass - seems like a good idea as well!) (Both were previously set to "no") The user was authentication just fine - so some sort of stripping of the realm was happening before validation - so some sort of "ignore the space" appears to have been happening... but what I'd like to know is will "nospace_user = before" fix future problems of this sort? ???? In addition - in my SQL statement - if the user does not provide a realm - then I append a default realm - which also may have allowed the name to authenticate... (I have some old users who are set in their ways). I see I also compare the two parts (username and realm) separately. authorize_check_query = "SELECT userid as id,UserName,'Password' as Attribute,password as Value,'==' as op FROM useracct WHERE Username='%{Stripped-User-Name}' AND realm=( case when '%{Realm}'='NULL' then 'domain.dom' else '%{Realm}' end) AND status>2 ORDER BY id" -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

Re: access rights for some users ou users groups with
by BADAOUI Nasr-Eddine (P) 14 Oct '08

14 Oct '08

I've configured my tables as follows : mysql> select * from usergroup; +----+----------+-------------+ | id | UserName | GroupName | +----+----------+-------------+ | 13 | st234824 | test_radius | +----+----------+-------------+ mysql> select * from radcheck; +----+----------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------+----+------------------------------------+ | 1 | st234824 | Crypt-Password | := | LqI8nHgSp/pTY | +----+----------+----------------+----+------------------------------------+ mysql> select * from radgroupcheck; +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 4 | test_radius | Auth-Type | := | TLS | +----+-------------+-----------+----+-------+ mysql> select * from nas; +----+---------------+-----------+-------+-------+------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+---------------+-----------+-------+-------+------------+-----------+-------------+ | 6 | 192.168.9.155 | switch | cisco | 1812 | bonjour | | | | 9 | 192.168.9.154 | webmail01 | other | 1812 | testing123 | | | Which type of attributes should I use to access from "webmail01", but not "switch" for example ? thanks ________________________________ De: freeradius-users-bounces+nasr-eddine.badaoui=ratp.fr(a)lists.freeradius.org de la part de freeradius-users-request(a)lists.freeradius.org Date: lun. 13/10/2008 19:30 À: freeradius-users(a)lists.freeradius.org Objet : Freeradius-Users Digest, Vol 42, Issue 80 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. access rights for some users ou users groups with freeradius and mysql (BADAOUI Nasr-Eddine (P)) 2. Re: access rights for some users ou users groups with freeradius and mysql (tnt(a)kalik.net) 3. Re: One user - Different Service Type depending on NAS (Alan DeKok) 4. Re: NAS-Identifier (Paul Bartell) 5. FR2.1.1 Solaris 5.10 x86 32-bit race condition (Chris Howley) 6. Re: FR2.1.1 Solaris 5.10 x86 32-bit race condition (Alan DeKok) 7. Authentication ok but not login on a Netopia (Gamaliel Bedolla) 8. syntax errors on mysql ip pools (Marcelus Trojahn) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 Oct 2008 13:51:28 +0200 From: "BADAOUI Nasr-Eddine (P)" <nasr-eddine.badaoui(a)ratp.fr> Subject: access rights for some users ou users groups with freeradius and mysql To: <freeradius-users(a)lists.freeradius.org> Message-ID: <E50F5250B1B60045B2B10390D6FFE79462BC7E(a)EXCHANGEA2.info.ratp> Content-Type: text/plain; charset="iso-8859-1" Hi, I'd like to know how to authorize some users or users's group created in mysql tables can logged only on some mysql's clients, with freeradius. Mysql's tables are : nas table for clients radcheck table for users radgropucheck table usergroup table many thanks

2 1

Regex remove realm from username
by Eric Martell 13 Oct '08

13 Oct '08

Hi.. I searched thru the forums but not getting the right username after using regex. The request I am getting is : test(a)google.com and I need to strip everything after @ and pass the username as test. I am using ldap for auth. This is the config I have in ldap. if (User-Name =~ /^([^@]+)(@.*)$/) { // just want to dblchck is the right regex update request { Stripped-User-Name := "%{0}" } } filter = "(uid=%{Stripped-User-Name})" //filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" //filter = "(uid=%{Stripped-User-Name})" encryption_scheme = crypt I get the following while ldap lookup expand: (uid=%{Stripped-User-Name}) -> (uid=) Here is the radius -X log ; rad_recv: Access-Request packet from host 216.2.193.1 port 55751, id=107, length=65 User-Name = "test(a)google.com" User-Password = "test123" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "google.com" for User-Name = "test(a)google.com" rlm_realm: No such realm "google.com" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++- entering group rlm_ldap: - authorize rlm_ldap: performing user authorization for test(a)google.com expand: (uid=%{Stripped-User-Name}) -> (uid=) expand: dc=xyz,dc=net,o=internet -> dc=xyz,dc=net,o=internet rlm_ldap: ldap_get_conn: Checking Id: 0

3 3

eap md5 and cisco 1250 ap?
by Jonathan D. Proulx 13 Oct '08

13 Oct '08

Hi All, I'm trying to get am MacOS 10.5 client to connect to a cisco 1250 ap running IOS 12.4(10b) authenticating against Freeradius 1.1.7 on Ubuntu (8.04). Yeh md5 is a bad idea, but it should be a simple first step. The only changes I made to the default Freeradius config were to add the client info for the 1250 and one user: jon Cleartext-Password := "password" Freeradius sends: Sending Access-Accept of id 56 to 192.168.32.10 port 1645 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "jon" Finished request 95 Which the AP sees: *Mar 1 17:13:08.871: RADIUS: Received from id 1645/54 192.168.32.34:1812, Access-Accept, len 49 *Mar 1 17:13:08.871: RADIUS: authenticator 80 F5 FE FA 84 E9 7A EB - C9 D0 0C F2 E5 07 9C 02 *Mar 1 17:13:08.871: RADIUS: EAP-Message [79] 6 *Mar 1 17:13:08.871: RADIUS: 03 02 00 04 [????] *Mar 1 17:13:08.871: RADIUS: Message-Authenticato[80] 18 *Mar 1 17:13:08.871: RADIUS: 61 20 78 47 53 68 E0 80 20 7F 10 04 95 CE 64 9D [a xGSh?? ?????d?] *Mar 1 17:13:08.871: RADIUS: User-Name [1] 5 "jon" *Mar 1 17:13:08.871: RADIUS(000000B0): Received from id 1645/54 *Mar 1 17:13:08.871: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes *Mar 1 17:13:09.919: %DOT11-7-AUTH_FAILED: Station 001e.c2b7.f0de Authentication failed But note the AUTH_FAILED at the. The Mac client then just spins retrying athentication. I must be missing something so stupidly obvious noone else has ever missed it, as I can't seem to find anyone onlline who's had trouble with simple md5 auth... Help? Thanks, -Jon

3 11

syntax errors on mysql ip pools
by Marcelus Trojahn 13 Oct '08

13 Oct '08

Hello, I've been trying for a few days to configure a new freeradius server with mysql IP pools support and I noticed there's a few errors with the syntax of some queries on sqlippool.conf for mysql. First of all, some queries would never match because the schema provided with freeradius for the radippools table would set the 'expiry_time' field as default to NULL and then the queries would try something like expiry_time < NOW(), which would never match if the field as NULL. So, the correct schema for the database would be: CREATE TABLE radippool ( id int(11) unsigned NOT NULL auto_increment, pool_name varchar(30) NOT NULL, framedipaddress varchar(15) NOT NULL default '', nasipaddress varchar(15) NOT NULL default '', calledstationid VARCHAR(30) NOT NULL, callingstationid VARCHAR(30) NOT NULL, expiry_time DATETIME NOT NULL, username varchar(64) NOT NULL default '', pool_key varchar(30) NOT NULL, PRIMARY KEY (id) ); And the, the complete ippool.conf should be: -- begin ----------- # ## This series of queries allocates an IP address allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE pool_key = '${pool-key}'" ## This series of queries allocates an IP address ## (Note: If your pool-key is set to Calling-Station-Id and not NAS-Port ## then you may wish to delete the "AND nasipaddress = '%{Nas-IP-Address}' ## from the WHERE clause) allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND \ AND nasipaddress = '%{Nas-IP-Address}'" ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ FOR UPDATE" # ## If you prefer to allocate a random IP address every time, i # ## use this query instead # allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ # WHERE pool_name = '%{control:Pool-Name}' \ # AND expiry_time IS NULL \ # ORDER BY RAND() \ # LIMIT 1 \ # FOR UPDATE" ## If an IP could not be allocated, check to see if the pool exists or not ## This allows the module to differentiate between a full pool and no pool ## Note: If you are not running redundant pool modules this query may be ## commented out to save running this query every time an ip is not allocated. pool-check = "SELECT id FROM ${ippool_table} \ WHERE pool_name='%{control:Pool-Name}' LIMIT 1" ## This is the final IP Allocation query, which saves the allocated ip details allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE framedipaddress = '%I'" ## This series of queries frees an IP number when an accounting ## START record arrives start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" ## This series of queries frees an IP number when an accounting ## STOP record arrives stop-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees an IP number when an accounting ## ALIVE record arrives alive-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting ON record arrives on-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting OFF record arrives off-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00' \ WHERE nasipaddress = '%{Nas-IP-Address}'" -- end of file -------------- I might add I'm not any Mysql expert so any opinions about what I said are really welcome... I've tested it and apparently it works and I couldn't find any potential bugs so far... I hope my english is not that rusty :) -- Marcelus Trojahn

1 0

Authentication ok but not login on a Netopia
by Gamaliel Bedolla 13 Oct '08

13 Oct '08

Hi all, I have problems with the autentication of a Netopia R910 router with firmware 4.11. The configuration of the Freeradius is ok but Netopia is not accepting the Acces-Accept form the freeradius. The questions are: Is there an atrribute the Freeradius must reply to the Netopia ? Is there any misconfiguration on the Netopia? Freeradius ver. is 2.0.4. (part of the reply of the Freeradius) rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "****" rlm_pap: Using clear text password "****" rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [gbf/****] (from client ezeronet port 0) +- entering group post-auth ++[exec] returns noop Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 24 with timestamp +98 Ready to process requests. This is the configuration of the Netopia router: Advanced Security Options Security Databases... RADIUS then Local RADIUS Server Addr/Name: (Ip-of-the-Freeradius) RADIUS Server Secret: ******************** Alt RADIUS Server Addr/Name: Alt RADIUS Server Secret: RADIUS Identifer: RADIUS Server Authentication Port: 1812 RADIUS Access Privileges... All Telnet Server Port: 23 LAN (EN Hub) IP Filter Set... Remove Filter Set Thanks to all.

2 1

FR2.1.1 Solaris 5.10 x86 32-bit race condition
by Chris Howley 13 Oct '08

13 Oct '08

Alan, FR 2.1.1, Solaris 5.10 x86 32-bit We're using the latest code from git.freeradius.org. We're using PEAP/MSCAHPv2 and authenticating against Microsoft AD. We've encountered a race condition affecting the server when the supplicant on a windows XP station attempts to reauthenticates 30 minutes after the initial user logon. Here's the URL for the gdb and radiusd -X output: http://129.11.59.52/RADIUSD/ Any help in fixing this problem would be appreciated. Thanks, Chris Howley

2 1

NAS-Identifier
by Stefan Eck (gmail) 13 Oct '08

13 Oct '08

Hi, running successfull freeradius in 1.x version, i'm looking for some free radius documentation to the NAS-Identifier. Couldn't find anything in the doc or wiki. Anyone who can point me to some docs? I do have now an additional NAS which sends an different NAS-Identifier, but I do currently not know how to take advantage of them. Thanks

3 4

One user - Different Service Type depending on NAS
by Mats Blomgren B 13 Oct '08

13 Oct '08

Hi, I have about 6 people working with Network Administration. 3 of the users should have full access (read/write) to the network (94 Extreme Switches). This is straight forward. The other 3 should have read/write to about 80 switches and read only to the last 14. I understand that I can group devices in huntgroups and users in groups and then control the access. The problem I have is that I don't know how to give a certain user a specific "Service-Type" depending on the NAS he/she tries to connect to. I want the Service Type do differ for certain users depending on the NAS. Admin should always have read/write access to all switches and the others should have "read" on some switches and "read/write" on some. The Service type for Extreme Switches are as follows: Service-Type = Login-User (Read Only) Service-Type = Administrative-User (Read/Write) Best Regards Mats Blomgren

3 2

access rights for some users ou users groups with freeradius and mysql
by BADAOUI Nasr-Eddine (P) 13 Oct '08

13 Oct '08

Hi, I'd like to know how to authorize some users or users's group created in mysql tables can logged only on some mysql's clients, with freeradius. Mysql's tables are : nas table for clients radcheck table for users radgropucheck table usergroup table many thanks

2 1