- Freeradius-Users - lists.freeradius.org

Date and Time based authorization ???
by Marcelo Freitas 04 Sep '08

04 Sep '08

3 2

freeRADIUS not sending accounting responses
by Adrian Cowham 04 Sep '08

04 Sep '08

Hello All, I stumbled onto some unexpected behavior with freeRADIUS and I'm curious if it's a mis-configuration or a defect. The first thing I did was comment out all places where radutmp and sradutmp were being used. I don't use those files so I figured I'd free up some resources by commenting them out. Upon doing so, I noticed that freeRADIUS no longer sent accounting-response packets to my NAS, everything else worked fine. However, when I ran radiusd -X from the command line it sent accounting-responses, everything ran perfectly. When I went back to running radiusd as a service, it no longer sent accounting-responses. To address the issue, I commented out the "unix" line in the accounting module in radiusd.conf. My assumption is that since I commented out the "radwtmp" line in the "unix" section but not the "unix" line in the "accounting" section, radiusd is choking on processing accounting packets because it can't find the radwtmp file. Mis-configuration on my part? Below you'll find my freeRADIUS version, snippet from my radiusd.conf causing the unexpected behavior containing the "unix" and "accounting" sections, and lastly a snippet from the fixed version of radiusd.conf where the "unix" line is commented out. Any insight would be greatly appreciated. Thanks for you time. FreeRADIUS Version ProCurve NAC 800(ac-nac):~ # radiusd -version radiusd: FreeRADIUS Version 1.1.6, for host i686-redhat-linux-gnu, built on Jun 3 2008 at 10:26:23 Copyright (C) 2000-2007 The FreeRADIUS server project. Snippet of problem radiusd.conf Accounting and unix sections of my /etc/raddb/radiusd.conf unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # passwd = /etc/passwd shadow = /etc/shadow group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # #radwtmp = ${logdir}/radwtmp } accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. $INCLUDE ${confdir}/hpidm.accounting.conf detail #daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. #radutmp #sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } Snippet from working radiusd.conf accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. $INCLUDE ${confdir}/hpidm.accounting.conf detail #daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. #unix COMMENTED OUT # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. #radutmp #sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip }

2 1

VSA byte issue with Redback attribute
by Thomas LAVIGNE 04 Sep '08

04 Sep '08

Hi all, I have a problem with a FreeRadius server. The guys at the other side says that the reply coming from my server is not correct. Have somebody any idea how to solve this : Maybe I have added the Redback subscriber attribute at the wrong place in the redback dictionary ? I checked the 'Access-Accept' packet coming from the Radius server. The byte that identifies the 'subscriber-profile-name' VSA is incorrect. Jul 8 16:29:32: [0014]: [4/3:1:63/2/2/66258]: %AAA-7-RAD_PKT: aaa_idx 10c3bdca: Received packet (55 bytes) from xx.xx.xx.xx/1812 (f111111@XXXX <mailto:1@x>): 0 02 43 00 37 57 50 fe a1 5a 29 0c 10 c0 34 83 1f 16 e7 cb 53 b8 1a 11 00 00 09 30 *98* 0b 66 6f 72 74 32 65 70 6c 75 73 06 06 00 00 00 02 07 06 00 00 00 48 01 08 06 ff ff ff fe It's sending back 'forteplus', however, the VSA byte (98) is incorrect. It should be '5b' (decimal 91). 66 6f 72 74 65 70 6c 75 73 f o r t e p l u s Have them correct the Radius server. Thank you for your help. Thomas

3 4

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

alan!! and install the new version and the probe, probe with radtest and I get this: Sending Access-Request of id 236 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "testing123" NAS-IP-Address = 10.30.1.104 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=236, length=20 its ok but... radiusd -X run and I get this:: FreeRADIUS Version 2.0.5, for host x86_64-unknown-linux-gnu, built on Sep 3 2008 at 17:32:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client 10.0.6.29 { require_message_authenticator = no secret = "testing123" shortname = "ap" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Generating a 2048 bit RSA private key ........................................................................................................................................................................................................................................................................................................+++ .....+++ unable to write 'random state' writing new private key to 'ca.key' ----- Generating a 2048 bit RSA private key .......+++ ..................................+++ unable to write 'random state' writing new private key to 'server.key' ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Sep 3 20:51:16 2008 GMT Not After : Sep 3 20:51:16 2009 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Sep 3 20:51:16 2009 GMT (365 days) Write out database with 1 new entries Data Base Updated unable to write 'random state' unable to write 'random state' MAC verified OK Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time *****************************+*************************+****************************** ... unable to write 'random state' Exec-Program output: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program-Wait: plaintext: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program: returned: 0 Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: cannot bind socket: Address already in use /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 0.0.0.0port 1812 ¿a que se debe este error? Why is this wrong?

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

ouch!! mmmm ok, change the version and started again :S Like thank you very much! -- -- Silvero Martin

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

Good morning everyone! Well, I have progressed a bit in the installation of RADIUS EAP TLS. what I did was install the version FreeRADIUS-1.0.4.tar.gz on my server, configure the client (AP) and modules to work with eap tls, probe with "radtest" and the response was: Sending Access-Request of id 240 to 127.0.0.1:1812 User-Name = "test" User-Password = "testing123" NAS-IP-Address = radius NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=240, length=20 by what I see this perfec! my problem is that I already have everything set up, including the AP and try to connect with a notebook but, first, the SSID of the notebook is not if but listed under the name hidden, when I want to connect asks me to configure the profile of the connection, but it set the connection fails. to consider: -configure a local user on the server - + EAP TLS is handled with certificates, and I do not install any certificate or touch any folder and cert / I have this: -rw-r--r-- 1 root root 721 Aug 20 15:44 cert-clt.der -rw-r--r-- 1 root root 1741 Aug 20 15:44 cert-clt.p12 -rw-r--r-- 1 root root 2452 Aug 20 15:44 cert-clt.pem -rw-r--r-- 1 root root 717 Aug 20 15:44 cert-srv.der -rw-r--r-- 1 root root 1733 Aug 20 15:44 cert-srv.p12 -rw-r--r-- 1 root root 2439 Aug 20 15:44 cert-srv.pem drwxr-xr-x 2 root root 4096 Aug 20 15:44 demoCA -rw-r--r-- 1 root root 0 Aug 20 15:44 dh -rw-r--r-- 1 root root 2913 Aug 20 15:44 newcert.pem -rw-r--r-- 1 root root 1753 Aug 20 15:44 newreq.pem -rw-r--r-- 1 root root 1024 Aug 20 15:44 random -rw-r--r-- 1 root root 431 Aug 20 15:44 README -rw-r--r-- 1 root root 954 Aug 20 15:44 root.der -rw-r--r-- 1 root root 1973 Aug 20 15:44 root.p12 -rw-r--r-- 1 root root 2764 Aug 20 15:44 root.pem should they have to install certificates is not what (I Wxp service pack 3) they occur any idea? -- -- Silvero Martin

2 1

Freeradius - pairing users with clients.
by Michał Iwaszko 03 Sep '08

03 Sep '08

Hello. Is it possible to pair users with clients? I wan't to authenticate users on one RADIUS server for different services and "set up permissions", that certain client (that the user is connecting to) can only authenticate users for example with certain Auth-Type, so it will not be possible to access the service using different Auth-Type users (but with the same username). Is that doable? -- Pozdrawiam, Michał Iwaszko

2 1

ippool
by Alexandre Chapellon 03 Sep '08

03 Sep '08

Hi again, Looking at freeradius online doc, i saw that sqlippool requires transmission of interim-updates packets to the accounting server to "function correctly" (http://wiki.freeradius.org/Rlm_sqlippool#Important_Info) I what would like to use sqlippool to manage ip allocation of framed-users, but my NASes doesn't send me Interim packets. What issue may I face using sqlippool anyway? Is there a workaround? Does thius requirement still exists with ippool module? regards.

2 1

Realm delimiter characters
by Nemec Christopher 02 Sep '08

02 Sep '08

Hello list! Currently my installation of freeradius 2.0.5 only listens to realms including the "@" character. This seems to be the default behaviour; so far, so good. Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } However, I would like the rlm_realm module also to process prefixes. I know I need to configure the rlm_realm module in a way just like the following: realm prefix { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5. Any help? Thank you! Christopher ------------------------------------------------------------------------------------- DI (FH) Nemec Christopher Österreichische Lotterien Ges.m.b.H., Rennweg 44, 1038 Wien, Österreich Netzwerk Management Telefon: +43 (1) 790 70-5567, Fax: +43 (1) 790 72-5567 ------------------------------------------------------------------------------------- Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706

5 8

GnuTLS support?
by Greg 02 Sep '08

02 Sep '08

Hi all, Are there still plans to add in GnuTLS support for freeradius, or have those died? I looked through the mail archives and found references to people wanting to do it in 2003 and 2006, against pre-2.0 code, and wondered if things had changed (either in freeradius or gnutls) to make it more or less likely. I'm a Debian user caught by their licensing trap, and I hateses compiling and revisioning one-off packages for something so simple. Thanks for your time. -Greg

3 3