- Freeradius-Users - lists.freeradius.org

is there normal way to create a user that can not log on until a future date?
by Rob Fowler 27 May '08

27 May '08

I am setting up a hotspot in a cafe that is not very high tech. They offer free wifi in a well known cafe down here in Darlinghurst Sydney (All radius users welcome :) ) To prevent abuse I was planning on making daily access keys. The idea was to make a year of them and print them in a book. The first person in would simply look up the date in the secret book put it into the cash register to print on the receipt. Setting the 'Expiration' time is simple (and works well) but I want to prevent someone from simply copying a key far in the future and using it until then so I want to make each key only valid for a day. (Yes I know this does not prevent them from photocopying the whole book, but that's a lot harder than getting a key for this time next year) Ideally everyone for that day will get the same key (I made an application to populate the database with simple two word tokens). I think I can probably do it with the SQL interface by only selecting from 'check records' that are current but is there a 'proper' way to do this? Surely a dialup ISP would set a 'start date', before which a user can not log in? Sorry if this has already been answered but I have searched the list and don't seem to be able to find a term that will give me an answer. - Rob Fowler - Sydney

4 5

Help with dialupadmin
by Joel MBA OYONE 27 May '08

27 May '08

Hi guys, Am i on the right place to find help with dialup_admin? MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

mysql simultaneous login detection
by Gabriel J Marais 26 May '08

26 May '08

Hi I have been trying to setup freeradius with mysql to detect and reject simultaneous logins for the past two days and been reading up, but I can't get it working at all. Perhaps someone here has some more information on a working example for me... ? mysql> select UserName, GroupName from usergroup where UserName = 'testgiga(a)saudsl.co.za'; +-----------------------+-----------------+ | UserName | GroupName | +-----------------------+-----------------+ | testgiga(a)saudsl.co.za | UNSHAPED_NORMAL | +-----------------------+-----------------+ 1 row in set (0.00 sec) mysql> select * from radgroupcheck where GroupName = 'UNSHAPED_NORMAL'; +----+-----------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------------+------------------+----+-------+ | 9 | UNSHAPED_NORMAL | Auth-Type | := | Local | | 12 | UNSHAPED_NORMAL | Simultaneous-Use | := | 1 | +----+-----------------+------------------+----+-------+ 2 rows in set (0.00 sec) mysql> select * from radgroupreply where GroupName = 'UNSHAPED_NORMAL'; +----+-----------------+-----------------------+----+-----------------+----- -+ | id | GroupName | Attribute | op | Value | prio | +----+-----------------+-----------------------+----+-----------------+----- -+ | 42 | UNSHAPED_NORMAL | Framed-Protocol | = | PPP | 0 | | 41 | UNSHAPED_NORMAL | Acct-Interim-Interval | = | 3600 | 0 | | 36 | UNSHAPED_NORMAL | Configuration-Token | = | UNSHAPED_NORMAL | 0 | | 43 | UNSHAPED_NORMAL | Session-Timeout | = | 3600 | 0 | | 46 | UNSHAPED_NORMAL | Port-Limit | = | 1 | 0 | +----+-----------------+-----------------------+----+-----------------+----- -+ 5 rows in set (0.00 sec) My radius.conf file as follows :- prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 10.0.0.128 port = 1812 hostname_lookups = no allow_core_dumps = yes regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no #$INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } # Unix /etc/passwd style authentication # unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } # EDIT MY GJM sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Framed-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } # # The "always" module is here for debugging purposes. Each # instance simply returns the same result, always, without # doing anything. always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module currently has no configuration. # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{expr:2 + 3 + %{exec: uid -u}}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. expr { } # # The 'digest' module currently has no configuration. # # "Digest" authentication against a Cisco SIP server. # See 'doc/rfc/draft-sterman-aaa-sip-00.txt' for details # on performing digest authentication for Cisco SIP servers. # digest { } # # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. # # The RADIUS attributes from the user request will be placed # into environment variables of the executed program, as # described in 'doc/variables.txt' # exec { wait = yes input_pairs = request } } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { auth_log sql } authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } } # # Pre-accounting. Decide which accounting type to use. # preacct { acct_unique suffix } # # Accounting. Log the accounting data. # accounting { detail sql radutmp # sql # sql_log } session { sql } post-auth { sql # sql_log } pre-proxy { } post-proxy { } My extract from the sql.conf file :- simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Any pointers much appreciated ! Regards Gabriel

4 9

EAP-TLS & deny access?
by uhel＠gmx.net 26 May '08

26 May '08

Hi, how can i deny access to a user (a certificate)? Is a CRL (with the CA_path and c_rehash stuff) the only possibility to deny access or is it possible to have a *whitelist* (like the CA_path and c_rehash stuff but as a whitelist) with certs that are allowed? I'm using Freeradius 1.1.7 with EAP-TLS which works fine so far. I'm not using any SQL or LDAP backend only the *users* file. -- regards uHel

2 2

radius x509 authentication + LDAP ?
by Riccardo Veraldi 26 May '08

26 May '08

Hello, I am actually using freeradius with EAP-TLS and x509 user certificat authentication. After authentication I would like to chack the common name or email address propertires of te certificate againsta LDAP, to authorize the user connection. is it possible to do this ? I tyed but it seems not working in my configuration. any hints ? thank you very much Riccardo

3 12

Groups Problem
by radius＠e-comec.com 26 May '08

26 May '08

Hey, one question: I am working on FreeRadius 2.0.4 with mysql I have following situation: I have created 2 groups and I configured parameters for them in radgroupreply. Then I added one user, and added him to those 2 groups in radusergroup table. When I authenticate with that user, I get only parameters from the first group, but not from both. I tried to place a Fall-Through parameter in both groups, but it didn't help.. How can I make that the user by authentication gets parameters from 2 (or more groups) that he is in? Thx CoMeC

4 4

need info on EAP-SIM
by Kalyani Garigipati (kagarigi) 26 May '08

26 May '08

Hi Alan, Thanks for the reply .But I am still getting the same errors.I have put the lines as follows. I did not put any balnk lines in between . the editor in the mail is shoing like that. DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7 I am getting the following errors [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items Module: Checking session {...} for more modules to load Regards, Kalyani -----Original Message----- From: freeradius-users-bounces+kagarigi=cisco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+kagarigi=cisco.com@lists.freeradius.org ] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, May 26, 2008 3:30 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 37, Issue 125 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] (Riccardo Veraldi) 2. chap for ldap (Zahra Bahar) 3. Re: need info on EAP-SIM (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Mon, 26 May 2008 11:26:26 +0200 From: Riccardo Veraldi <Riccardo.Veraldi(a)cnaf.infn.it> Subject: Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <483A8242.3030708(a)cnaf.infn.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I wrote a rule in users file to reject login for users being in a certain grup, but still access is given DEFAULT Ldap-Group == "cn=rjgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have dialup access" user can authenticate succesfully with EAP-TLS. User is found in LDAP tree, user is part of ldap group rjgroup, but still is not being rejected. What am I missing ? thanks Riccardo Alan DeKok ha scritto: > Riccardo Veraldi wrote: > >> Not all the people having a certificate should authenticate on my WiFi >> infrastructure. >> These certificates are for general purpose, so also for EAP-TLS, >> > > Then your PKI system is wrong. You should NOT issue certificates for > multiple purposes. > > You should issue RADIUS (EAP-TLS) certificates ONLY to the people who > are allowed to use EAP-TLS. > > >> but some user in my case should not be authenticated. >> To select which are the users to be authenticated and which are not, >> I wanted to use LDAP properties. If a user is in the LDAP directory >> it should pass, if it is not, it should be refused, but at the end, I am >> unable to do it. >> > > Did you read my statement about using LDAP groups? Do you know what > an LDAP group is? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 2 Date: Mon, 26 May 2008 14:02:15 +0330 (IRST) From: Zahra Bahar <zahra_bahar(a)ec.iut.ac.ir> Subject: chap for ldap To: freeradius-users(a)lists.freeradius.org Message-ID: <30958651.75851211797935796.JavaMail.root(a)mta.iut.ac.ir> Content-Type: text/plain; charset=utf-8 Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server? ------------------------------ Message: 3 Date: Mon, 26 May 2008 10:44:09 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: need info on EAP-SIM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080526094409.GA8435(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, put the first check on the same line as DEFAULT and remove all those blank lines from between each check alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 37, Issue 125 *************************************************

4 3

rlm_exec
by Vittore Zen 26 May '08

26 May '08

I'm looking for some rlm_exec documentation? Which parameters pass, what's return.... thanks in advance v.

1 0

can not initiate sim, no RAND1 attribute
by Kalyani Garigipati (kagarigi) 26 May '08

26 May '08

Hi, Now I am able to start the Radiusd without any errors. But I am getting the following messages when I initiate EAP-SIM request to free Radius rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim can not initiate sim, no RAND1 attribute rlm_eap: Default EAP type sim failed in initiate rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [dummy(a)cisco.com/<via Auth-Type = EAP>] (from client cisco port 0 cli dummy(a)cisco.com) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> dummy(a)cisco.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. I have configures EAP -type as SIM in eap.conf Regards, Kalyani

1 0

chap for ldap
by Zahra Bahar 26 May '08

26 May '08

Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server?

3 2