- Freeradius-Users - lists.freeradius.org

Simple configuration for authoriazation
by avihai marchiano 20 May '08

20 May '08

Hey, I need to have simple Radius server in order to test a Radius client. I want to test authentication and authorization. I add a new user in the user file and test authentication and it work. Now i need to test authorization, where I assign role to this user and how? can someone give me a simple configuration for this? Thank you

1 0

Auth type change when it called through asterisk.
by johnson elangbam 20 May '08

20 May '08

Hi, I successfully done my authentication and authorization with the perl and digest with mix mode, and it reply access accept packets from the radius server. But when i tried to call through asterisk, the server again try to authenticate again and rejected. The auth type is turned into local again though i put perl and digest. How the auth type will be into perl and digest when I called through asterisk. *This is the output log after the server authenticate a user: * rad_recv: Access-Request packet from host 192.168.1.227 port 32958, id=215, length=259 User-Name = "100(a)192.168.1.227" Digest-Attributes = "\n\005100" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*4832e5db308756e206b4536810ea3e70cf300c66" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "805279e87b5ef1a7bc640350165079ff" Service-Type = SIP Sip-URI-User = "100" Cisco-AVPair = "call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x98c2a88 asigned new request. Handled so far: 1 found interpetator at address 0x98c2a88 rlm_perl: Added pair Digest-Response = 805279e87b5ef1a7bc640350165079ff rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193 rlm_perl: Added pair User-Name = 100(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = 100 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\005100 rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Cleartext-Password = 100 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x98c2a88 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " 100(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "100" Digest-Realm = "192.168.1.227" Digest-Nonce = "4832e5db308756e206b4536810ea3e70cf300c66" Digest-URI = "sip:192.168.1.227" Digest-Method = "REGISTER" A1 = 100:192.168.1.227:100 A2 = REGISTER:sip:192.168.1.227 H(A1) = fc0ea6eaea4a4b50ad280e803f4bd6a2 H(A2) = fbf27b090821dd0f71c0a0dda09e5e8e KD = fc0ea6eaea4a4b50ad280e803f4bd6a2:4832e5db308756e206b4536810ea3e70cf300c66:fbf27b090821dd0f71c0a0dda09e5e8e EXPECTED 805279e87b5ef1a7bc640350165079ff RECEIVED 805279e87b5ef1a7bc640350165079ff ++[digest] returns ok Login OK: [100(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) +- entering group post-auth perl_pool: item 0x9997960 asigned new request. Handled so far: 1 found interpetator at address 0x9997960 rlm_perl: Added pair Digest-User-Name = 100 rlm_perl: Added pair Digest-Response = 805279e87b5ef1a7bc640350165079ff rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Digest-URI = sip:192.168.1.227 rlm_perl: Added pair Digest-Realm = 192.168.1.227 rlm_perl: Added pair Cisco-AVPair = call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193 rlm_perl: Added pair Digest-Method = REGISTER rlm_perl: Added pair User-Name = 100(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = 100 rlm_perl: Added pair Digest-Nonce = 4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\005100 rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Cleartext-Password = 100 rlm_perl: Added pair Auth-Type = digest perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9997960 ++[perl] returns ok Sending Access-Accept of id 215 to 192.168.1.227 port 32958 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 214 with timestamp +5 Cleaning up request 1 ID 215 with timestamp +5 Ready to process requests. *This is the output log after the server reject a user when it is call through asterisk *rad_recv: Access-Request packet from host 192.168.1.227 port 33036, id=222, length=104 Called-Station-Id = "200" Calling-Station-Id = "100" User-Name = "100" User-Password = "\034]W\242\237\233\312s6\210Sx\241\345pl" NAS-Identifier = "Asterisk" h323-conf-id = "1211297773.35" NAS-IP-Address = 192.168.1.227 NAS-Port = 5071 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9cc2358 asigned new request. Handled so far: 1 found interpetator at address 0x9cc2358 rlm_perl: Added pair Calling-Station-Id = 100 rlm_perl: Added pair Called-Station-Id = 200 rlm_perl: Added pair User-Name = 100 rlm_perl: Added pair User-Password = \034]W\242\237\233\312s6\210Sx\241\345pl rlm_perl: Added pair NAS-Identifier = Asterisk rlm_perl: Added pair h323-conf-id = 1211297773.35 rlm_perl: Added pair NAS-IP-Address = 192.168.1.227 rlm_perl: Added pair NAS-Port = 5071 rlm_perl: Added pair Cleartext-Password = 100 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9cc2358 ++[perl] returns ok ++[digest] returns noop rlm_realm: No '@' in User-Name = "100", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [100/\034]W\242\237\233\312s6\210Sx\241\345pl] (from client 192.168.1.227 port 5071 cli 100) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 100 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 222 to 192.168.1.227 port 33036 Waking up in 4.9 seconds. Cleaning up request 2 ID 222 with timestamp +768 Ready to process requests. with regards, Elangbam Johnson

1 0

Testing FreeRaduis
by youness hsina 20 May '08

20 May '08

Hi all sorry for my english. i'm running a freeradius server on FreeBSD and i wanted to test it but it doesn't work and i don't know why. i have tried this command : *radtest yhsina yhsina @IPserver 1 testing123. * *yhsina* is a user who is located in a LDAP server. it give me this thing : radclient: no reponse from server for ID 107 have any idea please thank for your help in advance. Uness

2 11

mysql isn't match with online users status
by Zahra Bahar 20 May '08

20 May '08

we have freeradius for accounting of dialup and vpn users. sometimes users have been stoped but they are online in mysql table . what's wrong? is there any log of commmands exchange between freeardius and mysql?

4 6

Re: SNMP error
by Alan DeKok 20 May '08

20 May '08

Edvin Seferovic wrote: > I am also curious about the answer on this question ! Are there any plans to > implement AgentX protocol into freeradius project? No plans. At this point, the only plans for 2.0 are minor feature improvements and bug fixes. I plan on spending time working on the book, unless otherwise motivated. Alan DeKok.

3 5

proxy.conf problem: username send with suffix
by Hans Bornemann 20 May '08

20 May '08

Hi, what is wrong in this configuration: # A standard realm entry. A request from "user(a)company.com" will be # sent to radius.company.com as "user", unless the 'nostrip' # configuration item is specified. If the 'nostrip' configuration # item is specified, then the request will be proxied as # "user(a)company.com" # realm tu-dortmund.de { type = radius authhost = LOCAL accthost = LOCAL } but freeradius takes username(a)tu-dortmund.de to check against radcheck. debug output: rad_recv: Access-Request packet from host 129.217.169.191:32769, id=14, length=280 User-Name = "mhanborn(a)tu-dortmund.de" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-60-39-10:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 129.217.157.246 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0210005019800000004616030100410100003d03014832b93a0818b6073bdbd9b486630753af0d0f2e0469e2b071963d5240815fae00001600040005000a000900640062000300060013001200630100 State = 0x622cbb3df28c136e779e7cacb89d1a8d Message-Authenticator = 0xc969e31716dd9b76025be36ae5e396e4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 81 modcall[authorize]: module "preprocess" returns ok for request 81 modcall[authorize]: module "chap" returns noop for request 81 modcall[authorize]: module "mschap" returns noop for request 81 rlm_realm: Looking up realm "tu-dortmund.de" for User-Name = "mhanborn(a)tu-dortmund.de" rlm_realm: Found realm "tu-dortmund.de" rlm_realm: Adding Stripped-User-Name = "mhanborn" rlm_realm: Proxying request from user mhanborn to realm tu-dortmund.de rlm_realm: Adding Realm = "tu-dortmund.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 81 rlm_eap: EAP packet type response id 16 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 81 radius_xlat: 'mhanborn(a)tu-dortmund.de' rlm_sql (sql): sql_set_user escaped user --> 'mhanborn(a)tu-dortmund.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mhanborn(a)tu-dortmund.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radgroupcheck Thanks Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

2 1

Segmentation fault when use Odyssey Client
by Hangjun He 20 May '08

20 May '08

If I select EAP-TTLS + use only my certificate for auth will cause segmentation fault. Others seems OK. Debug info: rad_recv: Access-Request packet from host 192.168.200.57:32785, id=95, length=325 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0215009015800000008616030100461000004200400d423029041904e4b654b0384c78b56d7490853af607b909c2f54fc376bebac512ebfb7663e9ee2fc7320d175037da31f09e90ad986d539d519d6ef6c39f577914030100010116030100302027f914730434165f520dc31734211631a5c96402b0ddabaf4d815209d07bb6c0f2817ed3a2233822587288715beab6 State = 0x4f6739def5f0e9f45fd60479253cc3cd Message-Authenticator = 0xe06aac6aeeefc91f7920fd60b05ea9ab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 21 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 95 to 192.168.200.57 port 32785 Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IPv4 Tunnel-Type:0 = GRE EAP-Message = 0x0116004515800000003b1403010001011603010030b081e94e6f9087f3c237216ab3fd9d65fc8311b18e37e66208369fb451d373695f16b167d85e80c870295da3d2f21cf4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x10aabdcc7ef9ba295475b0706b6e070c Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.200.57:32785, id=96, length=187 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x021600061500 State = 0x10aabdcc7ef9ba295475b0706b6e070c Message-Authenticator = 0xa07cb0441d0e9d898030c912f9ae54d3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 10 modcall: leaving group authorize (returns updated) for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 Segmentation fault John --------------------------------- 雅虎邮箱，您的终生邮箱！

2 1

freeradius documentation: Auth-Type
by NPY 20 May '08

20 May '08

Hi, As someone very new to freeradius, I find that I am struggling with the available documentation. I have problem trying to find explanations on important attributes such as Auth-Type on what it means, what are the valid values etc. Can someone point me to the right place? I know http://www.freeradius.org/rfc/attributes.htm is around but it does not list all attributes, including Auth-Type.

6 8

users advanced configuration
by tribestom 20 May '08

20 May '08

Hi I have a little hard to configure freeradius. here is what i want to do : I want to run an hotspot with different accounts which give different connection time. I have an openldap server with this organisation : dc=com | dc=exempl | | ou=heure ou=jour | | uid=user1 uid=user2 What i have running now : I can authenticate a users with a time limit. Here is my users file : DEFAULT Auth-Type = ldap,Max-Daily-Session := 3600 I want add a second line with correspond to a day like this : DEFAULT Auth-Type = ldap,Max-Daily-Session := 86400 and i want that user from ou=heure use the first one and user from ou=jour use the policy with a day time which attribute should i add to this line or how should i do to realize this. I haven t found any clue on the net how to do this. Here is my ldap conf in radiusd.conf : server = "192.168.20.240" # ip de la machine avec le serveur ldap identity = "cn=admin,dc=exempl,dc=lcom" # login sur le serveur ldap password = "******" # mots de passe sur le serveur ldap basedn = "dc=exempl,dc=com" # base de recherche sur le serveur ldap filter ="uid=%u" # filtre de recherche ( ici tout utilisateur ) ldap_connections_number = 5 # nombre de tentative de connection timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no Sorry for my bad english and thanks for your help If you need more informations just tell me Tribolet Thomas

4 6

Question of Monthly-Session-Time
by Roberto Salazar M. 20 May '08

20 May '08

Hi: Sorry my english!! I need modify begin of period of Monthly-Session-Time parameter, this reset on 00:00:00 of the first day of each month, but I need set begin period in: day 24 of each month to 00:00:00. Is that possible? Regards, Roberto _________________________________________________________________ Do more with your photos with Windows Live Photo Gallery. http://www.windowslive.com/share.html?ocid=TXT_TAGLM_Wave2_photos_022008

1 0