- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 36, Issue 130
by Jack Murgia 22 Apr '08

22 Apr '08

Phil, on 4/21/08 3:00 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Mon, 21 Apr 2008 10:38:24 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480C6090.2070005(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Jack Murgia wrote: >> Alex, >> >> Is there a command I can run periodically that would flush the dns cache? > > pkill radiusd; /usr/sbin/radiusd > > i.e. restart the server. Otherwise, no. > >> >> I use the NAS table in MySQL rather than clients.conf to register my NAS >> devices. The only problem with NAS devices on PPOE ADSL links is that a >> restart of Freeradius server is required in order to pick up the new IP >> address from DYNDNS.org. >> >> Would this problem be solved by a rlm_nsupdate module (scheduled for future >> release)? I would be willing to donate to the creation of this module. > > How does that help? Not sure what the intention of that module is, but in the roadmap it says " New module: rlm_nsupdate (dyndns). Because dynamic addresses are cruel." Which made me think it might relate to this issue. > > The problem is that the server might have outstanding requests for a > given client record when it's removed. It's a hard problem. > Right- chillispot is web-based- so user's browser will hang for as long as the TCP timeout takes, I think- will have to test. > Does re-starting the server *really* take so long it's a problem for you? Oh it's very fast at restarting. But I'd have to decide how much "downtime" for the authorization process due to NAS ip changes I am willing to tolerate (10 minutes? 5 minutes?) and set my restart intervals accordingly, which seems a bit messy. Especially if someone is trying to login, as noted above. And does it affect open sessions on other NASs (force them to login again, creating simultaneous use issues with orphaned accounting records in MySQL)? Will have to test that as well. I suppose restarting freeradius would be an acceptable workaround for the time being if those two issues above aren't barriers. Jack Murgia

2 1

Re: Possible to limit user access to different types of authentication?
by Ryan 22 Apr '08

22 Apr '08

Hi Alan, Thanks for the update. I have read through "man unlang" as well. Overlooked on the part on the additional "Cisco-AVPair" attribute as it was only available after authentication is done. I have worked around it using the proxy-inner-tunnel method to terminal the EAP on the front radius and then proxy MS-CHAP to an internal radius that will do an LDAP bind with an additional attribute. As the front radius will also handle EAP requests that will not be handled by the internal radius, will it just proxy the EAP request based on the domain or it will terminate and forward to my internal radius instead? Thanks/Regards, Ryan On Fri, Apr 18, 2008 at 4:44 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > Date: Fri, 18 Apr 2008 07:55:42 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Possible to limit user access to different types of > authentication? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480837DE.5010400(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Ryan wrote: > > Did some further searching on the listing and noticed that it is > > possible to do a string compared in the authorize and authenticate > > sections. > > $ man unlang > > > However running radius in debug mode will return the following error. > > > > (Attribute Cisco-AVPair was not found) > > Because the attribute isn't in the request. Go look at the packet > that the server received. There is no such attribute in it. > > > I know that it is possible to match the Cisco-AVPair in the users > > file. Can we do the same in the authorize/authenticate sections as > > well? > > Yes. This is documented in the "unlang" man page. But if the > attribute isn't in the request, you can't compare it to anything. > > Alan DeKok.

2 1

Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 22 Apr '08

22 Apr '08

hi, I am using free Radius 2.0.3. I m configured my AAA through rlm_perl. I need to do the authorization by using the following attributes. Digest-Realm Digest-Method Digest-Uri Digest-Nonce Digest-Nonce Digest-Response Unfortunately i did not get any value from these attributes when i called using $RAD_REQUEST. Please tell me any idea to get these values. Here is the piece of authorization code that i've used. sub authorize { my $nasuser1; my $nasuser; my $naspass; my $dUserName; my $dRealm; my $dMethod; my $dUri; my $dNonce; my $nameindex; my $dResponse; $nasuser = $RAD_REQUEST{'User-Name'}; $naspass = $RAD_REQUEST{'User-Password'}; $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; my $dPassword; my $ha1; my $ha2; my $a1; my $a2; my $a; my $sqltest; my $sthtest; my $user = "user"; my $password = "password"; my $dbhtest=DBI->connect('dbi:ODBC:MSSQLDSN',$user,$password,{PrintError=>0,RaiseError=>0}); my $dbh = DBI-> connect('dbi:ODBC:MSSQLDSN', $user, $password, {PrintError =>0, RaiseError =>0}); my $sql = qq/select * from testing where UserName = '$nasuser'/; my $sth=$dbh->prepare($sql); if($dbh) { $sth->execute(); if(my $row = $sth->fetchrow_hashref) { #password from database against the username $dPassword=$row->{UserPassword}; $a1=$dUserName.':'.$dRealm.':'.$dPassword; #first part of the hash calculated. $ha1=md5($a1); $a2=$dMethod.':'.$dUri; #second part of the hash calculated. $ha2=md5($a2); #final string to be hashed. $a=$ha1.':'.$dNonce.':'.$ha2; #final response to be checked with the digest-response $a=md5($a); if($a eq $dResponse) { $RAD_REPLY{'Reply-Message'} = "Accepting Users"; return RLM_MODULE_OK; } else { $RAD_REPLY{'Reply-Message'} = "Incorrect Password"; return RLM_MODULE_REJECT; } }#End of row fetch else { $RAD_REPLY{'Reply-Message'} = "Incorrect Username"; #$RAD_REPLY{'Reply-Message'} = $nasuser; return RLM_MODULE_REJECT; }#End of else }#end of if database connection else { $RAD_REPLY{'Reply-Message'} = "Cannot connect to database"; } }#End of authorization subsection With Regards Elangbam Johnson

1 0

Freeradius/Netscreen help
by Mario Carassale 22 Apr '08

22 Apr '08

Hi All i am new to this list, so please understand my funny question :-) I have freeradius running fine and i want to authenticate a netscreen firewall against it. My question is, how can i get user privileges from the radius when a user logs into the firewall? If a set on the firewall to get get privilege from the RADIUS server, the login fails, i suppose this is due to not admin provileges. Thank you for all your help. Mario

5 4

imap + 802.1x password
by Enrico Fanti 22 Apr '08

22 Apr '08

Hi, I'm using freeradius 1.1.7, whith mysql to authenticate imap clients and wireless clients with peap method 8021x. For this to work, I created this user in radcheck table: mysql> select * from radcheck where username='fanti'; +------+----------+----------------+----+---------------+ | id | UserName | Attribute | op | Value | +------+----------+----------------+----+---------------+ | 7386 | fanti | Crypt-Password | := | 6yKjjYeLM2Y1E | | 6658 | fanti | Expiration | == | 1221515700 | | 7387 | fanti | User-Password | := | pippo | +------+----------+----------------+----+---------------+ I add the User-Password for the 8021x authentication (it needs clear text password). If I use the ":=" operator in tw0 password attributes It's OK , or I'm wrong ?? (If I use the "==", only the 8021x authentication it's ok) Thank you enrico

2 2

location of source files in windows freeradius
by sanjeev.kumarroy＠wipro.com 22 Apr '08

22 Apr '08

Hi, I tried installing freeradius 1.1.7 in windows XP machine. Here I am not able to locate the source files as was available in Linux. Can you please guide me by telling if the source file gets installed to some particular directory in windows when we install the freeradius exe. Or is there any website where I can get the source files. Any help is highly appreciated. Thanks The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 6

Q: on attr_filter.accounting_response
by rsg 22 Apr '08

22 Apr '08

Hi, I'm using FR 2.0.2. I require that the Accounting response includes "Reply-Message", Could one simply add Reply-Message =* ANY into ../raddb/attrs.accounting_response file to achieve? .. ------------------------------------------------------------------------------------------- Accounting Section: accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Return an address to the IP Pool when we see a stop record. # main_pool sqlippool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf #sql # # Instead of sending the query to the SQL server, # write it into a log file. # #sql_log # Cisco VoIP specific bulk accounting #pgsql-voip # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } ------------------------------------------------------ I see that Reply-Message is supressed only Proxy-State is carried by the accounting response excerpt of packet Capture: ------------- Radius Protocol Code: Accounting-Response (5) Packet identifier: 0xd (13) Length: 26 Authenticator: A6D7BFC84BEF5B6A8B1047F4435DAA16 Attribute Value Pairs AVP: l=6 t=Proxy-State(33): 30303064 Proxy-State: 30303064 ----------------- Commenting "attr_filter.accounting_response" from the accounting section has the same effect. What have I done missed in this? Thanks in advance for your help.

2 2

Dialup-Admin Alternatives?
by JaxxMaxx the Elder Druid 22 Apr '08

22 Apr '08

Greetings folks! I'm wondering if there is something else that other folks are using to allow GUI administrative access to FreeRadius w/MySQL-stored user databases. I'm noticing that the Dialup-Admin web interface is leaving a LOT to be desired, and doesn't appear to be keeping up with the rest of the FreeRadius updates. I had to modify some of the .sql schemas, and I'm still getting PHP errors on some of the interface pages. ** Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 ** Does anyone still use this interface with the current 2.0.3 ? What other methods do you use to allow non-SQL savvy administrative folks to add and remove valid usernames for authentication? Basically, this web interface is the last thing standing in my way of fully implementing the newer version of FreeRadius (needed to move to different hardware, supporting a captive portal device on a Wifi network)

2 1

Juniper ERX dictionary
by Giovanni Lovato 21 Apr '08

21 Apr '08

We need to use a dictionary for JunOS 8.2, but the syntax seems to be non-standard and FreeRADIUS can't recognize it: http://pastebin.com/m6916d351 How can I translate that dictionary or make FreeRADIUS recognize it? Thank you, G.L.

2 2

FreeRADIUS + 802.1X wireless rollout questions
by Walter Gould 21 Apr '08

21 Apr '08

List, Our institution (a 4 yr. state college) is planning on implementing a 802.1X wireless network in the coming months. We have a test network in place now and all seems to be working well. We have two FreeRADIUS servers. We followed the "FreeRADIUS Active Directory Integration HOWTO <http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO>" from the wiki to get freeradius talking with our centrally managed AD servers for authentication. We are using freeradius version 2.0.3. The primary server specs are: Intel 2GHz Xeon QC, 2GB installed RAM. The secondary is currently running on a vm. I hope to purchase a piece of hardware similar to the one above to run this on in the near future. Here's where my concerns lie - I am concerned about how many simultaneous authentication requests that a single Freeradius server can handle. I have read the "Testimonials" and the "Why we're #1" pages on the freeradius site - which says there are numerous sites using freeradius to support more than 10,000 or 20,000 users. Our school currently has around 21,000 students on our campus. Of that 21,000 - there is usually around 1000 users logged into our wireless network at any given time, however, that number continually increases. Questions: 1. Do any of you have feedback/thoughts/experience on how our freeradius server may handle the auth. request load given our situation? 2. Do you think that we may need to tweak any of the settings in the radiusd.conf file (max_requests, max_request_time, etc)? 3. Any other advice/suggestions you have or think of would be welcome and appreciated. Thanks, Walter -- Walter Gould Info. Tech. Specialist Office of Information Technology Auburn University, AL

3 3