- Freeradius-Users - lists.freeradius.org

Special Characters for special Attributes
by Leander S. 06 Apr '08

06 Apr '08

Hi, I use FreeBSD 7.0 and have mpd as PPPoE Server & FreeRADIUS & PGSQL succesfully running. My goal now is it to shrink down the Bandwidth for each user with the help of IPFW and Dummynet which is supported by mpd and shouldn't be that big of a deal. That's how my /usr/local/etc/raddb/users looks like: ############################################### test User-Password == "testpasswd" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 1.2.3.4, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1492, Framed-Compression = Van-Jacobsen-TCP-IP, mpd-table += "1=11.1.11.1", mpd-table += "1=1.2.3.4", mpd-pipe += "1=bw 20Kbyte/s", mpd-pipe += "5=bw 10Kbyte/s", mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", mpd-rule += "100=allow all from any to any", [...] ############################################### The last few lines are responsible for limiting the bandwidth but those brackets causing trouble because FreeRADIUS doesn't send it like that to mpd5. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- ... somebody told me: IPFW rules are operated using shell+ipfw execution. So you should add slashes before shell special chars, like "(" or ")": mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", PS: you RADIUS configuration syntax may require additional slashing for that slashes. :) [...] Enable 'log +radius2' in mpd and make sure that rules coming to mpd with that slashes added. If there will be no slashes, then you RADIUS config strips them and you should add slashes for slashes. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- here is a part of mpd5's log to have look how RADIUS sending those attributes to mpd5: ############################################### [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] ############################################### ^^ ... so you see .. one of that slashes is missed ... BUT how do I get those two Lines: [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] looking like they do look in the /usr/local/etc/raddb/users ? Thank you Regards, Leander

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. I'm now running using the 2.0.3 finally. here is my radiusd -X output [root@host redhat]# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 6 2008 at 16:19:04 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I run /usr/local/sbin/radiusd -X tsk, tsk. [root@host redhat]# /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 6 2008 at 16:19:04 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 16:21:04 Subject: Re: Freeradius + CHAP Hi, > I was surprised myself to see this. All the while I thought that I'm running the 2.0.3 version. I've check my source install folder and the tar.gz download. I both says that it's version 2.0.3. /usr/local/sbin/radiusd by any chance? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I just found out that I have the freeradius 1.0.1, pre installed in my RHEL4. tsk, tsk... Try /usr/local/sbin/radiusd -v [root@host cgi-bin]# /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 6 2008 at 16:19:04 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I was surprised myself to see this. All the while I thought that I'm running the 2.0.3 version. I've check my source install folder and the tar.gz download. I both says that it's version 2.0.3. ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 15:12:02 Subject: Re: Freeradius + CHAP Hi, > [root@host freeradius]# /usr/sbin/radiusd -v > radiusd: FreeRADIUS Version 1.0.1, for host , built on Mar 24 2006 at 12:12:25 > Copyright (C) 2000-2003 The FreeRADIUS server project. > > is this good or bad? very very bad. i cannot offer suport for such an old version and its got hundreds of known bugs. it also has several vulnerabilities. WHY are you running such an ancient version? alan PS undo my last recommended change for any hope - that old version only understands 'Password' and '=' - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Alan, I'm trying to install/reconfigure the freeradius... ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 15:12:02 Subject: Re: Freeradius + CHAP Hi, > [root@host freeradius]# /usr/sbin/radiusd -v > radiusd: FreeRADIUS Version 1.0.1, for host , built on Mar 24 2006 at 12:12:25 > Copyright (C) 2000-2003 The FreeRADIUS server project. > > is this good or bad? very very bad. i cannot offer suport for such an old version and its got hundreds of known bugs. it also has several vulnerabilities. WHY are you running such an ancient version? alan PS undo my last recommended change for any hope - that old version only understands 'Password' and '=' - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I still can't make this work. any more suggestions? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 13:17:36 Subject: Re: freeradius_2.0.3+mysql SANDY KALUGDAN wrote: > thanks for replying. > for testing purposes, i've use 's' as the password. > SQL password for user sandy is really 's' (a) you didn't type "s" as the user's password on the client (b) the client is broken, and does not do CHAP properly (c) the code in FreeRADIUS is broken, and does not do CHAP properly. There are few other options. Perhaps try a longer password. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

[root@host freeradius]# /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Mar 24 2006 at 12:12:25 Copyright (C) 2000-2003 The FreeRADIUS server project. is this good or bad? ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 14:47:58 Subject: Re: Freeradius + CHAP Hi, > I modified my rachek table to look like this. as you have mentioned. okay - which version of FreeRADIUS are you running? 1.1.7 or 2.0.3 ? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I modified my rachek table to look like this. as you have mentioned. mysql> select * from radcheck -> ; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | s | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec) now after modifying the radcheck, here is my log when i attempted to login rad_recv: Access-Request packet from host 127.0.0.1:37811, id=0, length=211 User-Name = "s" CHAP-Challenge = 0xc506b4cdad4a8f586e4a3f040bbc4708 CHAP-Password = 0x006ce96dd9b3bdf04b8de40bbeb01b0786 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.4 Calling-Station-Id = "00-1C-A4-6F-21-10" Called-Station-Id = "00-18-F8-0A-70-69" NAS-Identifier = "nas01" Acct-Session-Id = "47f89e2100000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x6176a287b46df6978515e0237c5e3029 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "s", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "s" rlm_realm: Proxying request from user s to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 radius_xlat: 's' rlm_sql (sql): sql_set_user escaped user --> 's' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 's' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 's' ORDER BY id rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 ----- Original Message ---- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 14:02:21 Subject: Re: Freeradius + CHAP SANDY KALUGDAN wrote: > I'm having problem authenticating my users. > here is a portion of my radiusd -X > > mysql> select * from radcheck; > +----+----------+-----------+----+-------+ > | id | UserName | Attribute | op | Value | > +----+----------+-----------+----+-------+ > | 1 | s | Password | == | s | > | 2 | steve | Password | == | s | > +----+----------+-----------+----+-------+ > 2 rows in set (0.00 sec) > > mysql> select * from usergroup; > +----+----------+-----------+ > | id | UserName | GroupName | > +----+----------+-----------+ > | 1 | s | dynamic | > | 2 | steve | dynamic | > +----+----------+-----------+ > 2 rows in set (0.00 sec) > firstly, your log showed no attempted connects...so freeradius sitn receiving any. got a firewall running which is stopping the NAS devices talking to your FR on USP 1812 and 1813? secondly, change your SQL radcheck table Attribute Cleartext-Password op := alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

just noticed... when i changed the radcheck table to use "Cleartext-Password" this appears in the log. rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" ----- Original Message ---- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 14:02:21 Subject: Re: Freeradius + CHAP SANDY KALUGDAN wrote: > I'm having problem authenticating my users. > here is a portion of my radiusd -X > > mysql> select * from radcheck; > +----+----------+-----------+----+-------+ > | id | UserName | Attribute | op | Value | > +----+----------+-----------+----+-------+ > | 1 | s | Password | == | s | > | 2 | steve | Password | == | s | > +----+----------+-----------+----+-------+ > 2 rows in set (0.00 sec) > > mysql> select * from usergroup; > +----+----------+-----------+ > | id | UserName | GroupName | > +----+----------+-----------+ > | 1 | s | dynamic | > | 2 | steve | dynamic | > +----+----------+-----------+ > 2 rows in set (0.00 sec) > firstly, your log showed no attempted connects...so freeradius sitn receiving any. got a firewall running which is stopping the NAS devices talking to your FR on USP 1812 and 1813? secondly, change your SQL radcheck table Attribute Cleartext-Password op := alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0