- Freeradius-Users - lists.freeradius.org

accounting & Interim-Update's on freeradius
by Joao Miguel Ferreira 15 Feb '08

15 Feb '08

Hello all, I'm a bit confuse here..... 1) -------------------------------------------- is it possible for a freeradius setup, runnging on a NAS system, via some authentication module, determine the traffic produced by a given user and autonomouslly send the Start, Interim-Update and Stop records to some _other_ Accounting Radius server ? Something like this: user1 --\ user2 ------<-->--|NAS w/ freeradius|-<------>-[Internet, www, ...] user3 --/ \ \ \ traffic records \ \ |freeradius accounting| -------------------------------------------------------------------- 2) if that is not possible, is there any kind of freeradius API for Linux (C++/Perl... ?!) that one can use in order to send such traffic accounting records ? --------------------------------------------- Cheers joao

2 1

Calling-Station-Id in pam_radius_auth
by Stefan Winter 15 Feb '08

15 Feb '08

Hi, a somewhat sophisticated problem: in a mail server, we'd like to record the IP address of the client that triggered the IMAP authentication request. The IMAP server uses PAM, specifically pam_radius_auth. Is there a way to tell pam_radius_auth to send a value in Calling-Station-Id? Is there a way at all to send variables to PAM at all, to be used for setting Calling-Station-Id within pam_radius_auth? We could also live with getting the value into PAM and then setting it into client_id= if Calling-Station-Id is not possible; string mangling on the server side would do nicely. Something like client_id=@{SOME_STRANGE_PAM_ITEM_WHICH_CONTAINS_MY_DESIRED_VALUE} as an option to pam_radius_auth? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

FreeRadius integration with MS Active Directory
by Rutger Beyen 15 Feb '08

15 Feb '08

Hello all, I'm following the howto http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO to integrate FreeRadius with Microsoft's AD. However, I'm experiencing some troubles. My disto is Debian 4. I had to install some packages, like krb5-kdc, krb5-user and krb5-config, to have the file /etc/krb5.conf (It wasn't there in the first place). When I want to do a net join, I get a message saying that I have errors in my krb5.conf file. I removed the lines "dns_lookup_realm = false" and "dns_lookup_kdc = false" and then it worked. At least I think it did. I got the message: joined "PROJECT" to realm "PROJECT.LOCAL". When I then wanted to test this using wbinfo, I get the error code "NT_STATUS_NO_SUCH_USER" (should be normal according to the howto) and another one: "NT_STATUS_ACCESS_DENIED" Could not authenticate user myuser with challenge/response. A try with ntlm_auth is also negative "NT_STATUS_NO_SUCH_USER". Can somebody please help me with my problem? Am I overlooking something or what am I doing wrong? Thanks a million, Rutger Here are the 2 config files: smb.conf [global] ## Browsing/Identification ### workgroup = project server string = %h server dns proxy = no #### Debugging/Accounting #### log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d ####### Authentication ####### # "security = user" is always a good idea. This will require a Unix account # in this server for every user accessing the server. See # /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html # in the samba-doc package for details. security = ads # You may wish to use password encryption. See the section on # 'encrypt passwords' in the smb.conf(5) manpage before enabling. encrypt passwords = true # If you are using encrypted passwords, Samba will need to know what # password database type you are using. passdb backend = tdbsam obey pam restrictions = yes ; guest account = nobody invalid users = root passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . # This boolean controls whether PAM will be used for password changes # when requested by an SMB client instead of the program listed in # 'passwd program'. The default is 'no'. ; pam password change = no ############ Misc ############ # Most people will find that this option gives better performance. # See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html # for details # You may want to add the following on a Linux system: # SO_RCVBUF=8192 SO_SNDBUF=8192 socket options = TCP_NODELAY # Some defaults for winbind (make sure you're not using the ranges # for something else.) idmap uid = 10000-20000 idmap gid = 10000-20000 template shell = /bin/bash winbind use default domain = no password server = project-ad.project.local realm = project.local #======================= Share Definitions ======================= [homes] comment = Home Directories browseable = no # By default, the home directories are exported read-only. Change next # parameter to 'yes' if you want to be able to write to them. writable = yes # File creation mask is set to 0700 for security reasons. If you want to # create files with group=rw permissions, set next parameter to 0775. create mask = 0700 # Directory creation mask is set to 0700 for security reasons. If you want to # create dirs. with group=rw permissions, set next parameter to 0775. directory mask = 0700 # Restrict access to home directories # to the one of the authenticated user # This might need tweaking when using external authentication schemes valid users = %S # Un-comment the following and create the netlogon directory for Domain Logons # (you need to configure Samba to act as a domain controller too.) ;[netlogon] ; comment = Network Logon Service ; path = /home/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no krb5.conf [logging] default = FILE:/war/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = PROJECT.LOCAL # dns_lookup realm = false # dns_lookup_kdc = false # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. v4_instance_resolve = false v4_name_convert = { host = { rcmd = host ftp = ftp } plain = { something = something-else } } fcc-mit-ticketflags = true [realms] PROJECT.LOCAL = { kdc = project-ad.project.local:88 admin_server = project-ad.project.local default_domain = project.local } [domain_realm] .project.local = PROJECT.LOCAL project.local = PROJECT.LOCAL [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [login] krb4_convert = true krb4_get_tickets = false

2 1

EAP session matching the State variable.
by Norbert Wegener 15 Feb '08

15 Feb '08

With 2.0.0 sometimes I get this error message, that I have not seen before: rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT This does not sound good, as there is no real load on the server and the same client will be authenticated some time later without configurational changes. If neccessary, I can provide the long log. Norbert Wegener

8 32

detail file reading
by Alexandre Chapellon 14 Feb '08

14 Feb '08

I upgraded to 2.0.2 but still have a problem with reading detail (to do copy-acct-to-home-server ): It only processes the first request of the detail file and stops after receiving the accouting response. May some one help me? here follows part of freeradius -X: Polling for detail file /var/log/freeradius/radacct/detail detail_recv: Read packet from /var/log/freeradius/radacct/detail User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... server copy-acct-to-home-server { +- entering group preacct rlm_realm: Looking up realm "XXX" for User-Name = "DFXMFhhp@XXX" rlm_realm: Found realm "XXX" rlm_realm: Proxying request from user DFXMFhhp to realm XXX rlm_realm: Adding Realm = "XXX" rlm_realm: Preparing to proxy accounting request to realm "XXX" ++[suffix] returns updated +- entering group accounting ++[ok] returns ok } # server copy-acct-to-home-server Sending Accounting-Request of id 21 to a.b.c.d port 1813 User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... Proxying request 2 to home server a.b.c.d port 1813 Sending Accounting-Request of id 21 to a.b.c.d port 1813 User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... Going to the next request Waking up in 0.5 seconds. rad_recv: Accounting-Response packet from host a.b.c.d port 1813, id=21, length=27 Proxy-State = 0x3438353131 server copy-acct-to-home-server { } # server copy-acct-to-home-server Finished request 2. Going to the next request Waking up in 0.5 seconds. Cleaning up request 0 ID 211 with timestamp +15

1 0

virtual servers
by Stefan Winter 14 Feb '08

14 Feb '08

Hi, just switching from a 1.1.7 with an incredibly sophisticated policy engine to a virtual-server based, simple 2.0 setup here. From what I see so far, virtual servers really rock. There's just one use case not entirely clear to me: I receive requests from a proxy who in turn has multiple clients behind. I want to decide stuff based on who *that other server's* clients are. It works today by tagging packets on that proxy with a VSA, upon which the home server decides the applicable policy. If I want to get that done with 2.0, I'm unsure how to proceed. If I get a tagged packet from the proxy and assign this proxy's IP address to a virtual server, I could process its VSAs in that server. But then I would ideally like to re-distribute the packets after that to their own virtual servers. Kind of like: in authorize, find out about the VSA, then set a magic variable "Handoff-to-Virtual-Server := someserver", and then the packet gets handed to that other virtual server automatically. Does that make any sense? How do I do that? Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 2

"rlm_sql_mysql.so" where do I locate this file and its associated files for CentOS to run freeRadius and MySQL
by johnson elangbam 14 Feb '08

14 Feb '08

Hi, I am trying to build a radius with free radius 2.0.0 using MySql 4.1.2and I am getting the following errors rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[124]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[34]: Errors parsing authorize section. where do I locate this file With Regards Elangbam Johnson

2 1

Version 2.0.2 has been released.
by Alan T DeKok 14 Feb '08

14 Feb '08

People using EAP should definitely upgrade. Feature improvements * Added notes on how to debug the server in radiusd.conf * Moved all "log_*" in radiusd.conf to log{} section. The old configurations are still accepted, though. * Added ca.der target in raddb/certs/Makefile. This is needed for importing CA certs into Windows. * Added ability send raw attributes via "Raw-Attribute = 0x0102..." This is available only debug builds. It can be used to create invalid packets! Use it with care. * Permit "unlang" policies inside of Auth-Type{} sub-sections of the authenticate{} section. This makes some policies easier to implement. * "listen" sections can now have "type = proxy". This lets you control which IP is used for sending proxied requests. * Added note on SSL performance to raddb/certs/README Bug fixes * Fixed reading of "detail" files. * Allow inner EAP tunneled sessions to be proxied. * Corrected MySQL schemas * syslog now works in log{} section. * Corrected typo in raddb/certs/client.cnf * Updated raddb/sites-available/proxy-inner-tunnel to permit authentication to work. * Ignore zero-length attributes in received packets. * Correct memcpy when dealing with unknown attributes. * Corrected debugging messages in attr_rewrite. * Corrected generation of State attribute in EAP. This fixes the "failed to remember handler" issues. * Fall back to DEFAULT realm if no realm was found. Based on a patch from Vincent Magnin. * Updated example raddb/sites-available/proxy-inner-tunnel * Corrected behavior of attr_filter to match documentation. This is NOT backwards compatible with previous versions! See "man rlm_attr_filter" for details.

4 4

using freeradius-failover with 2 servers
by Oguzhan Kayhan 14 Feb '08

14 Feb '08

Hello, I am wondering if such scenario is possible. I want to use 2 freeradius servers for failover. It seems it wont be a problem if i use mysql backend for logging etc. But, I wonder what will happen about multiple login check. Because as i know freeradius also checks radutmp file if the user is already logged in or not. And for ex...If user logs in from server1 and when he tries to login from server2...what will be the result? Thanks..

2 1

Are SHA-256 certificates supported?
by Jan Schroetter 14 Feb '08

14 Feb '08

Hello! I reply to old message from Thu Oct 25 13:37:14 CEST 2007. I'm trying to use freeRADIUS for EAP-TLS authentication using certificate with SHA-256 digest. I found this topic in archive and the last message (below) says support for SHA-256 is already in CVS. But it's probably not in 2.0.1. Can I ask why? I tried adding EVP_add_digest(EVP_sha256()); to eaptls_initiate(...) and it helps. But official support for SHA-256 would be fine.. Many thanks! Best regards Jan Schroetter ---Original message--- Hi, >> I can live with this hack in my test server, but would appreciate it if >> FreeRADIUS added official support for SHA-256 digests. > > I've added the appropriate OpenSSL initialization call to the source. > > Alan DeKok. thank you. The CVS version seems to work with my certificates, and also when using SHA-256 certificate on the server side. regards, - hannu

1 0