- Freeradius-Users - lists.freeradius.org

Service-Type=Framed-User translated to Service-Type=Framed?
by Jon SK Phang 14 Nov '07

14 Nov '07

Hi All, Not sure if anyone else saw this. I’m using freeradius-server-pre-2.0.0-8.1 and have got everything to work so far. The backend is a MySQL database. >From a debug instance of FreeRADIUS, it reads Sending Access-Accept of id 44 to 10.152.54.138 port 3129 Framed-IP-Address := 0.0.0.101 Cisco-AVPair += "lcp:interface-config=ip vrf forwarding VRF-PUBLIC" Cisco-AVPair += "lcp:interface-config=peer default ip address pool VRF-PUBLIC" Cisco-AVPair += "lcp:interface-config=ip unnumbered Loopback 99" Service-Type := Framed-User Finished request 0 state 5 Going to the next request But in the Cisco debug log, the word “-User” at the reply in Service-Type=Framed-User is missing. I can only see Service-Type=Framed In NTRadPing utility, the results are the same. Have tried putting the attributes both in radreply and radgroupreply with no difference. Regards Jonathan __________________________________________________________________ Yahoo! Singapore Answers Real people. Real questions. Real answers. Share what you know at http://answers.yahoo.com.sg

2 1

RLM_python patch to enable postproxy - Not work need a little help
by Mike O'Connor 14 Nov '07

14 Nov '07

Hi Guys I wrote the attached patch for Freeradius 1.1.7 to enabled calling python in the post-proxy, it compiles but will not run when the hook is listed in post-proxy because Freeradius complains that there is no support for post-proxy in rlm_python. My question is where in the source is the list of allowed call per module ? Once I know this I can fix this attached and supply as a tested patch. Thanks Mike --- src/modules/rlm_python/rlm_python.c.orig 2007-03-06 00:45:28.000000000 +1030 +++ src/modules/rlm_python/rlm_python.c 2007-10-10 15:36:51.000000000 +0930 @@ -54,6 +54,7 @@ char *mod_authenticate; char *mod_preacct; char *mod_accounting; + char *mod_post_proxy; char *mod_checksimul; char *mod_detach; @@ -63,6 +64,7 @@ char *func_authenticate; char *func_preacct; char *func_accounting; + char *func_post_proxy; char *func_checksimul; char *func_detach; @@ -71,6 +73,7 @@ PyObject *pModule_authenticate; PyObject *pModule_preacct; PyObject *pModule_accounting; + PyObject *pModule_post_proxy; PyObject *pModule_checksimul; PyObject *pModule_detach; @@ -80,6 +83,7 @@ PyObject *pFunc_authenticate; PyObject *pFunc_preacct; PyObject *pFunc_accounting; + PyObject *pFunc_post_proxy; PyObject *pFunc_checksimul; PyObject *pFunc_detach; }; @@ -120,6 +124,11 @@ { "func_accounting", PW_TYPE_STRING_PTR, offsetof(struct rlm_python_t, func_accounting), NULL, NULL}, + { "mod_post_proxy", PW_TYPE_STRING_PTR, + offsetof(struct rlm_python_t, mod_post_proxy), NULL, NULL}, + { "func_post_proxy", PW_TYPE_STRING_PTR, + offsetof(struct rlm_python_t, func_post_proxy), NULL, NULL}, + { "mod_checksimul", PW_TYPE_STRING_PTR, offsetof(struct rlm_python_t, mod_checksimul), NULL, NULL}, { "func_checksimul", PW_TYPE_STRING_PTR, @@ -490,6 +499,7 @@ python_objclear(&data->pFunc_authenticate); python_objclear(&data->pFunc_preacct); python_objclear(&data->pFunc_accounting); + python_objclear(&data->pFunc_post_proxy); python_objclear(&data->pFunc_checksimul); python_objclear(&data->pFunc_detach); @@ -498,6 +508,7 @@ python_objclear(&data->pModule_authenticate); python_objclear(&data->pModule_preacct); python_objclear(&data->pModule_accounting); + python_objclear(&data->pModule_post_proxy); python_objclear(&data->pModule_checksimul); python_objclear(&data->pModule_detach); } @@ -566,6 +577,12 @@ &data->pFunc_accounting) < 0) goto failed; + if (python_load_function(data->mod_post_proxy, + data->func_post_proxy, + &data->pModule_post_proxy, + &data->pFunc_post_proxy) < 0) + goto failed; + if (python_load_function(data->mod_checksimul, data->func_checksimul, &data->pModule_checksimul, @@ -633,6 +650,14 @@ "accounting"); } +static int python_post_proxy(void *instance, REQUEST *request) +{ + return python_function( + request, + ((struct rlm_python_t *)instance)->pFunc_post_proxy, + "post-proxy"); +} + static int python_checksimul(void *instance, REQUEST *request) { return python_function( @@ -663,7 +688,7 @@ python_accounting, /* accounting */ python_checksimul, /* checksimul */ NULL, /* pre-proxy */ - NULL, /* post-proxy */ + python_post_proxy, /* post-proxy */ NULL /* post-auth */ }, python_detach, /* detach */

2 4

1.1.7 on Debian sarge ?
by oz 13 Nov '07

13 Nov '07

Hello list, doesn't freeradius-1.1.7 no longer compile on Debian sarge (oldstable)? I get these errors on after ./configure and make: [...] Making all in rlm_perl... make[6]: Entering directory `/usr/local/src/freeradius-1.1.7/src/modules/rlm_perl' /usr/local/src/freeradius-1.1.7/libtool --mode=compile gcc -g -O2 -I/usr/local/src/f reeradius-1.1.7/src/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -f no-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I /usr/lib/perl/5.8/CORE -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-st rict-aliasing -I/usr/local/include -c rlm_perl.c mkdir .libs gcc -g -O2 -I/usr/local/src/freeradius-1.1.7/src/include -D_REENTRANT -D_GNU_SOURCE - DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOU RCE -D_FILE_OFFSET_BITS=64 -I/usr/lib/perl/5.8/CORE -D_REENTRANT -D_GNU_SOURCE -DTHREA DS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -c rlm_perl.c -fPIC - DPIC -o .libs/rlm_perl.o rlm_perl.c: In function `perl_xlat': rlm_perl.c:658: parse error before `*' rlm_perl.c:660: `handle' undeclared (first use in this function) rlm_perl.c:660: (Each undeclared identifier is reported only once rlm_perl.c:660: for each function it appears in.) make[6]: *** [rlm_perl.lo] Error 1 make[6]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/local/src/freeradius-1.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/local/src/freeradius-1.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/local/src/freeradius-1.1.7' make: *** [all] Error 2 /usr/local/src/freeradius-1.1.7# But I can compile 1.1.7 on Debian etch (stable) and Debian lenny (testing). Am I just missing a Debian developement package or something? I'd like to update our productive sarge installations before I try distro updates. Any ideas or known issues with Debian sarge? Thanks.

2 2

Some users can't login after upgrade!
by Dean, Barry 13 Nov '07

13 Nov '07

The configuration I had was FreeRADIUS 1.1.4 running on NetBSD_3.0 (STABLE) authenticating to Novell eDirectory using LDAP. All was fine... I upgraded to FreeRADIUS 1.1.7 and all seemed OK, until two of my users found they can no longer login to the Cisco VPN3000 which uses this RADIUS. The log files simply show: Tue Nov 6 15:06:40 2007 : Auth: Login incorrect: [<user>] (from client vpn3000 port 13712 cli X.X.X.X) We also use RADIUS with EZProxy. I used a spare EZProxy test box and asked the user to login using that, failed with 1.1.7 RADIUS, changed it to use a spare 1.1.4 server and they could login! User names are alphabetic only and less than 8 characters, passwords are alpha-numeric only and 8 characters. I am reasonably new to RADIUS and cannot figure out why these two users are being singled out! I thought at first it might be because we have "edir_account_policy_check=yes" and that given the ChangeLog for 1.1.7 says "Added more eDirectory support.", and the two users possibly have extra attributes as they are sysadmins, that something was being checked that was not with 1.1.4 and that was preventing login. However later in radiusd.conf in the post-auth section the LDAP server entries are commented out. and it says: # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. So does this mean this feature is not in operation? Has anyone any ideas where I should start looking? Thanks. --------------- Barry Dean Networks Team University of Liverpool

2 5

FreeRadius returns the same attribute value twice
by VM 13 Nov '07

13 Nov '07

Hi, I have a problem with the Filter-ID attribute : When a switch (Enterasys) gets the filter-ID in an 'access-accept' reply, its value is written twice : ..... AVP: l=6 t=Service-Type(6): Framed-User(2) AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=6 t=EAP-Message(79) Last Segment [1] ..... And this comportment confuses the switch (an old one). This happens only in an EAP negociation. Not in clear Radius. Do you know where this may come from ? Something to do with the fact that I set "use_tunnelled_reply=yes" in EAP.conf ? Thanks in advance, Vincent MAZARD

2 1

Re: Mikrotik ignores Framed-IP-Address
by Marinko Tarlac 13 Nov '07

13 Nov '07

Well I'm trying to use it. When I enter for example ID | UserName | Attribute | op 32 | user | Framed-IP-Address | 192.168.8.152 | := in radreply table, user should get static IP address (in this case 192.168.8.152) but this is ignored by Mikrotik because Framed-Pool is also available because user is inside specific group which has defined IP pool. When I delete IP pool from Mikrotik everything works fine... It seem that finally I will wrote specific perl or php script who will be dedicated to decide if framed-ip-address exist send it to MT else send IP-pool name Re: Mikrotik ignores Framed-IP-Address (tnt(a)kalik.co.yu) > > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 12 Nov 2007 12:55:14 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Mikrotik ignores Framed-IP-Address > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <fXF2NwKz.1194868514.1514360.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Use one way to assign IP addresses: DHCP or radius. If you want to give > static addresses to devices use dhcp pools (dynamic IP) and reservations > (static IP); if you want to give static IPs to users than use radius > ippool (dynamic IP) and (static) IP address assignment. > > Ivan Kalik > Kalik Informatika ISP > > Dana 12/11/2007, "Marinko Tarlac" <mangia81(a)gmail.com> pi?e: > > >> Hello >> >> I have freeradius and Mikrotik combination and here is the problem. >> Freeradius is configured to use mysql database. When I add >> Framed-IP-Address for certain user (in radreply table) For example >> >> 32 user Framed-IP-Address 10.51.8.152 := >> >> It works but only if I don't have IP pool created on Mikrotik. If I >> create IP pool than Framed-IP-Address is ignored. Framed-Pool is >> specified for every group and attributes for every group is added in >> radgroupreply table. >> >> Log without IP pool >> >> rad_recv: Access-Request packet from host 192.168.1.7:1026, id=229, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 870 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x89a28dc77659b6311a88c16eb7500767 >> CHAP-Password = 0x01d385ce5c814c1d1db9cafadb4736c351 >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 229 to 192.168.1.7 port 1026 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> >> Log with created IP pool called "radius" >> >> rad_recv: Access-Request packet from host 192.168.1.7:1027, id=240, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x5293ac8321ad51693a5e3109f8887511 >> CHAP-Password = 0x01b0a9f7bca1f632878bee51c13d667f5c >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 240 to 192.168.1.7 port 1027 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> rad_recv: Accounting-Request packet from host 192.168.1.7:1027, >> id=241, length=146 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> Acct-Session-Id = "81d00316" >> Framed-IP-Address = 192.168.8.159 >> Acct-Authentic = RADIUS >> Acct-Status-Type = Start >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> Acct-Delay-Time = 0 >> rlm_sql (sql): Reserving sql socket id: 3 >> rlm_sql (sql): Released sql socket id: 3 >> Sending Accounting-Response of id 241 to 192.168.1.7 port 1027 >> >> Any ideas? >> > >

2 1

Two more reasons to upgrade to 2.0
by Alan DeKok 12 Nov '07

12 Nov '07

Download CVS head, and: $ man radiusd ... In short: "-C" now works. Sort of. The server doesn't open any sockets. It doesn't check SQL, LDAP, etc. But modules which don't depend on anything (i.e. chap), and modules which only read flat-text files are checked for sanity when "-C" is used. The "man" page describes the limitations of "-C". $ kill -HUP `psgrep radiusd` This works. Sort of. For now, HUP *only* reloads the "files" module. it doesn't change ANYTHING else in the server. It doesn't reload, re-open, or examine ANY of the configuration files such as "radiusd.conf", "eap.conf", etc. With tiny amounts more work, a few other modules can be made to reload on HUP. i.e. preprocess, passwd, linelog, and a few others. Just as with "-C", SQL and LDAP won't be reloaded on HUP. Also, EAP won't be reloaded on HUP. If you *really* need that functionality, it's a large amount of work, and will need to be funded. Alan DeKok.

1 0

How to return Reply-Message when user submitted wrong password
by Lee Sing Chyun 12 Nov '07

12 Nov '07

Hi, Is there a way to reply with a intuitive Reply-Message (for e.g., 'Wrong Password') when the user tries to authenticate with a wrong password? My current configuration is using rlm_pap and rlm_sql for authorization and authentication. FreeRADIUS version is 1.1.7. Thanks in advance! -- Best Regards, SC

3 5

Mikrotik ignores Framed-IP-Address
by Marinko Tarlac 12 Nov '07

12 Nov '07

Hello I have freeradius and Mikrotik combination and here is the problem. Freeradius is configured to use mysql database. When I add Framed-IP-Address for certain user (in radreply table) For example 32 user Framed-IP-Address 10.51.8.152 := It works but only if I don't have IP pool created on Mikrotik. If I create IP pool than Framed-IP-Address is ignored. Framed-Pool is specified for every group and attributes for every group is added in radgroupreply table. Log without IP pool rad_recv: Access-Request packet from host 192.168.1.7:1026, id=229, length=149 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 870 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" CHAP-Challenge = 0x89a28dc77659b6311a88c16eb7500767 CHAP-Password = 0x01d385ce5c814c1d1db9cafadb4736c351 NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "admin-test" with CHAP password rlm_chap: Using clear text password "perica" for user admin-test authentication. rlm_chap: chap user admin-test authenticated succesfully Sending Access-Accept of id 229 to 192.168.1.7 port 1026 Framed-IP-Address := 192.168.8.152 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Ascend-Data-Rate := 0 Ascend-Xmit-Rate := 0 Framed-Pool := "radius" Log with created IP pool called "radius" rad_recv: Access-Request packet from host 192.168.1.7:1027, id=240, length=149 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 872 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" CHAP-Challenge = 0x5293ac8321ad51693a5e3109f8887511 CHAP-Password = 0x01b0a9f7bca1f632878bee51c13d667f5c NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "admin-test" with CHAP password rlm_chap: Using clear text password "perica" for user admin-test authentication. rlm_chap: chap user admin-test authenticated succesfully Sending Access-Accept of id 240 to 192.168.1.7 port 1027 Framed-IP-Address := 192.168.8.152 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Ascend-Data-Rate := 0 Ascend-Xmit-Rate := 0 Framed-Pool := "radius" rad_recv: Accounting-Request packet from host 192.168.1.7:1027, id=241, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 872 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" Acct-Session-Id = "81d00316" Framed-IP-Address = 192.168.8.159 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 Acct-Delay-Time = 0 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 Sending Accounting-Response of id 241 to 192.168.1.7 port 1027 Any ideas?

2 1

radius server and MAC authentication for wireless
by Shawn Adams 11 Nov '07

11 Nov '07

I've noted that some wireless APs using MAC/MAC authentication send the MAC in the form: 11-22-33-44-55-66 or 11:22:33:44:55:66 or 112233445566 The last seems most prevelent. Is there a method to configure $RADIUS/user.conf or $RADIUS/radiusd.conf (or other file) to allow the radius to authenticate *both* with one user entry ? I guess I'm thinking about a user.conf entry which allows PC_X to attach to Access_point_A and authenticate when the userid/password is sent 112233445566 *and* allow the same PC, when roaming to Access_point_B to authenticate with 11-22-33-44-55-66 using only one users.conf entry. Any help appreciated. Thanks

4 13