- Freeradius-Users - lists.freeradius.org

limiting Authentication based on the NAS
by Terry Pelley 08 Nov '07

08 Nov '07

Sorry, First posting contained no subject header. This is a repost. I want to be able to specify which Wireless Access Points certain users can gain access from. Is there an attribute that I can set so that a user can only be authenticated if the request comes from a predetermined NAS or group of NASs? thnx.

2 1

NAS is not available
by hadi golestani 08 Nov '07

08 Nov '07

Hi, I've a freeRadius that is configured to work with pptpd and it's working great, but when I've installed daloradius to generate some reports, dalo told me that there's no NAS configured ! so what's this NAS and is the NAS important for freeradius to find out disconnected people? tnx

2 3

ldap instead of /users file
by stefek143 08 Nov '07

08 Nov '07

Hello. I red that ldap can`t be used with eap-tls method to auth., but just what i wanna do is use LDAP instead of /raddb/users file . for example attribute VLAN ID etc. Is it possible? if yes, where i find some information about it? becouse everywhere is "howto authentication, authorization using LDAP" but i think its big different in radius configuration when i wanna use LDAP only instead of users file. THX for any information.

2 1

cisco freeradius problems
by Edgars Makņa 08 Nov '07

08 Nov '07

Hello I have interesting problems with freeradius authentication. NAS - cisco 2801 radius - freeradius running on freebsd with mysql db. I had a lot of such errors in radius.log: Auth: Login incorrect (rlm_pap: CRYPT password check failed): [1-102/D\014\003\222\374\267<z\013y\005\200\354S\373\344] (from client plaza port 0) In debug output i get "unprintable characters". In the same time authentication was working fine from other hosts, for example smtp server. Problem was solved in interesting way, on cisco i specified radius source interface. It was working fine until mysql server crashed and i got same garbage in authentication. I removed source radius interface from cisco configuration and everything started to work fine again. Any ideas?

2 6

radius going to sleep?
by Norbert Wegener 08 Nov '07

08 Nov '07

In a cvs version of pre2, which is newer than pre2, on one machine, after some time of inactivity, freeradius does not seem to answer at all- sometimes, not reliable reproducable. Freeradius has a lot of database connections to mysql, maybe they are the culprit for that behaviour? stracing freeradius gives: # strace -f -p 29757 Process 29807 attached with 51 threads - interrupt to quit [pid 29757] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29758] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29759] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29760] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29761] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- ... [pid 29796] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29797] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29798] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29799] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29800] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29801] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29802] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29803] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- --- [pid 29778] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29779] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29780] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29781] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29782] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29783] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29784] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29785] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29786] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- ... [pid 29803] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29804] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29805] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29806] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29807] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29758] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29759] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29760] read(9, <unfinished ...> [pid 29761] read(8, <unfinished ...> [pid 29762] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29763] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29764] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29765] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29766] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [..... [pid 29798] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29799] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29800] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29801] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29802] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29803] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29804] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29805] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29806] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29807] futex(0x8002f654, FUTEX_WAIT, 0, NULL with a few dozens lines deleted. strace's output stops here, also when radius request come in. They are not answered. Any idea, what's going wrong here or how to track that down? I already tried nohup gdb -x gdbargs /sbin/radiusd & with gdbargs containing: run -AX bt but was unable to reproduce that situation in this context. Running radiusd under gdb's control seemed to solve that problem, maybe that's not the final solution. Norbert Wegener

4 13

SIGHUP works in 2.0.0?
by Hangjun He 08 Nov '07

08 Nov '07

SIGHUP works in 2.0.0? Thanks. John --------------------------------- 雅虎邮箱，终生伙伴！

2 1

radius 1.1.7 hangs 100% cpu
by Joe Vieira 08 Nov '07

08 Nov '07

Hi, I currently have the server in debug and am waiting to see if it fails with an actual error. In the mean time this is what i am seeing. rhel5-64bit freeradius 1.1.7 after about a day and a half one of the threads decides to use 100% of the CPU it's on, and nothing is logged in the normal logs from the time that starts. my conf file is here let me know if you see a problem with it...everything WORKS, except when it hangs..... before this started happening i changed max request time up to 60 cleanup delay to 6 max requests to 640000 as well as increased the min number of servers to 8. i thought those changes would be pretty harmless, should i have been more careful with them? #######CONFIG FILE ############ prefix = /usr exec_prefix = /usr sysconfdir = /etc/ localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radius group = radius # max_request_time: The maximum time (in seconds) to handle a request. # # Requests which take more time than this to process may be killed, and # a REJECT message is returned. # # WARNING: If you notice that requests take a long time to be handled, # then this MAY INDICATE a bug in the server, in one of the modules # used to handle a request, OR in your local configuration. # # Useful range of values: 5 to 120 # max_request_time = 30 # delete_blocked_requests: If the request takes MORE THAN 'max_request_time' # to be handled, then maybe the server should delete it. # # If you're running in threaded, or thread pool mode, this setting # should probably be 'no'. Setting it to 'yes' when using a threaded # server MAY cause the server to crash! # delete_blocked_requests = no # cleanup_delay: The time to wait (in seconds) before cleaning up # a reply which was sent to the NAS. # # The RADIUS request is normally cached internally for a short period # of time, after the reply is sent to the NAS. The reply packet may be # lost in the network, and the NAS will not see it. The NAS will then # re-send the request, and the server will respond quickly with the # cached reply. # # If this value is set too low, then duplicate requests from the NAS # MAY NOT be detected, and will instead be handled as seperate requests. # # If this value is set too high, then the server will cache too many # requests, and some new requests may get blocked. (See 'max_requests'.) # # Useful range of values: 2 to 10 # cleanup_delay = 5 # max_requests: The maximum number of requests which the server keeps # track of. This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. # # If this number is too low, then when the server becomes busy, # it will not respond to any new requests, until the 'cleanup_delay' # time has passed, and it has removed the old requests. # # If this number is set too high, then the server will use a bit more # memory for no real benefit. # # If you aren't sure what it should be set to, it's better to set it # too high than too low. Setting it to 1000 per client is probably # the highest it should be. # # Useful range of values: 256 to infinity # max_requests = 340000 # It can either contain "*", or an IP address, or a fully qualified # Internet domain name. The default is "*" # listen { # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = 10.5.5.11 # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" port = 0 # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # type = auth } listen { # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = 10.13.13.13 # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" port = 0 # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # type = auth } # hostname_lookups: Log the names of clients or just their IP addresses # e.g., www.freeradius.org (on) or 206.47.27.232 (off). # # The default is 'off' because it would be overall better for the net # if people had to knowingly turn this feature on, since enabling it # means that each client request will result in AT LEAST one lookup # request to the nameserver. Enabling hostname_lookups will also # mean that your server may stop randomly for 30 seconds from time # to time, if the DNS requests take too long. # # Turning hostname lookups off also means that the server won't block # for 30 seconds, if it sees an IP address which has no name associated # with it. # # allowed values: {no, yes} # hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # # allowed values: {no, yes} # allow_core_dumps = no # Regular expressions # # These items are set at configure time. If they're set to "yes", # then setting them to "no" turns off regular expression support. # # If they're set to "no" at configure time, then setting them to "yes" # WILL NOT WORK. It will give you an error. # regular_expressions = yes extended_expressions = yes # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = no # usercollide: Turn "username collision" code on and off. See the # "doc/duplicate-users" file # # WARNING # !!!!!!! Setting this to "yes" may result in the server behaving # !!!!!!! strangely. The "username collision" code will ONLY work # !!!!!!! with clear-text passwords. Even then, it may not do what # !!!!!!! you want, or what you expect. # !!!!!!! # !!!!!!! We STRONGLY RECOMMEND that you do not use this feature, # !!!!!!! and that you find another way of acheiving the same goal. # !!!!!!! # !!!!!!! e,g. module fail-over. See 'doc/configurable_failover' # WARNING # usercollide = no # lower_user / lower_pass: # Lower case the username/password "before" or "after" # attempting to authenticate. # # If "before", the server will first modify the request and then try # to auth the user. If "after", the server will first auth using the # values provided by the user. If that fails it will reprocess the # request after modifying it as you specify below. # # This is as close as we can get to case insensitivity. It is the # admin's job to ensure that the username on the auth db side is # *also* lowercase to make this work # # Default is 'no' (don't lowercase values) # Valid values = "before" / "after" / "no" # lower_user = no lower_pass = no # nospace_user / nospace_pass: # # Some users like to enter spaces in their username or password # incorrectly. To save yourself the tech support call, you can # eliminate those spaces here: # # Default is 'no' (don't remove spaces) # Valid values = "before" / "after" / "no" (explanation above) # nospace_user = after nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad # SECURITY CONFIGURATION # # There may be multiple methods of attacking on the server. This # section holds the configuration items which minimize the impact # of those attacks # security { # # max_attributes: The maximum number of attributes # permitted in a RADIUS packet. Packets which have MORE # than this number of attributes in them will be dropped. # # If this number is set too low, then no RADIUS packets # will be accepted. # # If this number is set too high, then an attacker may be # able to send a small number of packets which will cause # the server to use all available memory on the machine. # # Setting this number to 0 means "allow any number of attributes" max_attributes = 200 # # delayed_reject: When sending an Access-Reject, it can be # delayed for a few seconds. This may help slow down a DoS # attack. It also helps to slow down people trying to brute-force # crack a users password. # # Setting this number to 0 means "send rejects immediately" # # If this number is set higher than 'cleanup_delay', then the # rejects will be sent at 'cleanup_delay' time, when the request # is deleted from the internal cache of requests. # # Useful ranges: 1 to 5 reject_delay = 1 # # status_server: Whether or not the server will respond # to Status-Server requests. # Normally this should be set to "no", because they're useless. # See: http://www.freeradius.org/rfc/rfc2865.html#Keep-Alives # # However, certain NAS boxes may require them. # # When sent a Status-Server message, the server responds with # an Access-Accept packet, containing a Reply-Message attribute, # which is a string describing how long the server has been # running. # status_server = no } # CLIENTS CONFIGURATION # # Client configuration is defined in "clients.conf". # # The 'clients.conf' file contains all of the information from the old # 'clients' and 'naslist' configuration files. We recommend that you # do NOT use 'client's or 'naslist', although they are still # supported. # # Anything listed in 'clients.conf' will take precedence over the # information from the old-style configuration files. # $INCLUDE ${confdir}/clients.conf # THREAD POOL CONFIGURATION # # The thread pool is a long-lived group of threads which # take turns (round-robin) handling any incoming requests. # # You probably want to have a few spare threads around, # so that high-load situations can be handled immediately. If you # don't have any spare threads, then the request handling will # be delayed while a new thread is created, and added to the pool. # # You probably don't want too many spare threads around, # otherwise they'll be sitting there taking up resources, and # not doing anything productive. # # The numbers given below should be adequate for most situations. # thread pool { # Number of servers to start initially --- should be a reasonable # ballpark figure. start_servers = 8 # Limit on the total number of servers running. # # If this limit is ever reached, clients will be LOCKED OUT, so it # should NOT BE SET TOO LOW. It is intended mainly as a brake to # keep a runaway server from taking the system with it as it spirals # down... # You may find that the server is regularly reaching the # 'max_servers' number of threads, and that increasing # 'max_servers' doesn't seem to make much difference. # # If this is the case, then the problem is MOST LIKELY that # your back-end databases are taking too long to respond, and # are preventing the server from responding in a timely manner. # # The solution is NOT do keep increasing the 'max_servers' # value, but instead to fix the underlying cause of the # problem: slow database, or 'hostname_lookups=yes'. # # For more information, see 'max_request_time', above. # max_servers = 35 # Server-pool size regulation. Rather than making you guess # how many servers you need, FreeRADIUS dynamically adapts to # the load it sees, that is, it tries to maintain enough # servers to handle the current load, plus a few spare # servers to handle transient load spikes. # # It does this by periodically checking how many servers are # waiting for a request. If there are fewer than # min_spare_servers, it creates a new spare. If there are # more than max_spare_servers, some of the spares die off. # The default values are probably OK for most sites. # min_spare_servers = 5 max_spare_servers = 10 # There may be memory leaks or resource allocation problems with # the server. If so, set this value to 300 or so, so that the # resources will be cleaned up periodically. # # This should only be necessary if there are serious bugs in the # server which have not yet been fixed. # # '0' is a special value meaning 'infinity', or 'the servers never # exit' max_requests_per_server = 0 } # MODULE CONFIGURATION # # The names and configuration of each module is located in this section. # # After the modules are defined here, they may be referred to by name, # in other sections of this configuration file. # modules { # # Each module has a configuration as follows: # # name [ instance ] { # config_item = value # ... # } # # The 'name' is used to load the 'rlm_name' library # which implements the functionality of the module. # # The 'instance' is optional. To have two different instances # of a module, it first must be referred to by 'name'. # The different copies of the module are then created by # inventing two 'instance' names, e.g. 'instance1' and 'instance2' # # The instance names can then be used in later configuration # INSTEAD of the original 'name'. See the 'radutmp' configuration # below for an example. # # PAP module to authenticate users based on their stored password # # Supports multiple encryption schemes # clear: Clear text # crypt: Unix crypt # md5: MD5 ecnryption # sha1: SHA1 encryption. # DEFAULT: crypt pap { encryption_scheme = md5 } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } # Extensible Authentication Protocol # $INCLUDE ${confdir}/eap.conf # Microsoft CHAP authentication # # This module supports MS-CHAP and MS-CHAPv2 authentication. # It also enforces the SMB-Account-Ctrl attribute. # mschap { # # As of 0.9, the mschap module does NOT support # reading from /etc/smbpasswd. # # If you are using /etc/smbpasswd, see the 'passwd' # module for an example of how to use /etc/smbpasswd # authtype value, if present, will be used # to overwrite (or add) Auth-Type during # authorization. Normally should be MS-CHAP authtype = MS-CHAP # if use_mppe is not set to no mschap will # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2 # use_mppe = yes require_encryption = yes # require_strong always requires 128 bit key # encryption # require_strong = yes # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # #--domain=%{mschap:NT-Domain} ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{doma in} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-resp onse=%{mschap:NT-Response:-00}" } # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication (Auth-Type := LDAP) # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks ldap wirlss{ server = "erebus.clarku.edu" basedn = "ou=Users, dc=clarku, dc=edu " filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=inetOrgPerson)" port = 389 #access_attr = "uid" access_attr = "clarkuWirelessAccess" ldap_debug = 0x0028 # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 } ldap vpn { server = "erebus.clarku.edu" basedn = "ou=Users, dc=clarku, dc=edu " filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=inetOrgPerson)" port = 389 access_attr = "clarkuVpnAccess" ldap_debug = 0x0028 # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 } ldap machine { server = "erebus.clarku.edu" basedn = "ou=Computers, dc=clarku, dc=edu " filter = "(macAddress=%{Calling-Station-Id})" base_filter = "(objectclass=ieee802Device)" port = 389 # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "macAddress" ldap_debug = 0x0028 # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 } # Realm module, for proxying. # # You can have multiple instances of the realm module to # support multiple realm syntaxs at the same time. The # search order is defined by the order in the authorize and # preacct sections. # # Four config options: # format - must be 'prefix' or 'suffix' # delimiter - must be a single character # ignore_default - set to 'yes' or 'no' # ignore_null - set to 'yes' or 'no' # # ignore_default and ignore_null can be set to 'yes' to prevent # the module from matching against DEFAULT or NULL realms. This # may be useful if you have have multiple instances of the # realm module. # # They both default to 'no'. # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no # A simple value checking module # # It can be used to check if an attribute value in the request # matches a (possibly multi valued) attribute in the check # items This can be used for example for caller-id # authentication. For the module to run, both the request # attribute and the check items attribute must exist # # i.e. # A user has an ldap entry with 2 radiusCallingStationId # attributes with values "12345678" and "12345679". If we # enable rlm_checkval, then any request which contains a # Calling-Station-Id with one of those two values will be # accepted. Requests with other values for # Calling-Station-Id will be rejected. # # Regular expressions in the check attribute value are allowed # as long as the operator is '=~' # checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } # rewrite arbitrary packets. Useful in accounting and authorization. # # # The module can also use the Rewrite-Rule attribute. If it # is set and matches the name of the module instance, then # that module instance will be the only one which runs. # # Also if new_attribute is set to yes then a new attribute # will be created containing the value replacewith and it # will be added to searchin (packet, reply, proxy, proxy_reply or confi g). # searchfor,ignore_case and max_matches will be ignored in that case. # # Backreferences are supported: %{0} will contain the string the whole m atch # and %{1} to %{8} will contain the contents of the 1st to the 8th paren theses # # If max_matches is greater than one the backreferences will correspond to the # first match attr_rewrite stupidjunk{ attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "ad" replacewith = "clarku" ignore_case = yes new_attribute = no max_matches = 10 ## If set to yes then the replace string will be appended to the original string append = no } # Preprocess the incoming RADIUS request, before handing it off # to other modules. # # This module processes the 'huntgroups' and 'hints' files. # In addition, it re-writes some weird attributes created # by some NASes, and converts the attributes into a form which # is a little more standard. # preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints # This hack changes Ascend's wierd port numberings # to standard 0-??? port numbers so that the "+" works # for IP address assignments. with_ascend_hack = no ascend_channels_per_line = 23 # Windows NT machines often authenticate themselves as # NT_DOMAIN\username # # If this is set to 'yes', then the NT_DOMAIN portion # of the user-name is silently discarded. # # This configuration entry SHOULD NOT be used. # See the "realms" module for a better way to handle # NT domains. with_ntdomain_hack = no with_specialix_jetstream_hack = no # Cisco sends it's VSA attributes with the attribute # name *again* in the string, like: # # H323-Attribute = "h323-attribute=value". # # If this configuration item is set to 'yes', then # the redundant data in the the attribute text is stripped # out. The result is: # # H323-Attribute = "value" # # If you're not running a Cisco NAS, you don't need # this hack. with_cisco_vsa_hack = no # Livingston-style 'users' file # files { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. #key = "%{Stripped-User-Name:-%{User-Name}}" usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # detail auth_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y %m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 # } # # This module logs authentication reply packets sent # to a NAS. Both Access-Accept and Access-Reject packets # are logged. # # You will also need to un-comment the 'reply_log' line # in the 'post-auth' section, below. # # detail reply_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-% Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 # } # Create a unique accounting session Id. Many NASes re-use or # repeat values for Acct-Session-Id, causing no end of # confusion. # # This module will add a (probably) unique session id # to an accounting packet based on the attributes listed # below found in the packet. See doc/rlm_acct_unique for # more information. # acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Add ress, NAS-Port" } # For Cisco VoIP specific accounting with Postgresql, # use: ${confdir}/pgsql-voip.conf # # You will also need the sql schema from: # src/billing/cisco_h323_db_schema-postgres.sql # Note: This config can be use AS WELL AS the standard sql # config if you need SQL based Auth # Write a 'utmp' style file, of which users are currently radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } # "Safe" radutmp - does not contain caller ID, so it can be # world-readable, and radwho can work for normal users, without # exposing any information that isn't already exposed by who(1). # # This is another 'instance' of the radutmp module, but it is given # then name "sradutmp" to identify it later in the "accounting" # section. radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" attr_filter { attrsfile = ${confdir}/attrs } # The "always" module is here for debugging purposes. Each # instance simply returns the same result, always, without # doing anything. always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module currently has no configuration. # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{expr:2 + 3 + %{exec: uid -u}}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. expr { } # # The 'digest' module currently has no configuration. # # "Digest" authentication against a Cisco SIP server. # See 'doc/rfc/draft-sterman-aaa-sip-00.txt' for details # on performing digest authentication for Cisco SIP servers. # digest { } # # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` # # The value of the attribute will be replaced with the output # exec { wait = yes input_pairs = request } # # Do server side ip pool management. Should be added in post-auth and # accounting sections. # # The module also requires the existance of the Pool-Name # attribute. That way the administrator can add the Pool-Name # attribute in the user profiles and use different pools # for different users. The Pool-Name attribute is a *check* item not # a reply item. # # Example: # radiusd.conf: ippool students { [...] } # users file : DEFAULT Group == students, Pool-Name := "students" # # ********* IF YOU CHANGE THE RANGE PARAMETERS YOU MUST ********* # ********* THEN ERASE THE DB FILES ********* # ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address alread y set override = no # maximum-timeout: If not zero specifies the maximum time in sec onds an # entry may be active. Default: 0 maximum-timeout = 0 } # ANSI X9.9 token support. Not included by default. # $INCLUDE ${confdir}/x99.conf } # Instantiation # # This section orders the loading of the modules. Modules # listed here will get loaded BEFORE the later sections like # authorize, authenticate, etc. get examined. # # This section is not strictly needed. When a section like # authorize refers to a module, it's automatically loaded and # initialized. However, some modules may not be listed in any # of the following sections, so they can be listed here. # # Also, listing modules here ensures that you have control over # the order in which they are initalized. If one module needs # something defined by another module, you can list them in order # here, and ensure that the configuration will be OK. # instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` # exec # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # # So the module needs to be instantiated, but CANNOT be # listed in any other section. See 'doc/rlm_expr' for # more information. # expr } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request. preprocess mschap eap # The ldap module will set Auth-Type to LDAP if it has not # already been set autztype VPN{ vpn } autztype WIRELESS{ wirlss } files } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # Allow EAP authentication eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS ntdomain } # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Querie" in sql.conf # sql } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log # # After authenticating the user, do another SQL qeury. # # See "Authentication Logging Queries" in sql.conf # sql # # Access-Reject packets are sent through the REJECT sub-section # of the post-auth section. # # Post-Auth-Type REJECT { # insert-module-name-here # } } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # attr_rewrite # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap }

2 7

make freeradius-2.0 cvs Version
by Hans-Peter Fuchs 07 Nov '07

07 Nov '07

Hello all, I want to make freeradius-2-0-pre2 on a Redhat 3.2.3-47 with openssl-0.9.7a-33.23. make gives this error: /service/freeradius-cvs/radiusd/libtool --mode=compile gcc -g -O2 -I/service/freeradius-cvs/radiusd/src -DHOSTINFO= \"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.0.0-beta\" -DOPENSSL_NO_KRB5 -c threads.c gcc -g -O2 -I/service/freeradius-cvs/radiusd/src -DHOSTINFO= \"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.0.0-beta\" -DOPENSSL_NO_KRB5 -c threads.c -fPIC -DPIC -o .libs/threads.o In file included from /usr/include/openssl/evp.h:81, from threads.c:64: /usr/include/openssl/md4.h:105: conflicting types for `librad_MD4_CTX' /service/freeradius-cvs/radiusd/src/freeradius-devel/md4.h:75: previous declaration of `librad_MD4_CTX' gmake[4]: *** [threads.lo] Fehler 1 On an other system with fedora 4.1.1-30 and openssl-0.9.8b-8.3.fc6 the make runs fine without errors -- Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

an intermittant PAP auth problem
by A.L.M.Buxey＠lboro.ac.uk 07 Nov '07

07 Nov '07

hi, we use nagios to monitor our freeradius install. this is using the adv_radius_check plugin to check from the nagios servers a user on the freeradius server (in the users file), the following are the succinct details users file entry nagios-user Huntgroup-Name == "nagios", Cleartext-Password := "password", Autz-Type := nagios-check Reply-Message = "This server is active", Fall-Through = No huntgroup file nagios Client-IP-Address == 127.0.0.1 nagios Client-IP-Address == 10.1.1.2 nagios Client-IP-Address == 10.1.1.3 sites-enabled/default auth entry authorize { Autz-Type nagios-check { files ok = return } } okay. so the user authentication tests fine with radtest on the radius server....and it works fine from the 2 nagios boxes...almost always. occasionally we see the following error come through during the 5-minute interval tests....... Wed Nov 7 11:21:40 2007 : Auth: Login OK: [nagios-user] (from client 10.1.1.2 port 0) Wed Nov 7 11:26:40 2007 : Auth: Login incorrect: [nagios-user] (from client 10.1.1.2 port 0) Wed Nov 7 11:29:40 2007 : Auth: Login OK: [nagios-user] (from client 10.1.1.2 port 0) of course, when that 11:26:40 event occurred, nagios claims a problem with the RADIUS. now, the check method is the same, the password is the same, the IP is the same, in essence nothing changes at all between each 5-minute test (the last entry 11:29:40 is quicker than a 5 minute interval as nagios catches up with failed events within a following window) and this is just plain PAP check in users file. so why is it occasionally failing? has anyone else seen this sort of activity? alan

2 1

rlm_ldap: Attribute "User-Name" is required for authentication.
by Ryan Pugatch 07 Nov '07

07 Nov '07

Hello, While I resolved my previous issue with radiusd segfaulting, I'm now running in to a new issue. I'm attempting to have my Linksys WRT54GL (running DD-WRT v23 SP2) use WPA RADIUS against a FreeRADIUS server (FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu) and subsequently have the FreeRADIUS server use our existing LDAP directory (OpenLDAP v2.2.13-4). When a user tries to connect to the access point and the access point contacts the radius server, the following happens: Ready to process requests. rad_recv: Access-Request packet from host 192.168.42.23:2050, id=0, length=129 User-Name = "rpugatch" NAS-IP-Address = 192.168.42.23 Called-Station-Id = "0018f8c16a5a" Calling-Station-Id = "0017f2e7032a" NAS-Identifier = "0018f8c16a5a" NAS-Port = 14 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d017270756761746368 Message-Authenticator = 0xe1b0b05b118ebe49d6b79b7569de75b1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_ldap: - authorize rlm_ldap: Attribute "User-Name" is required for authentication. modcall[authorize]: module "ldap" returns invalid for request 0 modcall: leaving group authorize (returns invalid) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- This is most likely an issue with my configuration, however, I'm not sure what the issue is. I'd appreciate any help I can get. Thanks, Ryan

4 6