- Freeradius-Users - lists.freeradius.org

SQL usage ideas
by Roy Walker 30 Jul '07

30 Jul '07

I think I have a pretty good idea of how the sql structure works for radius. Here are some ideas I have: It looks like the clients query is cached at startup (guessing this since I don't see thousands of queries to the nas table like I do to the other tables). One really useful option would be to add an option to read some of the database tables into the radius servers memory on startup. This would be EXTREMELY useful for my case in that I am using groups and could set the radgroupcheck and radgrouprely tables (since they just about never change, and I would be willing to deal with a restart if they did need to change) to load into memory on the radius server and still allow me to dynamically add/remove users from groups. Would be a good idea to offer this to every read only table (some like radpostauth just would not make sense), some may not be used often, but you never know. Thoughts? Roy

4 6

OpenSER + Freeradius accounting
by Marc LEURENT 30 Jul '07

30 Jul '07

Good Morning, I have some trouble accounting openser calls with freeradius. Calls are accounted, but only AcctSessionId / AcctUniqueId are stored in the database, UserName and Realm fields are empty! Any idea? Thanks My openser.cfg looklikes: # -- acc params (with radius )-- modparam("acc", "radius_config", "/etc/radiusclient-ng/radiusclient.conf") modparam("acc", "radius_flag", 1) modparam("acc", "radius_missed_flag", 2) modparam("acc", "early_media", 1) modparam("acc", "report_cancels", 1) modparam("acc", "detect_direction", 1) modparam("acc", "service_type", 15) # Radius service type used for accounting : 15 = (SIP) modparam("acc", "radius_extra", "Sip-Src-IP=$si; SIP-Method=$rm")

3 2

Wrong behaviour of rlm_ldap module + users file
by inverse 30 Jul '07

30 Jul '07

Hi, this problem is simple (everything not shown here is v1.1.6 out-f-the-box radiusd configuration): users file line: john.doe(a)test.com Auth-Type := EAP, User-Password == "a", Ldap-Group == "wifi" this is a test line, john.doe(a)test.com uses EAP-MD5 , but I want to check if he's in the Ldap-Group named 'wifi'. radiusd.conf lines, ldap section: filter ="(uid=%{User-Name})" edir_account_policy_check=no password_attribute = userPassword groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" This is where I actually suck. I think this is correct, but it won't work as expected because: rad_recv: Access-Request packet from host 149.132.5.108:35285, id=0, length=160 User-Name = "john.doe(a)test.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001f0170616f6c6f2e676169617264656c6c6940756e696d69622e6974 Message-Authenticator = 0x14b3675352d738629cc1bb21695f3122 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20070726' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20070726 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "test.com" for User-Name = "john.doe(a)test.com" rlm_realm: Found realm "test.com" rlm_realm: Proxying request from user john.doe to realm test.com rlm_realm: Adding Realm = "test.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 31 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=test,dc=com radius_xlat: '(uid=john.doe(a)test.com)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.test.com:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/crl/root.pem rlm_ldap: bind as cn=ldapreader,ou=servizi,dc=test,dc=com/blargh to ldap.test.com:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=test,dc=com, with filter (uid=john.doe(a)test.com) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid\3djohn.doe(a)test.com\2cou\3dusers\2cdc\3dtest\2cdc\3dcom))' This is where the problem arises. I don't want to check if uid=john.doe(a)test.com esists. rlm_ldap wants to, but that's not what I told him to do. I never told rlm_ldap to verify if john.doe(a)test.com is an LDAP user. Now he is, but only because I created him. rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=test,dc=com, with filter (&(cn=wifi)(&(objectClass=GroupOfNames)(member=uid\3djohn.doe(a)test.com\2cou\3dusers\2cdc\3dtest\2cdc\3dcom))) rlm_ldap::ldap_groupcmp: User found in group wifi and THIS is what I want rlm_ldap to do. I want to check this and only this, since john.doe(a)test.com is a member of wifi and doesn't exist anywhere else in the LDAP tree. He isn't a user. He's just an object in group wifi. That's what happens in my production environment. john'doe's login fails because the first useless search fails. I know I'm doing something horribly wrong, and I can't find out what's my major malfunction. Help! rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry john.doe(a)test.com at line 32 Bye, Inverse.

2 5

LDAP errror in dialup admin page
by Bishal 30 Jul '07

30 Jul '07

I am trying to use freeradius 1.1.7 in Freebsd 6.2 with openldap 2.3.37 for authentication and mysql for accounting. While creating new user I get following error in dialup admin page: Warning: file(/usr/local/etc/raddb/ldap.attrmap) [function.file]: failed to open stream: Permission denied in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 4 Warning: Invalid argument supplied for foreach() in /usr/local/www/apache22/data/dialupadmin/lib/ldap/attrmap.php3 on line 5

2 2

Re: "WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I didn't mean the real WPA key (that's why I put them in brackets). I wanted a key (a pass of some predefined user) in radius server. And the user in raduis server is deleted X hours after it's first login. Is this possible, or am I missing the point completely? Ferd0 ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, July 29, 2007 5:46:00 PM Subject: Re: "WPA keys" that expires after use Hi, > The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. err, if the WPA key only becomes active AFTER they've reached the RADIUS server - then HOW are they to connect to the wireless in the first place - as the WPA key is required for the layer 2 link to come alive(!) AAA would be able to give you this 'very low level' type of authentication. what you COULD do with AAA is to use SSL certs....eg EAP-PEAP/EAP-TLS with WPA-enterprise. and then once the cert has been used, expire it. alternatively use WPA as you are currently doing but enforce another control method to get online - such as a SOCKS5 proxy. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better Heartthrob. Get better relationship answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545433

2 1

"WPA keys" that expires after use
by Ferdo Piš 29 Jul '07

29 Jul '07

I would like to setup a wirelless network in my shop for my customers. And instead of giving them WPA Shared Key, which is valid until I change it manually, I would like to give them a "WPA key, which is valid only for x hours". The idea is, that the router does the authentication via radius server, which stores predefined "WPA keys". When user uses one of them to access the network, the "WPA key" is activated. After specified period of time, radius server automatically deactivates the WPA key and disconnects user. This way, I could forgetet about changing WPA key manually every week, stop worring that my key was spred to much, etc. Is this possible with FreeRadius server? If yes, is there any "how-to" on this subject? Or do you recomend any other aproach? Ferd0 ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

2 1

OCSP support at FreeRadius
by Frank Büttner 29 Jul '07

29 Jul '07

Hello, does anyone know when FreeRadius will support OCSP at the eap-tls module? Because crl's are not very useful, you have the restart the radius daemon every time when you will revoke an certificate or when an new crl comes out in it normal turn. Frank

2 1

Auth-Type in post-auth SQL insert
by Brad Robel-Forrest 28 Jul '07

28 Jul '07

I'm pretty new to FreeRADIUS so I apologize if this is a really basic question. I've searched around quite a bit and have been unable to locate an answer. I've successfully configured FreeRADIUS to use a SQL driver for authentication checks as well as inserting records via the post-auth query. Is there a runtime variable that I can reference to save the Auth-Type used for authenticating the user during post-auth? I've tried what I thought to be the obvious (e.g. %{Auth-Type}) but that doesn't seem to be available (just inserts an empty string). Essentially, I'd like to catalog the type of authentication that was used for authorizing a user (assuming it was successful, of course). For example, user Joe authenticated via PAP. -brad

2 1

EXEC question w/ LDAP Attributes
by Reynold McGuire 28 Jul '07

28 Jul '07

Hello all, I have a question regarding returning attributes from LDAP with freeRadius. I need to do some logic comparing and the only way I have been able to get close is to use the post-auth section, enable 'exec' and push out some data to an external program were I can do some patter matching. Now I have this working just fine with LDAP, the DN and search filter is fine etc. What I want to do is return other attributes from LDAP to be included in the radius reply. I have added the following to "dictionary_mapping = ${raddbdir}/ldap.attrmap" checkItem employeeType employeeType When I run the server in debug mode, I see that it is in fact returning the value of the employeeType from LDAP. The question revolves around how to pass that out to my test program for validation? I have been able to pass out everything that is in the initial radius request, but nothing else. I have tried to modify the program line below to also send out %{employeeType} %{check:employeeType} %{request:employeeType} %{reply:employeeType} None of those work. I have even tried along the lines of %{modules.ldap.checkval} I can't seem to get it to work. Any help would be appreciated. Blow is a snip of the radius configuration file, and the little program I have seen in the user groups to echo out the responses that I am using to test. I have verified that if I return a '0' the request is accepted, and a '1' will reject the request... That part works fine. Also below is parts of the debug dump. I don't have the actual connection portion of the log as I am at a remote site currently, I can send that along also if people think it will be of benefit. Thanks for any assistance! - Reynold radius.conf ----------- exec { wait = yes input_pairs = request program = '${raddbdir}/test.sh %u %{Called-Station-Id}' } test.sh ------- #!/bin/bash echo "A: $1" echo "B: $2" echo "C: $3" exit 0 radiusd -X ---------- Module: Loaded exec exec: wait = yes exec: program = "/etc/raddb/test.sh %u %{Called-Station-Id}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Loaded LDAP ldap: server = "<ldapserver>" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "admin" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "pwd" ldap: basedn = "base-dn" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectClass=user)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userpassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP employeeType mapped to RADIUS employeeType conns: 0x8115218 Module: Instantiated ldap (ldap)

1 0

RE: Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

> > I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! > > > > When a juniper equipment try to authenticate it fails! (most other brand > > succed) They told me the field order are not send in the good order...> > First of all, I have no idea what you are doing from your explanation... > you are authenticating the PPPoE users, so I would think that you are > the ISP yourself.> As a mather of fact I'm working for an ISP ! > - What is the role of the Juniper device? (The device that is requesting > the connection? The device that is receiving the connection?)> - Exactly what kind of equipment is on the other end of the line?> - Which device is communicating with FreeRADIUS? Our equipment ISP is a Xedia router (Lucent AP) The authentication is done via Freeradius 0.9.3 running on mdk 10 The juniper equipment is on one of our client side, and it's the only equipment that won't authenticate at all In the radius users file we have the following: username(a)domain.com Auth-Type := Local, User-Password == "edc852" Service-Type = Login, Framed-Protocol = PPP, Framed-Address = 200.100.50.25, Xedia-DNS-Server = 175.200.225.250, XEDIA-PPP-ECHO-INTERVAL = 30 To answer the other question : No I didn't try with the latest version I'm having problems installing it (1.1.6) on this distribution (mdk 10) Thanks for your reply> > > : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1> > <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > RECV DECODE:(ethernet0/0)> > ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > Can I do something about this rapidely> > This does not look like a RADIUS problem. One of your PPP peers (the one > on the other end of the line) is mangling its responses and the device > from which you posted the logs is not accepting that (as it should, like > you already indicated yourself). This is a PPPoE problem.> > Gtnx> Marcel> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

2 1