- Freeradius-Users - lists.freeradius.org

operators clarification
by Andrew Long 05 May '07

05 May '07

I have looked at the wiki and read the docs... never-the-less... I inherited a 0.9 freeradius/mysql/chap setup which I have updated to 1.4. Currently I am sending radreply like | 358 | indigoAmh-AP05 | Colubris-AVPair | += | mac-address=00-0D-BD-0F-90-83,indigoAmh-AP05,ap_connect | 359 | indigoAmh-AP06 | Colubris-AVPair | += | mac-address=00-0D-BD-59-57-EB,indigoAmh-AP06,ap_connect | 360 | indigoAmh-AP07 | Colubris-AVPair | += | mac-address=00-0D-BD-0F-91-89,indigoAmh-AP07,ap_connect Now this works, but I have read that the op ':=' would be more correct and this is what Colubris suggests in their examples. What I don't understand is.. my reading of the wiki leads me to believe that := would replace existing attributes of the same name (Colubris-AVPair) with the current one, rather than appending them, as we want. Can someone explain where my reading of the docs is wrong. ---QUOTE ':=' Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items. ---END QUOTE Regards, Andrew Long

2 1

libradius error
by Roberto Greiner 04 May '07

04 May '07

Hi, I'm having a small problem with radwho/libradius. When I give a 'radwho' command, I receive the following error: radwho: error while loading shared libraries: libradius-1.1.6.so: cannot open shared object file: No such file or directory I've installed FreeRadius following the guidelines for Debian from de wiki, including mysql support. FreeRadius itself works fine, as does access to the mysql base. The mentioned libradius file is in /usr/lib/freeradius, and the radius.conf file has the following entry(it's the pre-installed entry, I didn't change it): libdir = /usr/lib/freeradius So freeradius should find the library file. I'm running FreeRadius version 1.1.6, in a fresh Debian Etch install. Any Ideas? Thank you very much, Marcos Roberto Greiner The -x entry from freeradius is the following (although, as I said, FreeRadius itself works fine). Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to dialup@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=localhost,shortname=local,secret=foobar rlm_sql (sql): Adding client 127.0.0.1 (local) to clients list rlm_sql (sql): Read entry nasname=a.b.c.d,shortname=xxxxxxx,secret=s3mf!o/ rlm_sql (sql): Adding client a.b.c.d (xxxxxxx) to clients list rlm_sql (sql): Read entry **** Cut => more entries from the nas table in mysql rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

3 7

How to configure multiple LDAPs with different DN's ?
by Eric Martell 04 May '07

04 May '07

Hi, We are trying to use LDAP group for authentication and authorization. Ldap1 => baseDN = "dc=user,dc=net,o=internet" This Ldap1 will have users and passwords store in it along with profile. Ldap2 => baseDN = "dc=role,dc=system,o=internet" This Ldap2 will have only users and associated roles. No passwords will be store in Ldap2. While accessing the service, Radius should check if the user/password matches in Ldap1. If its fine, check on Ldap2 which has different baseDN to see if the role for that user validated. If both conditions satisfies, permits the user to access the service. I am not sure how to configured this. Please kindly help in changing radiusd.conf and users file. Thanks so much in advance. Regards. ____________________________________________________________________________________ Expecting? Get great news right away with email Auto-Check. Try the Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/newmail_tools.html

1 0

Default Authentication
by Norman Zhang 04 May '07

04 May '07

I have the following setup for users DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-ro cisco-avpair := "shell:priv-lvl=7" DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" However, system users not in group router-ro or router-rw are still able to login with privilege level = 1. Is there a way to force only group router-ro and router-rw can login? Norman

4 7

Freeradius proxy code questions and proposed patch
by Kostas Zorbadelos 04 May '07

04 May '07

Hello to everyone. In a previous thread http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg33354.… I had described a strange behavior in our large proxy setup. After running the server in debug mode (radiusd -xxx) in our production systems we found out what was causing our problems. The problem was that the home server in our proxy setup was marked dead quite often during the day and with a dead_time of 30 secs every request that came within these 30 secs was rejected. Our proxy conf initially looked like the following: proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 30 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... We first changed the dead_time to 0 so as to avoid marking the home server dead in synchronous mode. Additionally, we implemented the following patch (against version 1.1.6): --- ./src/main/files.c.orig 2007-04-23 15:14:14.569932000 +0300 +++ ./src/main/files.c 2007-04-23 15:22:30.995686000 +0300 @@ -489,6 +489,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "authentication server %s:%d for realm %s seems unresponsive.", + cl->server, port, cl->realm); + continue; + } cl->active = FALSE; cl->wakeup = now + mainconfig.proxy_dead_time; @@ -498,6 +507,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "accounting server %s:%d for realm %s seems unresponsive.", + cl->acct_server, port, cl->realm); + continue; + } cl->acct_active = FALSE; cl->acct_wakeup = now + mainconfig.proxy_dead_time; The purpose of this patch is to not have the freeradius server mark the home server dead when working in synchronous mode. We believe that in synchronous operation it is a good idea to leave the job of marking the server dead to the NAS client. All the above actions solved our initial problems. However, after a while we noticed again clients being rejected when they shouldn't. The following code in request_list.c caught my attention: /* * Refresh a request, by using proxy_retry_delay, cleanup_delay, * max_request_time, etc. * * When walking over the request list, all of the per-request * magic is done here. */ static int refresh_request(REQUEST *request, void *data) { ... (around line 1264 version 1.1.6) } else if (request->proxy && !request->proxy_reply) { /* * The request is NOT finished, but there is an * outstanding proxy request, with no matching * proxy reply. * * Wake up when it's time to re-send * the proxy request. * * But in synchronous proxy, we don't retry but we update * the next retry time as NAS has not resent the request * in the given retry window. */ if (mainconfig.proxy_synchronous) { /* * If the retry_delay * count has passed, * then mark the realm dead. */ if (info->now > (request->timestamp + (mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count))) { rad_assert(request->child_pid == NO_SUCH_CHILD_PID); request_reject(request); realm_disable(request->proxy->dst_ipaddr, request->proxy->dst_port); request->finished = TRUE; goto setup_timeout; } request->proxy_next_try = info->now + mainconfig.proxy_retry_delay; } difference = request->proxy_next_try - info->now; } else { ... It seems that in some "strange" occations the code enters the above path. A decision is made in case the current time is older than mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count. If this is the case, the request is rejected and the code tries to disable the realm. However in the proxy.conf configuration file it is mentioned: # If you want to have the server send proxy retries ONLY when the NAS # sends it's retries to the server, then set this to 'yes', and # set the other proxy configuration parameters to 0 (zero). # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Additionally, if you want 'failover' to work, the server must manage # retries and timeouts. Therefore, if this is set to yes, then no # failover functionality is possible. # synchronous = no When we have proxy_retry_delay and proxy_retry_count zero, the request is rejected whenever we enter the above code path. I can't tell for sure if there is a problem in that code but it does not look clean to me. In order to circumvent the problems we just gave values to these 2 configuration parameters, so we ended up with the following proxy.conf: proxy server { synchronous = yes retry_delay = 15 retry_count = 5 dead_time = 0 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... Please let me know your thoughts on these matters (also on the patch we provide) Thanks, Kostas

4 6

Force Inner=Outer identity
by Matt Ashfield 03 May '07

03 May '07

Hi All Using EAP-TTLS PAP with FR authenticated against LDAP. In looking at our monitoring software, it displays the user's outer identity. Problem is, a user can specify any userID as it's outer Identity and as long as it's a valid outer Identity, that's what shows up in our monitoring software. Makes user tracking quite difficult. Is there any way to force a users's outer identity to equal their inner identity? Thanks Matt Ashfield mda(a)unb.ca

2 2

multiple users with different service flows
by Cristian Novac 03 May '07

03 May '07

Hello all, I am Cristian NOVAC and I work to a Wimax project. I have to perform some tests where I need multiple users to authenticate, each of them having different service flows. I mention that I use Service-Flow-Descriptor and QoS-Descriptor VS ATTRIBUTES (defined in a WiMAX FreeRadius Dictionary) to configure the user's service flows. For now I have successfully run tests only if I've written these attributes into a DEFAULT reply of the "users" file. But this "technique" make all users having the same service flows. If I try to add the two attributes to a specific user's reply list of items(in users file) it doesn't work.(the attributes are not sent in Radius ACCESS-ACCEPT message). The same problem I encountered when I used the 3GPP2-Service-Option-Profile VSA (from freeradius dictionary.3gpp2) to set user's service flows. I am using EAP-TTLS authentication method. Could you please help, telling me what radius configurations to make, as you may have already encountered similar problems? Thanks!! BR, Cristian Novac.

2 3

additional SQL-query, after authorize_check_query fail
by cky 03 May '07

03 May '07

Hi, I use a SQL-database for authorization request from a cisco-ssg (a service gateway). This works fine But now I'm trying to perform an additional sql-query, when the calling-station-id isn't found in the sql-table. Also, my table looks like this: mysql> select * from ssg_check; +----+----------+-----------+--------+----+--------------------+ | id | UserName | Attribute | Value | op | Calling-Station-Id | +----+----------+-----------+--------+----+--------------------+ | 1 | Guest | Auth-Type | ACCEPT | := | 0009.2419.d428 | +----+----------+-----------+--------+----+--------------------+ If the SSG request the authorization for: Calling-Station-Id 0009.2419.a618, this record isn't found and the radius send a reject...this is ok. But, then the record isn't found, it would be great if the radius could do this insert-statement: INSERT INTO `ssg_check` (`UserName`,`Attribute`,`Value`,`op`,`Calling-Station-Id`) VALUES ('GUEST','Auth-Type','REJECT','op','%{Calling-Station-Id}'). Any ideas, how this can be realized? Thanks in advance! Best regards, Thomas PS: sorry for my bad english.... -- View this message in context: http://www.nabble.com/additional-SQL-query%2C-after-authorize_check_query-f… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: Freeradius-Users Digest, Vol 25, Issue 9
by khursheed Ahmed 03 May '07

03 May '07

1 0

FreeRadius+AD integration
by shrikant Bhat 03 May '07

03 May '07

Hi, I am trying to integrate freeradius with ADS 2003. I reffred to http://deployingradius.com/documents/configuration/active_directory.html . everything works perfectly fine till ( $ ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password=*password*) I get NT_STATUS_OK. I dont see NT_KEY output. I made changes to exec module in radius.conf as per the instructions, but radtest fails with Access-Reject .I have attached the debug window output for reference. ________________________________________________________________________________________ rad_recv: Access-Request packet from host 127.0.0.1:32928, id=44, length=57 User-Name = "raduser" User-Password = "radpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry sbhat at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 _____________________________________________________________________________________________________________________ Any help fixing this issue will be appreciated. thank you! SB

6 31