- Freeradius-Users - lists.freeradius.org

Default Authentication
by Norman Zhang 04 May '07

04 May '07

I have the following setup for users DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-ro cisco-avpair := "shell:priv-lvl=7" DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" However, system users not in group router-ro or router-rw are still able to login with privilege level = 1. Is there a way to force only group router-ro and router-rw can login? Norman

4 7

Freeradius proxy code questions and proposed patch
by Kostas Zorbadelos 04 May '07

04 May '07

Hello to everyone. In a previous thread http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg33354.… I had described a strange behavior in our large proxy setup. After running the server in debug mode (radiusd -xxx) in our production systems we found out what was causing our problems. The problem was that the home server in our proxy setup was marked dead quite often during the day and with a dead_time of 30 secs every request that came within these 30 secs was rejected. Our proxy conf initially looked like the following: proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 30 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... We first changed the dead_time to 0 so as to avoid marking the home server dead in synchronous mode. Additionally, we implemented the following patch (against version 1.1.6): --- ./src/main/files.c.orig 2007-04-23 15:14:14.569932000 +0300 +++ ./src/main/files.c 2007-04-23 15:22:30.995686000 +0300 @@ -489,6 +489,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "authentication server %s:%d for realm %s seems unresponsive.", + cl->server, port, cl->realm); + continue; + } cl->active = FALSE; cl->wakeup = now + mainconfig.proxy_dead_time; @@ -498,6 +507,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "accounting server %s:%d for realm %s seems unresponsive.", + cl->acct_server, port, cl->realm); + continue; + } cl->acct_active = FALSE; cl->acct_wakeup = now + mainconfig.proxy_dead_time; The purpose of this patch is to not have the freeradius server mark the home server dead when working in synchronous mode. We believe that in synchronous operation it is a good idea to leave the job of marking the server dead to the NAS client. All the above actions solved our initial problems. However, after a while we noticed again clients being rejected when they shouldn't. The following code in request_list.c caught my attention: /* * Refresh a request, by using proxy_retry_delay, cleanup_delay, * max_request_time, etc. * * When walking over the request list, all of the per-request * magic is done here. */ static int refresh_request(REQUEST *request, void *data) { ... (around line 1264 version 1.1.6) } else if (request->proxy && !request->proxy_reply) { /* * The request is NOT finished, but there is an * outstanding proxy request, with no matching * proxy reply. * * Wake up when it's time to re-send * the proxy request. * * But in synchronous proxy, we don't retry but we update * the next retry time as NAS has not resent the request * in the given retry window. */ if (mainconfig.proxy_synchronous) { /* * If the retry_delay * count has passed, * then mark the realm dead. */ if (info->now > (request->timestamp + (mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count))) { rad_assert(request->child_pid == NO_SUCH_CHILD_PID); request_reject(request); realm_disable(request->proxy->dst_ipaddr, request->proxy->dst_port); request->finished = TRUE; goto setup_timeout; } request->proxy_next_try = info->now + mainconfig.proxy_retry_delay; } difference = request->proxy_next_try - info->now; } else { ... It seems that in some "strange" occations the code enters the above path. A decision is made in case the current time is older than mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count. If this is the case, the request is rejected and the code tries to disable the realm. However in the proxy.conf configuration file it is mentioned: # If you want to have the server send proxy retries ONLY when the NAS # sends it's retries to the server, then set this to 'yes', and # set the other proxy configuration parameters to 0 (zero). # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Additionally, if you want 'failover' to work, the server must manage # retries and timeouts. Therefore, if this is set to yes, then no # failover functionality is possible. # synchronous = no When we have proxy_retry_delay and proxy_retry_count zero, the request is rejected whenever we enter the above code path. I can't tell for sure if there is a problem in that code but it does not look clean to me. In order to circumvent the problems we just gave values to these 2 configuration parameters, so we ended up with the following proxy.conf: proxy server { synchronous = yes retry_delay = 15 retry_count = 5 dead_time = 0 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... Please let me know your thoughts on these matters (also on the patch we provide) Thanks, Kostas

4 6

Force Inner=Outer identity
by Matt Ashfield 03 May '07

03 May '07

Hi All Using EAP-TTLS PAP with FR authenticated against LDAP. In looking at our monitoring software, it displays the user's outer identity. Problem is, a user can specify any userID as it's outer Identity and as long as it's a valid outer Identity, that's what shows up in our monitoring software. Makes user tracking quite difficult. Is there any way to force a users's outer identity to equal their inner identity? Thanks Matt Ashfield mda(a)unb.ca

2 2

multiple users with different service flows
by Cristian Novac 03 May '07

03 May '07

Hello all, I am Cristian NOVAC and I work to a Wimax project. I have to perform some tests where I need multiple users to authenticate, each of them having different service flows. I mention that I use Service-Flow-Descriptor and QoS-Descriptor VS ATTRIBUTES (defined in a WiMAX FreeRadius Dictionary) to configure the user's service flows. For now I have successfully run tests only if I've written these attributes into a DEFAULT reply of the "users" file. But this "technique" make all users having the same service flows. If I try to add the two attributes to a specific user's reply list of items(in users file) it doesn't work.(the attributes are not sent in Radius ACCESS-ACCEPT message). The same problem I encountered when I used the 3GPP2-Service-Option-Profile VSA (from freeradius dictionary.3gpp2) to set user's service flows. I am using EAP-TTLS authentication method. Could you please help, telling me what radius configurations to make, as you may have already encountered similar problems? Thanks!! BR, Cristian Novac.

2 3

additional SQL-query, after authorize_check_query fail
by cky 03 May '07

03 May '07

Hi, I use a SQL-database for authorization request from a cisco-ssg (a service gateway). This works fine But now I'm trying to perform an additional sql-query, when the calling-station-id isn't found in the sql-table. Also, my table looks like this: mysql> select * from ssg_check; +----+----------+-----------+--------+----+--------------------+ | id | UserName | Attribute | Value | op | Calling-Station-Id | +----+----------+-----------+--------+----+--------------------+ | 1 | Guest | Auth-Type | ACCEPT | := | 0009.2419.d428 | +----+----------+-----------+--------+----+--------------------+ If the SSG request the authorization for: Calling-Station-Id 0009.2419.a618, this record isn't found and the radius send a reject...this is ok. But, then the record isn't found, it would be great if the radius could do this insert-statement: INSERT INTO `ssg_check` (`UserName`,`Attribute`,`Value`,`op`,`Calling-Station-Id`) VALUES ('GUEST','Auth-Type','REJECT','op','%{Calling-Station-Id}'). Any ideas, how this can be realized? Thanks in advance! Best regards, Thomas PS: sorry for my bad english.... -- View this message in context: http://www.nabble.com/additional-SQL-query%2C-after-authorize_check_query-f… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: Freeradius-Users Digest, Vol 25, Issue 9
by khursheed Ahmed 03 May '07

03 May '07

1 0

FreeRadius+AD integration
by shrikant Bhat 03 May '07

03 May '07

Hi, I am trying to integrate freeradius with ADS 2003. I reffred to http://deployingradius.com/documents/configuration/active_directory.html . everything works perfectly fine till ( $ ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password=*password*) I get NT_STATUS_OK. I dont see NT_KEY output. I made changes to exec module in radius.conf as per the instructions, but radtest fails with Access-Reject .I have attached the debug window output for reference. ________________________________________________________________________________________ rad_recv: Access-Request packet from host 127.0.0.1:32928, id=44, length=57 User-Name = "raduser" User-Password = "radpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry sbhat at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 _____________________________________________________________________________________________________________________ Any help fixing this issue will be appreciated. thank you! SB

6 31

VLAN Queries
by Jacob Jarick 03 May '07

03 May '07

Salutations all, I will be attempting VLAN assignment tomorrow via FR + ADS + cisco wap. 1st Question: Is it possible to assign VLAN based solely on what ldap server authorized it. (The sites we are looking @ have 1 domain server for staff and 1 for students). 2: Ive been looking @ Mat Ashfields email query regarding vlans, it looks nice and straight forward to me, my only query: Is the ldap group automatically fetched or is some extra configuration needed under the ldap modules or ldap.attrbmap. Mats Example: DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=176, Tunnel-Type=VLAN, Fall-Through = no DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=177, Tunnel-Type=VLAN, Fall-Through = no Thanks for the info.

2 2

Problem with mysql authorization
by Ian Truelsen 02 May '07

02 May '07

I am trying to set up mysql authorization, but am having some problems. I have set up sql.conf which seems to be correct, based on the output: -- Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "xxxx" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" To me, that looks like it is correct. I have added info to the radcheck table: +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ Now, I try to test with radtest: brentwood-internet ~ # radtest ian tester localhost 1812 testing123 Sending Access-Request of id 88 to 127.0.0.1 port 1812 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=88, length=20 So, not so good. rad_recv: Access-Request packet from host 127.0.0.1:2048, id=88, length=55 User-Name = "ian" User-Password = "tester" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 That looks like the query is being processed as I would expect. The rest of the output: radius_xlat: 'ian' rlm_sql (sql): sql_set_user escaped user --> 'ian' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ian' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ian' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [ian]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [ian/tester] (from client localhost port 1812) So, I am not sure what is going on. When I run the command in mysql, I get the correct output, as I would expect: mysql> select id, -> UserName, Attribute, Value, op from radcheck where Username = 'ian' order by id; +----+----------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+--------+----+ | 1 | ian | password | tester | == | +----+----------+-----------+--------+----+ 1 row in set (0.00 sec) Any thoughts on what I missed here? Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 2

Missing Huntgroups Man Pages
by Norman Zhang 02 May '07

02 May '07

Is huntgroups(5) removed from FreeRADIUS? I googled but all end up with dead links and downloaded 1.1.6 source, can't find it in there either. Please help. Norman

1 0