- Freeradius-Users - lists.freeradius.org

Re: wrong user name is stored in mysql radacct table
by Zeli Kartzman 08 Mar '07

08 Mar '07

>Message: 2 >Date: Wed, 07 Mar 2007 14:28:07 +0100 >From: Alan DeKok <aland(a)deployingradius.com> >Subject: Re: wrong user name is stored in mysql radacct table >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <45EEBDE7.7010509(a)deployingradius.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Zeli Kartzman wrote: >> so what you're saying is that effectively a user can get around the >> simultaneous user limit and login as many times as they want -- all >>they >> have to do is type a new outside identity each time and as long as >>the >> tunneled PEAP identity is correct they will be allowed to login? > > If you configure it that way, yes. > > The server *can* be configured to enforce simultaneous login limits >no >matter what the users type into the outer session. The docs don't >describe how to do this, but they DO describe how to tie the inner & >outer sessions together, and also how to enforce simultaneous login. > can you give me a pointer to which docs to look at? thanks bz

1 1

CHAP Modification
by ChristosH 07 Mar '07

07 Mar '07

I'm trying to edit the way the CHAP module fetches passwords before hasing them due to a limitation in 2 different types of hardware we have. One set of devices takes a HEX password stored on the device, converts it to binary, and then calculates the MD5 CHAP challenge to send to the server. The other set of devices just takes the HEX password and calculates the MD5 as if it were a string. I can distinguish which device is which when I'm adding passwords to my database (by adding a prefix 0x to let me know it's going from HEX -> BIN or whatnot) because the password is fixed at 32 characters, but definately not which device is which at run time. I guess what I'm trying to do is find where in the CHAP encoding module is the password attribute accessed/read and then passed (I'm guessing as an arguement) to be hashed. I think I could possibly do my funky math in mind there by checking the length of the password or the first two letters, and then converting to binary as needed or just passing it through. My problem is where exactly is this password CHAP challege code? I'm sifting through the radius.c file but can't seem to find anything. I'm comfortable writing some stuff with C and reading more complex things, so I don't think that will be a barrier. When I change it, will it require me to recompile everything every time I want to check? I'm using Fedora Core 6, Freerad 1.1.4, and MySql 5.0. -- View this message in context: http://www.nabble.com/CHAP-Modification-tf3284565.html#a9136389 Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

NAS Table in SQL
by ChristosH 07 Mar '07

07 Mar '07

Does subnetting in the NAS table work when using SQL? If I wanted to allow any address from my internal network, 111.111.%.% for example, can I store the nasname as 111.111.0.0/16 like I do in the users table? Or does it have to be in the form 255.255.0.0? -- View this message in context: http://www.nabble.com/NAS-Table-in-SQL-tf3364456.html#a9360616 Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: Simple EAP flow support!
by Josh Howlett 07 Mar '07

07 Mar '07

You will need to modify the code. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Diameter K > Sent: 07 March 2007 18:53 > To: freeradius-users(a)lists.freeradius.org > Subject: Simple EAP flow support! > > Hi All, > I want to configure free-radius to handle a simple EAP > described below. > > 1. Radius receives a IDENTITY message. The IDENTITY message > contains a encrypted certificate. > 2. The server decrypts and validates the Certificate and send > out a EAP-Success or EAP-Failure. > > Is there any way i can configure freeradius to achieve this > flow or would i have to modify the code. As i understand the > standard flows are much more complicated(with challenge), > which i dont want. > > > Thanks & Regards, > Shiv > > >

1 0

redundancy/failover support for LDAP xlat
by Kenneth Marshall 07 Mar '07

07 Mar '07

Dear FreeRADIUS users, I am working on setting up LDAP failover for my radius servers. I currently have two instances defined in the modules section: ldap ldap1 {...} ldap ldap2 {...} and have a redundant section in authorize: redundant { ldap1 ldap2 } This is correctly making the connection to the ldap server. However, in the users file I am using the ldap_xlat process to send the appropriate Class definition back to the network gear: DEFAULT Auth-Type = Kerberos, NAS-IP-Address == x.y.z.g Class = "OU=%{ldap:ldap:///dc=rice,dc=edu?Class?sub?uid=%u}" The problem is that that this does not work unless I define a specific instance for the xlat process. This does not allow it to failover to the working server. Does anyone have any ideas about how to implement such functionality? Ken Marshall

2 1

Re: Logging based on port request came in on
by Walt Reynolds 07 Mar '07

07 Mar '07

Maybe you can help clear me up on something, if it is not in the 1.1.X version, how was it able to be used in this thread? http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-March/05160… Based on the date of the thread he must have been on 1.1.0 or earlier. > Date: Wed, 07 Mar 2007 14:36:48 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Logging based on port request came in on > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45EEBFF0.50202(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Walt Reynolds wrote: >> > So is there any way to use Packet-Dst-Port attribute in the freeradius >> > internal dictionary? > > It's in the CVS head, not in 1.1.x. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

Users file giving me headaches :)
by Marcelus Trojahn 07 Mar '07

07 Mar '07

Hello folks, For quite some time now I'm struggling with a problem I have no clue how to solve... Consider the following: zro Auth-Type := MD5, User-Password := 9bb05e8970a8c18991d3048f3f5ad976, Calling-Station-Id == 00:16:EC:54:2E:C4, Simultaneous-Use := 1 Mikrotik-Rate-Limit = "128k/192k 128k/384k 64k/64k 1/8" This is an example of an user account on my ISP. As you can see we also check the "Caller-ID" (MAC address) on the authentication process of our PPPOE customers. The problem is: we also provide free dialup connection to these customers. When connected via dialup we get the phone number as CallerID so, obviously, it doesn't match the MAC address and the authentication fails. Is there any way I can instruct the Radius to do like a logical OR check? Like: if (NAS-IP-Address != "10.200.200.2") { Calling-Station-Id has to be 00:16:EC:54:2E:C4 } else { Ignore the Calling-Station-Id, check only the password } Maybe it is just ask too much... For now, I've been ignoring the dialup users, allowing them to authenticate with any login or password using this in the begging of users file: DEFAULT NAS-IP-Address == 10.200.200.2, Auth-Type := Accept This way is not good because many people are now using our service without even being customers... My only option, if I can't solve this, is to make a secondary Radius server just to authenticate them. -- Marcelus Trojahn --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 000722-1, 07/03/2007 Tested on: 7/3/2007 11:49:19 avast! - copyright (c) 1988-2007 ALWIL Software. http://www.avast.com

2 1

Re: Logging based on port request came in on
by Walt Reynolds 07 Mar '07

07 Mar '07

> Date: Wed, 28 Feb 2007 19:35:48 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Logging based on port request came in on > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45E5D994.2070801(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Walt Reynolds wrote: >> Hello, >> >> I have freeradius 1.1.2 set up to listen on both ports 1812/1813 and >> 1645/1646. This is simply to separate user and admin login. What I >> would like to do is to add logging based on the port. I could add >> %{NAS-Port-Type} to the Detail such as: >> >> detailfile = ${radacctdir}/%{NAS-Port-Type}/auth-detail-%Y%m%d >> >> The problem with doing this as it uses the string "Wireless-802.11" or >> "Virtual". I would instead like to use the port the request came in on > > NAS-Port-Type is, as you've discovered, the port type of the session > being authenticated/accounted > >> (1812 or 1645) or even modify that string value. I tried to add the >> string %(request:Packet-Dst-Port) (from the >> dictionary.freeradius.internal) in the detailfile, but comes back blank. > Since it is in this dictionary, is there something I would have to do > You'll need a sufficiently recent version of the server for that to > work, and IIRC the "preprocess" module needs to be run (you should > always run it) Well, I am using 1.1..2 version of Freeradius. I also am preprocessing, though I am not sure that would be needed here. As this is a variable defined in the dictionary file, I was under the impression that I could use it. Either way, here is the section from the config: preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_cisco_vsa_hack = yes } I had added this to the hints files as well, but did not seem do anything: > >> Am I misreading this in some way. I assume that internally freeradius >> knows what port the request came in on. > > What version are you running? > > 1.1.2 -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 2

Help with multiple attributes sent with accounting request
by Normando Marcolongo 07 Mar '07

07 Mar '07

Hi! We are using freeradius 1.0.4, I'm receiving this kind of accounting from our access points: rad_recv: Accounting-Request packet from host 195.32.84.44:32771, id=215, length=221 User-Name = "normando(a)wifi.user" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "micso(a)wifi.ap" NAS-IP-Address = 192.168.1.2 Acct-Status-Type = Start Calling-Station-Id = "00-16-CB-BD-1F-54" Called-Station-Id = "00-03-52-DC-5A-60" Event-Timestamp = "Mar 2 2007 16:09:38 CET" Acct-Delay-Time = 0 Acct-Session-Id = "30965f0f" Acct-Authentic = RADIUS Framed-IP-Address = 172.21.7.65 Colubris-AVPair = "ssid=micso.wifi" Colubris-AVPair = "nat-port-range=5000-5049" WISPr-Location-Name = "micso(a)wifi.ap" Using rlm_sql *only the first "Colubris-AVPair" attribute is being logged*: radius_xlat: 'INSERT into radacct (`Colubris-AVPair`, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASIdentifier,NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress,ClientIPAddress, AcctStartDelay, AcctStopDelay) values('ssid=3Dmicso.wifi', '137281aa', '73ff613a5a1e65ff', 'normando(a)wifi.user', '', '192.168.1.2', 'micso(a)wifi.ap', '1', 'Wireless-802.11', '2007-03-02 16:24:51', '0', '0', 'RADIUS', '', '', '0', '0', '00-03-52-DC-5A-60', '00-16-CB-BD-1F-54', '', '', '', '172.21.7.65', '195.32.84.44', '0', '0')' Is there a way to log both? Obviously we are interested in the second attribute (Colubris-AVPair = "nat-port-range=5000-5049") :-) Thank you for your time. Normando

2 1

Re: wrong user name is stored in mysql radacct table
by Zeli Kartzman 07 Mar '07

07 Mar '07

On Fri, 2007-03-02 at 17:13 +0100, Alan DeKok wrote: > Zeli Kartzman wrote: > > i was thinking the NAS had something to do with it. is there any way i > > can get the NAS to send me the correct user name? we are using cisco > > aironet for access points running IOS 12.3. > > No... what I said was that's what the USER is using to log in. The > NAS just sends what the user types. > > > or is there any other way to get the correct user name into the table? > > thanks > > Get the users to type something else? > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > so what you're saying is that effectively a user can get around the simultaneous user limit and login as many times as they want -- all they have to do is type a new outside identity each time and as long as the tunneled PEAP identity is correct they will be allowed to login? bz

2 1