- Freeradius-Users - lists.freeradius.org

Cisco VoIP Recording
by Chris Halverson 01 Feb '07

01 Feb '07

I have setup freeradius 1.1.4 to log Cisco VOIP records into Postgres as described in src/billing. I am getting records just fine, but I am getting 16 entries logged into the database (radacct table) per phone call. Is this normal? If so, how do I figure out what the final one (or pair if I need 2 entries) should be? I'm also not seeing anything logged in the {start|stop}voip tables if that's important. Thanks for any help. Chris -- Chris D. Halverson http://www.chrishalverson.com/ YIM/AIM: chrisdhal MSN Messenger: chris(a)chrishalverson.com

2 1

Removing characters from usernames
by Andrew Zirkel 01 Feb '07

01 Feb '07

Is there a way to parse the input of a username and password before it is passed to the back end database? I'm doing mac address authentication and some devices are passing the mac address with dashes, where I need to have no separation between the octets. I basically need to strip out these dashes from the input. Thanks Andy Zirkel

3 4

help
by Stephen Baker 01 Feb '07

01 Feb '07

3 2

?? PEAP MSChapv2 and Proxy to LDAP
by Thomas Sterber (tsterber) 01 Feb '07

01 Feb '07

Can the freeradius be used to work as a proxy between a PEAP_MSChapv2 request and a central LDAP server ? I read a lot in the mailing forum, but its not clear. regards, Thomas

2 1

Message in "radius.log"
by Jean Frontin 01 Feb '07

01 Feb '07

Hello, Here is two lines of the radius.log. Everything in tables looks like okay. Where must I search, I don't understand the first line below. So, why is the second line good ? What does mean "cli" at the end of the second line ? Wed Jan 31 15:45:05 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [frontin] Wed Jan 31 15:45:05 2007 : Auth: Login OK: [frontin/xxxxxx] (from client swsfspare port 0 cli ) Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

RE: a freeradious/wireless solution for a school
by John Wan 01 Feb '07

01 Feb '07

Hi Michael, I have setup the "chillispot"+"freeRadius"+"Win2k3AD" for my wireless network. Everything is working but the AD authentication. Apparently the reason not working is because AD does not like the CHAP authentication and AD likes MS-CHAP. I do not know how to configure and where to configure my Linux box to use MS-CHAP instead of CHAP. Have you done this before? If you do would you please teach me how to rectify this problem. Please see the following output from "$ Radius -X" when a wireless client uses "administrator" logon into the chillispot web logon page: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 User-Name = "administrator" CHAP-Challenge = 0xa784482e8ac92fd573e87bbbad9ca58f CHAP-Password = 0x00f54cc04e288eec67feff0b13e9448bd2 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.5 Calling-Station-Id = "00-16-6F-79-91-F4" Called-Station-Id = "00-05-5D-9E-0F-94" NAS-Identifier = "nas01" Acct-Session-Id = "45aec9a900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x97668bae73249b0dd4755ab03d364f34 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "administrator" with CHAP password rlm_chap: Could not find clear text password for user administrator modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 Sending Access-Reject of id 0 to 127.0.0.1:32772 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 45aecedc Nothing to do. Sleeping until we see a request. Many thanks in advance. John Wan > -----Original Message----- > From: > freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org > [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradiu > s.org] On Behalf Of gkalinec > Sent: Friday, 26 January 2007 2:06 AM > To: freeradius-users(a)lists.freeradius.org > Subject: RE: a freeradious/wireless solution for a school > > > The database is not a problem, since we have a huge one in > place, one stored in Active Directory (for which I can use > the freeradius LDAP module) or MySQL one. The database is > really our main strength, since we have tons of information > about every student, staff and parent in (its what my main > job responsibility entails). A quick question, however, > would this be just as eay to set up on a Macintosh? (since > many of my supplicants will be macs..) > > German Kalinec > > > King, Michael wrote: > > > > Without being too subtle, You've mis-understood much of the > research > > you've read. Don't worry about it, there is quite a bit of > > contradictory information out there. > > > > There's quite a bit of background information, so it'll be a little > > bit before I mention FreeRADIUS. > > > > First. It's WPA, not WAP. (Different fields of technology) > > > > Forget much of what you've read. > > > > First, This is what you have been doing. > > > > Its called MAC filtering. The AP will only talk to MAC's > that it has > > in it's table. > > In short, this is useless, since if I wanted to get on, I'd > just fire > > up a packet sniffer. > > (They're free and easy to get. http://www.wireshark.org/ > for example) > > Copy some poor souls MAC address, and I'm on. It's an > administrative > > nightmare. > > > > You should not do this. A second form of this, is to load > all the MAC > > addresses into a radius server, then the AP will > interrogate Radius to > > find out if it's on it's allow list. This is as useless as the way > > your doing it now, because I can still easily copy your MAC > address. > > You should not do this either. > > > > Second: > > You mention 802.1x with WEP. You do not enter WEP keys at all, the > > RADIUS server takes care of it. This is a standard way of doing > > wireless. However I'd highly recommend you DO NOT pursue this, as > > it's very insecure, and has been replaced by WPA. All the > benefits of > > doing this apply to WPA. But you can do this if you want, but I'd > > suggest not to. > > > > Third > > Now we're on to WPA. This is what you should implement. > > > > WPA comes in two forms. WPA and WPA2 > > > > The primary difference is the WPA was designed as a interim > protocol, > > with backward compatibility in mind. > > WPA2 was designed to be run on new hardware, and uses AES > encryption. > > If you are setting a new network up, just use WPA2. > > > > Both WPA and WPA2 come in two forms. PSK and Enterprise > > > > PSK (or Pre-Shared Key) is what you mentioned. You load a > secret key > > onto all your AP's, and then put the same key on all your users > > machines. It's designed for HOME Use. You do NOT want to > use this form. > > > > Enterprise is what you WANT to use. You have all your > usernames and > > passwords stored in a database. (Be it SQL, ActiveDirctory, LDAP, > > etc) This is where FreeRADIUS comes in. You configure all > your AP's > > to use RADIUS, and give it the radius IP. > > > > You configure RADIUS to perform either TTLS and/or PEAP. (This is > > site specific, you need to decide your backend database to > determine > > which one you can use) > > > > You configure your client to use TTLS or PEAP, and upon > connecting to > > the network, they will be prompted to enter username and > password. If > > they don't have one, they don't get on. If they do have > one, they get > > on. > > > > > > Now we're at RADIUS. What type of user database do you have? > > Activedirectory? Novell? No having one is an acceptable answer as > > well. > > > > Post back, it's a lot of info, but we're here to help. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > View this message in context: > http://www.nabble.com/a-freeradious-wireless-solution-for-a-sc > hool-tf3036221.html#a8626010 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

Why Freeradius and Mysql dont work?
by yao guoxian 01 Feb '07

01 Feb '07

Platform and Environment: Freeradius:1.0.5 on Redhat 9 MySQL:MySQL-standard-5.0.20-linux-i686 Step: 1. create database radius; 2.mysql -uroot -prootpass radius < db_mysql.sql ; 3.Edit radiusd.conf and sql.conf; Debug Result: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 User-Name = "barney" CHAP-Password = 0xad35a90d409c25b78b6d148a531358d9ac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "barney", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 radius_xlat: 'barney' rlm_sql (sql): sql_set_user escaped user --> 'barney' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barney' ORDER BY id' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 2 modcall: group authorize returns fail for request 2 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 Discarding duplicate request from client liv1:1490 - ID: 6 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 6 with timestamp 45bca7cb Nothing to do. Sleeping until we see a request. From the above results, I guess mysql doesnt work. But I can access databases from the command line .The Freeradius Server worked well when I use the "user", not using MySQL. Any suggestion?

8 19

return-codes on reject
by Guido 01 Feb '07

01 Feb '07

Hello list, Im using freeradius-1.1.2 whit ms-sql. I'm having serius problems with return-codes on reject messages. All was working fine with previus version of freeradius. I was reading something about that is not allowed return-codes on reject, but I think it is wrong because most of return-codes goes on reject messages. Only return-code = 0 (authorization succeeded) goes on access=accept. The rest, for example 2 (invalid pin), 9 destination number blocked, 12 insufficient balance, etc etc, are return-codes that go on reject. Please, I need solve this ASAP, Regards, Guido

2 1

FR not honoring AutzType
by Sam Schultz 01 Feb '07

01 Feb '07

I've been trying to set up FR in a realm-based configuration using only LOCAL realms that are passed to different MySQL tables via different instances. This setup, like several previous questions posted to this list for similar setups, requires conditional branching. The solution as suggested in those posts was to use an Autz-Type block within the authorize block, and an Auth-Type block within the authenticate block to use appropriate module instances for the given realm. The problem I am having is that no matter what I set Autz-Type to, or where I set it, FR doesn't seem to honor it. I've tried putting it in hints entries, user entries, and realm entries; all suggestions that had been posted in response to similar issues. Another problem that compounds this one is that different posters refer to Autz-Type differently: autztype, AutzType, & Autz-Type. Is the difference significant, or is this one of those cases where they ALL are valid, but do exactly the same thing? I would have thought there would be some way to use the Realm variable that the rlm_realm strips from the User-Name attribute directly within the Authorize & Authenticate blocks, but it appears the most straight-forward way of using a block like 'realm bogus {}' causes FR to confuse the block for another module instance definition. Any insights anyone may have on this would be appreciated. Following are the relevant configuration & output segments: radiusd.conf, authorize block: Autz-Type SQL-BOGUS { sql-bogus } radiusd.conf, authenticate block: Auth-Type SQL-BOGUS { sql-bogus } hints: DEFAULT Prefix == "BOGUS\", Strip-User-Name = Yes Hint = "MIE Login", Service-Type = Framed-User, Autz-Type := SQL-BOGUS, Auth-Type := SQL-BOGUS users: DEFAULT Realm == "bogus", Autz-Type := SQL-BOGUS mysql bogus realms' radcheck table: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 6 | user | User-Password | == | password | | 7 | user | Auth-Type | := | Local | +----+----------+---------------+----+----------+ radiusd -X -A (snippet 1, module instantiation): rlm_sql (sql-bogus): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-bogus): Attempting to connect to root@localhost:/radius rlm_sql (sql-bogus): starting 0 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #0 rlm_sql (sql-bogus): Connected new DB handle, #0 rlm_sql (sql-bogus): starting 1 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #1 rlm_sql (sql-bogus): Connected new DB handle, #1 rlm_sql (sql-bogus): starting 2 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #2 rlm_sql (sql-bogus): Connected new DB handle, #2 rlm_sql (sql-bogus): starting 3 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #3 rlm_sql (sql-bogus): Connected new DB handle, #3 rlm_sql (sql-bogus): starting 4 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #4 rlm_sql (sql-bogus): Connected new DB handle, #4 Module: Instantiated sql (sql-bogus) radiusd -X -A (snippet 2, module *NOT* getting used): modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "bogus" for User-Name = "bogus\user" rlm_realm: Found realm "bogus" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm bogus rlm_realm: Adding Realm = "bogus" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 NOTE: My module order, and the fact that radius found the "bogus" realm means that there should be SQL auth lines appearing immediately after the "mschap returns noop" line. They don't show up, which means FR either wasn't seeing Autz-Type at that point, or some other module changed it. Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

2 1

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

Nevermind I found the problem. There's a limitation in ldap_groupcmp() such that only the last LDAP module instantiated is actually checked -- ignoring whatever you specify. I found this info from http://lists.cistron.nl/pipermail/freeradius-users/2004-June/033220.html. "In any case the ldap module which will be instantiated last will be the one that will handle ldap-group comparisons. If we add a check that will change to the first ldap module which is instantiated. I think it's more or less a matter of personal taste, which module we 'd like to handle ldap-group comparisons. Is it really worth the effort. Users can just change the order in which the ldap modules are instantiated in order to achieve what they want." Rather disappointing that this limitation still exists from 2 years ago. Does FR2.0 have some sort of object-based virtualization that would support this? Like, a "LDAP group" object which you could tie LDAP instances to and make the check there? -richard ----- Original Message ---- From: Richard Hesse <rhesse(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, January 30, 2007 12:40:36 PM Subject: Troube with matching LDAP group membership in authorize I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html ____________________________________________________________________________________ Now that's room service! Choose from over 150,000 hotels in 45,000 destinations on Yahoo! Travel to find your fit. http://farechase.yahoo.com/promo-generic-14795097

3 2