- Freeradius-Users - lists.freeradius.org

log failed logins
by Cory Robson 24 Jan '07

24 Jan '07

I have the following sql in my sql conf file and this is working. My only gripe is if there is no info provided then what gets placed in the log. It appears in the case of User-Password that a default of Chap-Password is entered as per below. Does anyone have a list of attributes I can log on failed attempts and the structure for the SQL statement. Eg %{reply:Reply-Message} quite often gives me "=5Cr=5CnYou are already logged in - access denied=5Cr=5Cn=5Cn" whereas I obviously only need the statement you are already logged in. I assume that an attribute followed by :- means to place what follows in the event of no data provided. Looking for lots of clarification here. postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date, callingid) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Reply-Message}', NOW(), '%{Calling-Station-Id}')" Thanks Cory

3 3

RE: a freeradious/wireless solution for a school
by Josh Howlett 24 Jan '07

24 Jan '07

(I'll bite to save Alan the déjà vu) An attacker sets up a captive portal system that looks exactly the same as yours (spoof). Users can't distinguish between the two captive portals, and so some users inevitably enter their credentials into the spoof portal. These credentials can be used by the attacker to gain network access through the authorised portal, or whatever else they're authorised for. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Tas Dionisakos > Sent: 23 January 2007 21:55 > To: FreeRadius users mailing list > Subject: Re: a freeradious/wireless solution for a school > > Please elaborate on how the system can be circumvented? > > Tas. > > A.L.M.Buxey(a)lboro.ac.uk wrote: > > Hi, > > > > > >> * Apache > >> * Freeradius > >> * Chillispot > >> * Mysql > >> > > > > though note that captive portals are easy to mitigate/spoof and > > circumvent > > > > alan > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > -- > ************************************* > Tas Dionisakos > IT Manager > St Mary's College and Newman College > The University of Melbourne > T: 03 9342 1708 > M: 0439 655 565 > E: tas(a)newman.unimelb.edu.au > C: (0o (||||)(||||) o0) > ************************************* > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Can't start FreeRadius after 1st installation
by Tek Bahadur Limbu 23 Jan '07

23 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, I am very new to FreeRadius. Just today, I have installed FreeRadius 1.13 from FreeBSD 6.0 (i386) ports. I am following this material from: http://www.onlamp.com/pub/a/onlamp/excerpt/radius_5/index1.html However when I try to start it using: radiusd -X, I get the following errors: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Segmentation fault: 11 (core dumped) Can somebody shed some light on this issue? - -- With best regards and good wishes, Yours sincerely, Tek Bahadur Limbu (TAG/TDG Group) Jwl Systems Department Worldlink Communications Pvt. Ltd. Jawalakhel, Nepal -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQFFoMAnVrOl+eVhOvYRAkQZAJ4mnkYZj5EzStO36Yl07vCrp+KjGwCgoY0U eptcoO+IV9DavLvJDl/LXow= =rnIv -----END PGP SIGNATURE-----

5 10

Freeradius + DHCP server ?
by Rafał Kamiński 23 Jan '07

23 Jan '07

Hi, Is it works ? If yes, can somebody tell me how i can do that ? My users is auth. and i want get him some address IP. BR -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

5 9

RE: Access-Accept ONLY on every second try
by Miguel Reategui 23 Jan '07

23 Jan '07

Thanks for your reply Alan, I believe I found the problem and I will describe it here as it might help others Looks like for some reason the only access-request that was issued, was being resent endlessly: The block below would be repeated 192 times (I don't know why) each time adding one more Proxy-State line <log> modcall[authorize]: module "sql" returns ok for request {/*1 to 192* ) modcall: leaving group authorize (returns updated) for request (/*1 to 192*/) Sending Access-Request of id (/*1 to 192*/ to xx.xx.xx.xx8 port 1812 User-Name = "18xxxxxxxx" User-Password = "xeexxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Proxy-State = 0x313230 Proxy-State = 0x30 Proxy-State = 0x31 Proxy-State = 0x32 Proxy-State = 0x33 </log> Finally the authentication realm would be marked as DEAD for each request <log> marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 2. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 3. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 4. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 5. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 6. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 7. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead {go on until all requests would be dead} </log> As this realm was marked dead, the next request (the second one) would go through another (default?) realm and this time, it would work normally. So, I took the proxy.conf file and commented out the offending realm information, forcing the "first request" to go to the next realm (default?) and it worked!!! I still need to see what I might be affecting as this is probably a Hack I hope this makes sense to someone....actually I got the idea from checking an old mailing list archived message about missing proxies Thanks to everyone, Mig

2 1

Rewrite accounting request/Proxy-To-Realm
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

i) How rewrite accounting request to insert certain attribute in order for billing engine to process futher.?? ii) Tried to set Proxy-To-Realm to force proxy accounting using rlm_perl.. But failed... $RAD_REPLY{'Proxy-To-Realm'} = "infranet2"; --haizam

1 0

Proxy accounting after query LDAP
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

FR: freeradius-1.1.2 OD: FreeBSD 6.0 trying to query LDAP for certain attribute.. if found, then proxy accounting to other server if not store accounting locally. trying using rlm_perl as below:- i) radiusd.conf perl y5perl { module = /usr/local/etc/raddb/y5perl.pl } accounting { ...... y5perl } ii) y5perl.pl sub accounting { # For debugging purposes only &log_request_attributes; # You can call another subroutine from here &test_call; &wifi_infranet; return RLM_MODULE_OK; } sub wifi_infranet { ## some code to query ldap for attribute A if (A) { ## What should i put here to force proxy accounting to other server?? } Any other method?? TQ.. --haizam

1 2

match client's shortname in huntgroups file
by Jakob Hirsch 23 Jan '07

23 Jan '07

Hi, is there an easy/good way to determine the huntgroup depending on the the shortname from clients.conf? We have more than 100 clients configured (with a "ProviderLocationCounter" pattern), so the information is duplicated in the huntgroups file (multiple times, as the huntgroup is also determined by Called-Station-Id). So it would really simplify things to have the shortname available for matching in the huntgroups file. I could extend one of our custom modules to put the name into a VSA and use that like 'Client-Shortname == "blub"' (already did it in a test environment and it works fine), but that seems a little clumsy to me, so I wondered if there's an easier way. unrelated side note: As I see, client_find() walks linearly through the client list. Shouldn't we keep this in a more appropriate data structure, like a btree or a trie, and/or save the once found RADCLIENT* pointer in the REQUEST struct? I understand that it doesn't matter for most installations (and we don't have any performance problems, either), it just does not feel right to waste so many cpu cycles :) regards, J

3 2

3ComSwitch Login
by Alexandre Soares 23 Jan '07

23 Jan '07

Hi All, Sorry team, but I still problem to authenticate a valid Administrator User in 3Com Swithc, my question is anyone implemented this feature ? I really don't know where to start the solution in freeradius

4 5

Freeradius(.net) and Oracle
by Brian Atkins 22 Jan '07

22 Jan '07

I am working on setting up a wireless hotspot using Chillispot on DD-WRT. I have installed Freeradius on a W2K server that runs an Oracle database. After reading the documentation and various howtos, I wanted to see if someone could offer some pointers on authenticating to Oracle using a pre-existing database and not the db/tables built from the sql file in the example docs. For example: I have a list of users listed in the database as 'barcode' (20 Char) and the password is stored in plain text as 'pin' (4 Char). I don't care about updating or creating users through Freeradius nor do I care about accounting (simultaneous connections). The defaults in the oraclesql.conf are: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authcheck_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" Which I assumed might be able to be trimmed down to: authorize_check_query = "SELECT barcode,pin FROM ${authcheck_table} \ WHERE barcode = '%{SQL-User-Name}'" Am I incorrect in this assumption? Thanks, Brian

3 2