- Freeradius-Users - lists.freeradius.org

redundant use of SQL-Group in "users"
by Phil Mayers 15 Jan '07

15 Jan '07

All, The configurable failover mechanism allows one to say: authorize { redundant { sql1 sql2 } } ...but can one do this: DEFAULT SQL-Group == "BANNED", Auth-Type := Reject ...in a way that will failover between sql1 and sql2? I don't believe so, but just want to check before I do the fallback option (which for various reasons too tedious to go into, is a lot of work for this config).

2 1

RE: Using MySQL and assigning IP-Addresses based onCalling-Station-ID
by Ackbar Joolia 15 Jan '07

15 Jan '07

Phil, Thanks for your reply. I didn’t know about the Fall-Through. I have got a list of static addresses, which I will need to assign through the Framed-IP-Address attribute. This is what I am trying to do: When I receive requests, they all come with the same username and password, but with different Calling-Station-ID. I have to authenticate and differentiate on the calling-station-id, and then assign static IP-Address to these users, based on the calling-station-id. I know it sounds simple, but I can't get it to work or am not getting the logic right. Can you advise please? My model has to work in the way described above i.e. same username and password, and assigning Framed-IP-Address based on the calling-station-id, in MySql. Thanks Al -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalmetering.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalmetering.com@lists.freeradius.org] On Behalf Of Phil Mayers Sent: 15 January 2007 16:32 To: FreeRadius users mailing list Subject: Re: Using MySQL and assigning IP-Addresses based onCalling-Station-ID Ackbar Joolia wrote: > The radcheck table contains an entry for the password. > The radreply table contains a Fall-Through = Yes for the user user1. > The radgroupcheck contains groupnames (coming from the usergroup table) and Calling-Station-Id which I need to authenticate against. > The radgroupreply table contains the replies I want to send to the different groups, which would have been authenticated/differentiated through their calling-station-id. That's not right, and if I'm understanding you correctly you can't do exactly what you want with the current release version of FreeRadius. Fall-Through does nothing on the current release version of FreeRadius - the SQL module merges the user and all the group check items into one, checks them, then puts all the reply items in. Since they're all merged, putting users into >1 group with conflicting check items will fail, as will putting users into >1 group with the same reply items. Also, you would not normally assign IPs to groups - you would assign them to sessions from a pool (see rlm_sqlippool) or statically to users (using Framed-IP-Address in the radreply items) Could you be a bit more specific about what you're trying to do? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

Using MySQL and assigning IP-Addresses based on Calling-Station-ID
by Ackbar Joolia 15 Jan '07

15 Jan '07

Hi all, I sent an email to the list before, and still haven’t been able to fix my problem. This is what I want to do: I am using MySql to authenticate users. However, I need to authenticate them based on the Calling-Station-ID, and then assign IP-addresses to them, through the Framed-IP-Address attribute. This seems to be a very one to do, but its not working. All users will be having same username (user1) and password. This is the logic I am using: I haven't changed the sql query which comes with FreeRadius. In my usergroup table, I am putting users with the same username, but different groupnames. The radcheck table contains an entry for the password. The radreply table contains a Fall-Through = Yes for the user user1. The radgroupcheck contains groupnames (coming from the usergroup table) and Calling-Station-Id which I need to authenticate against. The radgroupreply table contains the replies I want to send to the different groups, which would have been authenticated/differentiated through their calling-station-id. Is this setup wrong? The replies which are being allocated is for the first groupname that appears in the radgroupreply table, which to me, means that the radgroupcheck is not having any user. Can anyone who has done the above before give me some hints as to what I am doing wrong, or maybe my setup could be wrong? Would the radius server not check the attributes appearing in the request automatically against the ones in the radcheck/radgroupcheck tables, or do I need to modify the sql_query? Thanks AL -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

Works in debug mode but not service mode
by Foo JH 15 Jan '07

15 Jan '07

Hello all, I'm using the Windows binary distribution of FreeRadius, to receive accounting logs from Cisco routers. Setup-wise, I try to keep it to a minimum; mostly from the FreeRadius tutorials. After the setup, I am able to receive the log posts in debug mode, but not in the Windows Service mode. Is there anything different between the modes, perhaps the security authentication? Hope to get some good help here. Thanks.

1 0

Forward L2TP request to another LNS
by Hemant Arora 15 Jan '07

15 Jan '07

Hi All, I need to forward L2TP requests from Freeradius to another LNS. To explain in more details Two Domain xyz.com and abc.com are the realms for which I am accepting the connections and both are terminating on our LNS1. Forwarded to Radius. >From freeradius I want to forward the requests for xyz.com to LNS2 via Tunnel not via Realmproxy. Is it possible ? If yes please can somebody throw some light on that. I am using Mysql with Freeradius. Thanks hemant

2 1

Daily Accounting - 3 days account?
by liran tal 14 Jan '07

14 Jan '07

Hey everyone, I've seen that there's a Max-All-Session, Daily, Weekly and Monthly even. I need to limit the user for a 3days period. How do I accomplish that? Thank you. Liran.

2 3

My Dictionaries seem corrupted
by Evan Vittitow 14 Jan '07

14 Jan '07

Working Dictionaries requested. Anyone with known working dictioniaries?

4 4

Radius Server refusing to MS-CHAP
by Evan Vittitow 14 Jan '07

14 Jan '07

This is the configuration producing the MS-CHAP issue. No matter what I do, it wants to use CHAP instead of MS-CHAP radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = /var/log/radius raddbdir = /etc/raddb radacctdir = /var/log/radius/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radius group = radius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = no require_strong = no } ldap { server = "kurama.pukey" identity = "cn=Manager,dc=pukey" password = password basedn = "dc=pukey" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.101.1 range-stop = 192.168.101.99 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess ldap mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql } session { radutmp } post-auth { sql } pre-proxy { } post-proxy { eap } users DEFAULT Auth-Type := MS-CHAP Fall-Through = 1 ldap.attrmap # # Mapping of RADIUS dictionary attributes to LDAP directory attributes # to be used by LDAP authentication and authorization module (rlm_ldap) # # Format: # ItemType RADIUS-Attribute-Name ldapAttributeName # # Where: # ItemType = checkItem or replyItem # RADIUS-Attribute-Name = attribute name in RADIUS dictionary # ldapAttributeName = attribute name in LDAP schema # # If $GENERIC$ is specified as RADIUS-Attribute-Name, the line specifies # a LDAP attribute which can be used to store any RADIUS # attribute/value-pair in LDAP directory. # # You should edit this file to suit it to your needs. # checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem SMB-Account-CTRL-TEXT sambaAcctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } clients.conf #client some.host.org { # secret = # shortname = localhost #} # # You can now specify one secret for a network of clients. # When a client request comes in, the BEST match is chosen. # i.e. The entry from the smallest possible network. # #client 192.168.0.0/24 { # secret = testing-1 # shortname = private-network-1 #} # #client 192.168.0.0/16 { # secret = testing-2 # shortname = private-network-2 #} #client 10.10.10.10 { # # secret and password are mapped through the "secrets" file. # secret = testing # shortname = liv1 # # the following three fields are optional, but may be used by # # checkrad.pl for simultaneous usage checks # nastype = livingston # login = !root # password = someadminpas #} I've removed passwords. /etc/ppp/opions.pptpd lock nobsdcomp nodeflate mtu 1000 mru 1000 debug auth -chap -mschap +mschap-v2 plugin radius.so plugin radattr.so

4 12

RE: FreeRadius IRC...
by Thibault Le Meur 13 Jan '07

13 Jan '07

> The issue is, I've done everything, a semi-competent Linux user with > Critical thinking skills should do, I've been methodical. asnd > disciplined and persistent. Yet still, I cannot succeed at this. This > will make my University Career look bad. I just think I could use > another pair of eyes, maybe I missed something. > > I feel like Edward Elric searching for the Philosopher's stone. I posted an idea and you decided not to reply to my questions ! I suspect that your VPN server doesn't know Microsoft Radius attributes and refuses to send them to the radius server. I've tested a bad setup (lack of Microsoft radius dictionary), and I get the same radiusd -X debug log: no MS-CHAP Challenge in the request... I asked "have you checked possible error messages in /var/log/messages " on the vpn server ? To be more specific, look for the following lines in you log file: " rc_avpair_new: unknown attribute" If you see such lines it might be that your radiusclient library (used by the PPPd plugin on your VPN server) doesn't understand the Microsoft attributes (for instance the MS-CHAP Challenge). Thus, the PPPd radius plugin doesn't send these attributes that are required for Freeradius to do MS-CHAP authentication. Could you really check that your dictionnary file on the VPN server side contains a line like: INCLUDE /usr/share/radiusclient-ng/dictionary.microsoft and check the content of this file... HTH, Thibault

2 2

MySQL authentication problem
by Ian Truelsen 13 Jan '07

13 Jan '07

radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Dec 26 2006 at 01:46:55 mysql Ver 14.12 Distrib 5.0.30, for pc-linux-gnu (i686) using readline 5.2 I thought that I had everything configured properly for MySQL authentication, but when I try to do a test with radtest, the test user is not authenticated and there is no log of activity to the MySQL database. Anyway, here is the output of radiusd -X and, at the end, the population of my database: rad_recv: Access-Request packet from host 192.168.182.1:2053, id=7, length=55 User-Name = "ian" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ian", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ian' rlm_sql (sql): sql_set_user escaped user --> 'ian' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ian' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ian' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ian' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect: [ian/test] (from client brentwood port 1812) Delaying request 0 for 1 seconds Finished request 0 mysql> select * from radcheck -> ; +----+----------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-------+ | 1 | Password | == | te | | | 2 | ian | Password | == | test | +----+----------+-----------+----+-------+ 2 rows in set (0.01 sec) Any thoughts on why this is not working would be greatly appreciated. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

4 14