- Freeradius-Users - lists.freeradius.org

SQL Start Query Strings
by Cory Robson 09 Jan '07

09 Jan '07

My NAS sends a Ascend-Session-Svr-Key packet attr-151 and I wish to add an additional field into the tables to have this logged into. Now my question is what to call the variable in the sql statement (I.E. %{NAS-IP-Address}) I cannot find any documentation on the list of available strings and assume it is based on the dictionary files. Anyone have an answer on this for me.. Thanks

2 1

a bit off-topic policy question
by Matt Ashfield 09 Jan '07

09 Jan '07

Hi All We're in the process of setting up our wireless system to use radius authentication against our usernames/passwords which are stored in LDAP. We have come across an issue in testing the radius server. We are using Freeradius. The way we have this setup is quite standard (I hope). The user associates to the AccessPoint (AP) and is prompted for authentication credentials for access to the network. The AP sends the client's username/password credentials to the Radius server. This connection is secured. The Radius server then attempts to bind to the ldap server (again, a secured connection) using the clients credentials. The issue we have is when running the Radius server in debug mode with full log-level, we see the cilent's username and password in clear-text as it attempts to bind to the LDAP server. Certainly we could change the debug mode level to not see this, but the fact that the ability to see that is available is troubling. I'm sure many others on this list use FreeRadius and I'm wondering what sort of policies you have in place to address this security risk. Anyone with high-level access to the box could certainly login, make a change to the debug level and capture sensitive login information. Any advice/feedback is appreciated. Thanks Matt mda(a)unb.ca

5 5

Parse errors with Cisco-Avpair
by William Gemmill 09 Jan '07

09 Jan '07

I'm trying to use FreeRADIUS with a Cisco router to implement an authentication proxy. However when I try to define a test user in users, I'm getting a parse error on the spaces in the ACLs. Has anyone else implemented something similar? I found several guides for cisco logins, but they did not cover ACLs. Any help would be appreciated. Thanks! radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Jan 4 2007 at 13:58:04 radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/dictionary.cisco Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" */etc/raddb/users[3]: Parse error (check) for entry Cisco-Avpair="auth-proxy:proxyacl#1=permit: expecting '='* Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. *users file:* steve Auth-Type := Local, User-Password == "testing" Cisco-Avpair="auth-proxy:priv-lvl=15", Cisco-Avpair="auth-proxy:proxyacl#1=permit tcp any any eq 26", Cisco-Avpair="auth-proxy:proxyacl#2=permit icmp any host 60.0.0.2", Cisco-Avpair="auth-proxy:proxyacl#3=permit tcp any any eq ftp", Cisco-Avpair="auth-proxy:proxyacl#4=permit tcp any any eq ftp-data", Cisco-Avpair="auth-proxy:proxyacl#5=permit tcp any any eq smtp", Cisco-Avpair="auth-proxy:proxyacl#6=permit tcp any any eq telnet"

2 1

Ericsson Tigress access concentrator
by Cory Robson 09 Jan '07

09 Jan '07

Does anyone have a dictionary file for the old ericsson Tigress that will work with freeradius, I know there are still a few of these old units floating around.

1 0

PHP coding request - give me a price
by Cory Robson 08 Jan '07

08 Jan '07

I have an mysql backend from my accounting program that contains all my user details. I need a php script that I can run from cron that will Import all new users into freeradius that aren't already in its mysql db If the user is already in the freeradius db then see if any information is changed and update it. If the user is no longer in my mysql accounting system then also either remove it from freeradius or expire the user. I have the sql select statement for my mysql accounting system with the relevant information. Anyone able to do this at a reasonable price then drop me an email. thanks

4 4

call for help
by Andrew Long 08 Jan '07

08 Jan '07

I may need some consulting if someone is willing. We have freeradius 0.9.3 running on RHE 6, and need to move the server to a new ip address. I have been trying to get things rolling on a second server running 1.3, but cannot get it right so far (NAS's authenticate but our wireless clients do not authenticate to the nas). I would prefer to build a new 1.4 server. System is chap, using mysql. I have all the 0.9.3 configs and tables. I will say up front that I would prefer to do this myself but seem to need a little more help than is possible or efficient via the list. If someone would consider making themselves available via telephone or chat for a tutelage, great; If $ is required, we can discuss that. Please email off-list if you would consider. -- Regards, Andrew Long Network Support Specialist EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 ****** CONFIDENTIALITY NOTICE ****** NOTICE: This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system. Thank you.

1 0

Can't access Internet?
by Tim Tyler 08 Jan '07

08 Jan '07

FreeRadius experts, We are trying to run FreeRadius on a RedHat AS 2.1 system. We use an external password file for authentication defined in the unix system (password = filename) section of radius.conf. This seems to work fine. Modem users can authenticate to our old 3com Total Control modem pool, but users can not access the Internet. They can access all local domain servers on campus, but they can't get off campus. This really should not be a firewall issue as the same ip addresses are still associated with the modem pool. Note: if we go back to our old Lucent Technology radius server running on AIX, everybody is fine and can access the Internet again. I am trying to find out what might cause a modem pool to only work locally (access servers on our campus) after switching to FreeRadius particularly since it seems that the authentication part is working? I know that the 3com Total Control modem pool is rather old but I don't know why it would behave differently from one radius server to another as long as authentication works. I read in one of the FreeRadius archives that some users have experienced a similar problem of either very slow or won't work at all for some customers accessing the Internet via Freeradius authentication until they modified the MTU setting. This is curious to me. Is there a place in FreeRadius that I might change the mtu setting given that I am using an external unix password crypt file for all authentication? If so, what mtu setting might be recommended? Is there another possible explanation that might relate to Freeradius? any thoughts are much appreciated? Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

3 2

MySql and calling-station-id help please
by Ackbar Joolia 08 Jan '07

08 Jan '07

Dear all, I want to do authentication based on calling-station-id and then to assign a static IP from my database to that requester. SO basically, all the requests coming in will have the same username and password, and I will only identify each of them through their calling-station-id, and then assign a Framed-IP-Address to them. I cannot get the above to work at all, can anyone please give me an idea of how to do the above? Thanks Al -- Internal Virus Database is out-of-date. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.15.29/607 - Release Date: 28/12/2006 12:31

3 2

Authomated Access Accept/Deny
by Tamba Ben-Jusu 08 Jan '07

08 Jan '07

Hi All, I am running the freeradius server on an ubuntu server platform and it is running fine. However, I want to include a time factor in the operations: Users to be set in the following groups 1. Grant Access-Accept only between 8am to 6pm every day 2. Grant Access-Accept only between 6pm to 8am every day 3. Grant Access-Accept only weekends etc Please help me with information on how to set it up in the users file, other means of achieving this. Thanks Tamba -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.7/619 - Release Date: 07/01/2007 18:29

3 2

overwriting ldap radiusprofile according to realms?
by Markus Krause 08 Jan '07

08 Jan '07

Hi list, we are storing our user data in openLDAP with a radiusProfileDN attribute, which is sent back by the freeradius server (v.1.1.3, on SLES10) as expected. The profile contains information for the vlan of user. We now would like to have the possibility to let the user login in a special vlan (the "internetcafe") and thought of doing this with realms, which means the user has to login with "username" or "username@ic", setting the following in the users file: ---- /etc/raddb/users DEFAULT User-Name =~ "@ic$", User-Profile := "cn=InternetCafe,ou=Netconfig,o=Test" ---- This works if the users has no radiusprofileDN stored in LDAP, but if he has such an attribute the profile data from the user is used, not the "cn=InternetCafe". How can I overwrite the value for radiusprofiledn if the user appends "@ic" to this username? Or is there a better way to achieve this (changing the profile data / vlan according to login)? Thanks in advance for any help! Reagards Markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0