- Freeradius-Users - lists.freeradius.org

New Setup
by Scott Hughes 18 Dec '06

18 Dec '06

I am looking to change my freeradius setup. I would like to use EAP-TTLS, MySQL, and dialup-admin. All of these are installed and functioning. Is there a HOWTO, web page, etc that will guide me on this. Thanks, Scott

1 0

chap requests and users file
by Thor Spruyt 17 Dec '06

17 Dec '06

Hi, I was wondering how I should create an entry in the users file for a user that authenticates with CHAP. Normally I have entries like this: ausername Auth-Type := Local, User-Password == "apassword" This works for PAP requests, but is it also fine for CHAP? I actually need a method to let both PAP and CHAP succeed, it's up to the user to decide what to use. -- Thor Spruyt M: +32 475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com

2 1

Faisal Butt is out of the office.
by Faisal Butt 17 Dec '06

17 Dec '06

I will be out of the office starting 12/17/2006 and will not return until 12/26/2006. Please send all your queries to sales(a)sbm.net.sa. For any technical support, please send your emails to tech-support(a)sbm.net.sa.

1 0

EAP-TLS authentication error
by Rafiqul Ahsan 17 Dec '06

17 Dec '06

Hi All, I am using wpa_supplicant-0.5.5 against freeradius - v1.1.3 . I am getting following error : TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0D07209B:asn1 encoding routines:ASN1_get_object:too long rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap: SSL error error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header rlm_eap_tls: BIO_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 23 modcall: leaving group authenticate (returns reject) for request 23 auth: Failed to validate the user. Login incorrect: [rafi/<no User-Password attribute>] (from client 192.168.1.102 port 19801 cli ) Delaying request 23 for 2 seconds Finished request 23 Here are my configs : test.conf (wpa_supplicant config) linux:/home/admin/wpa_supplicant-0.5.5 # cat test.conf ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel ap_scan=0 network={ scan_ssid=0 key_mgmt=IEEE8021X eap=TLS identity="rafi" eapol_flags=0 ca_cert="/etc/1x/eap_tls/certs/cacert.pem" client_cert="/etc/1x/eap_tls/certs/clientcert.pem" private_key="/etc/1x/eap_tls/certs/clientkey.pem" private_key_passwd="wimax i2 test certs" } eap.conf : eap { default_eap_type = tls timer_expire = 120 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 2 pem_file_type = yes private_key_password = "wimax i2 test certs" private_key_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/serverkey.pem certificate_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/servercert.pem CA_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/cacert.pem dh_file = /usr/local/etc/raddb/certs/rafi/dh random_file = /usr/local/etc/raddb/certs/rafi/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } } users : rafi Auth-Type := EAP -- Rafiqul Ahsan 630-717-1698(h) 2120 Periwinkle Ln 630-689-1457(h) Naperville, IL 60540 847-812-6176(c)

1 0

Properly using the operators?
by Mike 16 Dec '06

16 Dec '06

Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user: > radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike-

1 0

Accounts staying online past Session Timeout value
by Mike Jakubik 16 Dec '06

16 Dec '06

Hello, I am having some problems lately with freeradius 1.1.2 + mysql, and users staying online past their session timeout value (4 hours). Can anyone shed some light on the matter? I can not find any problems with the server itself, the loads are low and everything seems to be functioning OK. Would this be a function of the NAS to disconnect the user and send a stop packet or is it up to freeradius? Also, sometimes i have users who are getting disconnected and can not reconnect because they are still shown to be online, and i am limiting the sessions to 1. Again, would this be a problem with the NAS/network because freeradius is not receiving the stop packet? This setup has been running for over 80 days without a problem, so it leads me to believe that the problem is not on the radius server, but i would like some second opinions. Thank You.

4 6

Error: Failed to link EAP-Type/tls
by Nazeer Khan 16 Dec '06

16 Dec '06

Hi, I am trying to run freeRADIUS. Following is the version information. radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Dec 16 2006 at 15:37:14 --------------------------- I am getting the error messages as: rlm_exec: Wait=yes but no output defined. Did you mean output=none? . . . . rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. Also "radiusd start" gives the following errors: Sat Dec 16 18:03:46 2006 : Info: Starting - reading configuration files ... radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[10]: eap: Module instantiation failed. ) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[1939] Unknown module "eap".) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[1886] Failed to parse authenticate section. ------------------------------ Can anyone help me please that what is the problem. I have successfully created the certificates. But i could not run the freeRADIUS... :( Thank you. Nazeer Khan -------------------------------------------------------------------------- This email and any attachments may be confidential. They may contain legally privileged information or copyright material. You should not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages. We do not accept liability in connection with computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment. This notice should not be removed.

1 0

NAS-Port translation
by Jack Daniels 16 Dec '06

16 Dec '06

Hi, is there a way to translate the NAS-Port integer value into a string representing the physical interface on the switch? I mean, is there a way to get something like 'Fa0/1" from something like "Nas-Port = 50001"?? If so, could somebody tell how to do it? Thanks _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

rlm_sql: Password in Accounting Packet
by Marco Stuhl 15 Dec '06

15 Dec '06

Hello, Is there a way to insert password in radacct table? Changing SQL query to insert %{User-Password} has no effect. I'm aware of the RFCs - is there any workaround for this? Thanks, Marco

3 8

Help with Simultaneous Login on Freeradius+Ldap
by listasmw＠netconsult.inf.br 15 Dec '06

15 Dec '06

Hi, we are using FreeRadius 1.1.3 on Fedora Core 6 and the RLM_LDAP module, we're needing control simultaneous logins, eg. the ldap user "John" can authenticate only one time. When are monitoring the ldap users logins, they can log successfully in ldap, but we can't see or monitoring the users login in radutmp log file is empty with 0kb, when we execute the radwho command, it is empty but is opening. could you help me please? Regards, Maicon Wendhausen Freeradius Files Logs File: [root@firedap3 radius]# ls -la total 24 drwx------ 3 radiusd radiusd 4096 Dec 14 18:21 . drwxr-xr-x 10 root root 4096 Dec 14 19:06 .. drwx------ 3 radiusd radiusd 4096 Dec 14 19:55 radacct -rw------- 1 radiusd root 5357 Dec 14 20:03 radius.log -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radutmp -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radwtmp [root@firedap3 radius]# Log do Radius in Debug mode rad_recv: Access-Request packet from host 10.69.70.210:32771, id=87, length=63 User-Name = "user6" User-Password = "user6" NAS-IP-Address = 10.69.70.210 Service-Type = Authenticate-Only NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "user6", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 users: Matched entry DEFAULT at line 222 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for user6 radius_xlat: '(uid=user6)' radius_xlat: 'dc=nct,dc=com,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=nct,dc=com,dc=br, with filter (uid=user6) rlm_ldap: Added password {SSHA}f21M8OjksIKSJ1zUEii6JWKu43tWPRFgsBeiQg== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user user6 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "user6" with password "user6" rlm_ldap: user DN: uid=user6,dc=nct,dc=com,dc=br rlm_ldap: (re)connect to 10.69.70.25:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=user6,dc=nct,dc=com,dc=br/user6 to 10.69.70.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user user6 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'user6' modcall[session]: module "radutmp" returns ok for request 2 modcall: leaving group session (returns ok) for request 2 Login OK: [user6] (from client firepass port 0) Sending Access-Accept of id 87 to 10.69.70.210 port 32771 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... users file #...... DEFAULT Simultaneous-Use := 1 Fall-Through = 1 clients.conf file .... default configuration..... client 10.69.70.210 { secret = teste shortname = firepass } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { radutmp { filename = ${logdir}/radutmp ## username = "(uid=%{Stripped-User-Name:-%{User-Name}})" username = %{User-Name} case_sensitive = "yes" check_with_nas = "yes" perm = "0644" callerid = "no" } pap { encryption_scheme = crypt } chap { authtype = CHAP } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = no } ldap { server="10.69.70.25" identity="uid=gged,dc=nct,dc=com,dc=br" password=ged basedn="dc=nct,dc=com,dc=br" filter = (uid=%{Stripped-User-Name:-%{User-Name}}) ## filter= (uid=gged,dc=nct,dc=com,dc=br) password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 150 ldap_cache_size = 0 ldap_connections_number = 1 timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { #key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" key = "User-Name, Acct-Session-Id, NAS-IP-Address" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr # daily } authorize { #preprocess # auth_log # attr_filter chap mschap suffix digest # ntdomain #eap # Read the 'users' file files ldap # daily # checkval } authenticate { Auth-Type PAP { pap ldap } Auth-Type CHAP { chap ldap } Auth-Type MS-CHAP { mschap ldap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix # Read the 'acct_users' file #files } accounting { detail # daily # # For Simultaneous-Use tracking. # radutmp # sradutmp # main_pool } session { radutmp # sql } post-auth { } pre-proxy { } post-proxy { }

2 1