- Freeradius-Users - lists.freeradius.org

FreeRadius Newbie
by Gustavo Alejandro Gonzalez 15 Nov '06

15 Nov '06

Hello All!, im newbie in RADIUS, I have installed freeradius and I want to configure it to work as AAA with CISCO AV-PAIRS. I have a program that send request as a radius client and the attributes what I send is: Authenticantion: I send to radius: ==>ACCESS REQUEST ==>USERNAME:xxxxxxxx(8 digits) ==>PASSWORD:xxxx(4 digits) ==>VENDOR: Cisco-AVPair I recive from radius if: <==ACCESS ACCEPT <==Cisco-AVPair=' h323--credit-amount=xx' <==Cisco-AVPair=' h323-return-code=X' else: <==ACCESS REJECT Radius use a mysql database to process this Authentication. I apreciate any help in configure freeradius as shown. Greetings,

2 1

Failed to link to module 'rlm_counter'
by Eranga Amarakoon 15 Nov '06

15 Nov '06

When using 'radius -X' the following error occured. radiusd.conf[1392] Failed to link to module 'rlm_counter': rlm_counter.so: cannot open shared object file: No such file or directory There's no rlm_counter.so in the library directory What is the reason ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

2 1

identify dial-up test session
by Ryan Melendez 15 Nov '06

15 Nov '06

Hello, I would like to identify a ppp session as a "test" session by somehow marking the accounting records. I've considered overloading the username sent by pppd to include a .test and alter the 'Service-Type' based on the suffix. I'd like to be able to somehow pass an Attribute from LCP->IPIP->RADIUS to identify a session as unique, but I'm not sure if that is even possible. Note, I do not need any special service that might be associated with say a Service-Type = Administrative, just an Attribute I can load to the db to later filter out. Has anyone tried anything similar in the past? If anyone can point me in the right direction I would really appreciate it. -- Thanks, Ryan

1 0

how to force NAS-port info in accounting-start, for radutmp to work ok
by Radu IONESCU 15 Nov '06

15 Nov '06

I have installed freeradius-1.0.5-1.2 on FC-5, and I intend to use Freeradius with only one NAS - ZyXEL VSG-1200 - a subscriber gateway for wire/wireless campus access zone. The NAS is defined in clients.conf file as "nastype = other". The VSAs are working ok. It seems that the NAS, doesn't include the NAS-Port attribute (Integer) in the accounting packets, so RADIUS accounting process doesn't write into radwtm/radutmp files (radwho outputs no data), and Simultaneous-Use check is not effective: rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! Is there a workaround for this, I mean on the RADIUS host? Thank you for any help! ri Following is a radiusd -X output for a current accounting request: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rad_recv: Accounting-Request packet from host 192.168.19.226:10661, id=7, length=136 User-Name = "pcrist" Acct-Status-Type = Alive Acct-Delay-Time = 0 Acct-Session-Id = "0050fce8552031000000" NAS-IP-Address = 192.168.19.226 NAS-Identifier = "vsg" Framed-IP-Address = 10.59.1.2 Calling-Station-Id = "00-50-FC-E8-55-20" Called-Station-Id = "00-13-49-6F-EE-C4" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 21 modcall[preacct]: module "preprocess" returns noop for request 21 rlm_acct_unique: Hashing 'Client-IP-Address = 192.168.19.226,NAS-IP-Address = 192.168.19.226,Acct-Session-Id = "0050fce8552031000000",User-Name = "pcrist"' rlm_acct_unique: Acct-Unique-Session-ID = "c425325ee3d8e6fc". modcall[preacct]: module "acct_unique" returns ok for request 21 modcall[preacct]: module "files" returns noop for request 21 modcall: group preacct returns ok for request 21 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 21 radius_xlat: '/var/log/radius/radacct/192.168.19.226/detail-20061115' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.19.226/detail-20061115 modcall[accounting]: module "detail" returns ok for request 21 modcall[accounting]: module "unix" returns noop for request 21 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'pcrist' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 21 modcall: group accounting returns ok for request 21 Sending Accounting-Response of id 7 to 192.168.19.226:10661 Finished request 21 Going to the next request ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and this is a radiusd -X output when I simulate an accounting packet with NTRadPing, forcing an attribute of NAS-port=1: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rad_recv: Accounting-Request packet from host 192.168.19.11:3828, id=4, length=43 User-Name = "dani" Acct-Status-Type = Start Acct-Session-Id = "460" NAS-Port = 1 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 22 modcall[preacct]: module "preprocess" returns noop for request 22 rlm_acct_unique: Hashing 'Client-IP-Address = 192.168.19.11,NAS-IP-Address = 192.168.19.11,Acct-Session-Id = "460",User-Name = "dani"' rlm_acct_unique: Acct-Unique-Session-ID = "45e816fe4586d71f". modcall[preacct]: module "acct_unique" returns ok for request 22 modcall[preacct]: module "files" returns noop for request 22 modcall: group preacct returns ok for request 22 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 22 radius_xlat: '/var/log/radius/radacct/192.168.19.11/detail-20061115' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.19.11/detail-20061115 modcall[accounting]: module "detail" returns ok for request 22 modcall[accounting]: module "unix" returns ok for request 22 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'dani' modcall[accounting]: module "radutmp" returns ok for request 22 modcall: group accounting returns ok for request 22 Sending Accounting-Response of id 4 to 192.168.19.11:3828 Finished request 22 Going to the next request --- Walking the entire request list --- Cleaning up request 22 ID 4 with timestamp 455b108c Nothing to do. Sleeping until we see a request. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ the above seems ok, as I have now an entry in radutmp: # radwho Login Name What TTY When From Location dani dani shell S1 Wed 15:05 193.254.2 and an authentication packet sent with NTRadPing with the same user-name 'dani' gets an 'Access-Reject' response: 'You are already logged in - access denied' So, Simultaneous-Use works ok for me if NAS includes NAS-port attribute in accounting start packet. I wrote to ZyXEL with no much hope for an answer, so I am looking for a FreeRADIUS workaround on the host installation. --- / Universitatea TRANSILVANIA Brasov / -- virus checked - cciu unitbv

1 0

realm table
by Santiago Balaguer García 15 Nov '06

15 Nov '06

1 0

Configure option for /usr/sbin/radiusd
by Dow, Corey 14 Nov '06

14 Nov '06

Hi, I'm experiencing a problem with freeradius 1.1.2 when I configure and compile. It writes the binaries and configuration files to the correct directories, but /usr/sbin/radiusd tries to source config files in /usr/etc instead of /etc/raddb. I can change this via /usr/sbin/radiusd -X -d /etc/raddb I know but is there a way to change the default at configure so it always will look in /etc/raddb? Thanks, Corey My configure options are: ./configure --with-edir --localstatedir=/var --sysconfdir=/etc --exec-prefix=/usr Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747 Tel : 1-916-785-8003

2 1

Assigning IPs on a per-NAS basis?
by Jan Mulders 14 Nov '06

14 Nov '06

Hello, Trying to do a very simple task here - create a new check attribute Pool-Name := servername, depending on what NAS sends the request to the RADIUS server (identifiable by IP address or by name or whatever in the request attributes). What's the best way of doing this? Thanks, Jan

1 0

RE: huntgroup issue, multiple huntgroups per device
by Garber, Neal 14 Nov '06

14 Nov '06

>Is it possible to have multiple huntgroups for the same NAS-IP-ADDRESS? >I am running into this issue trying to configure a vpn appliance that uses >the same freeRADIUS server to authenticate its users as well as its admins. Yes, but something needs to distinguish the two (another attribute). Are you saying that your appliance is using radius to authenticate VPN users as well as to authenticate admins. that are using telnet/ssh/http to administratively manage the appliance? If so, check the request attributes for each type of access. Then, you can add the attribute that lets you tell what access type the user is requesting. For instance, I have an AP that uses FR to authenticate 802.11 users as well as for local logons to the AP itself. In my case, the NAS-Port-Type allows me to discern the difference between the two types of access. For 802.11 user access, the AP sends NAS-Port-Type = "Wireless-802.11" and for local logon, the AP sends NAS-Port-Type = "Async" or "Virtual". Figure out what's different in the request and then you can have multiple NAS-IP-Address == 10.20.30.1 entries with different values in the other attribute. For example: vpn NAS-IP-Address == 10.20.30.1, NAS-Port-Type == "XXX" Group = VPNUSERS vpn-admin NAS-IP-Address == 10.20.30.1, NAS-Port-Type == "YYY" User-Name = admin1, User-Name = admin2

1 0

proxy questions
by Justin Church 14 Nov '06

14 Nov '06

I need to be able to proxy accounting requests that arrive with no User-Name attribute. Is that possible? I haven't been able to make it work. Maybe I could insert a dummy User-Name pre-proxy and remove it post-proxy? Also, I notice that when running in -X mode, the accounting-response is not relayed to the original client. Works fine when not in -X mode. Here's a debug of a scenario where an accounting-request was proxied correctly; yet, the accounting-response is not relayed to the client by the proxy server: rad_recv: Accounting-Request packet from host 152.2.199.26 port 32823, id=155, length=86 User-Name = "jcc" NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 5060,,NAS-IP-Address = 152.2.199.26,Acct-Session-Id = "accounting-session-1-id",User-Name = "jcc"' rlm_acct_unique: Acct-Unique-Session-ID = "7910d35136b9eb7a". rlm_realm: No '@' in User-Name = "jcc", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user jcc to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy accounting request to realm "NULL" modcall: group preacct returns noop for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114 radius_xlat: 'Tue Nov 14 12:15:11 2006' rlm_detail: Freeradius-Proxied-To set to 152.23.129.213 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'jcc' modcall: group accounting returns ok for request 4 Sending Accounting-Request of id 227 to 152.23.129.213 port 1815 User-Name = "jcc" NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" NAS-IP-Address = 152.2.199.26 Proxy-State = 0x313535 --- Walking the entire request list --- Cleaning up request 4 ID 155 with timestamp 4559f99f Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Response packet from host 152.23.129.213 port 1815, id=227, length=25 No outstanding request was found for proxy reply from home server 152.23.129.213 port 1815 - ID 227 Nothing to do. Sleeping until we see a request. root@rtc306:/usr/local/etc/raddb# radiusd -v radiusd: FreeRADIUS Version 2.0.0-pre0, for host i686-pc-linux-gnu, built on Sep 6 2006 at 16:44:16 Thanks. -jc

2 4

RE: huntgroup issue, multiple huntgroups per device
by Charles Tompkins 14 Nov '06

14 Nov '06

So sorry! [root@server ~]# radiusd -v radiusd: FreeRADIUS Version 2.0.0-pre0, for host i686-pc-linux-gnu, built on Apr 29 2006 at 19:51:21 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ------------ Master timed out! Holding election... I am declaring myself the master! -----Original Message----- From: freeradius-users-bounces+crt=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+crt=thig.com@lists.freeradius.org] On Behalf Of Charles Tompkins Sent: Tuesday, November 14, 2006 2:36 PM To: 'FreeRadius users mailing list' Subject: huntgroup issue, multiple huntgroups per device Is it possible to have multiple huntgroups for the same NAS-IP-ADDRESS? I am running into this issue trying to configure a vpn appliance that uses the same freeRADIUS server to authenticate its users as well as its admins. The huntgroups file gets checked from top to bottom, so depending which specified group comes first, the other gets denied access. i.e. "../raddb/huntgroups" vpn NAS-IP-Address == 10.20.30.1 Group = VPNUSERS vpn-admin NAS-IP-Address == 10.20.30.1 User-Name = admin1, User-Name = admin2 This config keeps the admins out of the vty but lets the users vpn in. Debug reveals: No huntgroup access: [admin1] (from client vpn.foo.com port 6256 cli 10.10.10.10) modcall[authorize]: module "preprocess" returns reject for request 1 modcall: leaving group authorize (returns reject) for request 1 FYI, my users file checks for admins first then falls through to framed users... I would like to avoid adding another ip address to the vpn appliance if at all possible. Regards from sunny Florida, -Charles Tompkins ------------ Master timed out! Holding election... I am declaring myself the master! CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

1 0