- Freeradius-Users - lists.freeradius.org

Decisionmaking in FreeRADIUS & Check/Reply Items
by Jan Mulders 11 Oct '06

11 Oct '06

Hello list, I am trying to use the 'files' module of Freeradius to do decisionmaking, based on information pulled in from the sql module, and the sqlcounter thing. First off, is this the right way of doing this? I want to assign users a different Pool-Name for each assigned speed, and send Max-Download-Speed and Max-Upload-Speed vendor-specific variables to the client on each request. My actual problem relates to the following errors, pulled from radiusd -X: ............ Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" [/etc/raddb/users]:214 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items Module: Instantiated files (files) radiusd.conf: "files" modules aren't allowed in 'post-auth' sections -- they have no such method. radiusd.conf[327] Failed to parse post-auth section. root@betabitch [/etc/raddb]# The offending rules are in users: DEFAULT User-Bytes-Used < 21474836480 , Group == "512k" # user gets high speed service if under 20gb Pool-Name := "512k_high", Max-Download-Rate := 524288, Max-Upload-Rate := 262144 DEFAULT User-Bytes-Used > 21474836480 , Group == "512k" # user gets low speed service if under 20gb Pool-Name := "512k_low", Max-Download-Rate := 262144, Max-Upload-Rate := 131072 DEFAULT User-Bytes-Used < 53687091200 , Group == "10m" # user gets high speed service if under 50gb Pool-Name := "10m_high", Max-Download-Rate := 10485760, Max-Upload-Rate := 10485760 DEFAULT User-Bytes-Used > 53687091200 , Group == "10m" # user gets low speed service if over 50gb Pool-Name := "10m_low", Max-Download-Rate := 1048576, Max-Upload-Rate := 1048576 But... but... the bottom 3 attributes *aren't* check attributes! I want to *set* them! Or am I getting entirely the wrong end of the stick here? Can somebody point out how these rules are meant to be arranged, and perhaps how I could do this in sql? It's all quite confusing. ##### radiusd.conf - important bits ###### sqlcounter monthlybytecounter { counter-name = User-Bytes-Used check-name = Max-User-Bytes sqlmod-inst = sql key = User-Name reset = monthly # this query is awesome in every way. # it selects the traffic used by the user since they last paid for their subscription # and adds up the input and output bytes together to get a composite usage figure. query = "SELECT SUM(AcctInputOcte.......................... } instantiate { monthlybytecounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess # acct_unique } accounting { #acct_unique #detail radutmp # ? 512k_high 512k_low 10m_high 10m_low sql } session { #radutmp # ? sql } post-auth { sql files 512k_high 512k_low 10m_high 10m_low } Thank you everyone :) Jan

3 3

Switch dies
by Jack Daniels 11 Oct '06

11 Oct '06

Hello everyone, just a dumb question. My switch is configured for vmps and freeradius and I'm playing with dynamic assignation of vlans. Vmps, when instructs the switch to place a client in a determined vlan, if that vlan doesn't exist in the switch, the switch just blocks access and continues with its normal operation. But, if I try the same with FreeRadius, when FreeRadius gives the vlan back (this vlan doesn't exist in the switch either), the switch freezes and I can't use it anymore until I restart it. Why is this behaviour? Thanks _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 2

Accounting-Response Log ??
by Rio Yang 11 Oct '06

11 Oct '06

Hi, I have two radius servers. (Freeradius and Juniper SBR). Freeradius server be a radius proxy to proxy all auth/acct requests to Juniper SBR. Then I sometimes found there are some accounting-stop request don't arrival to Juniper SBR. Because Freeradius server and Juniper SBR is in the different subnet and through firewall. I think this problem may cause by firewall. In the radius accounting communication model there should have request and response. Is freeradius log the accounting-response result ? How to enable it ? I want to this log to identify the problem. Thanks. Rio Yang

1 0

mac auth help please
by Marwan Sultan 10 Oct '06

10 Oct '06

Hello guys, Im on FreeBSD6.1-R, freeradius, mysql4.1, and using chillispot to authentication users. its wired network not a wireless. The problem is some users are using "phone adapters" such like motorola or cisco on my network so instead of plugin the cat5 (ethernet) cable to thier laptop they are plugin the cable to the phone adapter. the adapter is not working ofcourse because its expecting an internet.. in the time that chillispot will expect the adapter to "authenticate" which adapter will not So I have been advised to add the MAC adress to some allow list.. Is there a any way, that I can make 1 MAC adress only to not authenticate ? and keep the rest of the network authenticate using chillispot? Thank you. Marwan Sultan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Adding proxying to our EAP setup
by Dave Mussulman 10 Oct '06

10 Oct '06

Hello, I've been using FreeRADIUS for years to do PEAP/MSCHAP2 WPA authentications, and it's worked well enough to be a set-it-and-forget-it solution. I'm currently running 1.0.4, but would upgrade if it would help me accomplish the goals in this message. However, changing environments bring me back into the config, and I'm not sure how to do what I want. We've been using ntlm_auth against the AD for our primary authentication, with a fallback to sql and plaintext passwords for local accounts. I'd like to change from maintaining my own sql copy/user database to RADIUS proxying to someone else's server. >From a few trial/error tests, I have two questions about proxying and EAP. What's the recommended way to configure failover proxying/realms when there's no realm-ish identifier? When "user" logs in, I want them to check against ntlm_auth, and if that fails, resort back to a proxied realm as "user". Right now, I'm doing that via the default config realm suffix {} module, and a realm NULL section in proxy.conf. Is there a better way? Hints or something? Does this involve the configurable_failover documentation? Second question involves proxies and EAP. Since my upstream RADIUS server I'm proxying to doesn't seem to support EAP, is it even possible for my RADIUS server (in its PEAP/MSCHAPv2 decoding,) to create a 'normal' RADIUS packet to relay? Or do I have to get the upstream server to support EAP? It seems like if suffix (realm) module is anywhere in the authorize section, it proxies the entire EAP packet. Can I tell it only to do that at a certain stage in the process? How would you recommend I configure this? Dave

3 4

RE: EAP-TLS Certificate problems.
by Jason-Wittlin-Cohen 10 Oct '06

10 Oct '06

> Date: Mon, 9 Oct 2006 11:26:51 -0400 > From: "Brian vb" <nova5radius(a)gmail.com> > Subject: RE: EAP-TLS Certificate problems. > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <000f01c6ebb7$59118220$be01010a@lightwave> > Content-Type: text/plain; charset="us-ascii" > > Recreated certs, same issue came with the Issuer field. XPExtensions are > used. Password is the same in this file an what Freeradius has just changed > to protect it. > > > Here is the batch file I'm using to create the certs. I don't see anything > amiss between it and the page you sent.. any ideas? > > > PATH=C:\openssl\bin;C:\ssl1;%path% > export LD_LIBRARY_PATH=C:\openssl\lib > > > CD\SSL1 > > REM CA Creation > C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -export -in newreq.pem -out root.p12 -cacerts > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in root.p12 -out root.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in root.pem -out > root.der I'm not sure what you're doing here. First, "> C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved" You're outputting the private key and public key to the same file. I'm not sure if this will include both in the same file, or only create one. Regardless, it's not what you want to do. Give the files unique names. The clients and server need the public key and only the certificate signing machine needs the private key. You don't want to combine the keys. To create a CA: openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf Also, why are you creating a p12 file for the CA? You certainly don't want to hand out the private key to clients, and for certificate signing, you only need the private key which can be stored in cakey.pem for example. Clients should be given cacert.pem or cacert.der depending on the format you use. The p12 format should only be used for client certs because those need to combine private key + certificate (at least for the MS supplicant). > > REM Client cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, -keyout is used to creaate the private key, and -out to create the certificate signing request which is then passed on to the CA later. You're using the same filename, so I have no idea what's happening. Either you have a certificate signing request and no key, or a key without a signing request. Either way, it won't work. You need to do something like this: openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf Notice that the key and the signing request are given different names. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpclient_ext -extfile > xpexts -infiles newreq.pem > > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-clt.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-clt.pem -out > cert-clt.der So, you convert from a PEM certificate and PEM key, to a P12 cert+key, to a PEM cert+key to DER cert+key. Why? The P12 cert+key will work fine. > > REM Server Cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, the key and certificate signing request must be given different names or else your setup will fail. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpserver_ext -extfile > xpexts -infiles newreq.pem > Do you need these steps? Freeradius will use a seperate certificate and key in PEM format. It works fine for me. It seems like your setup is overly complex. Keep it simple, and see if it works. Then you can change file formats- etc. For now, just make the changes I recommended and see if it gives you a working CA and client/server certificates. > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-srv.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-srv.pem -out > cert-srv.der > Jason Wittlin-Cohen

2 1

AD Group based ldap auth
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

I'm trying to get group based authentication working using LDAP against AD. Right now I'm getting a failure related to the group search filter. What filter should I be using? groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniq uemember=%{Ldap-UserDn})))" Looking at the howto here http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048536. html got me part of the way. Anyone out there doing group based auth against AD mind sharing their config? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

1 0

RHEL4 and Oracle Instant Client
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

Has anyone gotten the source RPM's from RHEL4 to build with the oracle module using the Oracle instant client? It keeps giving me the following error no matter what I try: checking for oci.h... yes checking for oracle_init in -loracleclient... no configure: warning: oracle libraries not found. Use --with-oracle-lib-dir=<path>. configure: warning: sql submodule 'oracle' disabled Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

2 1

Re: disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Thanks guys for your post. First off, I have tried using the WinXP supplicant and I have no problems authenticating with the Linksys wifi cards. I just wish the Linksys utility was like Cisco where I can tell it do provide either/or username/cert. The Cisco cards have no problem with this as where using the Linksys with its utility does not provide me with what I want. No big deal. Using the Linksys client utitliy, a username, password, and certificate must be provided (the certificate is a combo box so I can't even leave it blank). I have always preferred to use the utility that came with wifi cards for configuration. They typically provide more information and are more user friendly than the Windows supplicant. This problem does pertain to the Linksys software more than FreeRadius. I was just hoping there was a way in the FreeRadius config files to help solve the problem Travis ----- Original Message ----- From: "Artur Hecker" <artur(a)wave-storm.com> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, October 10, 2006 12:42 PM Subject: Re: disable FreeRadius checking of client certs > Hi Travis > > > Excuse me for top-posting, but just as Alan I'm a bit surprised by your > post. > > If your authentication system is based on certificates, you need > certificates and you really should not say anything like "certificates > bother me" since that is the only expression of your trust, so without > that verification no authentication will ever be reasonable or complete. > > If it is not, you do not have certificates. Allowing both for the same > client (same machine) is discouraged. Personally I am not familar with a > supplicant which tries one and then another for the same username. > > Thus, per user if you are using EAP-PEAP-MSCHAPv2 (passwords), then you > are not using EAP-TLS. And vice versa. > > The good news is: the authentication method has strictly nothing to do > with the WiFi card; it is completely virtualized, in software. EAP is > only a transporter protocol, it does not say how to authenticate, it only > says how to transport data. Thus, if EAP is supported by the card, then > *every* EAP method is supported. That's magic about 802.1X and that's why > it's supported in the operating system rather than being supported by a > network card. > > Now if you are saying that you use a special Linksys 802.1X client, then > I would first suggest that you use the standard WinXP client. Sorry, but > the Linksys client is fairly unknown. > > Practically, it's difficult to guess from what you provided, but I think > that you do use the WinXP supplicant (i.e. 802.1X client - I do not know > of any linksys supplicant) and that you probably want to use > EAP-PEAP-MSCHAPv2. That involves one server certificate (obviously one > common trust anker - a self signed CA certificate) and some > username/passwords on clients. What probably happened is that in the two > cases where the Linksys card is used, you did not correctly configure > EAP-PEAP (called "Protected EAP" in WinXP or similar), but you let it be > "Smartcard or Certificate". Thus, the card tries to do TLS with some > available pub/priv key combination, but Freeradius rejects it. > > Reconfigure the WinXP supplicant to do EAP-PEAP and it will ask you for > passwords. Do not forget to deploy the server certificate on user > machines... > > >> Well, I have not issued certs to clients. Some of my clients have the >> option to log in with a username "OR" a cert. However, there are a few >> random Linksys cards (I guess I should have mentioned this was for >> Wifi/WPA) that I "MUST" provide a username and a cert. > > Strictly speaking, every EAP session will take a Username and the AAA > server will derive from it the authentication method to use. When used in > EAP-TLS, Windows XP typically fills it out with the CN from the > certificate (if available) but that is of course insufficient and it > would be more correct to give an identifier and then to start a TLS > authentication session for that id. (How exactly the username compares to > the certified information is an open question, since the username can be > altered by different means). > > >> If there are no certs on the client machine, Linksys fills the cert in >> with "Trust Any", so I assume it may be attempting with a blank? cert or >> another cert on the machine, such as VeriSign or the like.So this client >> is attempting to authenticate, I believe, with other certs on its >> machine because the radius log looks like below: > > hmmm??? you can't just use any certificate for authentication. What you > need is a pair: certificate/private key. Nobody except Verisign has their > private key. > > The only option for your Linksys 802.1X client would be to spontaneously > create a CA and to issue one user certificate for EAP authentication > signed by the latter. That can be done by XP, but there is no interest in > doing so. > > I would suggest you deploy passwords on these machines and configure EAP > PEAP. > > > regards > artur > > >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:error in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 00000000:lib(0):func(0):reason(0) >> Tue Oct 10 11:16:16 2006 : Error: TLS Alert read:fatal:unknown CA >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:failed in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: SSL_read failed inside >> of TLS (-1), TLS session fails. >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: BIO_read failed in a >> system call (-1), TLS session fails. >> >> I am not a FreeRadius expert so I may be misinterpreting the logs. >> Thanks. >> >> >> Travis >> ----- Original Message ----- From: "Alan DeKok" >> <aland(a)deployingradius.com> >> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >> Sent: Tuesday, October 10, 2006 10:27 AM >> Subject: Re: disable FreeRadius checking of client certs >> >> >>> "devel" <devel(a)oberonwireless.com> wrote: >>>> Is it possible to disable FreeRadius's checking of client certificates >>>> using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance >>>> over-head. Thanks. >>> >>> Huh? Client certs are used for PEAP only when you deploy client >>> certs to the end-user machines. Once they're deployed, they should >>> really be checked. >>> >>> Perhasp you can explain why you've deployed client certs, but now >>> don't want to use them. >>> >>> Alan DeKok. >>> -- >>> http://deployingradius.com - The web site of the book >>> http://deployingradius.com/blog/ - The blog >>> >> >> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html > >

1 0

cisco-accounting do not work. what i miss?
by Paloma Munoz 10 Oct '06

10 Oct '06

Hello to all! I have a problem with the accounting. I have FreeRADIUS Version 1.0.1 I think i have all I need to make the accounting but do not work. When I use the: "Radius Test Client", all is OK, i can see the log in mysql table(radacct)and in detail log file, but in the NAS don´t work. The authentication and authorization work ok. The Ip is assigned from the Radius. Also the "postauth logs" in mysql, works ok. ---------My cisco configuration---------------- aaa group server radius pal server A.B.C.D auth-port 1645 acct-port 1646 ! aaa authentication ppp default group pal aaa authorization network default group pal aaa accounting delay-start aaa accounting update newinfo aaa accounting network default start-stop group pal interface Virtual-Template2 ip unnumbered ATM2/0 ppp authentication pap radius-server configure-nas radius-server host A.B.C.D auth-port 1645 acct-port 1646 radius-server retransmit 2 radius-server timeout 20 radius-server key -------------------------------- ----my RADIUS configuration---- radiusd.conf: accounting { detail radutmp pool sql} ------------------------------- Any idea, where is the problem? I do not know, what is it happens Thanks for all

1 0