- Freeradius-Users - lists.freeradius.org

v1.1.3 - Logging Levels / Syslog / logging passwords
by Lin Richardson 28 Sep '06

28 Sep '06

Hello All, I've been working to configure logging as an aide to supporting our Freeradius installation. I'm familiar with logging level flags -x and -xx, as well as the big debug -X flag. My first observation is that ALL of these flags output to console by default. Is there any way to make the -xx or -x log to the logfile? I have toyed with setting logdir to 'syslog' in the radiusd.conf file. Alan said in a note to the list on Sept 6 that this feature didn't work in 1.1.3, but would in 2.0 I find it actually works pretty well IF you use the -x -xx or -X flag. The output that usually goes to the screen (most of it anyway) gets dumped to the syslog on my Solaris box just fine. It must be because either stderr or stdout get redirected to syslog, but not both. The actual requests still scroll on the console. I figure I can use >/dev/null 2>&1 & or some variant to kill the output still going to console and background the process... All of this is good, because I WANT a very verbose log file... my only problem is that user passwords are logged in clear text as part of the output - specifically from the pap module. This presents a security problem. (Never mind why I'm using clear text pap if I'm concerned with security.) Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? suggestions from those who know? I seem to recall seeing a related thread a few weeks back, but cannot find it... my apologies in advance if this is repetitive. Regards, Lin Richardson

2 1

Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

>> I think as I'm using digital certificates (EAP-TLS) to authenticate >> users, and the user has a valid one, if there aren't any aditional >> checks in radcheck, the user has already been authenticated due to the >> certificate, and is allowed to enter the network. Is that right? > > Yes. But you can still reject them before the certificate is >validated. Or, you can have a Certificate Revocation List that marks >their certificate as invalid. Yes, I'm using them to reject users that, although having a valid certificate, I want to be out of the network, and works OK. Only wanted to aditionally prevent users that bypass my access control system changing their 'UserName' to an unused one, accessing the network. The revocation list is something I'll give a look, thanks! > > If that's the case, I think about using the exec module to call a > external shell script which checks if 'UserName' is included in my > database, and if it's not, modify 'UserName' to something like > 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. > Do you think there's an easier way? > > See "rlm_exec". Run the script, and have the script print >"Auth-Type := Reject" to stdout if the user isn't found. That should >cause them to be rejected. Yes, It seems a good solution. Thank you very much! > Alan DeKok.

1 0

Re: Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

=?ISO-8859-1?Q?Marcos_Gonz=E1lez?= <mgtroyas(a)gmail.com> wrote: >> Is there any way to allow known users (those whose UserName appears in >> radcheck) access, but deny unknown (all other) users? > >Huh? If the user & password aren't known to the server, the default >*is* to reject them. If that isn't happening, then something in your >config is allowing them in. > >As always, run the server in debugging mode to see what's going on. > >Alan DeKok. I think as I'm using digital certificates (EAP-TLS) to authenticate users, and the user has a valid one, if there aren't any aditional checks in radcheck, the user has already been authenticated due to the certificate, and is allowed to enter the network. Is that right? If that's the case, I think about using the exec module to call a external shell script which checks if 'UserName' is included in my database, and if it's not, modify 'UserName' to something like 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. Do you think there's an easier way? Thank you for your help.

2 1

Radrelay - Duplicate records...
by Etienne Pretorius 28 Sep '06

28 Sep '06

Hello List, I would like to know if it is possible to setup FreeRAIUS not to log accounting info from a specific server to the detail file and still log the accounting info into the local mysql database. Some background on the subject: I have recently taken over the maintenance of a couple of FreeRADIUS servers. I'll be frank, I am not an experienced FreeRADIUS admin, so my first priority was to get the accounting information synced at all times between our servers. After some searching I found a couple of documents and posts about radrelay and I have proceeded to set it up on the servers hoping to achieve a two-way accounting replication service. +-----------+ +-----------+ | Primary | <===================== | Secondary | | RADIUS | =====================> | RADIUS | +-----------+ +-----------+ As the documentation is quite brief - I assume everything is working fine. I kept my eye on the logs and started to see the following appearing. Wed Sep 27 17:37:45 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090715896 duplicate Wed Sep 27 17:37:46 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090716313 duplicate (Also please note that I am aware of record duplication coming from my upstream provider's RADIUS proxy) When I killed radrelay on the Secondary then everything was OK except I now only have a one-way replication happening. Looking at the sql tables showed that there are about double the amount of records on the primary then on the secondary for that time period. As I have little experience on configuring FreeRadius (We all have to start somewhere), I would greatly appreciate the any help or comments about the subject at hand. Thank you. Etienne Pretorius

1 1

'-' Character in Group
by William A. Peroche 28 Sep '06

28 Sep '06

When I use '-' character as Group name, the authentication fails. For example 1. Group Name: -A Result : Aunthentication Fails 2. Group Name: A- Result : Authentication Successful What are the valid character and what is the explanation regarding this? Thank you very much. --------------------------------- Try the new Yahoo! Philippines Front Page!

2 1

Ascend 16 Bit VSAs
by Adam 28 Sep '06

28 Sep '06

Version: freeradius-1.1.3 I need to be able to send Ascend 16 bit VSAs to my NAS. The two that I need to be able to send are: Ascend-LCP-Keepalive-Period and Ascend-LCP-Keepalive-Missed-Limit. In my "/etc/raddb/dictionary" file I have place the following two lines: ATTRIBUTE Ascend-LCP-Keepalive-Period 321 integer Ascend ATTRIBUTE Ascend-LCP-Keepalive-Missed-Limit 322 integer Ascend When I start Radius I get the following errors: ... read_config_files: reading dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[34]: dict_addattr: ATTRIBUTE has invalid number (larger than 255). Is there support for 16 bit Ascend VSAs? If so how do I enable and use them? Thanks Adam

2 3

Using pam_radius_auth.o, why call pam_sm_chauthtok twice??
by 나종현 28 Sep '06

28 Sep '06

1 0

CRITICAL! NFS/ SQLIPPOOL :~(
by Guilherme Franco 27 Sep '06

27 Sep '06

Hello, I'm in a situation where I have 2 freeradius servers, working perfectly with rlm_sql_oracle (the entire AAA is done in Oracle, except the ippool). It's not possible to have the same pool configured the same way in the 2 servers, and also It's totally out of question to configure range1 for radius1 and range2 for radius2. I can't create the pool in the BRAS because of a limitation of itself. So, another option would be NFS with db files for the ippool module (which does not work also because of file locks). The only option that I see is to use SQLIPPOOL, which is not working for me in Oracle. I''ve modified sqlippool.conf to suit Oracle's needs and even removed the 'BEGIN' section from rlm_sqlippool.c and recompiled it (because oracle does not need BEGIN and it was causing me more problems). Even then, I'm still not able to use sqlippool! If sqlippool in oracle does not work, the only option left would be install postgre in the same machine as oracle (horrible!). This is the output (without BEGIN): ------------------------------------------------------------------------------ rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' sqlippool_command: xlat failed. UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414557' SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#157'), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user' rlm_sql (sql): sql_set_user escaped user --> 'test_user' ------------------------------------------------------------------------------ The first sqlippool_command: xlat failed. is because I removed the begin in rlm_sqlippool.c... This is the output (with BEGIN): ------------------------------------------------------------------------------ rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414558' SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#158'), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user' rlm_sql (sql): sql_set_user escaped user --> 'test_user' ------------------------------------------------------------------------------ Can anybody help me, please?

1 0

How to deny user with changed username when using EAP-TLS
by Marcos González 27 Sep '06

27 Sep '06

Hello, my name is Marcos and I'm developing an access control solution using FreeRADIUS+MySQL+Web frontend. I use check attributes in table 'radusercheck ' to allow or deny access on a per user basis. The problem is, if an user changes his 'UserName' in his wireless network adapter configuration, then there's no match in the table, and he enters the network bypassing my solution. There's an option in sql.conf that allows defining a DEFAULT profile, and also assigning it to non known users. But it's parsed after the normal check, so if I define an 'Auth-Type := Reject', both are denied, known and unknown users. Is there any way to allow known users (those whose UserName appears in radcheck) access, but deny unknown (all other) users? Thank you in advance.

2 1

assigning vlan based on LDAP attribute
by Matt Ashfield 27 Sep '06

27 Sep '06

Hi All, I'm trying to add a user to a vlan based on an ldap attribute. I've checked out: http://vuksan.com/linux/dot1x/802-1x-LDAP.html annd saw the following would have to be added to the user's ldap record: radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 If I don't want to actually insert that into the LDAP database, is it possible for Radius to figure out which vlan to assign to based on some other already existing LDAP attribute? For example, if I want to assign users whose userDepartment attribute equals ITS into vlan 3 and those who's userDepartment attribute equals HR into vlan 4? If so, could you give me a link to how to do that, or explain briefly? Thanks for your time, Matt mda(a)unb.ca

3 9