- Freeradius-Users - lists.freeradius.org

RE: Report Generator
by Geoff Dornan 24 Aug '06

24 Aug '06

Yes that sounds great Sean, please make available -----Original Message----- From: freeradius-users-bounces+geoff=cmcnetworks.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+geoff=cmcnetworks.net@lists.freeradius. org] On Behalf Of Sean Sent: Wednesday, August 23, 2006 9:58 PM To: freeradius-users(a)lists.freeradius.org Subject: Report Generator Hi, Ive written a report generator in PHP and HTML that will allow your clients to generate usage reports from the FreeRadius log files. When the user logs in he/she is asked for their IP address and the Month that they want to display. If anyone wants a copy let me know. If there is enough interest I'll make it available for public download. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: Report Generator
by Deramus, Chris 23 Aug '06

23 Aug '06

I'd be very excited to take a look and give you some feedback/input. Let me know what you need from me. -----Original Message----- From: freeradius-users-bounces+chris.deramus=hq.doe.gov(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.deramus=hq.doe.gov@lists.freeradi us.org] On Behalf Of Sean Sent: Wednesday, August 23, 2006 3:58 PM To: freeradius-users(a)lists.freeradius.org Subject: Report Generator Hi, Ive written a report generator in PHP and HTML that will allow your clients to generate usage reports from the FreeRadius log files. When the user logs in he/she is asked for their IP address and the Month that they want to display. If anyone wants a copy let me know. If there is enough interest I'll make it available for public download. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Help to modify the reply list for accounting response packets.
by Shankar Ganesh C 23 Aug '06

23 Aug '06

Hi , Like to add some vendor speciifc parameters in the request list and the reply list. I have created the dictionary file for vendor specfic attributes and tested it also with NTRadPing utitlity. I understand from the document and manual that if i want this attributes to be added to the Accounting response then i need to add this attributes to the reply list. But i do not know where and how to add this reply list could be modifed so that it gets included in the accounting response. Do i need to do some changes with the sql.conf ? It whould be great help if some body could help me on this. Thanks and regards Shankar ganesh

2 1

unix module authentication doesn't work.....
by Walter Tautz 23 Aug '06

23 Aug '06

Hi, I have a freeradius server running on Ubuntu/Dapper/i386 platform. Version: 1.1.0-1ubuntu2 I have a client which is Ubuntu/Dapper/amd64 architecture. I have installed libpam-radius-auth and set it up with the server. Version: 1.3.16-4. NOTE. 64 bit AMD architecture. What I am trying to do: ====================== Use the /etc/shadow,/etc/passwd file on the server for user authenticatication. I have configure (on the client) /etc/pam.d/common-auth with contents: auth sufficient pam_unix.so nullok_secure auth required pam_radius_auth.so debug I setup /etc/pam_radius_auth.conf with IPaddress_of_server secret-string 3 where the secret string is typable by keyboard. I added the relevant data to the server for this client. Do I need to use the users file /etc/freeradius/users and put the user in that? Doesn't seem to help. Below I have included two logs, from the client, server and my radiusd.conf file (no comments for the latter file). ------------ Log of /var/log/auth.log on client ------------ Aug 22 15:24:37 fe104 sshd[1745]: Invalid user test-walter from 129.97.15.20 Aug 22 15:24:37 fe104 sshd[1745]: Failed none for invalid user test-walter from 129.97.15.20 port 753 ssh2 Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) check pass; user unknown Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cscf.cs.uwaterloo.ca Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got user name test-walter Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got password ^H ^M\177INCORRECT Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Sending RADIUS request code 1 Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1409445184. Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: Got RADIUS response code 3 Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: authentication failed Aug 22 15:24:45 fe104 sshd[1745]: Failed password for invalid user test-walter from 129.97.15.20 port 753 ssh2 Aug 22 15:26:35 fe104 sshd[1745]: fatal: Timeout before authentication for 129.97.15.20 -------- radius -X log on server ----------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "md5" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "NULL" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 129.97.152.227:2770, id=124, length=102 User-Name = "test-walter" User-Password = "\010\n\rINCORRECT" NAS-IP-Address = 129.97.152.227 NAS-Identifier = "ssh" NAS-Port = 1745 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "cscf.cs.uwaterloo.ca" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test-walter", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [test-walter]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 124 to 129.97.152.227 port 2770 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 124 with timestamp 44eb54e1 Nothing to do. Sleeping until we see a request. ---------------------- end of radius -X log ------------------- my radiusd.conf (egrep -v '^ *#|^$' /etc/freeradius/radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = md5 } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 passwd = /etc/passwd shadow = /etc/shadow group = /etc/group } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } ----------------end of /etc/freeradius/radiusd.conf -------------------------------

3 5

Recall: help on this issue solved
by Elie Hani 23 Aug '06

23 Aug '06

Elie Hani would like to recall the message, "help on this issue solved".

1 0

PEAP LDAP confusion
by Rob Shepherd 23 Aug '06

23 Aug '06

Dear FreeRADIUS users, Firstly, I am attempting to get XP/OSX clients to connect to a 802.1x WLAN provided by a cisco wlan controller. This is currently backed by ACS and works, but i'd like to use FreeRADIUS is possible, with half my users in LDAP and half in MySQL. The setup uses PEAP, however am I correct in thinking that the RADIUS server never touches any TLS components. The TLS tunnel is between the WLAN controller and the client right? Furthermore, I know I cannot use ldap authentication (binding) as a result of the eap conversation, however can I store an NT-Hash in LDAP/MySQL for the mschapv2 module to pick up and use? I'd prefer not to store clear text at all if possible... I have everything I need compiled and installed, but I'd like to know whether or not I can achieve my goal before wasting a lot of my time. Any pointers are thus greatly appreciated. thanks Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

7 10

BUG! Variables and MySQL queries
by Chris Knipe 23 Aug '06

23 Aug '06

radiusd: FreeRADIUS Version 1.1.1, for host , built on May 18 2006 at 13:16:06 Copyright (C) 2000-2006 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. sql query: authorize_check_query = "SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `User` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID LEFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes`.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `GroupTimes`.StopTime > DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `Realm`.Realmname=LOWER(SUBSTRING('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') +1))) AND `User`.Username=LOWER(LEFT('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute" Escaped query sent to the database: SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `Use r` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID L EFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y ' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes `.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `GroupTimes`.StopTime > D ATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `Realm`.Realmname=LOWER(SUBSTRING('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') +1))) AND `User`.Username=LOWER(LEFT('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute The mySQL variables %H:%i:%S is over written by FreeRadius' variables... I have filed in BugZilla as well. Any possibility to get this fixed??? Regards, Chris.

2 2

More SQL
by Chris Knipe 23 Aug '06

23 Aug '06

1 1

Re: Re: openser and AD
by Artur Hayne 23 Aug '06

23 Aug '06

Active Directory does not supply clear-text passwords to FreeRADIUS. In many cases, Active Directory doesn't *have* the clear-text passwords. Digest authentication is impossible when the passwords are in Active Directory. Sorry. > I see in some tutorials show how authenticate in a domain to use one > tool called ntlm_auth, but it seams that only work with the mschap > protocol, and the openser uses the digest. Yes. ntlm_auth will not help you. > What to do? Any ideia? Use another database, like OpenLDAP or MySQL. Active Directory is responsible for making Digest authentication impossible. > Its necessarily to do some configuration in the users or another files? No. There is NOTHING you can do except use another database. The Openser , Active Directory and FreeRadius support TLS. Can I use it for solve my problem? Or is this a bad ideia? --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora!

1 0

bill payment using RADIUS
by Asiful Mustafa 23 Aug '06

23 Aug '06

Hi, Is there any ways that post-paid users can pay their bill using RADIUS packet? Is there any RADIUS attribute which updates a user account by specifed amount? Thanks, Asif

3 4