- Freeradius-Users - lists.freeradius.org

FreeRadius Log File ?
by Scott Miller 29 Jun '06

29 Jun '06

Hello all - I have freeradius with mysql up and running perfectly. I recently "upgraded" from icradius because it seems to have dropped off the face of the earth. Anyways - there was a feature in icradius where I could poll the log file to get customers authentication status. I created a link to a php file which referenced this log file for our techs to help with troubleshooting. The file looks like this: <?php include ('header.php'); $file ="/var/log/radius.log"; $limit="60"; $fp = popen("/usr/bin/tail -$limit $file", 'r'); if (! $fp ) { echo 'unable to pipe command'; } while (!feof($fp) ) { $line = fgets($fp, 4096); print $line."<br>"; } include ('footer.php'); ?> But - there doesn't seem to be any log file I can poll this type of info from. Here's an excerpt of what I was able to get with the above: Wed Jun 28 13:22:13 2006: Auth: Login OK: [sshort] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:22:56 2006: Auth: Login OK: [lilia] (from nas Cisco AS5300/S0) socket 0 (0 sec) Wed Jun 28 13:23:03 2006: Auth: Login OK: [eaglesight] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:23:56 2006: Auth: Login OK: [dierman] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:23:58 2006: Auth: Login OK: [rprice] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:25:32 2006: Auth: Login OK: [hafens] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:25:43 2006: Auth: Login OK: [edie_a] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:26:09 2006: Auth: Login OK: [megameg] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:26:35 2006: Auth: Login OK: [stinger] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 13:26:39 2006: Auth: Login OK: [inahat] (from nas CiscoAS5300/S0) socket 0 (0 sec) Wed Jun 28 14:26:57 2006: Auth: Login OK: [cafe] (from nascore219.interbel.net/S10101001) socket 0 (0 sec) Do we have a log file we can poll this type of info from, or does it store it in the mysql database somewhere? Thanks, Scott Miller

5 13

Multiple AD-Domains with rlm_ldap
by robiwan＠arcor.de 29 Jun '06

29 Jun '06

Dear all, For AAA-Authenticating on a Cisco Catalyst Switch 3750, i use the rlm_ldap module to authenticate users against our single Active Directory (domain-name: SOUTH). Users telnet the switch, therefore a clear-text password will be sent. This works properly. But now, we have four AD-Domains (NORTH, SOUTH, EAST, WEST) and sometimes the same username in different AD-Domains e.g. NORTH\nicole.smith SOUTH\john.smith NORTH\john.smith WEST\john.smith What would be the best way to authenticate users? In my case, access should be granted for user SOUTH\john.smith and NORTH\nicole.smith ? Is ntlm_auth the right way, or multiple ldap instances to differ the AD-Domains or what else? Thanks in advance for any suggestions... Robert My current config follws below: users --------- john.smith Service-Type = Login, Cisco-AVPair = "shell:priv-lvl=15" nicole.smith Service-Type = Login, Cisco-AVPair = "shell:priv-lvl=7" radiusd.conf ------------------ prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } ldap { server = "10.187.64.3" identity = "CN=Hans Dampf,CN=Computers,DC=SOUTH,DC=rsnhm,DC=com,DC=de" password = laber basedn = "DC=SOUTH,DC=rsnhm,DC=com,DC=de" filter = "sAMAccountname=%{User-Name}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

Setting vlan tag based on authentication/authorization source
by Tom Whitehouse 29 Jun '06

29 Jun '06

I have a freeradius setup (currently 1.1.1) for a VPN NAS box using 128-bit MPPE MSCHAPv2 authentication against a Samba password file and have recently added an EAP/PEAP setup for switches and access points to provide 802.1x access control. This all works, and I now need to check multiple Samba password files and depending on which one contains the users credentials return a VLAN tag to the switch. In users I think I need: DEFAULT something == "staff" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = 1000 DEFAULT something == "student" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = 1001 where 'something' gets set depending on which password file the username exists in. Note that usernames are mutually exclusive - they will only exist in one of the samba password files. I created multiple instances of passwd modules: passwd smbpasswd_staff { filename = /path/to/smbpasswd_staff format = "*User-Name::LM-Password:NT-Password:SMB- Account-CTRL-TEXT::" authtype = MS-CHAP hashsize = 100 ignorenislike = no allowmultiplekeys = no } passwd smbpasswd_student { filename = /path/to/smbpasswd_student format = "*User-Name::LM-Password:NT-Password:SMB- Account-CTRL-TEXT::" authtype = MS-CHAP hashsize = 100 ignorenislike = no allowmultiplekeys = no } and tried using realms and Autz-Type in the authorize section and changing User-Name to Stripped-User-Name, but this doesn't work with EAP. I would also prefer not to have the users specify some prefix or suffix to select which samba password file is check if possible. I've had a look through the list archives and can't find any hints so can anyone suggest what I could try next ? Tom -- Tom Whitehouse Department of Computer Science, University of York Heslington, York YO10 5DD, United Kingdom email: tomw(a)cs.york.ac.uk | Fax: +44 1904 432767 http://www.cs.york.ac.uk | Voice: +44 1904 434725

2 1

exec-program dependent on ldap attribute values
by Tariq Rashid 29 Jun '06

29 Jun '06

Hi, I am using the acct_users file to trigger an external script when an accounting start has been received: DEFAULT Acct-Status-Type == Start Exec-Program = "/etc/freeradius/scripts/acct_start.py %{User-Name}" I would like however for the script to be called only when an LDAP attribute has a certain values. Is this possible? The user's LDAP profile has already been searched for the user's password in the initial auth request, and possibly in the acct request. something like the following does not work: DEFAULT Acct-Status-Type == Start, Account-Status == "inactive" Exec-Program = "/etc/freeradius/scripts/acct_start.py %{User-Name}" where Account-Status is mapped to the LDAP attribute in the ldap-attrmap file. Tariq

2 1

basic handling of multiple EAP-Methods by freerad
by Rainer Brinkmann 29 Jun '06

29 Jun '06

Hello, we wonder, how a freeradius can request a client to use a fixed EAP-Method: so its defined: Client starts with EAP-Start-Msg Radius wants EAP-Identity Client answers with Username or Hostname NOT using a special EAP-Method Radius now starts communiucating with the first EAP-Packet, using the special EAP-Method Question: you run in your wireless LAN many SSIDs: SSID1 shall use EAP-TTLS SSID2 shall use EAP-TLS (high-secured Net like personal Data) what logic starts the right inner-EAP-Protocol, cause neither the AccessPoint(WLAN-Controller), nor the radius server know, what Method to use, when there are many enabled. e.g. on a cisco-Radius, that runs with enabled PEAP and TLS, but there's no special attribute defined to control that thanks for reply, Rainer Brinkmann University-Clinicum Hamburg / Germany

3 2

monitoring freeradius
by Giuseppe Parlato 29 Jun '06

29 Jun '06

Hi all, Have you ever tried to monitor freeradius using mrtg or what's up gold ? Is there any way to monitor this service using snmp? I've already compiled freeradius with snmp. thanks Giuseppe

1 0

Band-Width Limitation
by amr el-saeed 29 Jun '06

29 Jun '06

Dear All, i'm using freeradius 1.1.0 . i want to use the monthly counter function of the sqlcounter module. i want to use it to calculate Band-Width not time. i modified it and it is working fine but it sends the remaining allowed bandwidth in the attribute 'Session Timeout' and the associated code of-course. what i want is to change that code !! how can i do something like that ?? thanks for your help -- regards, Amr el-Saeed

2 1

FreeRadius and Ericsonn NAS
by David Goodenough 29 Jun '06

29 Jun '06

Has anyone connected FreeRadius to an Ericsonn NAS which identifies itself as:- Ericsonn AB - Packet Core Networks My FreeRadius setup is receiving an Access-Request and is sending back an Access-Accept but the NAS thinks it is being rejected. Apparently this NAS does not have easily accessible diagnostic logs and matters are complicated as there is one guy with access to the Ericsonn who has only ever used Steel Belted Radius before, me who has never used FreeRadius (or any other Radius come to that) and a network managed by others who had firewall problems getting the packets to flow between the NAS and FreeRadius. Any help greatfully received, David

1 0

FW: mpd+freeradius+AD
by Егоров Сергей 29 Jun '06

29 Jun '06

>This is Framed-IP-Address in radius dialect. Thanks for explaining freeradius basic concepts. I understood, that to assign IP to user I should use users freeradius file. But I couldn't configure it correctly. Now I have only one line in this file DEFAULT Auth-Type := MS-CHAP I've add another string (for user test), but it doesn't correct test Auth-Type := MS-CHAP, Framed-IP-Address = 192.168.10.65, That should I fix? -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Monday, June 26, 2006 5:09 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: mpd+freeradius+AD On Monday 26 June 2006 14:04, Егоров Сергей wrote: > Thanks for reply. > > >You can use one of the three firewalls avaliable in the base system(ipfw, > > >ipf and pf), however mpd comes with a small dictionary that uses > > ipfw(8) >and you can easily define some filter bound to an interface > > (bound to a >username) via a radius reply attribute, let filter be a > > pipe(for bandwidth >control) or a packet filtering expression. > > That's fine for filtering vpn users access to local net. But how could I > assign specific IP for specific user in AD? > > > Your questions don't clearly tell where your problem is. > >Active Directory? mpd? or FreeRADIUS? You should define > >them better in order to get help from the list. > > My goal is to replace VPN server, based on win2003, with FreeBSD one. WIN > 2003 can do 1 and 2 in my questions, so I have to realize how to setup this > in mpd + freeradius. I already authenticate users from AD group: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00} > --require-membership-of=EXAMPLE+VPN_Allowed". > > But I have several vpn groups and need to setup timeouts on each one. setup timeout? This looks like Session-Timeout in radius dialect. > Also > I need to I assign specific IP for specific user in AD. This is Framed-IP-Address in radius dialect. > Looks like > FreeRadius should respond for this. Yes, you have to have basic understanding of what radius is. All of these are very basic setup. I don't know how FreeRADIUS interacts with AD and what info it should get from AD. So, try searching (or asking) for active directory and FreeRADIUS. Keep the mpd part out of it, since it will add unneeded complexity. Or perhaps start from setting up mpd and FreeRADIUS. And then you could add AD. A few suggestions, Nikos - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius advocacy needed for convincing corporate management
by Kostas Zorbadelos 29 Jun '06

29 Jun '06

My greetings to the list. The company I work is one of the largest ISPs in Greece. We are evaluating the possibility to move away from our current radius software (FUNK Radius now Juniper) in favour of freeradius. We as technical people understand all the benefits of the move (and it would also give us opportunity to contribute to the project). However management would like to hear stuff like - Any large installations that use freeradius effectively today (commercial environments preffered). This would give us arguments in favour of freeradius scalability and reliability - Possibility to have commercial support Anyone who can contribute arguments or facts is more than welcome. Kostas -- Kostas Zorbadelos m@il contact: kzorba (at) otenet.gr Out there in the darkness, out there in the night out there in the starlight, one soul burns brighter than a thousand suns.

4 4