- Freeradius-Users - lists.freeradius.org

RE: modcall[authorize] after Access-Accept
by Ryan Melendez 07 Jun '06

07 Jun '06

Thanks, exactly what I needed. Here is my being very impressed that is a config option. Ryan > -----Original Message----- > From: freeradius-users-bounces+rmelendez=wayport.net(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+rmelendez=wayport.net(a)lists.freeradius.org] On Behalf Of Alan > DeKok > Sent: Wednesday, June 07, 2006 12:03 PM > To: FreeRadius users mailing list > Subject: Re: modcall[authorize] after Access-Accept > > "Ryan Melendez" <rmelendez(a)wayport.net> wrote: > > I have both the realm and sql modules in my authorize section. After > > freeradius receives an Access-Accept it processes the authorize section. > > See post_proxy_authorize. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

modcall[authorize] after Access-Accept
by Ryan Melendez 07 Jun '06

07 Jun '06

Hello, I have both the realm and sql modules in my authorize section. After freeradius receives an Access-Accept it processes the authorize section. It is not clear to me why, but I assume this is intentional based on debug messages: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "realmslash" returns noop for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "realmat" returns noop for request 0 My problem is that the sql module is called after the realm modules and querys the db. I don't know why this would ever be necessary, but it is undesirable for my configuration. I cannot simply group 'realmslash' and 'relamat' and return if 'noop'. This would cause a 'LOCAL' realm to skip the sql. I appreciate any help. Thanks, Ryan

2 1

Re: SecurID authentication
by David Mitton 07 Jun '06

07 Jun '06

Darshak, SecurID uses a proprietary client/server protocol between it's clients and it's authentication servers. That protocol is implemented in a binary DLL (or equivalent on Unix) that is part of the distribution. All our own components use that mechanism to communicate with the auth server, including our RADIUS server. You can obtain a source API library and API documentation on how to use this client. I'm not sure on the logistics, but look at our web site or ask your sales/support people. This capability has been used by others, Funk (now Juniper) developed their own support in SBR. I'm sure other have too. Dave. > ----- Original Message ----- > From: darshak <darshak(a)elitecore.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: SecurID authentication > Date: Wed, 7 Jun 2006 09:31:45 +0530 > > > Thanxs David,This has been useful to me . > Although proxy is best answer.I just wanna go in some details. > If i own RSA ACE/server,then does it come with RSa Ace/client agent? Then what > i need to do is write a code that talks with Freeradius and RSA ACE/client? > Or I need not do it? > Is this RSA/Ace server comes with client that talks to RADIUS? and I can be > free from coding burden? > Can u please explain How > RADIUS <-->RSA/ACe server talk to each other?[if i not use proxy ] > I have read that Lucent and SBR supports this RSA/ACE SecurID so how they > actually support?Do they have coded extra or by proxy ? > Thanxs again for your help > > Rgds > Darshak > > > ----- Original Message ----- From: "David Mitton" <david(a)mitton.com> > To: <freeradius-users(a)lists.freeradius.org> > Sent: Tuesday, June 06, 2006 10:23 PM > Subject: RE: SecurID authentication > > > > Darshak, > > > > I'm not a legal representative, but Michael's response is for > > someone that wishes to sell or distribute(?) a product that uses the > > SecurID service > > > > While doing a RADIUS proxy to for the new RADIUS server may be the correct > > approach, if you are an owner of a SecurID server solution, you can > > certainly develop code to use your licensed server for whatever > > application you wish. > > > > The product offering includes an ACE Client SDK which gives you a > > C-language API for doing SecurID authentication. It would be fairly > > straight forward to develop your own Free RADIUS module, but there are > > details with New Pin assignment and Next Token mode that get messy. The > > server uses Access-Challenge for them. > > > > Also the new server includes EAP support for several methods. So proxy > > may still be the best path. > > > > David Mitton > > Software Development, > > RSA Security, Inc. > > > > PS: I urge all senders to use meaningful Subject lines, the original > > message was discarded by me on first pass as spam. > > > > ----- Original Message ----- > > > > From: "Michael Lecuyer" <mjl(a)theorem.com> > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Hello, > > Date: Tue, 06 Jun 2006 09:08:16 -0400 > > > > > > It would be difficult to say how RADIUS would interact with the actual > > ACE > > server since it's a proprietary system. In 2002 I thought about going > > down > > this route and I'm summarizing from the 5 page SecurId integration > > document. > > > > You must write code that uses RSA's 'RSA Agent' software to communicate > > with > > the RSA ACE server. You must become a partner a a cost of ten thousand > > dollars > > for each product each year you provide the product(s). You must pay RSA > > twenty > > percent of your product's licensing fee. And you must have RSA certify > > it and > > may be required to provide a training program for RSA certification > > technicians. The sublicense agreement with RSA is incompatible with any > > open > > source software. > > > > The best thing to do is use FreeRadius as a proxy to the RSA RADIUS > > server. > > > > From a client's point of view the ACE RADIUS server may require a > > simple > > CHAP/PAP transaction or there may be challenges asking for more > > information. > > It depends on the RSA server configuration. > > > > darshak wrote: > >> Hi All > >> I m new to AAA things.I want how can I support RSA ACE/Server in > >> freeradius. > >> Can anyone has details How interaction is made between RADIUS and > >> RSA/ACE-server?. in general scenario > >> > >> > >> Rgds > >> DArshak > >> > > > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

ldap and MD5-Challenge
by robiwan＠arcor.de 07 Jun '06

07 Jun '06

Dear all, My Supplicant is a WinXP-Client, EAP-Type is MD5-Challenge. My Authenticator is a Cisco Catalyst 3750 I try to do a 802.1X Authentication for a user listet in a LDAP-database. When i do a MD5-Challenge it does not work. Do i have a problem with MD5-encrypted passwords? My configuration files follows below... Thanks in advance.... The LDAP-Authentication seems to work, here is the freeradius -X output after radtest: Debian# radtest schlapp Gerti1000 localhost 1645 testing123 rad_recv: Access-Request packet from host 127.0.0.1:32852, id=247, length=59 User-Name = "schlapp" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "schlapp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry schlapp at line 87 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for schlapp radius_xlat: '(&(sAMAccountname=schlapp)(objectClass=person))' radius_xlat: 'DC=winlab,DC=rsnhm,DC=t-com,DC=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.187.64.3:389, authentication 0 rlm_ldap: bind as CN=Robert Huber,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de/Gerti1000 to 10.187.64.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in DC=winlab,DC=rsnhm,DC=t-com,DC=de, with filter (&(sAMAccountname=schlapp)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user schlapp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "schlapp" with password "Gerti1000" rlm_ldap: user DN: CN=schlapp hut,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de rlm_ldap: (re)connect to 10.187.64.3:389, authentication 1 rlm_ldap: bind as CN=schlapp hut,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de/Gerti1000 to 10.187.64.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user schlapp authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Login OK: [schlapp/Gerti1000] (from client localhost port 1645) Sending Access-Accept of id 247 to 127.0.0.1 port 32852 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... But when i try to use my WinXP-Client, EAP says: rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select Here is the entire freeradius -X output: rad_recv: Access-Request packet from host 10.187.0.15:1645, id=174, length=129 User-Name = "schlapp" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" EAP-Message = 0x0202000c017363686c617070 Message-Authenticator = 0x7a4a5ff5030a44b2fcee7b79d3aac47c NAS-Port = 60003 NAS-Port-Type = Virtual NAS-IP-Address = 10.187.0.15 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "schlapp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry schlapp at line 83 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for schlapp radius_xlat: '(&(sAMAccountname=schlapp)(objectClass=person))' radius_xlat: 'DC=winlab,DC=rsnhm,DC=t-com,DC=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.187.64.3:389, authentication 0 rlm_ldap: bind as CN=Robert Huber,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de/Gerti1000 to 10.187.64.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in DC=winlab,DC=rsnhm,DC=t-com,DC=de, with filter (&(sAMAccountname=schlapp)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user schlapp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 174 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4172a142a08feeb924f2a128e5ddef32 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=175, length=141 User-Name = "schlapp" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" EAP-Message = 0x020300060304 Message-Authenticator = 0x71486fbf711a2bbd7b14377510a81beb NAS-Port = 60003 NAS-Port-Type = Virtual State = 0x4172a142a08feeb924f2a128e5ddef32 NAS-IP-Address = 10.187.0.15 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "schlapp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry schlapp at line 83 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for schlapp radius_xlat: '(&(sAMAccountname=schlapp)(objectClass=person))' radius_xlat: 'DC=winlab,DC=rsnhm,DC=t-com,DC=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=winlab,DC=rsnhm,DC=t-com,DC=de, with filter (&(sAMAccountname=schlapp)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user schlapp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/md5 rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 175 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x01040016041033c920c71b4f300c45c31a67d56acce6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x166498a3095698d1df3c6b3827bdd631 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=176, length=164 User-Name = "schlapp" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" EAP-Message = 0x0204001d04108ade4625748baf1353f8c786e23d72527363686c617070 Message-Authenticator = 0x28e98702a7aec9aec73273be08999cee NAS-Port = 60003 NAS-Port-Type = Virtual State = 0x166498a3095698d1df3c6b3827bdd631 NAS-IP-Address = 10.187.0.15 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "schlapp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry schlapp at line 83 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for schlapp radius_xlat: '(&(sAMAccountname=schlapp)(objectClass=person))' radius_xlat: 'DC=winlab,DC=rsnhm,DC=t-com,DC=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=winlab,DC=rsnhm,DC=t-com,DC=de, with filter (&(sAMAccountname=schlapp)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user schlapp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 2 modcall: leaving group authenticate (returns invalid) for request 2 auth: Failed to validate the user. Login incorrect: [schlapp/<no User-Password attribute>] (from client M4DEMRCO0000015 port 60003 cli 00-0B-5D-84-AE-CA) Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.187.0.15:1645, id=176, length=164 Sending Access-Reject of id 176 to 10.187.0.15 port 1645 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... my users: ------------ schlapp Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 50 my eap.conf -------------- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } } my radiusd.conf ----------------- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } ldap { server = "10.187.64.3" identity = "CN=Robert Kastl,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de" password = Gerti1000 basedn = "DC=winlab,DC=rsnhm,DC=t-com,DC=de" filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } my ldap.attrmap ------------------- checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

Error
by Ross Hosman 07 Jun '06

07 Jun '06

Hello all, I'm new to using freeradius but I've gone trhough and have read what I can and have googled for my problem and yet i still have not been able to solve it. Whenever I try to start freeradius i get this error. rlm_preprocess: Error reading /etc/raddb/huntgroups radiusd.conf[971]: preprocess: Module instantiation failed. - Well i want to do with radius is have it authenticate against /etc/passwd and that is all. If anyone can point me to a config that simplifies it down to that I'd appreciate it.

2 1

Authentification link with PEAP + PAM + LDAP
by thomas hahusseau 07 Jun '06

07 Jun '06

Hello, Finally my boss is not interested in an PEAP authentication due to password and login stocked in clear in the OpenLDAP database, and he doesn't want to use the ntlm_auth to ask a Active Directory Server. So I wonder if that kind of authentication is possible. PEAP(MsCHAP) request --> Freeradius server (extract the hashed password ) --> Authentication request sent to PAM (login + Hashed password ) via rlm_auth ---> OpenLDAP Server ( compare hashed password received with the one stocked in database ) PAM is used as mediator to permit comparason with hashed stocked in OpenLDAP. My boss only wants cipher/hashed password and login.

3 2

Re: Freeradius-Users Digest, Vol 14, Issue 31
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

RE: peap authentication with active directory
by King, Michael 07 Jun '06

07 Jun '06

> -----Original Message----- > From: > On Behalf Of Kartthik Raghunathan > > A supplicant ie. win XP machine validates the identity and > logon credentials against active directory using > peap-mschapv2 randomly ie. every 30 mins or 60 mins. This > disturbs the wireless connectivity often and am unable to > complete this project due to this situation. In krb5.conf and > smb.conf i have left with default settings. here is my > radiusd.conf file, let me know someone faced this issue. is > there something am missing in my configuration. > It's not a FreeRADIUS problem. It's your access point. The access point determines when you should reauthenticated. (At least mine do) Also, my AP's allow me to stay connected while they are renegotioning. (My AP's have 4 states, Blocked, Connecting (Access is blocked), Connected, ReAuthenticated (Access is allowed)) I would consult your AP docs to figure out how to increase the Reauthetication time, but that is more a hack, they shouldn't be dropping your access while they reauthenticate. (Unless this is a change in behavior that everyone thinks is a good idea, my AP's are over 6 Years old, so it may not be standard practice now)

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 30
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

RE: Storing in SQL, Procedure call
by Jackie Lau 07 Jun '06

07 Jun '06

I tried both suggestions and still no luck. Any other suggestion on how to get a Stored Procedure to work with FreeRadius, unixODBC/FreeTDS and Microsoft SQL Server 2000? For some reason when trying to call a Stored Procedure rlm_sql module is trying to perform a query rather then the procedure call. Thanks! -----Original Message----- From: Marko Dinic [mailto:marko@yu.net] Sent: Tuesday, June 06, 2006 4:16 AM To: freeradius-users(a)lists.freeradius.org Cc: Jackie Lau Subject: Re: Storing in SQL, Procedure call Im using the same setup for access to some ancient Sybase and it works fine. However, the query doesn't use EXEC ... it's plain : accounting_stop_query = "sp_my_stored_procedure_name '%{SQL-User-Name}','%{Realm}', ...." I did have problems with freetds 0.62.3, tho, so I installed 0.63 and had no problems with Sybase access since then. On the other hand, Oracle setup (using rlm_sql_oracle) with "EXEC SP_NAME(...)" didn't work either, so I had to change it to "BEGIN SP_NAME(...); END;" Maybe that would work for your unixODBC/freetds setup too. -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. ----- > Hi, > > I'm using freeradius with freetds and unixodbc. I am having an issue > using a procedure call to insert to a Microsoft SQL Server. When I > try to use the procedure call 'exec', I see the following errors: > > radius_xlat: 'exec *** > rlm_sql (sql): Reserving sql socket id: 8 > query: exec *** > rlm_sql_unixodbc: '00000 ' > rlm_sql (sql): Couldn't update SQL accounting ALIVE record - 00000 > > But if I don't use a procedure call and use an insert command in its > place, it works just find. > > radius_xlat: 'INSERT **** > rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql > socket id: 3 > modcall[accounting]: module "sql" returns ok for request 6 > > My question is why can't I use a procedure call 'exec'? > > Thanks! > > > > >

3 2