- Freeradius-Users - lists.freeradius.org

Freeradius & Mysql initial install
by Atkins, Dwane P 17 Mar '06

17 Mar '06

All, I appreciate the help you have given me on this and I am pretty sure I am like one or two changes off the correct path. When I do the radtest, it always tells me that: [root@cleveland ~]# radtest atkinsd xxxxx lhost 1645 xxxx Sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Re-sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=168, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) I have checked and double checked the shared secret in Users, sql.conf, radiusd.conf. Any ideas? Thanks again

2 1

rlm_perl segfault
by Grant Zanetti 16 Mar '06

16 Mar '06

I've just tried to get the rlm_perl module working. I'm running debian 3.1 with perl 5.8.8. I've tried installing the prebuilt debian packages as well as from source with "dpkg-buildpackage -rfakeroot -uc -b" However after loading the module freeradius segfaults. Freeradius config: modules { perl ipalloc { module = /etc/freeradius/dynip.pl func_accounting = accounting func_post_auth = post_auth } } post-auth { ipalloc } When running freeradius I get traffic:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded perl perl: module = "/etc/freeradius/dynip.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Segmentation fault The file "/etc/freeradius/dynip.pl" exists and is readable but the segfault is the same whether it exists or not. This is the output from gdb Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1210271424 (LWP 866)] 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 (gdb) bt #0 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 #1 0xb7c13369 in Perl_hv_delayfree_ent () from /usr/lib/libperl.so.5.8 #2 0xb7c142cc in Perl_hv_fetch () from /usr/lib/libperl.so.5.8 #3 0xb7bbf7ba in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.8 #4 0xb7bbc14a in Perl_my_failure_exit () from /usr/lib/libperl.so.5.8 #5 0xb7bbe97d in perl_parse () from /usr/lib/libperl.so.5.8 #6 0xb7cbcd5d in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #7 0x0812e590 in ?? () #8 0xb7cbc130 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #9 0x00000003 in ?? () #10 0xbffa29b0 in ?? () #11 0x00000000 in ?? () #12 0x0812e590 in ?? () #13 0xb7cc0060 in rlm_perl () from /usr/lib/freeradius/rlm_perl-1.1.0.so #14 0xb7cc0350 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #15 0xb7b99618 in ?? () from /usr/lib/libperl.so.5.8 #16 0xb7cc0344 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #17 0x0811a9e8 in ?? () #18 0x08119c68 in ?? () #19 0x00000000 in ?? () #20 0x0812e4c8 in ?? () #21 0xb7cbf6a0 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #22 0x08050455 in log_debug () #23 0x08055332 in find_module_instance () #24 0x08056a4f in modcallable_free () #25 0x080559e4 in setup_modules () #26 0x0804cd80 in main () I have tried with perl 5.8.4 with the same result. Any help would be appreciated. I'm not sure how to get more debug out of freeradius with gdb.

6 12

problem with MD5 encrypted secret
by Guido 16 Mar '06

16 Mar '06

Another question about secret... How can I configure freeradius to work with MD5 secret ? The secret now, is coming MD5 encrypted and I see the following error: ---rad_recv: Accounting-Request packet from host 192.168.1.12:1813, id=0, length=772 ---Received Accounting-Request packet from 192.168.1.12 with invalid signature! (Shared secret is incorrect.) ---Server rejecting request 11. Regards, Guido

2 1

Vendor Specific IDs
by Eliot, Wireless and Server Administrator, Great Lakes Internet 16 Mar '06

16 Mar '06

Before I start, let me just ask if there are any already created attributes that control bandwidth rates in the Tx and Rx directions which take a string as a value? I found USR-Initial-Tx-Link-Data-Rate and USR-Initial-Rx-Link-Data-Rate, but they take enumerated values that will not allow me to set up generic service rate (like 256Kbps or 1Mbps). I found a couple of other attributes that specific just "Data-Rate", but I can't find any that do Rx and Tx data rates. So, barring the existence of already created attributes, I'd like to set up my own vendor specific attributes -- which leads me to my main question: How do I choose a number for the Vendor-Id? For instance, Bristol's vendor ID is: VENDOR Bristol 4363 Do we have to request these from somewhere? Or, can we just pick a free one? Our AS number from ARIN is free (11541); can I just use that? Also, I have a secondary question related to this. I am setting up some bandwidth limiting scripts on our router that will limit customers' bandwidth usage. The idea is to execute a script when they authenticate which receives the AVPs from the Access-Accept packet (which would include the above mentioned Rx and Tx data rates). The script would take those attributes and instate some tc and iptables rules to shape the customers' bandwidth. When the user logs off, or the AP notices the client is gone, the AP sends an Accounting-Stop record FreeRADIUS. FreeRADIUS would then execute a cleanup script which brings down the rules that the first script instated. So, my second question is: When FreeRADIUS calls that second script, can/does it send the original Access-Accept attributes to the cleanup script? Thanks for any and all help. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1

Passing value of attribute set in acct_users
by Ben Plimpton 16 Mar '06

16 Mar '06

Can someone please tell me how I can reference a value I set in the acct_users file so that I can use it in attr_rewrite? Or can I not do so? Thanks Ben

1 0

Question about processing multiple authorization sources
by Will Saxon 16 Mar '06

16 Mar '06

Hello, I am using FreeRADIUS 1.1.0 on FreeBSD 6.0 with Cisco Aironet 1200 WAPs. I need to be able to control which VLAN my users are assigned to, and it seems like this is accomplished by setting three RADIUS user attributes which control the assigned vlan after authentication. The problem is that my authorization/authentication source is an LDAP server, which I don't have any control over, that does not contain these attributes. Is it possible to have FreeRADIUS check a separate user database to provide the additional attributes? It seems like I could write a script to take the username, perform some database queries and return the appropriate information, but beyond that I don't know how to go about implementing such a solution. If it matters, I am currently using EAP-TTLS/PAP with SecureW2 and the aforementioned LDAP server. -Will -- Will Saxon Systems Programmer - Network Services University of Florida Department of Housing

2 2

RE: About Monthly Time Limits
by Ben Plimpton 16 Mar '06

16 Mar '06

Please let me know if you can tell what I'm doing wrong. I do authorization and authentication all from LDAP. Here's my line in ldap.attrmap: replyItem Ldap-UserDn dn Here's my counter config: counter monthly { filename = ${raddbdir}/db.monthly key = Ldap-UserDn count-attribute = Acct-Session-Time reset = monthly counter-name = Monthly-Session-Time check-name = Max-Monthly-Session allowed-servicetype = Framed-User cache-size = 5000 } But I get this in my radius logs when I logout: rlm_counter: Packet Unique ID = '549154f744531b54' rlm_counter: Could not find the key-attribute in the request. Returning NOOP. I hope I'm not missing something really simple. Thanks Ben On Tue, 2006-03-14 at 00:05 +0100, Seferovic Edvin wrote: > > -----Original Message----- > > From: freeradius-users-> > >bounces+edvin.seferovic=kolp.at(a)lists.freeradius.org > [mailto:freeradius->users-bounces+edvin.seferovic=kolp.at(a)lists.freeradius.o > rg] On Behalf Of >Ben Plimpton > >Sent: Montag, 13. März 2006 23:34 > >To: freeradius-users(a)lists.freeradius.org > >Subject: RE: About Monthly Time Limits > > > >This is a somewhat related question. > > > >Can I use an attribute that is not in the Stop record as the key for a > >monthly counter? For example, I would like to make the Ldap-UserDn > >attribute the key for the counter. Is there a way to make that value > >available to my counter? > > > >Thanks > > Sure.. if you use LDAP for Authentication and Authorisation ! there is > ldap.attrmap file which maps the LDAP attributes to freeradius attributes. > > The key is usually username ( or something else specific for a user or > machine ). > > I have such setup in a boarding home and it works like a charm ;) > > Regards, > > Edvin >

4 4

LDAP authorization for EAP-TLS authentication
by Keith Moores 16 Mar '06

16 Mar '06

I'm trying to understand the relationship between the modules in the authorize {} and authenticate {} sections and how it relates to the directives defined in users. EAP-TLS works fine, but I can't seem to figure how to get make the ldap authorization reject a user. DEFAULT Auth-Type := eap, Autz-Type := ldap authorize{ preprocess ldap eap } authenticate { eap } ldap { server = "our-server.itc.virginia.edu" identity = "uid=uva-all,ou=ITC-User,ou=It,o=University of Virginia,c=US" password = "our-password" basedn = "o=University of Virginia,c=US" filter = "(wirelessAccess=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=Person)" start_tls = no access_attr = "wirelessAccess" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = yes } In the ldap server logs show multiple queries, which are not returning anything. This can be confirmed with: ldapsearch -b "o=University of Virginia,c=US" wirelessAccess=kmm6b wirelessAccess which returns nothing. If nothing is returned shouldn't the authorization fail? I'm missing something, hopefully not too obvious... ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

2 1

freeradius
by mkerkoub＠free.fr 16 Mar '06

16 Mar '06

Hello, Here is my question: i would like to créate a proxy freeradius. I have 3 forests, 3 data base for storing users. I want to know how to configure: 1. proxy freeradius with IAS in each forest, how to give to freeradius server the certificat stored in active directory? 2. Is it possible to configure proxy freeradius to forward requests directly to Active Directory without IAS (3 Active directory). Thank you very much for you answer. Have a good day.

2 1

problem with secret
by Guido 16 Mar '06

16 Mar '06

Hi list, I'm using Freeradius 1.0.2 and receiving request from Squire SVI Softswitch as NAS. The problem is that Squire softswitch is not sending to freeradius the shared secret in request accounting. So, I need accept accounting request from a NAS that does not send secret. I know that secret is mandatory in clients.conf, but I need solve this... Who can help me ? Thanks in advance, Guido

2 1