- Freeradius-Users - lists.freeradius.org

Re: Multiple accounting hosts for one realm?
by Johan Ramm-Ericson 22 Dec '05

22 Dec '05

On Wed, 2005-12-21 at 22:07 +0100, > Nicolas Baradakis wrote: > Johan Ramm-Ericson wrote: > > > While configuring freeradius 1.0.5 on Solaris 9 I began to look at > > setting up different accounting hosts for users depending on which realm > > users orginated from. That worked fine. However; I have now come across > > a situation where it might be valuable to send the same accounting > > information to multiple accounting hosts. > > > > I am hoping to do this by changing the accthost variable in > > etc/raddb/proxy.conf. Does anyone on the list know if (a) this is > > possible, and if it is possible (b) how to do it - i.e can I add further > > hosts in a list to the existing variable or do I need to use some other > > method? > > You might look at radrelay, it comes with FreeRADIUS. > http://freeradius.org/radiusd/doc/radrelay > > -- > Nicolas Baradakis Ooopps, sorry about that. I thought I'd gone through the documentation, but obviously my search was not thorough enough... Thanks! /Johan

1 0

segmentation fault on solaris,unable to call modules
by Qin Zhen 22 Dec '05

22 Dec '05

Hi All, installing freeradius on Solaris is already a big headache, afterwards i encountered Segmentation fault as well. i am using Freeradius-1.0.5 seems the problem is that it is not able to call any of the modules in radiusd.conf, if i commend up all the modules under 'Authorize' (files, preprocess, ldap, prefix, etc. ) in radiuad.conf, there won't be segmentation faults. and this configuration is able to work for freeradius-0.8 on solaris or freeradius-1.0.5 on debian. pls advise. thanks in advance. below is what the debug mode shows: >> ******************************************************* >> >> Wed Dec 14 10:15:31 2005 : Info: Starting - reading configuration files >> ... >> >> Wed Dec 14 10:15:31 2005 : Debug: reread_config: reading radiusd.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/proxy.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/clients.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/snmp.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/sql.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: main: prefix = "/usr/local/radius5" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: localstatedir = >> "/usr/local/radius5/var" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: logdir = "/usr/local/radius5/log" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: libdir = "/usr/local/radius5/lib" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: radacctdir = >> "/usr/local/radius5/radacct" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: hostname_lookups = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: max_request_time = 40 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: cleanup_delay = 5 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: max_requests = 5120 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: delete_blocked_requests = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: port = 1645 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: allow_core_dumps = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_stripped_names = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_file = >> "/usr/local/radius5/log/radius.log" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth_badpass = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth_goodpass = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: pidfile = >> "/usr/local/radius5/var/run/radiusd.pid" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: user = "radius" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: group = "radius" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: usercollide = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: lower_user = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: lower_pass = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: nospace_user = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: nospace_pass = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: checkrad = >> "/usr/local/radius5/sbin/checkrad" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: proxy_requests = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: retry_delay = 5 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: retry_count = 3 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: synchronous = no >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: default_fallback = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: dead_time = 120 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: post_proxy_authorize = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: wake_all_if_all_dead = no >> >> Wed Dec 14 10:15:31 2005 : Debug: security: max_attributes = 200 >> >> Wed Dec 14 10:15:31 2005 : Debug: security: reject_delay = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: security: status_server = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: debug_level = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading dictionary >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading naslist >> >> Wed Dec 14 10:15:31 2005 : Info: Using deprecated naslist file. Support >> for this will go away soon. >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading clients >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading realms >> >> Wed Dec 14 10:15:31 2005 : Debug: radiusd: entering modules setup >> >> Wed Dec 14 10:15:31 2005 : Debug: Module: Library search path is >> /usr/local/radius5/lib >> >> Segmentation Fault >> >> - List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

4 9

RADIUS process looping...
by Stefan Adams 22 Dec '05

22 Dec '05

I am sure that this is not related to FreeRADIUS but I have seen the topic posted here so I wanted to post my research for those that search these archives. It appears to be a common problem of having a Windows Client (specifically with the wZc utility) which gets stuck in a loop of constantly verifying authorization and obtaining an IP. I, personally, can see from my radiusd -A -X output that the entire auth/autz process succeeds -- on EVERY pass of the loop. AFTER applying the MS Hotfix KB885453, I still have my clients periodically stuck in a loop (as according to the RADIUS server showing the same debug info over and over). I have found that it appears to be due to my access point (D-Link DWL-3200AP) REBOOTING! Here is what I told my D-Link rep: "These steps help to illustrate the problem: logged into the windows domain. configured the wireless interface for WPA using automatically provided windows credentials successfully and immediately logged on to the wireless WPA network logged out logged back into the windows domain and it successfuly and immediately connected to the WPA network rebooted logged into domain, it took 3 (THREE) minutes to login (using cached credentials) -- This entire time NO connections were made to the RADIUS server after finally logging in I notice that about 40 pings to the AP were dropped before it came back to life and suddenly 260 buffered RADIUS requests were sent to the RADIUS server After the 260th, the windows computer successfully connected to the wpa wireless network It is important to note that DURING a windows domain logon (and simultaneously a connection to the WPA wireless network) the AP REBOOTED." Is my hypothesis correct -- that it is the AP? Do I have enough information to make that determination? To anyone that would like to help me troubleshoot the issue, let me know if I can provide more information or logs or debug output or whatever... BTW, I also have syslog logs (DWL-3200AP can log to a syslogger...) proving that the AP REBOOTED and not just some of my pings were dropped. Stefan Here is my configuration: D-Link DWL-3200AP FW2.10, WPA-Enterprise w/AES, multi-SSID support, VLAN support FreeRADIUS 1.1.0-pre0 (snapshot-20051220) Windows XP SP2, 802.1x, EAP-PEAP, MS-CHAPv2 radiusd.conf: proxy_requests = no $INCLUDE ${confdir}/proxy.conf modules { unix { radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "<snip>" identity = "<snip>" password = <snip> basedn = "<snip>" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" tls { ... } access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 auto_header = no access_attr_used_for_allow = yes } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = <snip> private_key_file = /etc/1x/server.pem certificate_file = /etc/1x/server.pem CA_file = /etc/1x/root.pem dh_file = /etc/1x/DH random_file = /etc/1x/random include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes } mschapv2 { } } realm ntdomain { format = prefix delimiter = "\\" } preprocess { : with_ntdomain_hack = no : } } authorize { preprocess ntdomain eap ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } clients.conf: client 172.16.16.0/24 { secret = testing123 shortname = ap } client 172.16.254.0/24 { secret = testing123 shortname = server } proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } [ If SSID Authorization is desired: modules { ldap { filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusCalledStationId=%{Called-Station-ID}))" } attr_rewrite getssid { attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet # Strip the MAC Address out of the Called-Station-ID # Resulting in just the SSID searchfor = ".................:" replacewith = "" ignore_case = yes new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended to th # append = no } } authorize { : eap getssid ldap : } ] Windows XP: Apply this Pre-SP3 Hotfix: http://support.microsoft.com/?kbid=885453 Windows Network Connection Properties: Preferred networks, [SSID] Properties: Association: Network Auth: WPA Data Enc: AES Authentication: EAP Type: PEAP Properties: X Validate Server certificate [You must install the Root CA certificate into the trsuted root ca list and choose it here.] EAP-MS-CHAP v2 Configure: X Automatically use my Windows logon name and Password (IF PC IS JOINED TO DOMAIN) [ ] Automatically use my Windows logon name and Password (IF NOT JOINED) X Enable Fast Reconnect

1 0

Re: Problem with CHAP, users file and radclient
by Andreas Engler 22 Dec '05

22 Dec '05

Hello Alan, >Andreas Engler <freeradius(a)arcor.de> wrote: > > >>> One question remains. Is it possible to resend an auth-detail file with >>> Access-Requests that once where successfully authenticated via radclient >>> and authenticate them successfully again, even if there are >>> Chap-Password and Chap-Challenge attributes in the auth-detail file and >>> so the Auth-Type will be CHAP? >> >> > > I have *no* idea what that means. > > Alan DeKok. > Ok, sorry. I try it with other words and hope the problem becomes clear. I try to test a fresh freeradius 1.0.5 installation. I use radclient to send Access-Request packets, which are stored in a file. These Access-Request packets were loged with an other freeradius server in production environment. These Access-Request packets contain Chap related attributes, so the Auth-Type will be CHAP. When i resend such Access-Request packet via radclient, it will not authenticate successfully again. Where is the problem in that test setup? Thank you Andreas Engler

2 1

Use Client-IP-Address in Hungroups?
by Dennis Skinner 21 Dec '05

21 Dec '05

Hello, First, before I forget again, this link: http://www.freeradius.org/radiusd/doc/ (linked from: http://www.freeradius.org/usage.html) is "Forbidden" and has been for some time. I keep forgetting to mention it when I see it since I just grab the tarball and get the info I need. Anyway, to my question... I read through the docs and man pages regarding huntgroups. All of the examples use items like this: alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 Is it possible to do this? network1 Client-IP-Address == 192.168.2.5 network1 Client-IP-Address == 192.168.2.6 network2 Client-IP-Address == 192.168.6.45 network2 Client-IP-Address == 192.168.6.46 If I understand the way huntgroups work, then I think I can add: user Huntgroup := network1 to my radcheck table and restrict user to modems from a particular modem provider (who is proxying radius to us). They add and remove NAS's quite oftem, so using NAS-IP-Address would be painful. Hopefully I am understanding it correctly since it would be somewhat easier than our current method (using a passwd module and regex matching). If anyone has tried it and it definitely won't work with Client-IP-Address, then it will save me several hours testing and running back and forth from the dialup machine. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

rlm_ldap filter problem
by Norbert Wegener 21 Dec '05

21 Dec '05

When I set my vars to the values below, ldapsearch succeeds: server="TDE002.mydomain.NET"^M identity="testrad(a)TDE002.mydomain.NET"^M password="!QAY2wsx3edc4"^M basedn="dc=TDE002,dc=mydomain,dc=NET"^M filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID "^M ^M #ldapsearch -LLL -b "DC=TDE002,dc=mydomain,dc=NET" -s sub $FILTER -x $LOGON ^M ldapsearch -LLL -h $server -b "$basedn" -s sub $filter -x -D $identity -w $password ^M lnxad:/usr/local/etc/raddb # sh x^M dn: CN=26TEF001,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=mydomain,DC=net^M primaryGroupID: 515^M servicePrincipalName: HOST/26TEF001^M servicePrincipalName: HOST/26tef001.tde002.mydomain.net^M ^M # refldap://DomainDnsZones.tde002.mydomain.net/DC=DomainDnsZones,DC=tde002,DC… itest,DC=net^M Having the same variables with the same values set on the same machine in radiusd.conf: ldap ldap1 { server = "tde002.mydomain.net" identity = "testrad(a)TDE002.SITEST.NET" password = "!QAY2wsx3edc4" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" ldap_debug=0xFFFF base_filter = "(objectclass=computer)" ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } radiusd fails to get the values from the ldap server, claiming "Bad search filter": ..... rlm_ldap: performing user authorization for host/26tef001.tde002.mydomain.net radius_xlat: '(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID' radius_xlat: 'dc=TDE002,dc=MYDOMAIN,dc=NET' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=TDE002,dc=MYDOMAIN,dc=NET, with filter (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_search put_filter: "(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" put_filter: AND put_filter_list "(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: "(servicePrincipalName=host/26tef001.tde002.mydomain.net)" put_filter: simple put_simple_filter: "servicePrincipalName=host/26tef001.tde002.mydomain.net" put_filter: "(objectclass=computer)" put_filter: simple put_simple_filter: "objectclass=computer" put_filter: "(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: NOT put_filter_list "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: simple put_simple_filter: "userAccountControl:1.2.840.113556.1.4.803:=2" put_filter: default put_simple_filter: "servicePrincipalName primaryGroupID" rlm_ldap: ldap_search() failed: Bad search filter: (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_msgfree rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns fail for request 2 modcall: leaving group authorize (returns fail) for request 2 There was no response configured: rejecting request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 206 with timestamp 43942d52 Sending Access-Reject of id 207 to 222.25.36.124 port 1645 What did I forget to obey? Thanks Norbert Wegener

2 2

rlm_ldap behavior: authorize v.s. authenticate
by Brian A. Seklecki 21 Dec '05

21 Dec '05

>From reading debug logs, am I correct in concluding that rlm_ldap's behavior: - when processing authorize{ } is to bind to the LDAP as the provided administrative DN and search for the DN of the user in the Access-Request packet - when processing authenticate{ } is to, if successful during authorize, then re-bind to the LDAP using the provided username and password and return Access-Accept only if the bind-as-the-user succeeds? Correct, as the default behavior? ~BAS

3 4

RE: rlm_sqlcounter and something else than Session-Timeout
by Jonathan De Graeve 21 Dec '05

21 Dec '05

> So if they're under the limit at the start of the session, they can > go over during the session, and no one will notice. This has NOTHING > to do with changing the limits during a session. The problem I think most people (and also me) now have appears when you have max-octet limits. If a user exceeded his monthly usage, he can't login anymore until the next month starts. But if he didn't so the remainder is returned as Session-Timeout. The problem with this is that all nasses take this value as 'seconds' instead as octets which will logout a user. Lets say if he got 4GB as remainder, the system will logout the user in 4s (which isn't the behaviour we want offcourse) That's the reason (IMHO) most people want the possibility to set the reply attribute. J.

2 1

Re: Problem with CHAP, users file and radclient
by Andreas Engler 21 Dec '05

21 Dec '05

> Andreas Engler <freeradius(a)arcor.de> wrote: > >>> rlm_chap: login attempt by "hubba" with CHAP password >>> rlm_chap: Using clear text password bubba for user hubba >>> authentication. >>> rlm_chap: Pasword check failed >> >> > > > The password entered in the client does not match the password you > configured on the server. Nothing else will cause this error. > > Alan DeKok. > > thank you for response. One question remains. Is it possible to resend an auth-detail file with Access-Requests that once where successfully authenticated via radclient and authenticate them successfully again, even if there are Chap-Password and Chap-Challenge attributes in the auth-detail file and so the Auth-Type will be CHAP? I expected that would work, but it seems not to function. Is that an CHAP related issue? Andreas Engler

2 1

rlm_sqlcounter and something else than Session-Timeout
by Damjan 21 Dec '05

21 Dec '05

Currently rlm_sqlcounter sums all the session time used by a user, via a MySQL query (summing all the AcctSessionTime) and returns a coresponding Session-Timeout reply to the nas. Now, in my application, I limit users by bytes transfered, so I need to sum AcctInputOctets and AcctOutputOctets, compare that sum to a check attribute (let's call it Max-All-Transfer) and return a coresponding ChilliSpot-Max-Total-Octets. I beleive this is not configurable in rlm_sqlcounter? I could try to make a patch if someone is willing to help me and guide me a bit. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

6 9