- Freeradius-Users - lists.freeradius.org

Computer Logon with PEAP-MSCHAPv2
by Sebastian Mauer 13 Nov '05

13 Nov '05

Hello there, after setting up our new central Radius Server I now want to finally set up PEAP-MSCHAPv2 with support for Computer acces, that my users can log in to the Samba administered Domain from Wireless Terminals (like their Laptops). I found a lot of helpful HowTos and Documentations but never managed to get Information about Computer Logons with PEAP. I understand that PEAP only uses certificates to identify the Radius Server, but uses Username/Password for connecting Users to the Wireless Network. Can someone point me to a resource or tell me how to do this all for Machines that they can authenticate when no user has logged in, to manage connection to the Domain when it comes to specific User login. Greetings, Sebastian Mauer

2 3

RE: sqlcounter and session-timeout
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> > > I am trying to use sqlcounter to count octets and am having the same > problem. It seems that sqlcounter module was designed to handle the > amount of time a user is allowed online and as such is hardcoded to > return the Session-Timeout value according to the sql query. > > >how can i override the value of session-timeout, lets say for 10 minutes > (i dont > >care if a user can stay connected until 0:10) ?? > > > I put a seperate entry in the radcheckgroup table with the > session-timeout value but freeradius seems to always return the lower of > the two values... again presumably to limit online usage. > > Anyway let me know if you find a way... I am going to see if I can make > sense of "rlm_sqlcounter.c" with my limited c knowledge :-) > I have the same problem and this by configured my nas to discard the session timeout. It would be nice if you could have a config parameter if the system should return session-timeout for the specific sqlcounter or return it as another 'defined by admin' radius attribute (for octets in the case of Nomadix lets say: Nomadix-MaxBytesDown/Nomadix-MaxBytesUp) J.

2 1

sqlcounter and session-timeout
by Markus Krause 12 Nov '05

12 Nov '05

hi all, i have set up freeradius v1.0.5 with experimental modules on a sles 9 system. i am storing the user information in a mysql db, which works. then i wanted to set configure some "short term accounts" which are only valid for some days, to be more exact: after the first usage of a username the account should be valid until midnight (the same, following, .. days). testing with ntradping worked. to achieve this i use the following in radiusd.conf, sqlcounter.conf and dictionary: +++++ radiusd.conf authorize { preprocess eap files sql shorttermaccount } authenticate { eap } accounting { detail unix radutmp sql } ----- (radiusd.conf) +++++ sqlcounter.conf sqlcounter shorttermaccount { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never query = "SELECT TO_DAYS( NOW() ) - TO_DAYS( AcctStartTime ) FROM radacct WHERE UserName = '%{%k}' LIMIT 1;" } ----- (sqlcounter.conf) +++++ dictionary ATTRIBUTE Max-Days-Passed 3000 integer ----- (dictionary) in the mysql db i have: +++++ mysql output mysql> select * from radcheck; +----+----------+-----------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+----------+ | 6 | guest2 | Password | := | secret99 | | 7 | guest2 | Max-Days-Passed | := | 1 | +----+----------+-----------------+----+----------+ ----- (mysql output) testing with ntradping shows access-accept (unil midnight after first accounting). but when using an ironpoint 200 ap i run into the following problem: the reply message contains "Session-Timeout := 1" which is (as it seems) sent by sqlcounter, which means the client (a windows xp sp2 with intel pro 2200bg) reconnects every second!! i already tried to enter the user "guest2" in mysql in the table "radreply": ++++ mysql output: mysql> select * from radreply; +----+----------+-----------------+----+-------+------+ | id | UserName | Attribute | op | Value | prio | +----+----------+-----------------+----+-------+------+ | 1 | guest2 | Session-Timeout | := | 600 | 1 | +----+----------+-----------------+----+-------+------+ 1 row in set (0.00 sec) ----- (mysql output) but this only affects user which have no attribute "Max-Days-Passed"... how can i override the value of session-timeout, lets say for 10 minutes (i dont care if a user can stay connected until 0:10) ?? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

rlm_radutmp: No NAS-Port seen
by Markus Krause 12 Nov '05

12 Nov '05

hi all! when running freeradius in debug mode i am finding the following message: +++++ [snipp] rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [snipp] radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'anonymous' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ----- is this really jsut a warning or does it mean the accounting (done for short term accounts using mysql) will not work? (as reported in another mail i only got accounting entries for user "anonymous" which comes from eap-ttls) thanks in advance for your help! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

assigning a vlan-id after successful authentication
by Sven Juergensen 12 Nov '05

12 Nov '05

hello people, how does the above mentioned work? i am not quite sure where to start. is it embedded in the 'Reply-Message' or does it have to do with the tunnel-types? i'm trying to supply a vlan-id to an hp2626 with mac-based authentication. couldn't find this in the faq or relevant conf-files either - what am i missing? thanks alot in advance, sven

2 1

RE: possible bug in rlm_preprocess parsing of huntgroups?
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> This time it DID match on the proper huntgroup. Radiusd debugging > confirms this, but for the sake of brevity I omitted it here. This > email is already long enough. Is this a bug or am I clearly doing > something wrong? This behavior is not seen in freeradius-0.9.3. It > seems to surface after 1.x. Prior to 1.x users file huntgroup matching > happens perfectly regardless of order and quantity of huntgroups. > > Any ideas? Thanks in advance! > There's nothing wrong with Freeradius. The code is: first matched, first served. The order in which you setup huntgroups is important, that's all. So you always need to specify the exceptions first and later on the default stuff J.

1 0

Ascend-Data-Filters
by Eric Gregory 12 Nov '05

12 Nov '05

I am having an issue that hopefully someone can help with. I am trying to configure my radius server to send liethe following reps Ascend-Data-Filterwhen a user authenticates. Ascend-Data-Filter = ip in forward tcp est Ascend-Data-Filter = ip in forward dstip xxx.xxx.xxx.4/32 Ascend-Data-Filter = ip in drop tcp dstport = 25 Ascend-Data-Filter = ip in forward This is for configuration with GlobalPops and I need my users to be able to relay mail through my SMTP server for this to work. I am using FreeRadius 1.0.4 with the Mysql backend. When I run radcheck I get this info in the reply Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Netmask = 255.255.255.255 Session-Timeout = 43200 Idle-Timeout = 1500 Port-Limit = 1 Framed-MTU = 1300 Ascend-Data-Filter = "ip in forward tcp est" If I wipe out the "ip in forward tcp est" line I get the "ip in forward dstip xxx.xxx.xxx.4/32" line in the reply, if I wipe that out the next comes back but I can't get more than one to come back at me. I have tried applying the filters to the user and to the group which the user is a part of and gotten the same result. Anyone know what my problem is here. Is there a setting that I have to set to allow it to send multiple instances of the same reply attribute back? Thanks for any help you can offer. Eric Gregory

3 2

possible bug in rlm_preprocess parsing of huntgroups?
by Christopher Carver 12 Nov '05

12 Nov '05

The scenario is complicated. I will try to keep this as short and simple as possible. We are experiencing odd and different behavior when we modify just the order of the huntgroups being built in raddb/huntgroups. Nothing else is changed, just the ordering. FreeBSD 5.3-RELEASE w/ Freeradius-1.0.5. We authenticate dialup users. In our users file we want to pass back to the NAS a specific ip pool if the customer's Calling-Station-Id is a certain set of area codes and exchanges. However, we want to have exceptions to this. So, we have a huntgroup called "migration" for the set of Calling-Station-Id area codes and exchanges and an "exceptions" huntgroup that has the Calling-Station-Id values of people who will not get the ip pool even though they are part of the set defined under "migration". raddb/huntgroups (note the ordering, migration THEN exceptions): migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" raddb/users (note the use of fall-through to keep exceptions matches from getting the ip pool): DEFAULT Autz-Type := NoTollfree, Simultaneous-Use := 1, Session-Type := dialup Port-Limit = 1, Idle-Timeout = 1800, Framed-Protocol = PPP, Service-Type = Framed-User, Fall-Through = yes DEFAULT Huntgroup-Name == exceptions Fall-Through = no DEFAULT Huntgroup-Name == migration cisco-avpair = "ip:addr-pool=migration", Now we test with an authentication request packet in a file and radclient. Here is the contents of the file and output when testing with radclient: # auth request packet User-Name = test Password = test Calling-Station-Id = 3047291185 # radiusd reply packet Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Cisco-AVPair = "ip:addr-pool=migration" Port-Limit = 2 It obviously didn't match the exceptions huntgroup in the huntgroups file because 3047291185 is clearly a member of that huntgroup. radiusd -x verifies it did not. Now watch what happens when we do nothing but reverse the order of the huntgroups and restart radiusd. The users file and authentication request packet will both remain exactly the same. Here's the new raddb/huntgroups file: exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" Now the new output after testing with radclient (keeping the auth packet and users file exactly the same): Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Port-Limit = 2 This time it DID match on the proper huntgroup. Radiusd debugging confirms this, but for the sake of brevity I omitted it here. This email is already long enough. Is this a bug or am I clearly doing something wrong? This behavior is not seen in freeradius-0.9.3. It seems to surface after 1.x. Prior to 1.x users file huntgroup matching happens perfectly regardless of order and quantity of huntgroups. Any ideas? Thanks in advance! Chris Carver

1 0

Announce: ARA v.0.3 released.
by Dawid Ciężarkiewicz 11 Nov '05

11 Nov '05

ARA is OpenSource web application written in PHP. It's goal is to create simple but convenient solution for managing the FreeRADIUS server. It resides on web server and connects to FreeRADIUS' database to allow easy and efficient manipulation of users, groups, network access servers and more. Currently only MySQL backend is finished, but adding other should be easy. While being a PHP application ARA uses the Sigma templating engine, and it's code tries to be friendly and "developer inviting". Be sure to check out the 0.3 release screenshots: http://projects.asn.pl/ara/wiki/screenshots And grab ARA here: http://download.asn.pl/ara/ara-0.3.tar.gz md5: aaf0301668a82bc1e9dcfa026e2fe100 More on http://projects.asn.pl/ara/ . Waiting for your comments! -- Dawid Ciężarkiewicz

1 0

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks anyway!. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Fri 11/11/2005 4:18 PM To: FreeRadius users mailing list Subject: Re: freeradius wont let realms based auth "Andres Pazos" <andy(a)ferengi.com.ar> wrote: > My problem is that after reading the "users" file and getting a Match, > when Radius enters the authorize seccion it never read the subsection > "autz-Type SQL2 { sql2 }". what's wrong with that?. thanks alan! I think the problem is that your story keeps changing. I don't think I can help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0