- Freeradius-Users - lists.freeradius.org

authenticate against bytes in and out with sqlcounter
by Martin Potgieter 09 Nov '05

09 Nov '05

hello, I am using freeradius 1.0.5 and trying to get to a point where I can deny access to a user when he has "used" more than a specific amount of bandwidth in a month (from the 1st to the last day of the month). rlm_sqlcounter seems to be what I need. I have configured it as I think it should be but when I go into debug mode the values seem to get changed at a point. Here is my sqlcounter.conf file: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ sqlcounter monthlycounter { counter-name = Max-Bytes check-name = Max-Bytes sqlmod-inst = sql key = User-Name reset = monthly Reply-Message = "You have reached your bandwidth cap for this Month" query = "SELECT sum(AcctOutputOctets) + sum(AcctInputOctets) FROM radacct where UserName = '%{%k}'" } +++++++++++++++++++++++++++++++++++++++++++++++++++++++ In my radiusd.conf my authorize section is as follows: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ authorize { preprocess chap mschap suffix sql monthlycounter } +++++++++++++++++++++++++++++++++++++++++++++++++++++++ When I am in debug mode I get the following: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Nov 10 00:17:41 2005 : Debug: rlm_sql_mysql: query: SELECT sum(AcctOutputOctets) + sum(AcctInputOctets) FROM radacct where UserName = 'surfing@home' Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): - sql_xlat finished Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Nov 10 00:17:41 2005 : Debug: radius_xlat: '9628587663' Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: (Check item - counter) is greater than zero Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: Authorized user surfing@home, check_item=-1073741824, counter=2147483647 Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: Sent Reply-Item for user surfing@home, Type=Session-Timeout, value=1 Thu Nov 10 00:17:41 2005 : Debug: modsingle[authorize]: returned from monthlycounter (rlm_sqlcounter) for request 2 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ Why the altered negative number in the check_item? Is the radius_xlat doing something? Do I need to put in Max-Bytes in one of the dictionary files? The example in experimental.conf did not mention anything about adding attributes so I assumed not. Also the "counter=2147483647" is not the value I have in the database for that user... I am missing something here :-) Thanks for any help Martin

1 0

simultaneous use, checkrad, and MPP attempts
by Christopher Carver 09 Nov '05

09 Nov '05

Hello, Thanks everyone for the great product that I've relying on for the past several years. I am now seeing a problem I hope someone can help with. I'm using Freeradius-0.9.3 on FreeBSD 5.2.1-REALEASE. We have Freeradius doing strictly dialup authentication. Some of the NAS's querying the radius server are our equipment. Some of the NAS's are equipment we lease from another company and have no access to. We have been successfully using simultaneous checking while using all of our own equipment. However, since leasing equipment we have been getting the following entries in radius.log: Tue Nov 8 23:26:09 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user1] (from client pa-230-radius0 port 2287 cli async) Tue Nov 8 23:27:17 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user2] (from client pa-230-radius0 port 2703 cli async) Tue Nov 8 23:32:38 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user3] (from client pa-230-radius0 port 3699 cli async) The proxy'ing radius servers and NAS's of the other company from whom we lease equipment are unavailable to checkrad. By default shouldn't it be allowing these people on? I looked at the code and it seemed as though it should. I set the nastype to other in clients.conf for these entries and I still see MPP attempts. Finally, I looked at the source of checkrad. I modified the line for "other" nastypes to always return 0, which should be interpreted as no multiple login. The numbers you see to the left are line numbers: 1351 } elsif ($ARGV[0] eq 'other') { 1352 $ret = 0; 1353 } else { Any idea why this isn't behaving how I expect? Is there a more appropriate way I can ensure that users connecting via NAS's and proxy'ing radius servers we lease will never be rejected because of multiple logins? And what is the difference between MPP attempt and regular multiple login? Thank you very much for your time. Chris Carver

3 2

Problem with loading files from free radius
by Eyas Sarabi 09 Nov '05

09 Nov '05

Hi All; I faced a major problem, My Hard disk was corrupted and the free radius wasn't being able to write to database, I still have the files generated by free radius and I want to load them to the database .Is there any tool that can load the generated files to oracle database ? Regards, Eyas

2 1

Proxying a PEAP request to an IAS server
by Dan Newcombe 09 Nov '05

09 Nov '05

Hi all. I've done my best to try and figure this out myself, but am really stuck. First the basics: An enterasys C2 switch setup to do 802.1x authentication. This switch points to my freeradius server. Attached to the swich is my XP notebook, which is setup to do 802.1x via PEAP. On the back end is a Win2k3 server which is running IAS. The idea is to have all the network switches send the authentication requests to the freeradius server, which will then decide if it needs to go to the windows box (for staff) or a different box (for students). Also, the Win2k3 IAS server has a limit of 50 clients unless you scale up to the advanced server, which I find just sad that they have done this. Anyway, I have tested from the freeradius box to the IAS box using radtest, and everything is working, so I am being seen as a client. The problem is when I try and have the notebook authenticate. I see rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. in the debug output, which I gather is normal, but somehow part of the problem. Basically, the IAS server seems to ignore whatever is coming across from the freeradius box. My (uneducated) guess is that this is because it has the EAP parms in it, but is not eap??? However, a normal "clear-text" attempt via radtest works fine. I have found this post by Alan DeKok - http://thread.gmane.org/gmane.comp.dial-up.freeradius.user/26170 which sounds very similar to what I am doing First, configure the server to terminate the tunnel, and authenticate the inner session locally. Once that works, configure the server to proxy the inner session only. I guess where I am really lost is how to follow the above suggestion. This is what it is sending to the IAS box, which is being ignored. Sending Access-Request of id 1 to 172.25.8.114:1812 User-Name = "CCSU\\dan" Called-Station-Id = "00-11-88-12-6e-70" Calling-Station-Id = "00-0f-1f-43-c8-38" NAS-Identifier = "00-11-88-12-6e-5d" NAS-IP-Address = 172.25.7.11 NAS-Port = 19 Framed-MTU = 1500 NAS-Port-Type = Ethernet EAP-Message = 0x0202001201434353555c646e6577636f6d63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3432 Thanks for any help...I'm really stuck on this part! -Dan

3 6

Re: JRadius
by Raoul Demour 09 Nov '05

09 Nov '05

Hello thanks for all the answers! > Regarding EAP-SIM, JRadius has no specific support > for it. What is it > you are trying to do? What I have understood: FreeRADIUS is able to authenticate using EAP-SIM. But you need to set the attributes: EAP-SIM-Rand1 EAP-SIM-SRES1 EAP-SIM-KC1 EAP-SIM-Rand2 EAP-SIM-SRES2 EAP-SIM-KC2 EAP-SIM-Rand3 EAP-SIM-SRES3 EAP-SIM-KC3 (do you really need to set all the 9 attributes? or just one rand, one SRES and one Kc is enough?) I dont have access to GSM network and I dont know Ki (share secret). But to check if the system is correctly set up, I would like to give manually the attributes (on the serveur). (In a way I cheat...). Or to reproduce the generation of Rand, SRES and Kc (using my own algorithm) and on the supplicant I simulate SIM card... With JRadius it is possible to create object like Attr_UserPassword (according to the given example of JRadius). After what, it is used to set the attribut UserPassord for FreeRADIUS. So I think it would not be too complicate to create new attribute like: Attr_EAP_SIM_Rand, Attr_EAP-SIM-SRES, Attr_EAP-SIM-KC. In a way, I would like to use JRadius to avoid writing a module which will set the nine above attributes. My explanation may be not realy clear because I still learning how the thing work (for exemple, I suppose that the algorith to generate Rand, SRES and Kc is mobil operator specific, but I'm not complitly sure of the fact) Raoul __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

1 0

Failed attempts log
by Thierry Hoferlin 09 Nov '05

09 Nov '05

Hi, I've configured a freeradius 1.0.5 with MSSQL authentification. It works fine. Is there a way to log failed authentification records to SQL ? For the moment i've just the accounting information logged to SQL. Thanks in advance Thierry H.

3 2

RE: Cisco AP Vlan assignment when proxying EAP-PEAP?
by Guy Davies 09 Nov '05

09 Nov '05

You could do this on IOS based APs by creating multiple SSIDs. You can have a secured SSID that connects to your protected VLAN. Then, you could have an appropriately named SSID (NEWUSERSSTARTHERE ? :-) that is unencrypted and unauthenticated. It is associated with a walled garden VLAN with some kind of web capture device so that when the user connects and opens their browser, they're redirected to your webpage with instructions on how to download the client and configure it. They then get reassociated to the secured SSID. Other vendors do this more elegantly by providing the ability to specify a "last-resort" VLAN to which users are dumped if they fail authentication via EAP. The main difficulty is that an SSID that supports EAP is encrypted whereas you need an unencrypted SSID for a last-resort type user. So you generally end up with different SSIDs anyway. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Josh Howlett Sent: 09 November 2005 14:39 To: FreeRadius users mailing list Subject: Re: Cisco AP Vlan assignment when proxying EAP-PEAP? Hi Jezz, > Do you have any cunning solutions to how you might get around the > reject issue? > I'd imagine it's quite a common scenario, IE wanting to let users know > that they are doing something wrong as opposed to just rejecting them. Not really. FWIW, I think that a module that caught proxied packets (such as Access-Rejects) and converted them into other packet-types (such as Access-Accepts) would be very useful. best regards, josh. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Cisco AP Vlan assignment when proxying EAP-PEAP?
by Palmer J.D.F. 09 Nov '05

09 Nov '05

Cheers Josh. :) That's pretty much the way we do the Roanmode stuff. Just wasn't sure being EAP whether you could mess around with the return packet. Do you have any cunning solutions to how you might get around the reject issue? I'd imagine it's quite a common scenario, IE wanting to let users know that they are doing something wrong as opposed to just rejecting them. This must be one of the only redeeming features of web redirect. :-D Thanks, Jezz. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Josh Howlett Sent: 08 November 2005 16:30 To: FreeRadius users mailing list Subject: Re: Cisco AP Vlan assignment when proxying EAP-PEAP? Hi Jezz, Palmer J.D.F. wrote: > Hi, > > Can anyone tell me if it's possible to proxy EAP-PEAP from a Cisco Aironet > to an IAS server via FreeRADIUS (I can do this bit), then, set the user's > VLAN information within FreeRADIUS in the access-accept packet returned to > the AP? Yes - write a script that outputs the relevant attributes to stdout, and specify it in an "exec" clause in radiusd.conf, making sure you set packet_type = access-accept. Invoke the exec clause by placing it in post-proxy section. For example (assuming you've got the proxying working): assign-vlan.sh: #!/bin/bash VLAN = "123" # We can also grab the RADIUS username attribute from the environment. # USER = $USER_NAME # This might be useful if you wanted to drop users # into different VLANs. # if ( $USER == "bujfxh(a)bristol.ac.uk ); then # VLAN = "666" # fi echo "Tunnel-Medium-Type = 802" echo "Tunnel-Type = VLAN" echo "Tunnel-Private-Group-ID = $VLAN" exit 0 radiusd.conf: exec assign-vlan { program = "/path/to/assign-vlan.sh" input_pairs = proxy-reply output_pairs = proxy-reply wait = yes packet_type = Access-Accept } authorize { ... # Make sure you put this AFTER the clause that invokes proxying assign-vlan ... } > Also, is there a way to return an access-accept with a 'dirty' VLAN ID, even > if the IAS server rejects the user? The idea being that the user would be > put into a dead end VLAN so they could get info on how to register to use > the service. No; only a couple of attributes are permitted in Access-Reject packets. I don't think it would be possible to "catch" Access-Rejects from IAS and cunningly turn them into Access-Accepts, either :-/ (well, it would be possible, but you'd need to hack FR to do this). josh. > Many thanks, > Jezz Palmer. > > **************************************** > Jezz Palmer. > Internet Systems Officer. > Library and Information Services > University of Wales, Swansea > Singleton Park > Swansea > SA2 8PP > **************************************** > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Freeradius .. EAP/PEAP ... no accounting
by Guy Davies 09 Nov '05

09 Nov '05

Is your AP configured to send accounting information? Many don't do this by default. You will have to set it and tell it to use the same RADIUS server for accounting. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Simone Sent: 09 November 2005 12:11 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius .. EAP/PEAP ... no accounting hi all.. I have installed a freeradius 1.0.5.. For my project i need to use it for authenticate and log (accounting) the wi-fi customer on an area of my city.. All is done ok.. the Hot-spot is configured for work with Radius using WPA - EAP using PEAP and radius.. Freeradius is configured with TLS and PEAP and the authentication way working correctly.. I'm able to use my winXp client with Wi-fi.. connecting to the Hotspot and get the IP address via DHCP.. all great.. DAMN !!! freeradius don't log the accounting and i don't find what is the problem.. all the config on radiusd.conf about auth and accounting seem to be ok.. Some part of radiusd.conf =============== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ....... ....... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ......... ......... # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } ........... ........... # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } ============================= Anyone could tell me .. "stupid here the error" :)) thanks for help.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Freeradius .. EAP/PEAP ... no accounting
by Simone 09 Nov '05

09 Nov '05

hi all.. I have installed a freeradius 1.0.5.. For my project i need to use it for authenticate and log (accounting) the wi-fi customer on an area of my city.. All is done ok.. the Hot-spot is configured for work with Radius using WPA - EAP using PEAP and radius.. Freeradius is configured with TLS and PEAP and the authentication way working correctly.. I'm able to use my winXp client with Wi-fi.. connecting to the Hotspot and get the IP address via DHCP.. all great.. DAMN !!! freeradius don't log the accounting and i don't find what is the problem.. all the config on radiusd.conf about auth and accounting seem to be ok.. Some part of radiusd.conf =============== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ....... ....... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ......... ......... # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } ........... ........... # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } ============================= Anyone could tell me .. "stupid here the error" :)) thanks for help..

2 1