- Freeradius-Users - lists.freeradius.org

Proxying based on AVPair (multiple SSIDs)
by Jason Carr 05 Nov '05

05 Nov '05

I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with. Our certificates don't include an @ sign in the username, nor do I know what authentication method the other groups will use. The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on. Anybody know if this is possible with freeradius or another software? If so, any configuration file contents I would need to set this up. Thanks, Jason

3 4

Attribute Value length using SQL
by Gunther 05 Nov '05

05 Nov '05

I am running FR 1.0.5 with MySQL 4.1.12. All data is stored in MySQL. My radgroupreply attribute values are SQL statements. It works very well. But it seems I have reached the limit for the Value column. My SQL output is setting the Session-Timeout. The length of Attribute Value can be found in the src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql CREATE TABLE radgroupreply ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', <== prio int unsigned NOT NULL default '0', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; I am trying to use a combination of the conditional syntax (e.g. %{Foo:-%{Bar}}) in connection with SQL statements. One sql statement is doing that and if false another sql statement is doing something else. e.g `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), ... and so on I was trying to change the AV lenght from 253 to 1024, but radius is simply cutting off after the limit, resulting in an error in the log file (MYSQL check_error: 1054). Log: radius_xlat: Running registered xlat function of module expr for string '%{sql:SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' radius_xlat: Running registered xlat function of module sql for string 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' rlm_sql (sql): - sql_xlat radius_xlat: 'gunther@demo' rlm_sql (sql): sql_set_user escaped user --> 'gunther@demo' radius_xlat: 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac rlm_sql_mysql: MYSQL check_error: 1054 received I then tried to shorten tablenames etc., but even with that I still have about 500+ bytes left. Is there any reason the limit must be at 253? Can the limit be changed ... in an easy way? My complete Sessiont-Timeout Value: `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user, phs_radacct WHERE user_username='%{User-Name}' AND radacct_username=user_username AND radacct_starttime >= user_starttime} :-%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(user_starttime, INTERVAL 24 HOUR) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(NOW(), INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user WHERE user_username='%{User-Name}'}}` Thanks! Gunther

2 3

RE: Attribute Value length using SQL
by Gunther 05 Nov '05

05 Nov '05

>I actually changed the MAX_STRING_LEN size from 254 to 762 in include/libradius.h and it seems to work. No, it doesn't work ...

1 0

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 05 Nov '05

05 Nov '05

>I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a >NetScreen5. I'm able to authenticate accounts just fine. Now I'd >like to begin pulling administrative privileges from the Radius >server, but I haven't figured out how to do that. I've referenced the >dictionary.netscreen file in my clients.conf file, nastype = >netscreen, but I'm embarrassed to say I can't figure out the format >for including the dictionary attributes for a user in my users file. > >I've tried various permutations like: > >markt Auth-Type := Local, User=Password == "testing" > NS-Admin-Privilege = "Read-Only-Admin" > >and: > >markt Auth-Type := Local, User=Password == "testing" > Netscreen-NS-Admin-Privilege = "Read-Only-Admin" > >Nothing's working. Can some one show me the correct syntax? > >Thank you, > >Mark >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Mark, I am having the same problems. I can authenticate fine, however, when I try and authorize via radius all logins fail (although RADIUS shows them to succeed. If I find the solution I will forward it along. Cheers, Chad

4 3

Newbie question re. dictionary files.
by Mark Tunnell 04 Nov '05

04 Nov '05

I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a NetScreen5. I'm able to authenticate accounts just fine. Now I'd like to begin pulling administrative privileges from the Radius server, but I haven't figured out how to do that. I've referenced the dictionary.netscreen file in my clients.conf file, nastype = netscreen, but I'm embarrassed to say I can't figure out the format for including the dictionary attributes for a user in my users file. I've tried various permutations like: markt Auth-Type := Local, User=Password == "testing" NS-Admin-Privilege = "Read-Only-Admin" and: markt Auth-Type := Local, User=Password == "testing" Netscreen-NS-Admin-Privilege = "Read-Only-Admin" Nothing's working. Can some one show me the correct syntax? Thank you, Mark

2 5

regexp and Group
by pepe lopez 04 Nov '05

04 Nov '05

Hi! I am using the 1.0.5 freeradius version. radiusd -v radiusd: FreeRADIUS Version 1.0.5, for host , built on Nov 1 2005 at 16:22:00 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I am trying to use regular expressions with the Group attribute, but its not working the way I expected. This is how my users file looks like: DEFAULT Auth-Type := Accept Fall-Through = Yes DEFAULT Group =~ "^test.*" Reply-Message = "%{0}", Fall-Through = No DEFAULT Huntgroup-Name == "as_totalcontrol" Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.255, Framed-IP-Address = 255.255.255.254, Framed-Routing = None, Framed-MTU = 1500, Reply-Message = "as_totalcontrol", Framed-Compression = Van-Jacobson-TCP-IP, Fall-Through = No First I tried a radtest with user test which belongs to group test groups test1 test1 : test_group_2 radtest -d /etc/raddb/ test1 test1 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 86 to 172.20.0.88:1812 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=86, length=27 Reply-Message = "test1" I ran freeradius in debug mode (radiusd X) This is the output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=86, length=63 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user test1 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 123 radius_xlat: 'test1' modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'test1' Sending Access-Accept of id 86 to 172.20.0.88:34613 Reply-Message = "test1" Finished request 1 Going to the next request Then I tried this: groups paraprueba paraprueba : test radtest -d /etc/raddb/ paraprueba parapeuba 172.20.0.88 1 hola 1 172.20.0.88 Sending Access-Request of id 98 to 172.20.0.88:1812 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 172.20.0.88:1812, id=98, length=79 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP This is radiusd output: rad_recv: Access-Request packet from host 172.20.0.88:34613, id=98, length=68 User-Name = "paraprueba" User-Password = "parapeuba" NAS-IP-Address = 172.20.0.88 NAS-Port = 1 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "paraprueba", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user paraprueba to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 71 users: Matched entry DEFAULT at line 147 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'as_totalcontrol' Sending Access-Accept of id 98 to 172.20.0.88:34613 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-IP-Address = 255.255.255.254 Framed-Routing = None Framed-MTU = 1500 Reply-Message = "as_totalcontrol" Framed-Compression = Van-Jacobson-TCP-IP Finished request 2 It seems as if the regular expression was matching the UserName attribute instead of the Group attribute. I also tried using regular expressions with the User-Name attribute and they worked as expected. Is it possible to use regular expressions with Group? And if it is so what am I doing wrong? Thanks in advance. Kind regards --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click. --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 1

how to use ntlm_auth
by mlopez＠uabc.mx 03 Nov '05

03 Nov '05

>> I have configured freeradius+ldap+802.1X for a wireless lan, but i >> can't get it to work because of mschap, and i dont have windows domain. > Then why the heck are you using ntlm_auth? It's only purpose is to >do MSCHAP authentication to a Windows domain controller. Because the configuration for 802.1X, using the 802.1X howto and http://vuksan.com/linux/dot1x/802-1x-LDAP.html, said that needs to configure peap and peap use mschap (....mmmm {thinking} but don't said nothing about ntlm) how the mschap module can perform authentication itself?? or how can i use 802.1X/peap and ldap ??? can i use it??? thank you in advance Manuel Lopez

3 2

Question about logging
by Lisa Casey 03 Nov '05

03 Nov '05

Hi Folks, You'll probably think this question is a bit nuts. With FreeRadius 1.01 on FreeBSD 5.3, is there any way of logging all authentication requests to radius.log EXCEPT requests from a particular username? Or alternatively, log all authentication requests EXCEPT those from a particular client (this would solve the same problem I have). I don't think this can be done, but you folks know a lot more about this than I do! Thanks, Lisa Casey -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.12.7/160 - Release Date: 11/3/2005

2 1

RE: expiration
by Serge Lhermitte 03 Nov '05

03 Nov '05

Thanks a lot. After some more troubleshooting, it appears it is not the release_1_0 which is having a problem but rather the fact that I was trying to compile it on a 64 bits machine. I'll work it out. About the Expiration being handled by the server core, I'll double check this as well. Cheers. S. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: jeudi 3 novembre 2005 10:56 To: FreeRadius users mailing list Subject: Re: expiration Serge Lhermitte wrote: > I am trying to get a working version of freeradius that includes the > expiration module. It seems this module doesn't exist in 1.0.x versions. I think the check item "Expiration" is handle by the server core (in auth.c), therefore you don't need a module. If you get version 1.0.5, it should work. > I actually succeeded a while ago, getting the following CVS > > $ cvs -d :pserver:[EMAIL PROTECTED]:/source checkout -r release_1_0 radiusd That's strange: the module rlm_expiration doesn't exist in this branch of the CVS. > However, it has not been compiling any longer for a couple of weeks now > and unfortunately, I didn't keep the sources at that time. There're only bugfixes in branch "release_1_0", and there's currently no known problems. Please detail your setup and post error messages. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using counters or Password-Retry attribute (RFC2869)
by Martin.Ward＠uk.neceur.com 03 Nov '05

03 Nov '05

Hi all, I am having another go at trying to implement a "maximum login attempts" using FreeRadius. >From what I can glean from the documentation and files I (currently) have two choices: 1. Use the Password-Retry attribute as per RFC2869. This attribute is used in Access-Reject packets (according to my O'Reilly book) and as I understand it is simply a number that is set in the Radius server which states how many times a user is allowed to attempt to login before they are locked out. The lock-out function is done by the FreeRadius client and clearly this client must understand and utilise the Password-Retry attribute for it to have any effect. I have no idea if my Radius client uses this attribute or not since I can't find a sensible place to store the attribute, at least I've tried it in various places and none of them work but this may simply be due to the fact that the client just ignores this attribute. 2. Use the counter module. While this might not be the way the modules was intended for use I have been thinking I could have it count the number of password failure attempts and when that value reaches a limit, say 3, the FreeRadius system rejects logins for that ID from then onwards. Investigating this option shows that I am missing a number of things: a. The counter should only be incremented when a password attempt fails. b. Ideally the counter should reset when the user logs in correctly, but it would be acceptable for the counter to be reset once a week or once a day or something like that. I know I can reset the counter at a given time ('reset' attribute of the counter module) but resetting it at a successful login would be best. So I guess I ma asking three questions. 1. Where should I put the Password-Retry attribute in the FreeRadius config files so that I can prove or disprove that the Radius client is using this attribute. 2a. How do I use the counter module to increment a counter only on Access-Reject? 2b. Can I reset the counter value on Access-Accept? Thanks fellows, |\/|artin -- Senior Network Consultant, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

1 0