- Freeradius-Users - lists.freeradius.org

freeradius + peap + ldap
by Yuri Francalacci 10 Oct '05

10 Oct '05

Hi, I have this environment: WinXP PEAP wireless client + linksys AP + freeradius 1.0.5 + openldap (with kerberos password) and I would like to setup the 802.1x peap authentication. Everything works well if I use users file for authenticating wireless client, but if I use ldap users, clients are not authenticated. My password attribute is UserPassword The error is (I suppose) here: -------------- modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: Told to do MS-CHAPv2 for yuri with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 -------------- Does anyone has a working configuration that looks like (more or less) mine? --- radiusd.conf ------ > mschap section mschap { authtype = MS-CHAP use_mppe = no # require_encryption = yes # require_strong = yes with_ntdomain_hack = no } Thanks, Yuri

1 0

how group checks/replies work in rlm_sql
by Todd Williams 10 Oct '05

10 Oct '05

I'm working towards implementing freeradius-1.0.5 with rlm_sql/mysql for authorization and kerberos for authentication. I've managed to work out the basic configuration but have run into problem understanding exactly how rlm_sql is designed to handle authorization. According to the documentation in doc/rlm_sql it seems as though during the group check/reply stage of authorization the group membership for a user is looked up in the usergroup table, and then for each group the check AV pairs are pulled and if the checks are passed the group-relevant reply AV pairs are added to the packet. However, during my testing of this I was not getting the results that I expected under the assumptions I had based off of the rlm_sql documention. After further investigation (reading code and further testing) it appears that the way rlm_sql really works is to just pull all the check and reply AV pairs for all of the groups a user belongs to and create two big linked lists-- one check, one reply-- containing all of these AV pairs. At that point if all of the check items are met then all of the reply items are added without any granular sense of group membership. Is my understanding of this correct? If my understanding is correct then I come to a question of how to best approach the following problem. A single user might be entitled to consume VPN, dialup, and wireless service all of which are serviced by different NASs that are under the control of different departments. Each NAS will have a set of check and reply information that it expects when transacting with the RADIUS server, and it seems that simply putting users in the appropriate groups (in the usergroup table) will likely yield potentially conflicting check and reply AV pairs being pulled by rlm_sql and unnecessarily involved in the transaction. Am I still on the right track or am I missing a concept? Anyway, it seems like one solution to this problem would be to use some method of discriminating between NASs prior to entering the authorization phase (perhaps with huntgroups) and adding an Autz-Type attribute containing the name of a particular instance of rlm_sql that is configured with service-specific radgroupcheck/reply tables. Is this the way to go? Thanks in advance for the help. -- Todd C. Williams tcwill(a)ufl.edu The Open Systems Group

1 0

Re : Crypted Password Problem with DIGEST
by Philippe Sultan 10 Oct '05

10 Oct '05

Hi, Meltem. DIGEST mode does not work with encrypted passwords. However, one way to have an encrypted password storage is to store a hash value of the username:realm:password string in the User-Password field of your entry. digest module configuration must include this line : digest { enc_mode=yes } Auth-Type might be set to Digest, but it is not necessary since Freeradius will trigger the rlm_digest module when parsing the Access-Request. If you want to build the hash value, try this command : echo -n 'username:realm:password' | md5sum You might want to test this patch for that purpose : http://bugs.freeradius.org/show_bug.cgi?id=287 Please give some feedback if you ever test it, since I suspect some modifications are needed. The advice of Freeradius managers is also needed, since a configuration option to the rlm_digest module has been added. Best regards, Philippe --- Mon, 10 Oct 2005 01:25:09 -0700 Hello, I am using SIP Express Router(SER) version 0.9.3 and freeRADIUS version 1.0.4. SIP uses digest as authentication scheme. I am trying to keep the user passwords as encrypted in freeRadius DB which is mySql table radcheck. The system is working with plaintext password, but it does not work with encrypted passwords even I tried all type of configurations. My first question is "Does DIGEST work with ENCRYPTED PASSWORDS" ??? Since Digest is a must for SIP. If NOT, what authentication scheme can I use to make SIP work with freeRADIUS? If DIGEST works with encrypted passwords, what should be the configuration files: 1) in radiusd.conf ? 2) What should be the value of "Auth-Type" parameter in radcheck or radgroupchek tables ? 3) What should be the attribute for password in radcheck table ? Is it "User-Password" or "Chap-Password" or "Crypt-Password" ?? I'll appreciate very much if anyone can help. Regards, Meltem Kirisci

2 2

Reid Canavan/FortErie is on Vacation
by Reid Canavan 10 Oct '05

10 Oct '05

I will be out of the office starting 10/10/2005 and will not return until 10/21/2005. I will respond to your message when I return.

1 0

Re: rlm_perl hang server
by Abdul Lateef 10 Oct '05

10 Oct '05

Hi, i am not using sql.conf at all. i have only DB connection in example.pl file. But my example.pl file really it is very big. and i have lot of queries cous of i am using this file for Prepaid CallShop Diffrent rate for diffrent customers. I would like to paste my script here. but i am really sorry to post big script here. ================example.pl ================== use DBI; #use strict; use POSIX qw(ceil floor); use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remaping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ my $db_host = '192.168.1.65'; my $db_user = 'testdb'; my $db_pass = 'MoHaKa21'; my $db_name = 'radius'; sub dbh{ my $db = "dbi:mysql:dbname=${db_name};host=${db_host}"; my $dbv = DBI->connect($db, $db_user, $db_pass, { RaiseError => 1, AutoCommit => 0 } ) || die "Error connecting to the database"; } sub debugit{ #if(!$RAD_REQUEST{'User-Password'}){ #my $cn = $RAD_REQUEST{'Called-Station-Id'}; #my $up = $RAD_REQUEST{'User-Password'}; #}else{ #my $tt = $RAD_REQUEST{'Acct-Unique-Session-Id'}; #} my $debug_sql = "INSERT INTO nas (nasname) VALUES ($tt)"; my $dbg = dbh()->prepare($debug_sql); $dbg->execute(); } #debugit(); # Function to handle authorize sub authorize { # For debugging purposes only &log_request_attributes; #debugit(); my $UserP; my $uidf; my $pwws; my $uid; if(!$RAD_REQUEST{'User-Password'}){ $uidf = $RAD_REQUEST{'User-Name'}; @WordList = split(/_/, $uidf ) ; $pwws = @WordList[1]; $uid = @WordList[0]; }else{ $pwws = $RAD_REQUEST{'User-Password'}; $uid = $RAD_REQUEST{'User-Name'}; } my $sql_reg = "SELECT 1 FROM radcheck WHERE UserName = '$uid' and Value = '$pwws' ORDER BY id"; my $auth = dbh()->selectrow_array($sql_reg); if(!$auth){return RLM_MODULE_REJECT;} else {return RLM_MODULE_OK;} } # Function to handle authenticate sub authenticate { # For debugging purposes only &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute if(!$RAD_REQUEST{'Called-Station-Id'}){$skipp=0;} else{max_time();} &log_request_attributes; return RLM_MODULE_OK; } } #end of authenticate function ################ FUNCTION FOR LIVE CALL ################## sub max_time{ #debugit(); my $sessionID = $RAD_REQUEST{'Acct-Session-Id'}; my $sessionID =~ s/T/V/; my $CalledID = $RAD_REQUEST{'Called-Station-Id'}; my $DCode = r_code($CalledID); my $UserName = $RAD_REQUEST{'User-Name'}; if ($ARGV[1] == 800800) #for ivr call { $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=60"; exit; } #End if my $sql_rate = "Select If(RT.Rate Is Null,T.Rate*STC.Percentage,RT.Rate) As Sell_Rate From (Tariff As T JOIN Tariff_Classes As STC Inner Join Rate_Card As RC On STC.ID=RC.Groupn) Left Join Reseller_Tariff As RT On T.Co_Name=RT.Code And RC.AgentID=RT.AgentID And RC.Groupn=RT.Groupn Where RC.UserName='$UserName' And T.Co_Name='$DCode'"; my $sql_usr_balance = "SELECT Amount FROM balance WHERE op='r' and UserName = '$UserName' "; my $sql_port = "SELECT port FROM radcheck WHERE UserName = '$UserName' "; my $sql_status = "SELECT count(*) as RecNo FROM radacct WHERE UserName = '$UserName' and status ='1' and AcctSessionId = '$sessionID' "; my $sql_statuso = "SELECT count(*) as RecNo FROM radacct WHERE UserName = '$UserName' and status ='1'"; my $query_resel = "select R_update_balance.Amount from R_update_balance INNER join Device_auth on R_update_balance.AgentID = Device_auth.AgentID Where Device_auth.DeviceID = '$UserName' "; my $reseller_balance = dbh()->selectrow_array($query_resel); my $calling_rate = dbh()->selectrow_array($sql_rate); if($reseller_balance <= 0){ $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=0"; exit;} if ($calling_rate <= 0) { $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=0"; exit;} # Callshop # if(!$RAD_REQUEST{'Calling-Station-Id'}){ # my $don = 1; # }else{ # my $callingID = $RAD_REQUEST{'Calling-Station-Id'}; # my $booth_credit = "SELECT credit FROM booth_credit WHERE UserName = '$UserName' and port ='$callingID'"; # my $boCredit = dbh()->selectrow_array($booth_credit); # &log_request_attributes; # if($boCredit <=0) # { # my $t=0; # }else{ # $total_minute_duration = $boCredit/$calling_rate; # $return_h323_time = $total_minute_duration*60; # $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; # &log_request_attributes; # #exit; # return true; # } #end if for callshop # # } #End if # End call shop area if($RAD_REQUEST{'Calling-Station-Id'}){ my $callingID = $RAD_REQUEST{'Calling-Station-Id'}; my $booth_credit = "SELECT credit FROM booth_credit WHERE UserName = '$UserName' and port ='$callingID'"; my $boCredit = dbh()->selectrow_array($booth_credit); &log_request_attributes; if($boCredit <=0) { my $t=0; }else{ $total_minute_duration = $boCredit/$calling_rate; $return_h323_time = $total_minute_duration*60; $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; &log_request_attributes; #exit; return true; } #end if for callshop } #End if my $returnba = 0; my $total_balance = dbh()->selectrow_array($sql_usr_balance); my $port = dbh()->selectrow_array($sql_port); my $status = dbh()->selectrow_array($sql_status); my $statuso = dbh()->selectrow_array($sql_statuso); if($total_balance >=5 && $port >= 2){ my $d = $port-$status; $returnba = $total_balance/$d; }elsif($total_balance < 5 && $statuso >= 2){ $returnba = 0; }elsif($total_balance <= 0){ $returnba = 0; }else{ $returnba = $total_balance; } #End If for port devision $total_minute_duration = $returnba/$calling_rate; #$total_minute_duration = $calling_rate; my $return_h323_time = $total_minute_duration*60; $RAD_REPLY{'h323-credit-time'} = "h323-credit-time=$return_h323_time"; &log_request_attributes; } #end max_time sub r_code #from reseller table { $wh = $_[0]; $wh =~ s/^00//; $sql_code = "SELECT Max(Co_Name) As Code FROM `Tariff` WHERE '$wh' Like Concat(`Co_Name`,'%')"; return dbh()->selectrow_array($sql_code); } #End r_code ######################## END LIVE CALL FUNCTION ######### # Function to handle preacct sub preacct { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { # For debugging purposes only &log_request_attributes; my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime time; my $years = $year+1900; my $mons = $mon+1; my $fdatetime = "$years-$mons-$mday $hour:$min:$sec"; my $accounting_start; my $accounting_stop_query; $accounting_start = "INSERT IGNORE into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, status,Termination) values('$RAD_REQUEST{'Acct-Session-Id'}', '$RAD_REQUEST{'Acct-Unique-Session-Id'}', '$RAD_REQUEST{'User-Name'}', '$RAD_REQUEST{'Realm'}', '$RAD_REQUEST{'NAS-IP-Address'}', '$RAD_REQUEST{'NAS-Port'}', '$RAD_REQUEST{'NAS-Port-Type'}', '$fdatetime', '0', '0', '$RAD_REQUEST{'Acct-Authentic'}', '$RAD_REQUEST{'Connect-Info'}', '', '0', '0', '$RAD_REQUEST{'Called-Station-Id'}', '$RAD_REQUEST{'Calling-Station-Id'}', '', '$RAD_REQUEST{'Service-Type'}', '$RAD_REQUEST{'Framed-Protocol'}', '$RAD_REQUEST{'Framed-IP-Address'}', '$RAD_REQUEST{'Acct-Delay-Time'}', '0', '1','$RAD_REQUEST{'h323-remote-address'}')"; $accounting_stop_query = "UPDATE radacct SET AcctStopTime = '$fdatetime', AcctSessionTime = '$RAD_REQUEST{'Acct-Session-Time'}', AcctInputOctets = '$RAD_REQUEST{'Acct-Input-Octets'}', AcctOutputOctets = '$RAD_REQUEST{'Acct-Output-Octets'}', AcctTerminateCause = '$RAD_REQUEST{'Acct-Terminate-Cause'}', AcctStopDelay = '$RAD_REQUEST{'Acct-Delay-Time'}', status = '1', ConnectInfo_stop = '$RAD_REQUEST{'Connect-Info'}' WHERE AcctSessionId = '$RAD_REQUEST{'Acct-Session-Id'}' AND UserName = '$RAD_REQUEST{'User-Name'}' AND NASIPAddress = '$RAD_REQUEST{'NAS-IP-Address'}'"; my $dbg = dbh()->prepare($accounting_start); $dbg->execute(); if($RAD_REQUEST{'Acct-Input-Octets'}){ my $dbup = dbh()->prepare($accounting_stop_query); $dbup->execute(); } return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only # &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only # &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

stripping av pairs
by Massimiliano Liccardo 10 Oct '05

10 Oct '05

hi, i want strip an AV pair only from my proxy-reply. If I use rlm_attr_filter, I have to list all the AV pairs "good". Any idea? -- Massimiliano Liccardo (maX) <liccardo(a)acmesolutions.it> jid:coccolesto@jabber.org sip:maX@macchese.no-ip.org GnuPG public key available on wwwkeys.eu.pgp.net Key ID: D01F1CAD Key fingerprint: 992D 91B7 9682 9735 12C9 402D AD3F E4BB D01F 1CAD "la velocità induce all'oblio, la lentezza al ricordo"

1 0

Crypted Password Problem with DIGEST
by meltem kirisci 10 Oct '05

10 Oct '05

Hello, I am using SIP Express Router(SER) version 0.9.3 and freeRADIUS version 1.0.4. SIP uses digest as authentication scheme. I am trying to keep the user passwords as encrypted in freeRadius DB which is mySql table radcheck. The system is working with plaintext password, but it does not work with encrypted passwords even I tried all type of configurations. My first question is "Does DIGEST work with ENCRYPTED PASSWORDS" ??? Since Digest is a must for SIP. If NOT, what authentication scheme can I use to make SIP work with freeRADIUS? If DIGEST works with encrypted passwords, what should be the configuration files: 1) in radiusd.conf ? 2) What should be the value of "Auth-Type" parameter in radcheck or radgroupchek tables ? 3) What should be the attribute for password in radcheck table ? Is it "User-Password" or "Chap-Password" or "Crypt-Password" ?? I'll appreciate very much if anyone can help. Regards, Meltem Kirisci _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Freeradius from inetd
by Adharsh P 10 Oct '05

10 Oct '05

Hello all, I am trying to start radiusd from inetd.conf. The entry in inetd.conf radius dgram udp wait root /usr/local/sbin/radiusd radiusd I have added the entries in /etc/services/ as radius 1812/udp radacct 1813/udp when I reload inetd, the logs say inetd[940]: /usr/local/sbin/radiusd: exit status (1) netstat -n displays *1812 but not *1813 udp 120 0 *.1812 *.* however radiusd is not accepting any request from the localhost using radclient/radtest. However, when I run radiusd from the command line /usr/local/sbin/radiusd radiusd starts and accepts requests. netstat -n displays udp 0 0 *.1812 *.* udp 0 0 *.1813 *.* I am not able to understand when using inetd, radiusd doesn't start. Am I missing something ? Do I have to modify anything in the configuration files ? I tried looking in the docs and archives, there is no mention on this. Could you please guide me, or give some pointers on where to look for. regards, adharsh.

3 3

RE: Freeradius from inetd
by Jonathan De Graeve 10 Oct '05

10 Oct '05

Put it in your startup scripts? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Adharsh P Verzonden: maandag 10 oktober 2005 7:58 Aan: Alan DeKok; freeradius-users(a)lists.freeradius.org Onderwerp: Re: Freeradius from inetd Hello Alan, Thanks, I am wondering, is there any other way that I can start radiusd automatically after every boot. Thanks and regards, adharsh -------------- > > I am trying to start radiusd from inetd.conf. > Don't. It won't work. > Alan DeKok. -------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Online Status with FR & SQL
by Gunther 10 Oct '05

10 Oct '05

I am trying to minimize the failure rate for detecting a user online status using FR105 & MySQL411. Sometimes the AcctStopTime in the radacct table remains 0 even the user is not anymore online for whatever reason (reboot, connection lost or ...). I can therefore not just check if the AcctStopTime for a particular user is 0. Since there is no record when the NAS unit sent the last update to FR and it is not recorded in the radacct table ... how do I know that the AcctStopTime=0 is not a 'leftover' ... Would it make sense to add a TIMESTAMP to the radacct table to record the last update? And would the use of TIMESTAMP for the radacct table produce some form of performance degrade? A TIMESTAMP would allow me to see if the row was updated within Idle-Timeout. Any hints from experience? Thanks, Gunther

2 3