- Freeradius-Users - lists.freeradius.org

Login-Time, huntgroup and mysql
by alexander＠infomed.sld.cu 17 Jun '05

17 Jun '05

Hi I'm have using freeradius+mysql. All the users are on a mysql database, and we have our owns NAS pointed to the radius servers, everything work fine. Recently, in order to increase our capabilities was introduced an other NAS that points to an other freeradius server who proxied the requests to our server. We were trying to control the trafic to the remote NAS by using the Login-Time attribute and "huntgroups" file to distinguish the requests that come from the remote NAS. So, we have an entry on huntgroup file like this: huntgroup file: . . . remote_nas NAS-IP-Address == 1.2.3.4 . . . then on the users file: . . . DEFAULT Service-Type == Framed-User, Login-Time := "al0600-1800", Huntgroup-Name == "remote_nas" Fall-Through = Yes . . . then on radiusd.conf, at the authorize we have files and sql The above configuration work O.K! But all peoples that try to connect to NAS 1.2.3.4 out of time will be reject. So we define 3 users categories: 1- the useres that only can login by day ("al0600-1800"); 2- users that only can login by night ("al1800-0600"); and 3- users than can login any time at the romote NAS. If the same user try to connect to an other NAS, then the Login-Time have'n effect, so that it can connect any time. How we can do that without have to do any change on the users names and groups of the data base? We probe the fallowing: huntgroup file: . . . remote_nas NAS-IP-Address == 1.2.3.4 . . . then on the users file: . . . DEFAULT Service-Type == Framed-User, User-Category == "day", Login-Time := "al0600-1800", Huntgroup-Name == "remote_nas" Fall-Through = Yes DEFAULT Service-Type == Framed-User, User-Category == "night", Login-Time := "al1800-0600", Huntgroup-Name == "remote_nas" Fall-Through = Yes DEFAULT Service-Type == Framed-User, User-Category == "fulltime", Huntgroup-Name == "remote_nas" Fall-Through = Yes . . . on mysql: radcheck +----+-----------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+-----------+----------------+----+------------------------------------+ | 1 | alexander | Crypt-Password | == | $1$9D9s.vO6$GlVbRFf7qRaUXTAJ1gGGe. | | 4 | alexander | User-Category | := | day | +----+-----------+----------------+----+------------------------------------+ and radiusd.conf, at the authorize we have files and sql But this configuration don't work because the request never match any of 3 entries of users file due to User-Category attribute, maybe cause sql is the last module that the server call: . . . authorize { . . preprocess . . files . . sql . . } We would be grateful for any suggestion. Thanks. ------------------------------------------------- Este mensaje fue enviado usando el servicio de correo en web de Infomed http://webmail.sld.cu

1 0

proxy wildcard realms (subdomains)
by Tariq Rashid 17 Jun '05

17 Jun '05

hi - i after much searching the archives i couldn't find a good way to proxy to subdomains of a domain: user(a)xxx.yyy.zz.domain.com for any number of subdomains under a given domain.com (inlcuding nil). is this possible? (i don't want the username stripped) thanks tariq

4 7

Looking for advice
by Benoit LELONG 17 Jun '05

17 Jun '05

Hello, I would like to build a freeradius plateform and I am looking for return of experiences about : - the best choice of Linux distribution to support the last version of freeradius. - the use of JRadius Thanks for your help, Benoit.

3 2

use_tunneled_reply
by ragan_davis＠colstate.edu 17 Jun '05

17 Jun '05

Hi, Using FreeRADIUS 1.0.2, Cisco/Airespace 4100 WLAN switch as NAS, and Odyssey Client v4.01 as supplicant. Kept seeing the user as "anonymous" in the WCS management software for the client. Wanted to see the *real* username, meaning the username that was actually authenticated to the backend db (in this case eDirectory). So, in eap.conf I changed use_tunneled_reply to equal yes. Still, replies to NAS show User-Name = "anonymous". Have I missed something? Thanks for the help, mack

2 1

corrupt UDP packets sent to proxy
by Taylor, Graham 17 Jun '05

17 Jun '05

Hi People, I hope you can shed some light on a problem I am having with freeradius acting as a proxy. As you can see the packet below has a corrupt UDP header ( Checksum: 0x5b10 (incorrect, should be 0x9f2d) ). If I use radtest then the packet is fine and I get authenticated, the problem only occurs when the request is proxied out, all of the packets forwarded to the secondary radius server have the UDP checksum error, I have tried the latest version of freeradius with exactly the same results, so I have gone back to the version supplied with RedHat, on a fresh build. Versions are as follows: radiusd: FreeRADIUS Version 1.0.1, for host , built on Nov 26 2004 at 10:48:39 OpenSSL 0.9.7g 11 Apr 2005 Linux <MY HOST NAME> 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux This is RedHat ES version 4 Please let me know if you need any further information Regards Graham Frame 12 (197 bytes on wire, 197 bytes captured) Arrival Time: Jun 17, 2005 11:19:35.560228000 Time delta from previous packet: 4.660183000 seconds Time since reference or first frame: 111.704161000 seconds Frame Number: 12 Packet Length: 197 bytes Capture Length: 197 bytes Protocols in frame: eth:ip:udp:radius:eap Ethernet II, Src: 00:12:79:3c:9c:61, Dst: 00:00:0c:07:ac:14 Destination: 00:00:0c:07:ac:14 (All-HSRP-routers_14) Source: 00:12:79:3c:9c:61 (HewlettP_3c:9c:61) Type: IP (0x0800) Internet Protocol, Src Addr: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX), Dst Addr: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 183 Identification: 0x0005 (5) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xdfd5 (correct) Source: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) Destination: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) User Datagram Protocol, Src Port: 1814 (1814), Dst Port: radius (1812) Source port: 1814 (1814) Destination port: radius (1812) Length: 163 Checksum: 0x5b10 (incorrect, should be 0x9f2d) Radius Protocol Code: Access Request (1) Packet identifier: 0x1 (1) Length: 155 Authenticator: 0x22840C6BAE7ECB8E4FE8A8A3773B1A08 Attribute value pairs t:User Name(1) l:8, Value:"graham" User-Name: graham t:Framed MTU(12) l:6, Value:1400 t:Called Station Id(30) l:16, Value:"000e.842e.8230" Called-Station-Id: 000e.842e.8230 t:Calling Station Id(31) l:16, Value:"0040.96a7.f8d2" Calling-Station-Id: 0040.96a7.f8d2 t:Service Type(6) l:6, Value:Login(1) Service-Type: Login (1) t:Message Authenticator(80) l:18, Value:C77E1EE1C2A7E98B00E464AB0DB0DE48 t:EAP Message(79) l:34 Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 32 Type: Identity [RFC3748] (1) Identity (27 bytes): graham(a)test.com t:NAS Port Type(61) l:6, Value:Wireless IEEE 802.11(19) t:NAS Port(5) l:6, Value:1646 t:NAS IP Address(4) l:6, Value:172.23.1.201 Nas IP Address: 172.23.1.201 (172.23.1.201) t:NAS identifier(32) l:8, Value:"ap1200" t:Proxy State(33) l:5, Value:323533

2 1

Don't work
by synackrst 17 Jun '05

17 Jun '05

Hello, I found a article wich explains how to use experimental counter of freeradius, but that seems not working. I can not find more documentation about that. Anyone know about that? http://www.chillispot.org/forum/viewtopic.php?t=37 Regards, Paulo Leitao

3 2

Problem with LDAP group searches
by Graham, Robert 17 Jun '05

17 Jun '05

I'm trying to get Freeradius configured to authenicate our vpn users from a Cisco 3005 concentrator against Active Directory using the ldap module. When I authenicated a vpn user on a per user basis - it works fine. However, I want authenicate not only the user, but also verify that the user is a member of a "group" in active directory. I was following Dustin Doris's suggestion on Per-Client "group" matching and configured the huntgroups, users, and radiusd.conf accordingly. However, it seems to fail doing a group lookup. I don't know if it matters, but the user object and group object in Active Directory are in different containers (OU's). Any help would be appreciated. Thanks Robert Graham ########## Debug out: ########## rad_recv: Access-Request packet from host 172.16.1.91:1054, id=40, length=119 User-Name = "rgraham" User-Password = "XXXXXXXXXX" NAS-Port = 1036 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "192.168.15.1" Calling-Station-Id = "192.168.15.2" Tunnel-Client-Endpoint:0 = "192.168.15.2" NAS-IP-Address = 172.16.1.91 NAS-Port-Type = Virtual rad_lowerpair: User-Name now 'rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mem_co_dept1.mem-ins.com:389, authentication 0 rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/XXXXXXXXXX to mem_co_dept1.mem-ins.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' radius_xlat: '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a member. users: Matched DEFAULT at 166 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 40 to 172.16.1.91:1054 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 40 with timestamp 42b1c93a Nothing to do. Sleeping until we see a request. ############ Users file: ############ DEFAULT Huntgroup-Name == vpnusers, LDAP-Group == MEMVPNFlex, Auth-Type := LDAP OU = TestGroup Fall-Through = 1 ############ huntgroup ############ vpnusers NAS-IP-Address == 172.16.1.91 ####################### ldap section of radiusd.conf ####################### ldap { server = "mem_co_dept1.mem-ins.com" basedn = "ou=mem users,dc=mem-ins,dc=com" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" identity = "cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com" password = XXXXXXXXXX start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 }

2 1

RE: proxy wildcard realms (subdomains)
by Tariq Rashid 17 Jun '05

17 Jun '05

thanks - this works very well. i'm replying so that future searchers of the mailing list archives can see that it does indeed work. working example (etc/raddb/users file for that that couldn't fine which file to edit!) # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.easynet\.co\.uk$", Proxy-To-Realm := "easynet.co.uk" # following is used to map subdomains of *.ukonline.co.uk # to be proxied according the realm ukonline.co.uk DEFAULT User-Name =~ "@.*\.ukonline\.co\.uk$", Proxy-To-Realm := "ukonline.co.uk" t -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 16 June 2005 17:59 To: FreeRadius users mailing list Subject: Re: proxy wildcard realms (subdomains) Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > hi - i after much searching the archives i couldn't find a good way to proxy > to subdomains of a domain: > > user(a)xxx.yyy.zz.domain.com > > for any number of subdomains under a given domain.com (inlcuding nil). > > is this possible? (i don't want the username stripped) yes. DEFAULT User-Name =~ "domain\.com$", Proxy-To-Realm := "domain.com" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Protection of accounting files
by Karl-Jose Filler 17 Jun '05

17 Jun '05

The file protection of the radius accounting files is currently 0600 [948]> ll /var/log/radius/radacct/135.246.192.119/ total 24 -rw------- 1 radiusd radiusd 2595 Jun 13 15:25 detail-20050613 -rw------- 1 radiusd radiusd 5193 Jun 14 15:33 detail-20050614 -rw------- 1 radiusd radiusd 6018 Jun 15 15:06 detail-20050615 -rw------- 1 radiusd radiusd 3477 Jun 16 15:38 detail-20050616 Is there a parameter in one of the config files to change this protection ? JIse Filler

2 1

upgrade from 1.0.1 --> 1.0.3
by Rohaizam Abu Bakar 17 Jun '05

17 Jun '05

OS: FreeBSD 4.11 Upgrade : from 1.0.1 to 1.0.3 Receive below error # ./configure --with-logdir=/var/log --with-radacctdir=/var/adm/radacct --with-raddbdir=/usr/local/etc/raddb # make Should be no problem compiling for 1.0.2 ################ In file included from rlm_attr_rewrite.c:31: /usr/include/regex.h:46: syntax error before `regoff_t' /usr/include/regex.h:46: warning: type defaults to `int' in declaration of `regoff_t' /usr/include/regex.h:46: warning: data definition has no type or storage class /usr/include/regex.h:56: syntax error before `regoff_t' rlm_attr_rewrite.c: In function `do_attr_rewrite': rlm_attr_rewrite.c:314: structure has no member named `rm_so' rlm_attr_rewrite.c:316: structure has no member named `rm_so' rlm_attr_rewrite.c:318: structure has no member named `rm_eo' rlm_attr_rewrite.c:318: structure has no member named `rm_so' rlm_attr_rewrite.c:330: structure has no member named `rm_eo' rlm_attr_rewrite.c:348: structure has no member named `rm_so' rlm_attr_rewrite.c:357: structure has no member named `rm_so' rlm_attr_rewrite.c:358: structure has no member named `rm_eo' rlm_attr_rewrite.c:358: structure has no member named `rm_so' rlm_attr_rewrite.c:359: structure has no member named `rm_eo' rlm_attr_rewrite.c:359: structure has no member named `rm_so' gmake[5]: *** [rlm_attr_rewrite.o] Error 1 gmake[5]: Leaving directory `/var/src/freeradius-1.0.3/src/modules/rlm_attr_rewrite' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.0.3/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.0.3/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.0.3/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.0.3/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /var/src/freeradius-1.0.3.

1 0