- Freeradius-Users - lists.freeradius.org

Multiple logins Freeradius/Mysql
by Mark Elkins 13 Jun '05

13 Jun '05

We've set up Simultaneous-Use := 1 - and this seems fine. However, I have my first user - who is really off the net and 'radzap' seems to do nothing.... (radwho still gives the user as being there). What is the code... in sql.conf... simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" ...for???? In our previous Radius - we used to simply provide a valid AcctStopTime time - and the user could then login again. What do I need to do to change freeradius to do Simultaneous-Use control using mysql and not using radwho?? I've read doc/Simultaneous-Use - which doesn't use/mention [my]sql. I'm guessing (looking at where radutmp is mentioned)... radiusd.conf has... session { radutmp } Should this be changed to... session { sql } ??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

2 2

RE: restricting access for users
by alan walters 13 Jun '05

13 Jun '05

Dustin I get matchs in my users files. But the huntgroup seems to just be bypassed. Could you PM me with a users file and huntgroups file incase it is a syntax issue. thenks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Dustin Doris Sent: 13 June 2005 14:52 To: FreeRadius users mailing list Subject: RE: restricting access for users > > I have a second issue with this in that the users file has a defulat > reject if the group is not matched. This also is not being used > correctly by freeradius. The user defaults into that if there group does > not match but does not get rejected. > I have never noticed any problems like that myself. I suspect you have something else in your users file that it is matching on. Perhaps a DEFAULT Auth-Type = something? Please post your users file in its entirety (you can remove the # lines if you would like for easier reading) Then post your radiusd -X output showing this behavior. That way you can read the debug info and look for a line that says something like "matched users file at 1". Without seeing the users file and the actual debug here its hard to say. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005

1 0

Database connection failure and retry
by Ming-Ching Tiew 13 Jun '05

13 Jun '05

A little while ago I posted about in my configuration, using unixodbc/freetds, we noticed that database/network failure causes permanent disability in radius server to stop logging and I was given the reply that it is in the feature of radius server to retry upon failure. So there is a discrepancy between what I noticed verses the "supposed to be" behaviour. Upon further investigation I explored into the code, I found this in sql_mysql.c :- static int sql_fetch_row(SQLSOCK * sqlsocket, SQL_CONFIG *config) { rlm_sql_mysql_sock *mysql_sock = sqlsocket->conn; /* * Check pointer before de-referencing it. */ if (!mysql_sock->result) { return SQL_DOWN; } sqlsocket->row = mysql_fetch_row(mysql_sock->result); if (sqlsocket->row == NULL) { return sql_check_error(mysql_errno(mysql_sock->sock)); } return 0; } However the code in sql_unixodbc.c is like this :- static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; sqlsocket->row = NULL; if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) return 0; /* XXX Check if return suggests we should return error or SQL_DOWN */ sqlsocket->row = unixodbc_sock->row; return 0; } There is no checking whatsoever, so unixodbc driver is unable to reconnect upon failure.

2 5

RE: restricting access for users
by alan walters 13 Jun '05

13 Jun '05

I have a configuration similar to your no one option. >From readinr the huntgroups how to and the users how to, this seems to be the most correct method to use. I have a second issue with this in that the users file has a defulat reject if the group is not matched. This also is not being used correctly by freeradius. The user defaults into that if there group does not match but does not get rejected. Please can someone confirm these findings. Regards alan -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Martial VdB Sent: 13 June 2005 13:06 To: freeradius-users(a)lists.freeradius.org Subject: RE: restricting access for users Hi Alan, thank you for replying, this is how I tried this before, I will try to keep this as short as possible. 1) users: bob Password == "bob", Huntgroup-name == "diegem" Login-Service = 0, Vendor-Specific = 9, Reply-Message = "Hello, bob", Cisco-AVpair = "shell:priv-lvl=15", Service-Type = NAS-Prompt-User, huntgroups: diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x brussels NAS-IP-Address == 10.2.x.x I hoped that the nas ip addresses belonging to diegem where only accessable for users who had Huntgroup-name == "diegem" in their config. But this did not seem to make a difference. ************************************************************************ ** 2) users: DEFAULT Auth-Type = System Login-Service = 0, Vendor-Specific = 9, Service-Type = NAS-Prompt-User, Cisco-AVpair = "shell:priv-lvl=15", $enab15$ bob bobke huntgroups: diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x diegem NAS-IP-Address == 10.5.x.x Group == NOC, brussels NAS-IP-Address == 10.2.x.x I made bob and bobke local users on my machine and added them to # groups. bob to NOC and bobke to brussels. bob:x:1005:1005::/home/bob: bobke:x:1006:1006::/home/bobke: NOC:x:1005: brussels:x:1006: If the user was not a member of group NOC he would be refused on the NAS servers belonging to huntgroup diegem.Because diegem is linked to group NOC (Group == NOC). This did not work either. In both cases every user was allowed access as soon as the username and passwords checked out. I also had problems with nas ip addresses belonging to more that 1 group. It looked like the groups are processed from top to bottom and as soon as it hits the first entry of that address freeradius allowes access. But for my problem to be solved it should cache information like Group = NOC or for example user_pool = diegem. And compare this information agains an entry in the users file like: user_pool=diegem or checking if on the system bob's primary group is NOC. I did several more combinations but I think one of these 2 should work. Perhaps I made a configuration error ? Big thank you in advance ony for reading and getting into this problem. If I was not clear enough please let me know. Martial >Yes this is my experience as well. Running v 1.0.2 there was nothing in the >change log for 1.0.3 >to say this was fixed either. >Just as a note when I posted these findings nothing came back. >I was using an ldap backend as well. It would be great to have a detailed >explaination of this one >and maybe confirmation that it is not working or >wheather is it syntax that causes the problem >Alan >>From: "Martial VdB" <mdbnoc(a)hotmail.com> >>Reply-To: FreeRadius users mailing list >><freeradius-users(a)lists.freeradius.org> >>To: freeradius-users(a)lists.freeradius.org >>Subject: restricting access for users >>Date: Mon, 13 Jun 2005 09:22:14 +0200 >> >>Hi there, >> >>I'm a newby here so forgive if I ask obvious questions. >> >>I'm trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on >>a Linux Debian machine and it is working fine :) >>But I need to achieve the following setup: >> >>We have # cisco routers and switches who are locally managed by on site >>engineers. So these local engineers have to be able to log in to their >>devices and not be allowed to log in to devices on other sites. Next to >>these different site engineers there is a group called NOC. The NOC >>engineers need to access all devices on all sites. >> >>I've tried several setups by using the huntgroups and using system as >>authentication method but I can't get the huntgroup validation to work. It >>looks like the huntgroups are just ignored. Everyone can just enter any >>device as soon as their usrname and password is matched on the system. >> >>Did someone do a similar setup where users where restricted and with a >>general group that needs access everywhere or can someone tell me how I >>should take this on. It should be fairly easy I thought... >> >> >>Thanks for your help, it is highly appreciated, >> >>Martial > >_________________________________________________________________ >Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be > >- List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee(r) Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

executing external program
by vicky 13 Jun '05

13 Jun '05

Hello guys and girls, While executing a script of mine in the radiusd.conf file I get a very strange error that worries me. /radius_xlat: '/home/vicky/finalprog/compAttrs Access-Request' Exec-Program: /home/vicky/finalprog/compAttrs Access-Request MASTER: Child PID 28050 failed to catch signal 11: killing all active servers./ The script it self is tested aside and it work. What seems to be the problem. I've never seen anything like this before... Thanks for all the suggestions! -- Vicky

1 0

rlm_ldap : user not found
by Nicolas Viers - SCI 13 Jun '05

13 Jun '05

Hello, i had a problem with freeradius and rlm_ldap module sometimes and i don' know why users couldn't authenticate on ldap server. I had this message in radius.log: Auth: Login incorrect (rlm_ldap: User not found): [dupont] and few seconds later the authentification is ok with the same user: Auth: Login OK: [dupont] Maybe a timeout problem with ldap ? Should i modify timeout parameters on radiusd.conf or in slapd.conf ? Maybe a nb of connections ? Sould i increase "ldap_connections_number =" parameters ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mél: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

2 1

Re: eDirectory backend with FreeRadius
by Sayantan Bhowmick 13 Jun '05

13 Jun '05

Hi, To be able to read Universal Password from eDirectory you will HAVE TO have a secure connection between FreeRADIUS and eDirectory. That willtake care of the "rlm_ldap: Error reading Universal Password.Return Code = 80" problem. So you have to setup up the TLS certificates properly in the ldap section of radiusd.conf. Get back to me in case you need any further help. -Sayantan >>> fahimdxb(a)gmail.com 06/12/05 2:07 PM >>> Having spent whole last fortnight trying to configure Freeradius module given here with LDAP Agent running on my eDir8.7.3.6 on Netware 5.1, using iManager 2.5, I am almost there but seemingly stuck with something vital. Ihave done everything as mentioned by Novell Admin guide posted on this Forge project here: http://forge.novell.com/modules/xfmod/project/?edirfreeradius My Freeradius is running on SuSe Linux Machine with iManager 2.5 installed for managing Radius users and Universal passwords. I can do an LDAP browse from there and connectivity is OK. Using a third Win2K for testing Radius connectivity. Had some problems configuring TLS/SSL connection to LDAP server so hashed (start_tls=no) in radiusd.conf. I don't mind secure or insecure connection between FreeRadius and LDAP Agent. My main concern is here:(Excerpted from console log) ------------------------------------ rad_recv: Access-Request packet from host 194.170.15.100:1089, id=28, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 4 modcall: group authorize returns userlock for request 4 Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 194.170.15.100:1089 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 28 with timestamp 42aaceb3 Nothing to do. Sleeping until we see a request. ------------------------------------------------------ After hashing access_attribute = 'dialupAccess' ------------------------------------------------------- So, When I restarted the Radius Server: ..... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 194.170.15.100:1091, id=30, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 194.170.15.158:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/cert/EUCCA.b64 rlm_ldap: setting TLS CACert File to /etc/rardb/cert/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=admin,o=euc/college to 194.170.15.158:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: Error reading Universal Password.Return Code = 80 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user test04 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request ---------------------------------------- MY PROBLEM: rlm_ldap: Error reading Universal Password.Return Code = 80 I hope it's not TLS related!!! Consider this an SOS....Please Advise!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

eDirectory backend with FreeRadius
by Fahim 13 Jun '05

13 Jun '05

Having spent whole last fortnight trying to configure Freeradius module given here with LDAP Agent running on my eDir8.7.3.6 on Netware 5.1, using iManager 2.5, I am almost there but seemingly stuck with something vital. Ihave done everything as mentioned by Novell Admin guide posted on this Forge project here: http://forge.novell.com/modules/xfmod/project/?edirfreeradius My Freeradius is running on SuSe Linux Machine with iManager 2.5 installed for managing Radius users and Universal passwords. I can do an LDAP browse from there and connectivity is OK. Using a third Win2K for testing Radius connectivity. Had some problems configuring TLS/SSL connection to LDAP server so hashed (start_tls=no) in radiusd.conf. I don't mind secure or insecure connection between FreeRadius and LDAP Agent. My main concern is here:(Excerpted from console log) ------------------------------------ rad_recv: Access-Request packet from host 194.170.15.100:1089, id=28, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 4 modcall: group authorize returns userlock for request 4 Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 194.170.15.100:1089 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 28 with timestamp 42aaceb3 Nothing to do. Sleeping until we see a request. ------------------------------------------------------ After hashing access_attribute = 'dialupAccess' ------------------------------------------------------- So, When I restarted the Radius Server: ..... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 194.170.15.100:1091, id=30, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 194.170.15.158:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/cert/EUCCA.b64 rlm_ldap: setting TLS CACert File to /etc/rardb/cert/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=admin,o=euc/college to 194.170.15.158:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: Error reading Universal Password.Return Code = 80 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user test04 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request ---------------------------------------- MY PROBLEM: rlm_ldap: Error reading Universal Password.Return Code = 80 I hope it's not TLS related!!! Consider this an SOS....Please Advise!!

2 1

Class attribute questions
by Shawn K. O'Shea 12 Jun '05

12 Jun '05

Greetings, I'm trying to look at the Class attribute during proxying. I want to take data stored in the Class attribute and rewrite other attribute(s) based on the contents. I have it working right now but have two questions regarding it. 1) I'm currently using rlm_exec to call a simple perl script that "decodes" the Class attribute value (from accessing %{Class}) from it's hex octet form back to the ASCII inside. I just wanted to make sure that I wasn't missing something, and that there isn't an easier way to get at the ASCII inside the octet stream. 2) The rfc's allow for more than one Class attribute (at least in Accounting-Request packets). How does FreeRADIUS treat references to %{Class} when this happens? i.e. Is there a syntax to refer to each instance of the Class attr or get a count of how many are in the packet? (I'm not currently running into this, but want to keep that base covered in case that situation arises). Thanks, -Shawn ~~~~~~~~~~~~~~~~~~~~~~~~~ Shawn O'Shea Network Engineer Airpath Wireless, Inc. "Clearing the Way" 781-250-3500-office 781-250-3535-direct 781-250-3503-fax shawno(a)airpath.com http://www.airpath.com ~~~~~~~~~~~~~~~~~~~~~~~~~ CONFIDENTIALITY STATEMENT This electronic message contains information from Airpath Wireless, Inc., and may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify the sender immediately by reply e-mail shawno(a)airpath.com or telephone at (781) 250-3500.

2 1

Performance tweaking and testing.
by Arne.Olav.Kjosnes＠pcsupport.no 12 Jun '05

12 Jun '05

Hi all, We have 1500 customers connected to our PPPoE servers, to autenticate we have 2 freeradius servers connected to a mssql server. The radius servers don't autenticate fast enough, our PPPoE server starts to hang when there are to many radius autentications idle/waiting for a answer from the radius server. Does anyone got a tip on how to improve performance on the radius servers? And how to test preformance?

4 7