- Freeradius-Users - lists.freeradius.org

Authentication on the basis of circuit id and not mac address
by Mahima Kumar 10 Mar '14

10 Mar '14

Hi , I have used an Alcatel router as relay agent which gives the circuit id and i can see that in the radius debug output, so the client is getting authenticated on the basis of mac address and is getting the ip address from the Dhcp server , now i want to authenticate the client based on the circuit id provided by the relay agent in between, but the radius server doesn't accept username as circuit id, it only authenticates based on mac address of the client(i tried changing the users file), so can anyone please guide me as to what changes i have to make for this to be possible. TIA Regards, Mahima

2 1

Testing an access-request user without the debugging mode
by Hangi Christian 10 Mar '14

10 Mar '14

Hello Guys, I am new in Freeradius server and also in linux and I need your help regarding the functionality of the server. I am currently using freeradius version 2.2.3 and my desktop computer is running the CentOS 6.4 linux operating. First of all, I've downloaded the uncompressed freeradius software package (freeradius-server-2.2.3.tar) from the freeradius website: http://www.freeradius.org from source code in the tar format. Then after I had to create a folder using CentOS linux in order to the freeradius server source code package to the folder, uncompressed and installed on the computer. After copied to the folder, I used the tar commands to uncompress the source code package and install it on the computer using #./configure, #make and #make install commands from the INSTALL file of the uncompressed server package. After installed, the configurations files of the RADIUS SERVER were found under /usr/local/etc/raddb directory path. i tested the server on the debugging mode using radiusd -X and at the end of the output i saw this line " Ready to process requests". I have first created a user inside the users file and I did the normal default testing with the debugging mode and the user was accepted. After that i change the clients.conf file putting my shared key and the IP Address of the switch and also configure ssh on the server side I have done the AAA , Radius and SSH configurations on the switch, then I used Putty on another computer to access to the server by putting the IP address of the switch . Is this the right way to access the server ? i ran the debugging mode on the server and try to access using putty on another PC . here is the result i got this : rad_recv: Accounting-Request packet from host 192.168.9.26 port 5001, id=151, length=122 User-Name = "testing" NAS-Identifier = "002389550a92" NAS-Port = 16781313 NAS-Port-Type = Ethernet Calling-Station-Id = "0000-0000-0000" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "1100030205009" Framed-IP-Address = 192.168.9.25 NAS-IP-Address = 192.168.9.26 Event-Timestamp = "Apr 2 2000 12:00:06 ICT" Service-Type = Login-User # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 16781313,NAS-Identifier = "002389550a92",NAS-IP-Address = 192.168.9.26,Acct-Session-Id = "1100030205009",User-Name = "testing"' [acct_unique] Acct-Unique-Session-ID = "6ff6addd9c912e31". ++[acct_unique] = ok [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 192.168.9.26 [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] expand: %t -> Mon Mar 10 13:12:05 2014 ++[detail] = ok ++[unix] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 151 to 192.168.9.26 port 5001 Finished request 1. Cleaning up request 1 ID 151 with timestamp +122 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +122 Ready to process requests. then i stopped the debugging mode. and run the server using this commands [root@chris raddb]# service radiusd restart Stopping radiusd: [ OK ] Starting radiusd: [ OK ] on the user's PC side i got access denied and the server does not report on the radius.log file . please help me and also correct me where ever i went wrong. With Regards, Chris

2 1

RE: dailycounter isnt started
by Sanity Computers 08 Mar '14

08 Mar '14

Guys, I found the right code from the Daloradius /sql/counter.conf. In all my googling I have not seen it like this. I found it a little tough when the wiki and Github show code that does not work for a daily-max-session. I guess there is a reason but loads of the examples out there simply don't work unless the radacct table is already populated, cheers. sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL(SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" Regards Jim

2 1

rlm_unix and logging of bad passwords
by Mischa Diehm 07 Mar '14

07 Mar '14

Hi, I run: freeradius-2.2.0p2 on OpenBSD 5.4 and I'm wondering how I can stop freeradius to log bad passwords to /var/log/radius/radius.log. The users are in the system password-db. I checked in rlm_unix.c where the log is happening but from there didn't figure what could be done to prevent the line from being logged: //line371ff if (fr_crypt_check((char *) request->password->vp_strvalue, (char *) vp->vp_strvalue) != 0) { radlog_request(L_AUTH, 0, request, "invalid password \"%s\"", request->password->vp_strvalue); return RLM_MODULE_REJECT; } Any hints? Thanks in advance. Mischa -- Mischa Diehm | Network Operations Center (NOC) UniBasel | UniRechenZentrum (URZ) Klingebergstr. 70 | CH-4056 Basel Tel. +41 61 267 1574 | http://urz.unibas.ch

3 2

mod_xml_radius concurrency limit
by Ričardas Stoma 07 Mar '14

07 Mar '14

I'm using mod_xml_radius module to do radius authentication and accounting. When doing stress test (using sipp), i noticed that EVERY time when the number of concurrent calls reached exactly 245, authentications started to fail. >From the logs, i see these errors appearing after 245 calls: freeswitch: rc_send_server: no reply from RADIUS server localhost.localdomain:1812, 127.0.0.1 FreeSwitch and FreeRadius are communicating over localhost. I'm using 3 servers to do this stress test. First server generates calls, seconds server does freeswitch + freeradius stuff and third servers is used for terminating calls. Calls are generated with RTP stream. Wireshark shows that freeradius is sending correct responses to every mod_xml_radius request, but after 245 calls, responses do not reach destination (i see error messages "destination port is unreachable"). When the number of concurrent calls drops below 245, new calls are authenticated correctly (until it reaches that weird 245 limit). I'm using CentOS 6 (64 bit) Does anyone know why i'm getting this weird limitation? Is this related to freeswitch? freeradius server? mod_xml_radius? freeradius-client? linux?

2 1

Failover with two different versions of FR
by Erwann Thoraval 07 Mar '14

07 Mar '14

Hi list, I have a working config with one FR 2.2.0 server. I also setup a FR 3.0.1 server for failover purpose. Accouting is done with one pgsql server. Is it safe for the acounting database to be written by two different versions of FR? (ie 2.x and 3.x) Thanks, -- Erwann

2 1

Re: dailycounter isnt started
by Sanity Computers 07 Mar '14

07 Mar '14

Sorry I thought I was clear, the debug looked absolutely normal except no sign of the counter doing its job. I have used all default settings from the wiki but I'm a bit lost to how the counter works and what I should be seeing. I found a few other users with the same problem - this chap found a solution and added to githup so I will attempt to find it. http://freeradius.1045715.n5.nabble.com/Probmels-with-sqlcounter-module-in-F reeRADIUS-2-1-12-td5713958.html The issue is when the counter first runs on the first login there is no data in radacct ... so the query has no result. Someone also said this is the query to use: query = "SELECT COALESCE( SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) ) FROM radacct WHERE username = '%{${key}}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" but that didn't work for me, I'll check github, thanks.

1 0

X11 Authentication
by Jon Spriggs 06 Mar '14

06 Mar '14

Hi, I've deployed FreeRadius and am using it without issue on web applications and SSH sessions, however, I'm trying to expand this usage into GUI logins on an Ubuntu Linux based system (using one of the LightDM, GDM or KDM login managers - any will suffice, but ideally LightDM for Unity). I realise that this is outside the normal remit of this mailing list, and I'm happy to be told to look elsewhere, but as the project shepherds the pam_radius plugin, I was wondering whether there was just some settings I needed to tweak or configure in that plugin, or even whether I'm just looking in the wrong place to support my desired outcome. Many thanks in advance, -- Jon "The Nice Guy" Spriggs

2 3

radius server presenting itself as 127.0.0.1
by Morris, Andi 06 Mar '14

06 Mar '14

Hi all, I'm working on developing a high-availability setup PacketFence, which uses freeradius to authenticate users against our internal active directory server. I've just come to implement the production self-signed certificates as laid out in http://deployingradius.com/documents/configuration/ca_import.html and when I enable the "validate server certificate" box on my windows client I am asked to accept the certificate, which is expected as I haven't deployed the CA certificate yet, however I'm seeing "127.0.0.1" presented as the radius server name in the pop up box, rather than the actual hostname. I can't seem to find why this is happening, and I'd rather that have the server hostnames in the trusted radius server list than something generic like 127.0.0.1. Can anyone please point me in the right direction? Debug log attached. Cheers, Andi

4 8

pam module / freeradius permissions
by msheiny＠seas.upenn.edu 06 Mar '14

06 Mar '14

Hello, I'm running FreeRadius 2.2.0 and am looking for advice on resolving a permissions issue I am running into with a third-party pam module. As far as freeradius goes, I have it configured how I would like - radius authentication is being checked against PAM as I intended. The problem is that this pam module I am running currently requires root permissions but I would prefer to keep radiusd running as a restricted user. I've confirmed I can get around the issue by specifying radiusd to run as root but this is not desired. So my question - what would be the best way to run the freeradius pam sub-routine as root but keep the rest of the freeradius system runnning as my restricted user? I'm trying to avoid editing source code if I can help it. I realize this is not strictly related to freeradius but figured there may be a freeradius setting I'm not familiar here. Thanks in advance for any assistance. -- --Mike

5 5