- Freeradius-Users - lists.freeradius.org

Group based Authentication with Apache module mod_auth_radius-2.0
by Finn Christiansen 03 Jan '14

03 Jan '14

Hi, I am using FreeRADIUS 2.1.12 with a MySQL database and an Apache 2.2.15 with the module mod_auth_radius-2.0 (http://freeradius.org/mod_auth_radius/) The module is loaded in the Apache configuration and it works for users with the following configuration: <Location /protected/> AuthType Basic AuthName "protected" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require user foo </Location> This works and user "foobar" can login. Now I am trying to do the same with groups so i replaced the line "Require user foo" with "Require group bar" but this doesn't work. Is it possible to use group based authentication with this Apache module or am I missing something like adding some attributes to the group? I have to say I am mostly new to Radius in general but I couldn't find any help regarding mod_auth_radius-2.0 and group based authentication. Thank you for your help! Regards, Finn Christiansen

2 1

Re: Subject: Using radsniff to generate stats
by Rui Ribeiro 03 Jan '14

03 Jan '14

Hi Arran, I have read the page you refer, and you say FreeRadius has no idea about the dropped packets. Would it be possible, or interesting to modify FreeRadius to give directly stats also like for instance named provides an interface for retrieving statistics? How about performance of this particular solution of sniffing traffic? I wonder how much load? Granted, RADIUS traffic volume is particularly low, however, in linux, the packets have to be copied to userland to libpcap to use them, contrary to for example, FreeBSD. (Note: There is the PF_RING patch. I havent tested it out) Note: Dont take the comments personally, it is just in the past I have always favoured solutions that were an alternative to sniffing traffic. Regards, Rui On 3 January 2014 06:11, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 2 > Date: Thu, 2 Jan 2014 19:50:21 +0000 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Using radsniff to generate stats > Message-ID: <C45652E4-7294-42FF-A79C-D5DCD2CCEDD6(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > If anyone's interested in how to do it: > http://wiki.freeradius.org/guide/stats-with-radsniff > > Will only work with radsniff from master branch, 3.0.x version is pretty > much the same as 2.0.x. > > If enough people want (and test) the new version of radsniff, it should > be pretty easy to port it to 3.0.x and get it into a released version > sooner. > > -Arran > > >

3 4

Using radsniff to generate stats
by Arran Cudbard-Bell 02 Jan '14

02 Jan '14

If anyone's interested in how to do it: http://wiki.freeradius.org/guide/stats-with-radsniff Will only work with radsniff from master branch, 3.0.x version is pretty much the same as 2.0.x. If enough people want (and test) the new version of radsniff, it should be pretty easy to port it to 3.0.x and get it into a released version sooner. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

control check_item := being overwritten by group check_item :=
by Jonathan 30 Dec '13

30 Dec '13

we are in the progress of migrating freeradius servers and encountering behavior changes 1.X: "check_item := takes precedence over group check_item :=" 2.X: "check_item := being overwritten by group check_item :=" current_release=1.1.8 target_release=2.2.3 (or any other stable) Some more detail: sqlcounter.conf configured with: sqlcounter limitvolume { counter-name = Octets-Total check-name = Max-Octets ... } behavior for: Max-Octets with operator ":=" ONLY groupcheck item set result in 1.1.8: groupcheck-item is taken, no issue result in 2.2.3: groupcheck-item is taken, no issue behavior for: Max-Octets with operator ":=" usercheck item set groupcheck item set result in 1.1.8: usercheck-item takes precende, no issue result in 2.2.3: groupcheck-item overwrites usercheck-item, user not able to increase his volume limit independent of the group he is a member off. I've validated as well in 2.1.12 which yields the same behavior as 2.2.3. So behavior has changed from 1.x to 2.x How can I make a user inherit group items while still overriding specific user check control items. The of "=" is not allowed, so i'm currently without direction in how to get this behavior back. Is this a bug or intended behavior, and how can I resolve this? Regards, Jonathan

1 0

Per realm different counters
by Marco Marino 28 Dec '13

28 Dec '13

Hi, how can i manage per-realm different Max-Daily-Session attributes? More precisely: i have a users table that correctly authenticate clients, but i'd like to use different Max-Daily-Session if the request have "User1@realm1" or "User1@realm2". Is this possible? Another solution: Can i istantiate multiple radius server (with multiple db??) but with the same users table and make a proxy only for accounting? I'm sorry if this is a stupid question. Thanks

1 0

RE: DHCP
by Rui Ribeiro 27 Dec '13

27 Dec '13

> > Message: 1 > Date: Mon, 23 Dec 2013 11:43:04 +0100 > From: Laura Marz? Porcar <laura.marza(a)servidir.es> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: DHCP > Message-ID: > <289ECAAED2DFDB4A9D68C89DF021BC8B018B2748(a)mail-cs.MARINA.LOCAL> > Content-Type: text/plain; charset="iso-8859-1" > > Good morning Alan, I have the server in production and I want to do things > carefully. While I understand that your role is not to teach this me, but I > appreciate if you check what I'll do. > My distribution is deb?an and I have the following packages installed: > > /var/cache/apt/archives/freeradius_2.1.10+dfsg-2+squeeze1_i386.deb > /var/cache/apt/archives/freeradius-common_2.1.10+dfsg-2+squeeze1_all.deb > /var/cache/apt/archives/libfreeradius2_2.1.10+dfsg-2+squeeze1_i386.deb > /var/cache/apt/archives/freeradius-utils_2.1.10+dfsg-2+squeeze1_i386.deb > > The packages that are installed on the server are: > > freeradius install > freeradius-common install > freeradius-utils install > libfreeradius2 install > libfreetype6 install > > I should do: > - First, I've copied the entire folder /etc/freeradius in another folder > for saving my configuration > - I've to download the version 2.2.3 (wget > ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.2.3.tar.gz) > - dpkg -r (for each. deb?) > - move to the new folder created freeradius-server-2.2.3 and ./configure > --with-dhcp > > Tx! > > LAURA MARZ? PORCAR > Administraci?n de Sistemas > Departamento UUTT > 964.722.633 - ext. 741 > MARINA D'OR - Espa?a > laura.marza(a)servidir.es > http://www.marinador.com > Soporte: http://soporte.marinador.com > > -----Mensaje original----- > De: freeradius-users-bounces+laura.marza=servidir.es(a)lists.freeradius.org[mailto: > freeradius-users-bounces+laura.marza=servidir.es(a)lists.freeradius.org] En > nombre de Alan DeKok > Enviado el: viernes, 20 de diciembre de 2013 22:50 > Para: FreeRadius users mailing list > Asunto: Re: DHCP > > Laura Marz? Porcar wrote: > > Thanks Alan, Then there will be two different instances of the > application or the application will be updated? > > You will need to re-install everything. Uninstall the RPM. You can't > have two versions of FreeRADIUS on the same machine. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 104, Issue 56 > ************************************************* Hi Alan and Laura dpkg -r deinstalls everything, you will have to do it, of course. However I would advise to compile for the debs instead of doing a ./configure ; make install. In the long run, you will have less problems, and it is more consistent for system administration, and something it is missing, it will install the dependencies automagically when using aptitude, for instance. Please also dont go to the deb cache to list installed packages, do a dpkg -l, or better, installl and get used to aptitude. Regards, Rui >

3 6

Proxy DHCP-requests
by newuse＠qip.ru 25 Dec '13

25 Dec '13

Hi all, I am newbie in setting up FR 2.2.3, I am trying to proxy all request coming from dhcp to an other RADIUS server, but I can't setup FR to do this. I was trying the fowling: cat ./raddb/sites-enabled/dhcp server dhcp { listen { ipaddr = 255.255.255.255 port = 67 type = dhcp interface = eth0 broadcast = yes } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 8.8.8.8 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.16.1.1 } update control { Proxy-To-Realm := DEFAULT } # ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 8.8.8.8 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.16.1.1 } update control { Proxy-To-Realm := DEFAULT } # ok } # If there's no named section for the packet type, then the packet # is processed through this section. dhcp { # send a DHCP NAK. reject } } The proxy.conf here: cat ./raddb/proxy.conf proxy server { default_fallback = no } realm NULL { authhost = 172.16.1.5:1600 accthost = 172.16.1.5:1601 secret = testpass } realm DEFAULT { authhost = 172.16.1.5:1600 accthost = 172.16.1.5:1601 secret = testpass } Please, help to find mistake.

2 1

Debain
by Jed Gainer 24 Dec '13

24 Dec '13

I have just made a switch from Arch Linux to Debian because Arch Linux has started using FR 3.x which does not support my SQL counters. I am running into issues getting CoovaChilli to work with FreeRADIUS I keep getting the following: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 50139, id=0, length=173 Received Accounting-Request packet from client 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. Cleaning up request 0 ID 0 with timestamp +7 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 50139, id=0, length=173 Received Accounting-Request packet from client 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. Cleaning up request 1 ID 0 with timestamp +18 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 50139, id=0, length=173 Received Accounting-Request packet from client 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. Cleaning up request 2 ID 0 with timestamp +28 Ready to process requests. But the shared secret is the same in both the NAS and FR: root@hotspot2:/etc/freeradius# cat clients.conf | grep secret # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # The secret can be any string, up to 8k characters in length. # depends COMPLETELY on this secret! We recommend using a # shared secret that is composed of: # length. The secret MUST be random, and should not be words, # The default secret below is only for testing, and should secret = z6B3YT1B57rX9Bkwzqc9QSldGQDKXpDS # secret = testing123 # secret = testing123 # secret = testing123 # You can now specify one secret for a network of clients. # secret = testing123-1 # secret = testing123-2 # # secret and password are mapped through the "secrets" file. # secret = testing123 # secret = testing123 root@hotspot2:/etc/freeradius# root@hotspot2:/etc/chilli# cat config | grep HS_RADSECRET HS_RADSECRET=z6B3YT1B57rX9Bkwzqc9QSldGQDKXpDS # HS_RADPROXY_SECRET=$HS_RADSECRET root@hotspot2:/etc/chilli# Any ideas?

3 2

update
by Jed Gainer 23 Dec '13

23 Dec '13

I did a system upgrade and my silly disto upgraded FreeRADIUS to 3.0.0 so I am reconfiguring it from scratch because of the changes. I have managed to get SQL up and running but am having troubles getting my sqlcounters to work. After putting the following in /etc/raddb/mods-config/sql/counter/mysql/queries.conf sqlcounter counter_octets_daily { sql_module_instance = sql counter_name = ChilliSpot-Max-Total-Octets-Daily check_name = CS-Total-Octets-Daily reply-name = ChilliSpot-Max-Total-Octets key = User-Name reset = daily query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } I put "counter_octets_daily" in the authorize{} block after "sql" in /etc/raddb/sites-available/default but when I try and boot radiusd I get: /etc/raddb/sites-enabled/default[339]: Failed to find "counter_octets_daily" in the "modules" section. /etc/raddb/sites-enabled/default[220]: Errors parsing authorize section. When I remove "counter_octets_daily" from the authorize{} block after "sql" in /etc/raddb/sites-available/default radiusd boots but does not know what the CS-Total-Octets-Daily attribute is so I must be missing something... I can't find docs for version 3 Thanks in advance for any help

5 14

Migration from radsecproxy/RadSec problems
by JB 20 Dec '13

20 Dec '13

Hi! We're trying to migrate from FreeRADIUS 2.x with radsecproxy to FreeRADIUS 3.x and encountered two major problems. The first being that FR doesn't seem to send any replies to the client when it receives Access-Request messages via RadSec. At least we're not seeing the typical "Sending Access-Accept/Access-Reject …" messages in the debug log. The last message is always something like "Debug: (0) Auth-Type = Accept, accepting the user" but nothing regarding a response follows. We suspected SSL errors but don't find anything suspicious in the logs (server and client). The second problem is that we don't find any hints in the docs on how to configure FR 3.x to listen to both auth and acct using RadSec on port 2083. For instance: When the server receives an Accounting-On packet, we're seeing the following line in the log: Invalid packet code 4 sent from client test port 3065 : IGNORED We're using the latest git HEAD. I'd be very grateful for some pointers. (And sorry if they're blatantly obvious to you.) Thanks, JB

3 6