- Freeradius-Users - lists.freeradius.org

Re: Question about interaction Between Vmware View 5.1 and smsotp
by Thomas Glanzmann 27 Mar '13

27 Mar '13

Hello Stéphane, > It works. Thank you. Yes, the radiusd process listen on some > multiples ports and i was wrong when i put the value 1812 on VMware > View. for the list. The problem was that View was configured to port 1812 which does not do SMSOTP with my configuration, so we reconfigured it to port 11812 and it worked. > A little question, this is normal workflow => Client view ask for > user/pass AD => ASk for OTP => ask again for user/passAD? If I remeber correctly you either should put the username as: domain\username or username(a)full.realm.de than it should ask only once. But the last time I configured it with View is one year ago. Cheers, Thomas

1 0

Re: Question about interaction Between Vmware View 5.1 and smsotp
by Thomas Glanzmann 27 Mar '13

27 Mar '13

Hello Stéphane, can you please send a screenshot of your View Radius Configuration, your full configuration and the full debugging output which includes an authentication request from pap_challenge_request.pl and from View. Cheers, Thomas

1 0

How can I change proxy based on username?
by John Horne 26 Mar '13

26 Mar '13

Hello, Using Freeradius 2.1.10 I have been trying to see if I can proxy a request to a remote server but using a different User-Name attribute based on the original request User-Name attribute. For example so that: Request 'j.bloggs(a)plymouth.ac.uk' gets proxied to remote server with User-Name="j.bloggs(a)plymouth.ac.uk" in the proxy request. Request 'jbloggs(a)plymouth.ac.uk' gets proxied to the same remote server but uses the User-Name="jbloggs" attribute (so no realm) in the proxy request. So basically if a username contains a dot, then proxy on the whole thing (username and realm). But if the username does not contain a dot, then only proxy on the username, no realm. I have been trying in the authorize section to use: ========================= if (Realm !~ /^(NULL|DEFAULT|LOCAL)$/) { if (User-Name =~ /^([^.]+)@/) { update control { Proxy-To-Realm := NULL } } } ========================= The NULL realm will 'strip' the username, and proxy the request to the remote server. However, testing shows that the User-Name being sent is the original one still with the realm: ========================= Tue Mar 26 12:31:07 2013 : Debug: ++? if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) Tue Mar 26 12:31:07 2013 : Debug: ? Evaluating (Realm !~ /^(NULL| DEFAULT|LOCAL)$/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: ++? if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: ++- entering if (Realm !~ /^(NULL| DEFAULT|LOCAL)$/) {...} Tue Mar 26 12:31:07 2013 : Debug: +++? if (User-Name =~ /^([^.]+)@/) Tue Mar 26 12:31:07 2013 : Debug: ? Evaluating (User-Name =~ /^([^.]+)@/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: +++? if (User-Name =~ /^([^.]+)@/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: +++- entering if (User-Name =~ /^([^.]+)@/) {...} Tue Mar 26 12:31:07 2013 : Debug: ++++[control] returns updated Tue Mar 26 12:31:07 2013 : Debug: +++- if (User-Name =~ /^([^.]+)@/) returns updated Tue Mar 26 12:31:07 2013 : Debug: ++- if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) returns updated Tue Mar 26 12:31:07 2013 : Debug: ++[local_mschap] returns noop Tue Mar 26 12:31:07 2013 : Debug: [eap] Request is supposed to be proxied to Realm NULL. Not doing EAP. Tue Mar 26 12:31:07 2013 : Debug: ++[eap] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[files] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[expiration] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[logintime] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[pap] returns noop ... Tue Mar 26 12:31:07 2013 : Debug: Sending Access-Request packet to host 141.163.1.180 port 1812, id=140, length=191 Tue Mar 26 12:31:07 2013 : Debug: User-Name = "jbloggs(a)plymouth.ac.uk" Tue Mar 26 12:31:07 2013 : Debug: NAS-IP-Address = 127.0.0.1 Tue Mar 26 12:31:07 2013 : Debug: Calling-Station-Id = "02-00-00-00-00-01" Tue Mar 26 12:31:07 2013 : Debug: Framed-MTU = 1400 Tue Mar 26 12:31:07 2013 : Debug: NAS-Port-Type = Wireless-802.11 Tue Mar 26 12:31:07 2013 : Debug: Connect-Info = "CONNECT 11Mbps 802.11b" Tue Mar 26 12:31:07 2013 : Debug: EAP-Message = 0x020c00261900170301001b3fb7e62a2e47d33ede49271ebc0c70dc92c4a82ac889c9b1867ddc Tue Mar 26 12:31:07 2013 : Debug: State = 0x28af050f0000013700018da3c9b4000000035b2fcad100 Tue Mar 26 12:31:07 2013 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Tue Mar 26 12:31:07 2013 : Debug: Realm = "plymouth.ac.uk" Tue Mar 26 12:31:07 2013 : Debug: EAP-Type = PEAP Tue Mar 26 12:31:07 2013 : Debug: Proxy-State = 0x3132 ========================= As the output shows 'Request is supposed to be proxied to Realm NULL', so the authorize bit seems to be working, but the realm is not being stripped from the username. The proxy.conf file simply has: ========================= realm NULL { auth_pool = local_proxies } ========================= So the realm should be stripped from the username. Anyone any ideas about this? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

4 7

(no subject)
by Mehdi Ravanbakhsh 26 Mar '13

26 Mar '13

Hi All I am create stored persedure in postgresql database named "findout_cuncurrent_session_for_a_user_result" that return "Deny" or "Permit" . I need to call this persidure in session section but it not working i check all policy that be explaned in unlang man page but this cod is not working : session { if ("{%sql:select findout_cuncurrent_session_for_a_user_result ('%{User-Name}','%{NAS-IP-Address}','%{Called-Station-Id}','%{Calling-Station-Id}')}" == "Deny") { update control { Pool-Name := "Exceeded-Concurrent-Session" } } } What is the problem? Do i write sql query write ? (this query is work fine in sql.conf )

3 5

definitive info on authenticating to AD via NTLMv2
by Alex Sharaz 26 Mar '13

26 Mar '13

Hi., I've been running ntlm_auth to authenticate our 802.1x users against AD for a number of months without problems…… until this morning when our Systems group tightened up auth requirements to only use NTLMv2. and my ntlm_auth module started failing I'm running FR van 2.2 and samba Vsn 3.6.3 All the web stuff I've found doesn;t seem to mention v2 at all. Back in the dim and distant past I got round the ntlm v2 issue when using OSC Radiator by proxying off auths to Radiator running on a windows machine bound to AD and using their AuthBy LSA authentication mechanism. So, anything special I need to do to auth using ntlmv2? Can it be done? only reference I found was to have client ntlmve auth = yes in smb.conf Rgds Alex

4 11

Wrong destination port in reply to DHCP relay
by Бен Томпсон 26 Mar '13

26 Mar '13

Hello Everyone I have an issue with an installation of FreeRADIUS 2.2.0 configured for DHCP, and I am seeing a problem where FreeRADIUS is replying to the wrong port on the DHCP relay. The request comes in like this :- Received DHCP-Discover of id de6dc6f2 from 10.77.1.254:68 to 10.0.0.1:67 But the the server replys like this :- Sending DHCP-Offer of id de6dc6f2 to 10.77.1.254:68 The problem is that the relay is expecting the reply on port 67, so I am getting an ICMP port unreachable message back and the DHCP offer is lost. I found a similar thread from 2008 which says that this was fixed: http://lists.freeradius.org/pipermail/freeradius-users/2008-June/029146.html However, this is quite a while ago and I guess that lots of things have changed, so I would be grateful if someone could verify the current v2.2.0 code for me to check that the fix is in there. Thanks Ben

2 2

Server switch
by Emmanuel BILLOT 26 Mar '13

26 Mar '13

Hi, We have a Freeradius server configured with 3 instances, each using particular authorize, authenticate and accounting section. Each server listen on a particular port. Each server is used by a WLAN on access point. Our problem is that many "basic" access point can only declare one radius server. Our solution works with hardware that can declare 3 radius server (1 serveur but 3 different ports). We want to modify this so that all WLAN use only one radius server, with the default port. Considering request show lines like Called-Station-Id = "C0-8A-DE-3D-B4-09:TEST" or Called-Station-Id = "C0-8A-DE-3D-B4-09:WIFI" where TEST and WIFI are the SSID concerned. How can we route request to different ports of the server (so instances) by using this ? I mean when SSID is TEST, request is redirected to local instance on port 1820, and when SSID is WIFI, request is redirected to local instance on port 1821 ? BR,

3 9

Getting clients from a mysql table
by Peter Kaagman 26 Mar '13

26 Mar '13

Hi there list, I've been trying to get my client list from a MySql table. For this I've edited radius.conf to include sql.conf and edited sql.conf to reflect my database configuration and set readclients = yes. There is a table "nas" which has several records for the NAPs I have. When I restart radiusd I see no traffic on the mysql server coming from the freeradius server. And client are not loaded. Just the ones in clients.conf are loaded. I've excluded clients.conf from the configuration, which results in no clients at all. I would verry much like to have my clients in a database, which would simplify management a lot. But am at a loss what to do. I'm using: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 On a CentOS release 6.3 (Final) Packages installed: [root@hades raddb]# yum list installed|grep radius freeradius.x86_64 2.1.12-4.el6_3 @updates freeradius-mysql.x86_64 2.1.12-4.el6_3 @updates freeradius-perl.x86_64 2.1.12-4.el6_3 @updates freeradius-utils.x86_64 2.1.12-4.el6_3 @updates The radiusd -X output included has clients.conf included Met vriendelijke groet, Peter Kaagman / Atlas College / Systeembeheer FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules-enabled/ including configuration file /etc/raddb/modules-enabled/attr_filter including configuration file /etc/raddb/modules-enabled/perl including configuration file /etc/raddb/modules-enabled/files including configuration file /etc/raddb/modules-enabled/chap including configuration file /etc/raddb/modules-enabled/pap including configuration file /etc/raddb/modules-enabled/digest including configuration file /etc/raddb/modules-enabled/preprocess including configuration file /etc/raddb/modules-enabled/detail including configuration file /etc/raddb/modules-enabled/unix including configuration file /etc/raddb/modules-enabled/exec including configuration file /etc/raddb/modules-enabled/expiration including configuration file /etc/raddb/modules-enabled/radutmp including configuration file /etc/raddb/modules-enabled/acct_unique including configuration file /etc/raddb/modules-enabled/expr including configuration file /etc/raddb/modules-enabled/mschap including configuration file /etc/raddb/modules-enabled/logintime including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client ap { ipaddr = 10.0.9.151 require_message_authenticator = no secret = "secret" nastype = "cisco" } client ap { ipaddr = 10.0.9.152 require_message_authenticator = no secret = "secret" nastype = "cisco" } client ap { ipaddr = 10.0.9.153 require_message_authenticator = no secret = "secret" nastype = "cisco" } client ap { ipaddr = 10.0.9.154 require_message_authenticator = no secret = "secret" nastype = "cisco" } client ap { ipaddr = 10.0.9.155 require_message_authenticator = no secret = "secret" nastype = "cisco" } client switch { ipaddr = 10.0.9.47 require_message_authenticator = no secret = "testing123" nastype = "other" } client switch { ipaddr = 10.0.9.12 require_message_authenticator = no secret = "secret" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = Perl Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=ATLAS --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /etc/raddb/modules-enabled/perl perl { module = "/home/pkn/perl/radius/radius.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules-enabled/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules-enabled/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules-enabled/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules-enabled/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 47230 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.

4 6

unlang CONDITIONS and sql query
by Mehdi Ravanbakhsh 26 Mar '13

26 Mar '13

Hi All I am create stored procedure in postgresql database named "findout_cuncurrent_session_for_a_user_result" that return "Deny" or "Permit" . I need to call this procedure in session section but it not working i check all policy that be explaned in unlang man page but this is not working : session { if ("{%sql:select findout_cuncurrent_session_for_a_user_result ('%{User-Name}','%{NAS-IP-Address}','%{Called-Station-Id}','%{Calling-Station-Id}')}" == "Deny") { update control { Pool-Name := "Exceeded-Concurrent-Session" } } } What is the problem? Do i write sql query write ? (this query is work fine in sql.conf )

2 1

ldap connection status
by Chitrang Srivastava 25 Mar '13

25 Mar '13

Hi, I want to do something like this in *authorize* section if (ldap reachable) files else files_local Is it possible, how do I know if ldap server is reachable or not. I create 2 modules of files ( for ldap and local users , and both has different configs )

4 8