- Freeradius-Users - lists.freeradius.org

Session-Timeout
by Emmanuel BILLOT 18 Jan '13

18 Jan '13

Hi, We want to "force" Session-Timeout for all our users. Authorization and authentication are made by LDAP. Is it possible to add Session-Timeout in a file or config file to apply it to all our users ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

Re: Session-Timeout
by Alan Buxey 18 Jan '13

18 Jan '13

Yes. You could do it simply with users file, use unlang in post-auth or add it to LDAP as 3 places to start with (just one way is enough!) And you'll need to ensure tour NAS kit follow/honours the value you provide. If you are proxying a la eduroam then the remote site providing the service will decide what to do. They may honour your value, they may filter it out or they may override it with their chosen value alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Send Access-Reject when user does not match any group?
by Bogdan Enache 18 Jan '13

18 Jan '13

Hi, Is there a way to configure FreeRadius 2.1.10 to send Access-Reject on users which don't match any of the defined groups? I tried with: DEFAULT Group-Name !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No and DEFAULT Group !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No as the last and only rule in "users" but it isn't working, freeradius still sends Access-Accept, even if the user does not match any groups. Thanks!

2 7

Question on attributes
by Tiago 17 Jan '13

17 Jan '13

Hello everyone, I'm struggling with something that should be simple to fix. I have a rp-pppoe NAS server here that correctly understand a few attributes (radreply) that come from freeradius 1.x (w/mysql database). Example: Download (for download rates) attribute Simple real example, from pppoe server: # cat /var/run/radattr.ppp479 .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Download 12000 Upload 3072 Its ok. However, when I change the auth target to redirect auth requests to my freeradius 2.x (using the same database as freeradius 1.x), I will get the customer authenticated perfectly, but: # cat /var/run/radattr.pppxxx .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Without Download/Upload attributes. Debugging my freeradius 2.x I get a few relevant lines: including dictionary file /etc/freeradius/dictionary (which contains the same attributes as freeradius 1.x, including Download/Upload) .... few sql lines here... [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lokan' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lokan' ORDER BY id .... few other SQL lines here rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "852236" [pap] Using clear text password "852236" [pap] User authenticated successfully ++[pap] returns ok Login OK: [lokan/852236] (from client pppoe01 port 110 cli 52:E6:FC:9C:54:E7) # +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 192 to NASPPPOE01 port 48956 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cliente = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Framed-MTU = 1500 WISPr-Bandwidth-Max-Down = 256000 WISPr-Bandwidth-Max-Up = 256000 Finished request 0. Going to the next request What I'm missing? it seems like the attributes are not being sent to NAS, but I could be wrong. Thanks in advance for any help.

3 9

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Ajay Garg 17 Jan '13

17 Jan '13

I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? On Mon, Jan 7, 2013 at 11:35 AM, Ajay Garg <ajaygargnsit(a)gmail.com> wrote: > > > On Sun, Jan 6, 2013 at 8:00 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> Ajay Garg wrote: >> > I just realised that I can put the issue in a simpler realm (not >> > requiring any externally written client-code files ) :: >> > >> > I am unable to get "TLS-authentication" working, when a >> > "Fedora-17-client" tries to connect to a "WPA/WPA2-Enterprise network" >> > through "gnome-shell-applet", via Freeradius-running-on-Fedora-17". >> >> Look at the debug logs on the server. And on the client. Without >> that, your message is content-free. >> > > > Thanks Alan for the reply. > > a) > Alan, I am attaching the logs of "sudo /usr/sbin/radiusd -X". > These logs show failure-decryption errors. > > b) > Also, I tried taking up the "/var/log/messages" for only the > trying-to-connect duration (via "sudo rm /var/log/messages"; "sudo touch > /var/log/messages"), but the file then showed empty :( Please let me > know if this is indeed required; if yes, I will post this file too. > > c) > Also, I am attaching a snapshot of the settings entered for connecting to > the network. > > > > >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > -- > Regards, > Ajay > -- Regards, Ajay

5 30

Use of %{Framed-IP-Address} in dialup.conf
by Örn Arnarson 16 Jan '13

16 Jan '13

I'm logging into MySQL via post_auth_query = SQL query. I've added some fields that I want to log, such as the allocated IP address, the NAS IP address and the Calling-Station-ID. All fields are logging fine except for Framed-IP-Address which just seems to be absent. Is that variable not supposed to be accessible at that point? Here's an example entry from radreply, showing that I am indeed using Framed-IP-Address: +-----+---------------------+-------------------+----+--------------+ | id | username | attribute | op | value | +-----+---------------------+-------------------+----+--------------+ | 1 | username(a)host.com | Framed-IP-Address | := | 10.10.10.10 | Here's what I have in dialup.conf: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, response, nas, location, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{Framed-IP-Address}', \ '%{NAS-IP-Address}', \ '%{Calling-Station-ID}', '%S')" Is there anything obvious that I'm missing? Any suggestions on where to look for problems? Best regards, Örn

3 5

Slow Ldap Authorization
by Tyler Brady 15 Jan '13

15 Jan '13

Version 2.1.10 Since adding LDAP authorization, my login time has slowed down quite a bit. It takes 4 or 5 seconds longer for freeRadius to get through all of the [ldap] fields and send an Access-Accept. Is this a normal amount of time, or is there something in my configuration that is causing this slow down? LDAP Module: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "172.28.64.10" identity = "CN=User Name,OU=Phoenix_Users,DC=company,DC=com" password = password basedn = "DC=company,DC=com" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{contr$ groupmembership_attribute = memberOf # base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 Debug: Ready to process requests. rad_recv: Access-Request packet from host 172.28.64.3 port 1645, id=98, length=85 User-Name = "RadiusUser" User-Password = "password" NAS-Port = 3 NAS-Port-Id = "tty3" NAS-Port-Type = Virtual Calling-Station-Id = "172.28.64.119" NAS-IP-Address = 172.28.64.3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "RadiusUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: DC=company,DC=com -> DC=company,DC=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> RadiusUser [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.28.64.10:389, authentication 0 [ldap] bind as CN=User Name,OU=Alaska_Users,DC=company,DC=com/password to 172.28.64.10:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(cn=Radius-Users)(|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom)))) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=User Name,OU=Alaska_Users,DC=company,DC=com, with filter (objectclass=*) [ldap] performing search in CN=Radius-Users,OU=Alaska_Users,DC=company,DC=com, with filter (cn=Radius-Users) rlm_ldap::ldap_groupcmp: User found in group Radius-Users [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok [ldap] performing user authorization for RadiusUser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> RadiusUser [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] expand: DC=company,DC=com -> DC=company,DC=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user RadiusUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> TRUE ++? if (!control:Auth-Type) -> TRUE ++- entering if (!control:Auth-Type) {...} +++[control] returns noop ++- if (!control:Auth-Type) returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=RadiusUser [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 98 to 172.28.64.3 port 1645 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Motorola-WIBB-Auth-Role = security-officer-role Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 98 with timestamp +17 Ready to process requests. T. Brady

3 7

how to test a user in db from free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, I have configured freeradius server + oracle database 11g. I send user1 in the Access-Request from radclient to the free-radius server. I need to check whether user1 is exists in user_test table, which is in oracle database 11g. The table contains username - 'user1' and status--'valid' If user found in user_test table Access-Accept else Access-Reject should return to the radclient. Note : should not use 'users' file Please help me how can do that?........................ Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

how to call stored procedure with output varaibles in free-radius
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, How to call my own stored procedure ,which takes input and output variable in free-radius server. How do i do that ??? please help.................... Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 (Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

6 7

how to call stored procedure in free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi Arran, Thanks for your reply.... have created stored procedure(myS1Request) in oracle database 11g as shown below, procedure takes input and output parameters. The below procedure should be called in the SQL module in Free-radius for Authentication and Authorization purpose. PROCEDURE myS1Request( UserName IN VARCHAR2, MessageType IN LONG, RemoteAddress IN LONG, FemtoAp IN VARCHAR2, RadCoverageInd IN LONG, RadCellId IN LONG, Rad3GCellId IN LONG, RadGeoCord IN LONG, RadAltDirection IN LONG, HNBIPAddress IN LONG, RadPLMNId IN LONG, HNBCellIdentity IN LONG, RadLocAreaLAC IN LONG, RadRoutAreaCode IN LONG, RadServiceArCode IN LONG, RadCSGId IN LONG, RadUECap IN LONG, Result OUT VARCHAR2, RadRegRejCau OUT LONG, RadLocBlacklInd OUT LONG, HNBCellId OUT LONG, RadServiceAreaC OUT LONG, RadLocationAreaI OUT LONG, RadRoutAreaC OUT LONG ) please help me how can proceed........... . Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com Message: 2 Date: Tue, 15 Jan 2013 10:46:08 +0000 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: how to call stored procedure with output varaibles in free-radius Message-ID: <C47F1EE1-3524-4709-85FA-79D0B268C5D6(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 15 Jan 2013, at 06:22, "Lakshmi Narayana Baliah" <LB0074453(a)techmahindra.com> wrote: > Hi All, > > How to call my own stored procedure ,which takes input and output variable in free-radius server. > > How do i do that ??? please help.................... Guessing you're referring to stored procedures in SQL? Or are you misusing SQL terminology to refer to something like a subroutine or function writen in the policy language? -Arran ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 93, Issue 42 ************************************************ ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2