- Freeradius-Users - lists.freeradius.org

user-agent as authentication
by Budiono Untung 20 Dec '12

20 Dec '12

Hi All, I would like to make wifi hotspot , with user-agent as authentication to freeradius . The scenario is like this: If the user-agent is 'a' then it will rejected and if user-agent is 'b' then it will be allowed to login page that connected to freeradius as authenticator. Is above scenario will be possible ? TIA, Dion

2 3

Problem with proxying request
by BALSIANOK, Peter 20 Dec '12

20 Dec '12

Hi, I try to send proxy request via freeradius-2.2.0, but as i can see in the debug output, freeradius didn`t process Accounting Response ( tcpdump shows, that server got response ) rad_recv: Accounting-Request packet from host 127.0.0.1 port 49935, id=13, length=202 X-Ascend-Dial-Number != "<U+0557>\331\025" Acct-Session-Id != "d597d91572f51ab3" Service-Type != Framed-User Called-Station-Id != "orangewap" Acct-Link-Count != 1 X-Ascend-Metric != 1928665779 Acct-Authentic != Local Acct-Status-Type != Start NAS-IP-Address != 10.64.192.1 X-Ascend-PRI-Number-Type != 8 3GPP-SGSN-Address != 213.151.252.35 Calling-Station-Id != "421905012405" X-Ascend-IPX-Alias != 4294967295 Framed-Protocol != GPRS-PDP-Context User-Name != "421905012405" NAS-Identifier != "ggsn-01-bb1.orange.sk" Acct-Multi-Session-Id != "d597d9153962de6b" Framed-IP-Address != 10.10.1.1 (2) # Executing section preacct from file /app/radius/raddb/ggsn//sites-enabled/default (2) group preacct { (2) - entering group preacct {...} (2) [preprocess] = ok (2) linelog : escape: 'Start' -> 'Start' (2) linelog : expand: '%{Acct-Status-Type}' -> 'Start' (2) linelog : expand: 'Accounting-Request.%{%{Acct-Status-Type}:-unknown}' -> 'Accounting-Request.Start' (2) linelog : expand: '/app_log/radius/ggsn/ggsn-acct.dat' -> '/app_log/radius/ggsn/ggsn-acct.dat' (2) linelog : escape: 'Start' -> 'Start' (2) linelog : escape: '421905012405' -> '421905012405' (2) linelog : escape: '10.10.1.1' -> '10.10.1.1' (2) linelog : escape: 'orangewap' -> 'orangewap' (2) linelog : escape: '10.64.192.1' -> '10.64.192.1' (2) linelog : escape: '213.151.252.35' -> '213.151.252.35' (2) linelog : escape: 'd597d9153962de6b' -> 'd597d9153962de6b' (2) linelog : expand: '%{Acct-Status-Type}:%{Calling-Station-Id}:%{Framed-IP-Address}:%{Called-Station-Id}:%{NAS-IP-Address}:%{3GPP-SGSN-Address}:%{Acct-Multi-Session-Id}:%l' -> 'Start:421905012405:10.10.1.1:orangewap:10.64.192.1:213.151.252.35:d597d9153962de6b:1355835824' (2) [linelog] = ok (2) suffix : No '@' in User-Name = "421905012405", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) files : acct_users: Matched entry DEFAULT at line 25 (2) [files] = ok (2) # Executing section accounting from file /app/radius/raddb/ggsn//sites-enabled/default (2) group accounting { (2) - entering group accounting {...} (2) attr_filter.accounting_response : expand: '%{User-Name}' -> '421905012405' (2) attr_filter.accounting_response : Matched entry DEFAULT at line 103 (2) [attr_filter.accounting_response] = updated (2) # Executing section pre-proxy from file /app/radius/raddb/ggsn//sites-enabled/default (2) group pre-proxy { (2) - entering group pre-proxy {...} (2) files : preproxy_users: Matched entry DEFAULT at line 33 (2) files : expand: '%{Called-Station-Id}.%{3GPP-SGSN-Address}' -> 'orangewap.213.151.252.35' (2) [files] = ok (2) Proxying request to home server 213.151.250.149 port 1813 Sending Accounting-Request of id 93 from 255.255.255.255 port 56347 to 213.151.250.149 port 1813 X-Ascend-Dial-Number != "<U+0557>\331\025" Acct-Session-Id != "d597d91572f51ab3" Service-Type != Framed-User Called-Station-Id = "orangewap.213.151.252.35" Acct-Link-Count != 1 X-Ascend-Metric != 1928665779 Acct-Authentic != Local Acct-Status-Type != Start NAS-IP-Address != 10.64.192.1 X-Ascend-PRI-Number-Type != 8 3GPP-SGSN-Address != 213.151.252.35 Calling-Station-Id != "421905012405" X-Ascend-IPX-Alias != 4294967295 Framed-Protocol != GPRS-PDP-Context User-Name != "421905012405" NAS-Identifier != "ggsn-01-bb1.orange.sk" Acct-Multi-Session-Id != "d597d9153962de6b" Framed-IP-Address != 10.10.1.1 Event-Timestamp != "Dec 18 2012 14:03:44 CET" Proxy-State != 0x3133 Waking up in 0.3 seconds. Waking up in 0.4 seconds. (2) Expecting proxy response no later than 14 seconds from now Waking up in 13.1 seconds. (2) No proxy response, giving up on request and marking it done (2) Failing request due to lack of any response from home server 213.151.250.149 port 1813 No Post-Proxy-Type Fail: ignoring (2) Cleaning up request packet ID 13 with timestamp +323 Ready to process requests. Here is tcp dump of the communication between freeradius and 3rdparty radius server: 14:03:44.828028 IP (tos 0x0, ttl 64, id 16529, offset 0, flags [none], proto: UDP (17), length: 255) tdrad1.vas.orange.sk.56347 > dial-250-149.orange.sk.radius-acct: [bad udp cksum 9e40!] RADIUS, length: 227 Accounting Request (4), id: 0x5d, Authenticator: 872eb1da3e3ae0c483a4ee7eec20d78c Unknown Attribute (227), length: 12, Value: 0x0000: 3c55 2b30 3535 373e d915 Accounting Session ID Attribute (44), length: 18, Value: d597d91572f51ab3 0x0000: 6435 3937 6439 3135 3732 6635 3161 6233 Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Called Station Attribute (30), length: 26, Value: orangewap.213.151.252.35 0x0000: 6f72 616e 6765 7761 702e 3231 332e 3135 0x0010: 312e 3235 322e 3335 Accounting Link Count Attribute (51), length: 6, Value: 1 0x0000: 0000 0001 Unknown Attribute (225), length: 6, Value: 0x0000: 72f5 1ab3 Accounting Authentication Attribute (45), length: 6, Value: Local 0x0000: 0000 0002 Accounting Status Attribute (40), length: 6, Value: Start 0x0000: 0000 0001 NAS IP Address Attribute (4), length: 6, Value: 10.64.192.1 0x0000: 0a40 c001 Unknown Attribute (226), length: 6, Value: 0x0000: 0000 0008 Vendor Specific Attribute (26), length: 12, Value: Vendor: 3GPP (10415) Vendor Attribute: 6, Length: 4, Value: ...# 0x0000: 0000 28af 0606 d597 fc23 Calling Station Attribute (31), length: 14, Value: 421905012405 0x0000: 3432 3139 3035 3031 3234 3035 Unknown Attribute (224), length: 6, Value: 0x0000: ffff ffff Framed Protocol Attribute (7), length: 6, Value: #7 0x0000: 0000 0007 Username Attribute (1), length: 14, Value: 421905012405 0x0000: 3432 3139 3035 3031 3234 3035 NAS ID Attribute (32), length: 23, Value: ggsn-01-bb1.orange.sk 0x0000: 6767 736e 2d30 312d 6262 312e 6f72 616e 0x0010: 6765 2e73 6b Accounting Multilink Session ID Attribute (50), length: 18, Value: d597d9153962de6b 0x0000: 6435 3937 6439 3135 3339 3632 6465 3662 Framed IP Address Attribute (8), length: 6, Value: 10.10.1.1 0x0000: 0a0a 0101 Event Timestamp Attribute (55), length: 6, Value: Tue Dec 18 14:03:44 2012 0x0000: 50d0 69b0 Proxy State Attribute (33), length: 4, Value: 13 0x0000: 3133 14:03:44.832901 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto: UDP (17), length: 52) dial-250-149.orange.sk.radius-acct > tdrad1.vas.orange.sk.56347: [udp sum ok] RADIUS, length: 24 Accounting Response (5), id: 0x5d, Authenticator: d2521d74f782356ebf2d752e94dbfc82 Proxy State Attribute (33), length: 4, Value: 13 0x0000: 3133 Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

4 7

Return Access-Accept/-Reject depending on other active sessions during post-authentication
by Matthias Nagel 18 Dec '12

18 Dec '12

Hello together, my NAS supports used-based authentication, this means it is possible to have multiple sessions on the same ethernet port (same user multiple times and/or different users). Each attached supplicant must authenticate itsself. The switch prohibits a supplicant to use piggy-backing on top of some other already authenticated supplicant. Moreover I use RADIUS-assigned VLANs. If the same user or different users that are assigned to the same VLAN are authenticated on the same port, everything is fine. The trouble starts, if an additional user with a different VLAN than the VLAN that is already assigned to the port is sucessfully authenticated. In the past an additional user was denied access by the switch, if such a VLAN mismatch occured. This means is was impossible to have serveral different untagged VLANs on the same port. But my current NAS also grants access to the addtional user and assignes this user's VLAN to the port, too. This means there are more than one untagged VLAN on the same port at the same time and the result is some kind of "short-circuit fault" between the affected VLANs. Now, I would like to write some kind of RADIUS policy to prevent this behaviour. This policy is supposed to do the following during the post-authentication phase: 1) If there is no active session on the NAS port, just return Access-Accept 2) If there is at least one active session on the NAS port and the 'Tunnel-Private-Group-ID' of that session equals the 'Tunnel-Private-Group-ID' of the new request, return Access-Accept. 3) If there is at least one active session on the NAS port and the 'Tunnel-Private-Group-ID' of that session DOES NOT equal the 'Tunnel-Private-Group-ID' of the new request, return Access-Reject. Is this possible to do? I have the accounting information in a SQL database, hence I know, if there are active sessions on some port. But I do not know, which would be the correct RADIUS configuration section and I do not know if "unlang" or some other configuration directive can perform such a check. Best regards, Matthias ---------------------------------------------------------------------- Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

2 2

freeradius+mysql
by nanthitha shanmugam 18 Dec '12

18 Dec '12

Hi, I am using mysql with free radius for user authorization and accounting with assignment of ip pools from iptables in mysql. These all are working. But, I would like to know if we can bypass the authorization phase with mysql and use only ip pool assignment. Can you help in this part. Like even if the user is not authenticate, I wanted to send always access accept message with a framed ip from the ip pool table. Thanks, Nanthitha

1 0

Problem in xlat.c code
by BALSIANOK, Peter 18 Dec '12

18 Dec '12

Hi all, i have found problem in xlat.c code. Original code doesn`t work when i want to use in acct_users: DEFAULT Called-Station-Id == "orangewap" Called-Station-Id := "%{Called-Station-Id}.%{3GPP-SGSN-Address}" I have changed xlat.c [radiusd@tdrad1 main]$ diff xlat.c xlat.c.backup 1043a1044,1046 > if (isdigit(*p)) { > module_name = xlat_str = p; > } else { 1045a1049 > } Now everythink works correct. Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 5

Xlat iterate over sql result
by Stanislav Lorenc 16 Dec '12

16 Dec '12

Hi, is there some way how to iterate over xlat sql query result ? For example: I need send for user multiple ipv6 prefixes and they are stored in sql table and each prefix is represented by record in table. Query return for example 4 rows. update reply { Framed-IPv6-Prefix := "%{sql:SELECT network FROM ipv6_prefixes WHERE service = "user_service" }" } I am not able to find solution how to add all this records into reply. Best Regards Stanislav Lorenc

4 6

Simultaneous Proxy of Acct Messages to two External Radius Servers Using Replicate-To-Realm
by Jason Everard 15 Dec '12

15 Dec '12

We have been trying to get freeradius to work to do something I know works because I have seen it posted to this list on a few occasions. We have a Radius NAS (Cisco WLC) that is sending auth data to multiple Radius servers (not freeradius rather MS NPS and Cisco ACS and Cisco ISE) Problem is that we have several Radius receivers that need to see all of the accounting records from the WLC to make decisions re: the 802.11i session. So the sole function of the freeradius deployment is to proxy all received accounting packets to multiple Radius receivers simultaneously. We have been trying to get it to work with "Replicate-To-Realm := ISE" in the corresponding virtual-server configuration, however it doesn't work. The only way we can get the freeradius installation to send accounting packets to another external radius box is to use "Proxy-To-Realm" which requires a response from the server and does not seem to send the radius accounting packets to more than the first realm listed, i.e. preacct { preprocess update control { Replicate-To-Realm := ISE Replicate-To-Realm += BlueCoat } Doesn't work at all. However, the following will send the accounting packets to the ISE realm and NOT to the BlueCoat realm until the ISE realm is marked dead. preacct { preprocess update control { Proxy-To-Realm := ISE Proxy-To-Realm += BlueCoat } We want the Replicate-To-Realm functionality where the behaviour is to "send-and-forget" and to NOT require an accounting response from either server and where all packets are sent to ALL realms listed. We are running 2.1.12 currently. Is this maybe a bug that is fixed in 2.2.0? Regards, Jason

2 1

Need Help to Troubleshoot MySQL Auth FreeRadius 2.1.X
by Prabhpal S. Mavi 15 Dec '12

15 Dec '12

Dear Freeradius Hackers, This is new implementation. Can someone help me to troubleshoot why freeradius mysql authentication is failing. i have cross check every expect but still seem that something is not in place. What is i have done: installed Freeradius + MySQL Databases Configured Freeradius & Created MySQL Database. configured the following files: "sql.conf" "radiusd.conf" "default" enabled in radiusd.conf to "$INCLUDE = sql.conf" Radius is up and running without authentication even from localhost. Radius database is setup properly, no problem to start/stop "radiusd" radios_log are shown in section below. Results: tail -f "/var/log/radius/radius.log - Output Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server <default> Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server inner-tunnel Sat Dec 15 11:20:34 2012 : Info: ... adding new socket proxy address * port 32959 Sat Dec 15 11:20:34 2012 : Info: Ready to process requests. ========================================================================= Output of "radiusd -X" ... adding new socket proxy address * port 51412 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ======================================================================== Command to Check the radius Authentication: radtest mark mypassword localhost 1812 99THi49UGotool Output: Sending Access-Request of id 48 to 41.171.71.61 port 1812 User-Name = "mark" User-Password = "radmin" NAS-IP-Address = 192.168.3.106 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 ====================================================================== Two MySQL Radius Users PAY attention to the field "OP" (:= & ==) But auth is not working for any user. mysql> select * from radcheck where UserName='mark'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 3 | mark | radmin | := | 99THi49UGotool | +----+----------+-----------+----+-----------------+ 1 row in set (0.00 sec) mysql> select * from radcheck where UserName='dany'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 1 | dany | badmin | == | 99THi49UGotool | +----+----------+-----------+----+-----------------+ radius is up and running without authentication "== or :=" make no difference none of the user can authenticate. ============================================ selinux off freeradius is up mysql db is up there are two database users why auth would be failing? Any tip or clue would be greatly appreciated Thanks / Regards

2 1

Auth-Type already set?
by Lorenzo Milesi 15 Dec '12

15 Dec '12

I'm having a problem with FR2.1.10 and MD5 Passwords with MySQL. When I try to enable PAP I get the following: # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "F0073402", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> F0073402 [...] rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop the sites-enabled/default is: authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap noresetcounter dailycounter monthlycounter } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix sql exec attr_filter.accounting_response } session { sql } post-auth { sql exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } What's wrong? :( thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

3 3

EAP
by David Peterson 13 Dec '12

13 Dec '12

I wanted to ping the Eduroam people about EAP over WAN links. Are there considerations that can cause connectivity issues that I should be examining? David

3 6