- Freeradius-Users - lists.freeradius.org

how to add two ip pool
by ranjan kumar 13 Sep '12

13 Sep '12

Hi All, I am trying to add two default entries in users file for two ip pool. can it is possible to add two entries of default in users file ? If yes then how ? Please help me its very critical. I have configured two ippool which looks like: =================================================================== In Users file: DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := myippool Service-Type == Framed-User, Framed-Protocol == 7, Fall-Through == no, Acct-Interim-Interval = 500 DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := my_sec_ippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 In radiusd.conf ippool myippool { range-start = 192.168.2.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ippool my_sec_ippool { range-start = 192.168.1.1 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ==================================================================== When i am executing ./radiusd -X always getting IPs for only one ggsn. Please help me its very critical. Thanks in Advance. Regards Ranjan

2 1

Problem in configuring multiple IP pool
by ranjan kumar 13 Sep '12

13 Sep '12

Hi, I have created two ip pool in radiusd.conf which looks like below: ======================================================= In radiusd.conf ippool myippool { range-start = 192.168.182.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = yes maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ippool my_sec_ippool { range-start = 192.168.182.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = yes maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } --------------------------------------------------------------------------------------------------------------- In user updated like below: DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := myippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := my_sec_ippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 ======================================================= When I am executing radius server in debug mode i.e ./radiusd -X then getting the below error ======================================================= radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_aag Module: Instantiating module "aag" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/aag aag { integer = 1 boolean = no ipaddr = * } openfile opened /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//admin/log/error/startup.log LoggingLevel.conf path...../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/logginglevel.conf alarminglevel.conf path...../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/alarminglevel.conf Loggerportno conf file path..../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/loggerportno.conf } radiusd: #### Loading Virtual Servers #### server { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = aag Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/unix unix { radwtmp = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/preprocess preprocess { huntgroups = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/huntgroups" hints = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/files files { usersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/users" acctusersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/acct_users" preproxy_usersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/detail detail { detailfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/radutmp radutmp { filename = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server coa { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-enabled/coa modules { Module: Checking recv-coa {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking send-coa {...} for more modules to load } # modules } # server server originate-coa.example.com { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-available/originate-coa modules { Module: Creating Post-Proxy-Type = Fail-CoA Module: Creating Post-Proxy-Type = Fail-Disconnect Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server WARNING: Server originate-coa.example.com is empty, and will do nothing! server Access_Gateway { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking accounting {...} for more modules to load /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf[890]: Failed to load module "myippool". /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf[877]: Errors parsing accounting section. ===================================================================================================== Please look into my problem and guide me to come out of this problem. Thanks, Regards Ranjan

2 1

Re: In Access-Request h323-remote-address Multiple times How to get it in SQL query
by Blake Covarrubias 13 Sep '12

13 Sep '12

On Sep 12, 2012, at 11:57 PM, "Ankur - BillCall" <ankur.kalavadia(a)billcall.net> wrote: > We are getting h323-remote-address multiple times. How can I get both attribute in sql query for authentication? > > I set sql_user_name = "%{h323-remote-address}". But I get sql_user_name = Trunk ID (000111) only. How can I get IP XXX.105.4.197? You probably want this. sql_user_name = "%{h323-remote-address[1]}" Read "man unlang". Specifically section "String lengths and arrays". -- Blake Covarrubias

1 0

In Access-Request h323-remote-address Multiple times How to get it in SQL query
by Ankur - BillCall 13 Sep '12

13 Sep '12

Hi All, We have configure freeradius on centos with mysql. We are developing solution for Wholesale VOIP. We need to authenticate user on basis of Trunk Id & IP. We are getting Trunk Id and IP in h323-remote-address attribute. Please find my Access-Request. Packet-Type = Access-Request User-Name = "bk" User-Password = "8888891990942XXXX" h323-conf-id = "377BE9DC FC071910 90FB000C 290E95CC" Cisco-AVPair = "remote-media-address=XXX.105.4.197" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=88888919974063392" h323-remote-address = "000111" h323-remote-address = "XXX.105.4.197" Calling-Station-Id = "bk" Called-Station-Id = "88888919974063392" Service-Type = Login-User NAS-IP-Address = 79.99.198.YYY remote-media-address = "XXX.105.4.197" session-protocol = "cisco" gw-rxd-cdn = "8888891997406XXXX" We are getting h323-remote-address multiple times. How can I get both attribute in sql query for authentication? I set sql_user_name = "%{h323-remote-address}". But I get sql_user_name = Trunk ID (000111) only. How can I get IP XXX.105.4.197? Thanks & Regards, Ankur

1 0

[ANN] Version 3.0.0-beta0
by Arran Cudbard-Bell 12 Sep '12

12 Sep '12

The v2.1.x branch was created almost exactly 3 years ago (14/09/2009), and has diverged from the master branch significantly. The majority of the potentially disruptive code changes have now been completed for 3.0 and it is at a stage where community testing would be helpfull. To provide a single point to test against, the release_3_0_0_beta0 tag has been created. The tarball is available here: https://github.com/alandekok/freeradius-server/tarball/release_3_0_0_beta0 Instructions for converting existing 2.1.x configurations are available here: https://github.com/alandekok/freeradius-server/blob/release_3_0_0_beta0/rad… Please post any defects to http://bugs.freeradius.org. The interim changelog for 3.0 is as follows: FreeRADIUS 3.0.0 Mon 01 Jan 8:00:00 CEST 2010, urgency=medium Feature improvements * Largely configuration file compatible with 2.1.x. * Documentation for upgrading from 2.x is in raddb/README.rst Please follow it. Do not just install 3.0. * Updated packet encode/decoder. The resulting code is much simpler and easier to extend. * Updated internal API to support new attributes and formats * Added RADIUS over TLS (i.e. RadSec). See raddb/sites-available/tls * Added "extended attributes" using the new encoder/decoder. * Added the "integer64" data type. * Added full WiMAX support, using the new encoder/decoder. The old code could not handle some unusual corner cases. * Added code to send SNMP Traps. See raddb/trigger.conf. * Added support for Apple's Grand Central Dispatch * Added for MS-CHAP Change Password from Phil Mayers. See raddb/mods-available/mschap, "passchange" subsection. * Added provisions for raddb/dictionary.local, for local changes. See raddb/dictionary for more details. * Added EAP-PWD implementation from Dan Harkins * Added packet/s tracking. See max_pps in the "listen" sections, and auto_limit_acct in the "thread pool" section. * Moved configuration entries in radiusd.conf to make more sense. * Moved raddb/modules/ to raddb/mods-available, and raddb/mods-enabled, following the examples of other projects. * Moved eap.conf to mods-available/eap * Moved sql.conf to mods-available/sql * Moved TLS configuration for EAP into a common subsection. See raddb/mods-available/eap, tls-config section. * Added internal connection pool API, this consolidates connection management code that was previously spread across many modules. Advantages are that it actually works, well, under nearly all conditions, supports triggers, and has 'elastic' limits on the numbers of connections. * SQL now uses the connection pool. * SQL query config has changed to support arbitrary Acct-Status-Types, this change breaks config compatibility with 2.1.x. Configurations must be updated. Bug fixes * All known bug fixes from 2.1.x are included. * Removed "addport" functionality. All features and bug fixes from 2.2.0 are also included.

1 0

Radius Config and Router
by George Innocent 12 Sep '12

12 Sep '12

Hello; I have configured the radius and some servers to authenticate through the Radius. I can authenticate well from the servers but the same is not working on the routers. Users have been created on the router as a test before implementation. The log file has credentials that i have not created. Thanks to assist -- Regards: George Innocent.

4 7

Multiple EAP config
by BILLOT 12 Sep '12

12 Sep '12

Hi, We have a config with 3 virtual servers, running on a different port. Each virtual server must have a particular config (different LDAP server, different SQL server). However, each one uses EAP auth and so the inner-tunnel which is unique. Thus in the inner-tunnel config, default modules are used (ldap and SQL). How can we use a different EAP config for each server and so one particular config for each inner-tunnel ? BR,

3 5

Re: freeradius OTP with OATH
by Thomas Glanzmann 12 Sep '12

12 Sep '12

Hello Henk, > I've looked closely at your video and accomplishment with smsotp, > congrats! thank you. However the video shows something that is outdated. I now wrote a perl module for rlm_perl which does it much better without all the moving parts. > Did you also had a look at OATH TOTP instead of SMS authentication? > This is a RFC (http://tools.ietf.org/html/rfc6238) as you may know. A > user installs an app on their phone which implements this RFC (e.g. > Google Authenticator) and it acts as a soft token. I did and evaluated it together with RADIUS. > I've got this running with freeradius and the google authenticator PAM > module. The downside of PAM is the lack of challenge-access and > response support (AFAIK). If you want a challenge response integration like the user first needs to authenticate with username and password and than gets a challenge and needs to answer with a response that is possible. You could also tweak it that you leave the first step out. Just have a look at the rlm_perl implementation in http://thomas.glanzmann.de/smsotpd.2012-08-16.tar.bz2 > Do you know of anything that supports OATH and TOTP natively with > freeradius and can be used with the access-challenge/response system > (or am I wrong about PAM not supporting that feature)? I think there was a module, but I don't recall, maybe ask the FreeRadius List, or grep in the modules directory. I take it on CC. Cheers, Thomas

2 3

Adding reply AVPs to a replicated proxy request
by Chadwick Sorrell 12 Sep '12

12 Sep '12

Hello, I'm using replicate to proxy my authorization and accounting requests to a server. I'm curious if it's possible to add some of the auth reply attributes to the auth proxy before I send it over. That way the proxied auth has both the request and the reply. Thanks

2 1

Adding reply AVPs to an authorization proxy
by Chadwick Sorrell 11 Sep '12

11 Sep '12

Hello, I'm using replicate to proxy my authorization and accounting requests to a server. I'm curious if it's possible to add some of the auth reply attributes to the auth proxy before I send it over. That way the proxied auth has both the request and the reply. Thanks

1 0