October 2005 - Freeradius-Users - lists.freeradius.org

Freeradius and What's Up Gold Continued
by Linda Pagillo 25 Oct '05

25 Oct '05

Good morning Mr. DeKok: I already sent this message to the list once, but i'm not sure that it got there because i was having email server issues that day. If you have already seen this and responded, i did not get your response. I changed my WUG timeout from 5 sec to 30 seconds as a test. The same thing was happening as usual. I would get a few good responses and then WUG would tell me that Freeradius was down. Then i changed my timeout to 60 seconds. I have not gotten a message from WUG telling me that Freeradius is down since i did that and that was several days ago.. Does that mean that my first suspision was correct about Freeradius taking up to 60 seconds to respond to a sent request at times? Also, i know that you said WUG should re-transmit the packet in a case like this, but i have WUG set to only send one request every 20 minutes because i monitor my entire network with WUG and if i sent a request to Freeradius every few seconds, i would have to send a "request" to all of my servers every few seconds. With WUG it doesn't let you send requests to different things at different times. It's set to poll everything at once. I'm coming to the conclusion that i paid way too much for a crappy monitoring system. Thanks! Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

3 2

Denying /dev/null shell accounts
by Scott Walker 25 Oct '05

25 Oct '05

Hi All, I have requirements that I prevent users with a shell of /dev/null from authenticating against freeradius server. Using the rpm provided with RHEL4.0: radiusd: FreeRADIUS Version 1.0.1 I am using the unix module and pam. /dev/null is not listed as a valid shell in /etc/shells, and accounts with /dev/null are currently able to log in (via the DEFAULT entry in the users file). /etc/passwd is not used and accounts are stored on a ldap server. users: DEFAULT Auth-Type = PAM Service-Type = Framed-User, Framed-Protocol = PPP, Ascend-Idle-Limit = 1200, Ascend-Maximum-Time = 15800 radiusd.conf: pam { pam_auth = radiusd } /etc/pam.d/radiusd: auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth /etc/shells: /bin/sh /bin/bash /sbin/nologin /bin/ash /bin/bsh /bin/ksh /usr/bin/ksh /usr/bin/pdksh /bin/tcsh /bin/csh /bin/zsh Any ideas around this? Thanks

2 1

SQL NAS table
by Alex M 25 Oct '05

25 Oct '05

Can some one point me to the documentation on use of SQL NAS table? So that I can add nas devices to the DB and not a text file? Thanks!

2 3

help newbie here
by achan awungshi 25 Oct '05

25 Oct '05

Hello friends, can you please suggest me whether i can used this freeradius for caching/proxy server only ? If yes please let me know. thanking you. Regards, Achandash __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

2 1

adding a stop packet
by Chuck 25 Oct '05

25 Oct '05

We are using freeradius with mysql. Is there some kind of script to easily add a fake stop date/time to a user when one gets missed? Currently I am looking them up in the accounting table and manually editing the entry. Would like to find something that just takes username as input and creates a stop based on current date/time. We don't use the accounting for anything other than getting usage reports so if a few users are incorrect , no matter. This happens frequently ( several times a week) that we don't get stop packets from our upstream. Then when users attempt a login, simultaneous use check item kicks in and denies them. They claim there is nothing they can do about it. -- Chuck

2 2

RE: Cisco and No NAS-Port seen (checkrad)
by Jonathan De Graeve 25 Oct '05

25 Oct '05

>Ok, i know what the problem is, but how can i instruct the cisco that it >must send the NAS-Port attribute?, is this even posible? Depends on the nas. Which nas? J.

2 1

Problem with Password and MySQL
by Fabio 25 Oct '05

25 Oct '05

Hi, I am trying to use MySQL to autenticate users of a wireless network, using EAP-TTLS-PAP or PEAP-MS-CHAPv2. I use the following users file: user1 User-Password == "user1" DEFAULT Suffix == "@mydomain.org", Autz-Type := SQL while I have the following user in radcheck in MySQL mysql> select * from radcheck; +----+----------+---------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-------+ | 11 | sql1 | User-Password | == | sql1 | +----+----------+---------------+----+-------+ 1 row in set (0.00 sec) Logging with the user "user1" work fo both TTLS-PAP and PEAP-MS-CHAP-V2 (Tested with wpa_supplicant (both TTLS and PEAP) and MS Windows XP (PEAP)). When i try to authenticate as the user sql1 (which is in the MySQL DB), works for TTLS-PAP but doesn't work with PEAP. Seems that inside the file "users" are handled both PAP and MS-CHAPv2 password, while with MySQL I can use only PAP. The relevant part of the log with radiusd -X is provided below. Thanks to anyone helping with this. auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user.

2 1

How config the Linux to let the freeradius auto-boot when the rad ius bootup.
by Yan-GTAC Li 25 Oct '05

25 Oct '05

The Linux version is RedHat 9. Thanks a lot! Rico

2 1

EAP-SIM test
by Raoul Demour 25 Oct '05

25 Oct '05

Hello! I just started using free radius. Why? because I need to make a supplicant for my studies which which support EAP-SIM.I am studying Computer Science at University of Applied Sciences (Yverdon-les-Bains / Switzerland). And so I hope that my questions are not too stupid... Does someboby know which programme or library was use to test freeRADIUS (as long as it support EAP-SIM)? How they do on the supplicant side? Or does someone know a any library to make EAP-SIM message? If somebody has install a authentification with smart card, what do you use? USB dongle for SC? Other readers? Any ideas or experiences would be appreciated. Best regards. __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

2 1

RE: adding a stop packet
by Jonathan De Graeve 25 Oct '05

25 Oct '05

I use automatic timestamps on update /default and run a script every minute to check if there are some records which hasn't been updated for 15minutes or more J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Michael Markstaller Verzonden: dinsdag 25 oktober 2005 20:58 Aan: FreeRadius users mailing list Onderwerp: RE: adding a stop packet I'm running something like this from crontab: UPDATE radacct SET AcctStopTime = FROM_UNIXTIME(unix_timestamp(AcctStartTime) + AcctSessionTime), AcctTerminateCause = 'NoStopRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)), AcctSessionTime = AcctSessionTime + 300 WHERE AcctStopTime = '' AND (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)) > 3660 AND AcctSessiontime > 0 ; UPDATE radacct SET AcctStopTime = AcctStartTime, AcctTerminateCause = 'NoStop-AliveRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime))) WHERE AcctStopTime = '' AND AcctSessionTime = 0 AND (unix_timestamp(now()) - unix_timestamp(AcctStartTime)) > 86400 ; /* Purge failed attempts */ DELETE FROM radacct WHERE AcctStopTime > 0 AND AcctSessionTime = 0 AND AcctStopTime <= DATE_SUB(CURDATE(),INTERVAL 7 DAY); Michael > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Chuck > Sent: Tuesday, October 25, 2005 8:30 PM > To: freeradius-users(a)lists.freeradius.org > Subject: adding a stop packet > > > We are using freeradius with mysql. Is there some kind of > script to easily add > a fake stop date/time to a user when one gets missed? > Currently I am looking > them up in the accounting table and manually editing the > entry. Would like to > find something that just takes username as input and creates > a stop based on > current date/time. We don't use the accounting for anything > other than > getting usage reports so if a few users are incorrect , no matter. > > This happens frequently ( several times a week) that we don't > get stop packets > from our upstream. Then when users attempt a login, > simultaneous use check > item kicks in and denies them. They claim there is nothing > they can do about > it. > > -- > > Chuck > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0