December 2005 - Freeradius-Users - lists.freeradius.org

help on rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
by Jie Yang 15 Dec '05

15 Dec '05

Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong? my server config? thanks, Jie Tue Dec 13 19:17:04 2005 : Debug: users: Matched supplicant_cts2@spirentcom. com at 53 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authorize]: returned from files (r lm_files) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authorize]: module "files" returns o k for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group authorize returns updated for r equest 14 Tue Dec 13 19:17:04 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Dec 13 19:17:04 2005 : Debug: auth: type "EAP" Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group authenticate for reque st 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling eap (rlm_ea p) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Request found, released from the li st Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: EAP/mschapv2 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: processing type mschapv2 Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group Auth-Type for request 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling mschap (rlm _mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for supplic ant_cts2(a)spirentcom.com with NT-Password Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is inc orrect Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: returned from mscha p (rlm_mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authenticate]: module "mschap" retur ns reject for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group Auth-Type returns reject for re quest 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Freeing handler

2 4

radclient ignores 'Group' attribute
by Bill Schoolfield 15 Dec '05

15 Dec '05

Hello, We are switching out a client from cistron radius to FreeRadius with MySQL. To test things out without changes to the NASs, we are proxing certain realms to the new FreeRadius server. Here's our problem; the proxy works fine but the authentication (actually the user lookup) is failing when testing via radclient. The user lookup fails because the 'Group' attribute in the referenced attribute file (-f file) is being ignored (not sent) by radclient. Why is this? Is there a workaround? The Group attribute is defined in the dictionary as: ATTRIBUTE Group 1005 string The attribute file used by radclient looks like: Acct-Session-Id = "6000006B", User-Name = "example(a)examp.com", User-Password = "example", Group = "default", NAS-IP-Address = 127.0.0.1, NAS-Port-Id = 32, NAS-Port-Type = Async, Service-Type = Framed-User, Framed-Protocol = PPP Thanks in advance for your response. Bill

2 2

Need "account valid for" attribute/counter (continuous time)
by Mikhail Zolikoff 15 Dec '05

15 Dec '05

Installation: Debian (sarge) + Freeradius 1.0.2 w/rlm_sqlcounter + MySQL 4.1.11 Hello, everyone! I've been trying to do the following, and I thought that I had it tonight, but I can't seem to get it: I'd like to set a "dropdead date/time" by which a user can log into my Freeradius server. I'm thinking of an attribute or counter that sets or performs the following: login-deadline or account-timeout or last-login-date or last-login-time or account-valid-for I'm not trying to limit how much a user can be logged in per unit of time (daily, monthly, etc.), but instead set the last time the user can possibly login starting from the first time they login. So, if this attribute is set to 86400, from the first time they login they can do whatever they want for a day but then they're done. Basically a continuous counter (or a math operation), whether the user is logged in or not. session-timeout works on a per session basis, so that doesn't work. Max-All-Session works like a prepaid card and only removes time in discontinuous chunks. What I really need is either an attribute or counter (like rlm_sqlcounter or rlm_counter) that can determine whether a user is close to their account deadline and let them pass through or be denied. Any thoughts? I've been banging my head against this for a while and can't seem to figure it out. I've searched just about every website and can't find a darn thing. I can get close, but nothing that takes care of the accounting without some custom programming. Thanks!

2 3

Pb with Mac and EAP auth
by Benoît Bianchi 15 Dec '05

15 Dec '05

Hi, Im using Freeradius for both Mac and WPA authentication (EAP-TTLS) of my WiFi users, and im facing a trouble I have no idea how to solve : In my users file Ive set a list of the mac address like this : # Portable MACHIN "001122334455" Auth-Type := Accept Cisco-AVpair := "ssid=Machin", Cisco-AVpair += "ssid=Machin2" And for users a password crypt file filecrypt DEFAULT Autz-Type := filecrypt The problem is that when doing EAP-TTLS authentication if I set the mac address of one of the allowed card as the login name I am authenticated!!! Is there a way to prevent this somehow? To specify that Auth-Type:=Accept is only for non EAP authentication ??? Thanks for help Benoît Bianchi <mailto:benoit.bianchi@cri.uvsq.fr> .

2 1

Cisco-AVPair SQL accounting (attr. not duplicated)
by James Wakefield (Sunet Sysadmin) 15 Dec '05

15 Dec '05

G'day, Sorry if this has been covered already, as I imagine it's a common issue, but I haven't been able to rustle any working answers up after a long time googling and grepping $FR/src. I've got an AS5300 that sends a few attributes, with accounting stop, encapsulated in Cisco-AVPair eg: Cisco-AVPair = "nas-tx-speed=53300" and the VSA hack doesn't appear to let me refer to that value in my SQL statements with either the %{nas-tx-speed} or %{Cisco-AVPair[index]} syntaxes I've seen suggested for Cisco VSAs in various places. rlm_sql complains of an unknown xlat function or non-existent attribute. Has anyone managed to do this? If so, what is the correct syntax to use these in SQL accounting statements? Cheers, -- James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West.

3 2

Freeradius as Proxy
by Nicola Iotti 15 Dec '05

15 Dec '05

Hi, I'm using Freeradius 1.0.5 as Proxy , but does anyone knows if freeradius have just to send requests from NAS to Server or also server's replies to the nas ? I mean does the radius serves reply directly to NAS or it communicates always through the freeradius proxy? Regards Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

2 1

Help with proxy scenario
by markcapelle＠pcmc.com 15 Dec '05

15 Dec '05

I have a need to proxy users based on either AD group membership or a substring in the username. I am currently using LDAP to AD . AD group membership scenario: If user is in group "x" then proxy to radius server "y". Substring scenario: If username contains string "x", then strip "x" and proxy to server "y". I believe both could work. Which is easiest and what modules are needed? Also, any examples of either would be greatly appreciated. Thanks, Mark CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0

Re: Welcome to the "Freeradius-Users" mailing list (Digest mode)
by yao guoxian 15 Dec '05

15 Dec '05

Hello! EveryOne! Nice to meet you! 2005/12/15, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org>: > > Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! > > To post to this list, send your email to: > > freeradius-users(a)lists.freeradius.org > > General information about the mailing list is at: > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > If you ever want to unsubscribe or change your options (eg, switch to > or from digest mode, change your password, etc.), visit your > subscription page at: > > > http://lists.freeradius.org/mailman/options/freeradius-users/yaoguoxian%40g… > > > You can also make such adjustments via email by sending a message to: > > Freeradius-Users-request(a)lists.freeradius.org > > with the word `help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. > > You must know your password to change your options (including changing > the password, itself) or to unsubscribe. It is: > > uvazgi > > Normally, Mailman will remind you of your lists.freeradius.org mailing > list passwords once every month, although you can disable this if you > prefer. This reminder will also include instructions on how to > unsubscribe or change your account options. There is also a button on > your options page that will email your current password to you. >

2 1

Re[4]: how get current TRAFFIC (ACCT) ?
by Andreas Sokov 15 Dec '05

15 Dec '05

Hi. [ You wrote Thursday, December 15, 2005, 2:52:10 PM ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= SE> Well you have set up your pppoe-server to send the accounting information SE> only at the end of the session. If connection is "lost", you will have the SE> accounting data in your database with AcctTerminateCause something like SE> "terminated by server". SE> The session you have sent me is just an open session. SE> As I said - you can set the Acct-Interim-Interval attribute so that your SE> server sends the accouting packets every few minutes for example. i try i insert into radreply : id UserName Attribute op Value 1 test Framed-IP-Address := 192.168.96.10 4 test Acct-Status-Type := Interim-Update 5 test Acct-Interim-Interval := 60 6 test Framed-IP-Netmask := 255.255.252.0 but it is not worked you wrote : add attribute into dictionary file tell me please IN WHAT FILE I NEED ADD IT ? and what will have to line ? into /etc/freeradius folder i c one file ./dictionaty : # # This is the master dictionary file, which references the # pre-defined dictionary files included with the server. # # Any new/changed attributes MUST be placed in this file, as # the pre-defined dictionaries SHOULD NOT be edited. # # $Id: dictionary.in,v 1.4 2004/04/14 15:26:20 aland Exp $ # # # The filename given here should be an absolute path. # $INCLUDE /usr/share/freeradius/dictionary # # Place additional attributes or $INCLUDEs here. They will # over-ride the definitions in the pre-defined dictionaries. # # See the 'man' page for 'dictionary' for information on # the format of the dictionary files. # # If you want to add entries to the dictionary file, # which are NOT going to be placed in a RADIUS packet, # add them here. The numbers you pick should be between # 3000 and 4000. # #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer what i need add there ? like this : ATTRIBUTE Acct-Interim-Interval 3003 integer ATTRIBUTE Acct-Status-Type 3004 string ?? SE> -----Original Message----- SE> From: Andreas Sokov [mailto:andre.s@j8.com.ru] SE> Sent: Donnerstag, 15. Dezember 2005 12:42 SE> To: freeradius-users(a)lists.freeradius.org SE> Cc: edvin.seferovic(a)kolp.at SE> Subject: Re[2]: how get current TRAFFIC (ACCT) ? SE> Hi. SE> [ You wrote Thursday, December 15, 2005, 2:14:10 PM ] SE> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- SE> =-= SE>> Hi, SE>> for traffic information - look at the RADACCT table in your mysql SE> database SE>> called radius. A simple sql query could be - SE> -) SE> i know what information about traffic collect in that table. SE> But please, look at this : SE> RadAcctId AcctSessionId AcctUniqueId UserName Realm SE> NASIPAddress NASPortId NASPortType AcctStartTime AcctStopTime SE> AcctSessionTime AcctAuthentic ConnectInfo_start SE> ConnectInfo_stop AcctInputOctets AcctOutputOctets SE> CalledStationId CallingStationId AcctTerminateCause SE> ServiceType FramedProtocol FramedIPAddress SE> AcctStartDelay AcctStopDelay SE> 19 43A154E9151B00 835535e0e65d3ace test SE> 213.159.102.146 0 Virtual 2005-12-15 14:35:05 0000-00-00 SE> 00:00:00 0 RADIUS 0 0 SE> Framed-User PPP 192.168.96.10 0 0 SE> 18 43A13CE87DBE00 73e57ea8afc72d3b test SE> 213.159.102.146 0 Virtual 2005-12-15 12:52:40 2005-12-15 SE> 14:10:12 4652 RADIUS 6857793 7229167 SE> User-Request Framed-User PPP 192.168.96.10 0 0 SE> look at id=19 into AcctStopTime and SE> while session OPENS! the value AcctInputOctets AcctOutputOctets == 0 SE> !!! SE> and if session will be open during 20 hourse - we can not know that current SE> value of SE> AcctInputOctets AcctOutputOctets ?! SE> What you think about it ? SE>> SELECT SUM(AcctOutputOctets) as download, SUM(AcctInputOctets) as upload SE>> GROUP BY Username ORDER BY Username ASC; SE>> This should give you a list of your users and their upload and download SE>> traffic ( list is sorted ascending by usernames ). SE>> Regards, SE>> Edvin SE>> -----Original Message----- SE>> From: freeradius-users-bounces(a)lists.freeradius.org SE>> [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of SE> Andreas SE>> Sokov SE>> Sent: Donnerstag, 15. Dezember 2005 11:33 SE>> To: freeradius-users(a)lists.freeradius.org SE>> Subject: how get current TRAFFIC (ACCT) ? SE>> Importance: High SE>> Hi, freeradius-users. SE>> Linux Debian, # uname -a SE>> Linux g48 2.6.14.3-1 #4 Sun Dec 11 05:57:57 MSK 2005 i686 GNU/Linux SE>> #freeradius -v SE>> freeradius: FreeRADIUS Version 1.0.5, for host , built on Oct 16 2005 at SE>> 11:56:56 SE>> # mysql -V SE>> mysql Ver 14.12 Distrib 5.0.13-rc, for pc-linux-gnu (i486) using SE> readline SE>> 5.0 SE>> TELL ME PLEASE : HOW I CAN GET CURRENT TRAFFIC INFORMATION ? SE>> I need to kno how much traffic user eat before it close your session. SE>> Do Know anybody ? SE>> I try radwho, radlast - but they show all but acct information SE>> Try radacct - but it is not show anything info, just run and no SE> information SE>> ... SE>> HELP PLEASE. SE> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- SE> =-= SE> -- ------------------------------------- SE> Best Regards, Andreas SE> Thursday, December 15, 2005 2:36:16 PM SE> Web-Media L.t.d. SE> +7 (901) 301-5811 SE> ICQ UIN 177624 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -- ------------------------------------- Best Regards, Andreas Thursday, December 15, 2005 2:55:28 PM Web-Media L.t.d. +7 (901) 301-5811 ICQ UIN 177624

2 1

Re[2]: how get current TRAFFIC (ACCT) ?
by Andreas Sokov 15 Dec '05

15 Dec '05

Hi. [ You wrote Thursday, December 15, 2005, 2:14:10 PM ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= SE> Hi, SE> for traffic information - look at the RADACCT table in your mysql database SE> called radius. A simple sql query could be - -) i know what information about traffic collect in that table. But please, look at this : RadAcctId AcctSessionId AcctUniqueId UserName Realm NASIPAddress NASPortId NASPortType AcctStartTime AcctStopTime AcctSessionTime AcctAuthentic ConnectInfo_start ConnectInfo_stop AcctInputOctets AcctOutputOctets CalledStationId CallingStationId AcctTerminateCause ServiceType FramedProtocol FramedIPAddress AcctStartDelay AcctStopDelay 19 43A154E9151B00 835535e0e65d3ace test 213.159.102.146 0 Virtual 2005-12-15 14:35:05 0000-00-00 00:00:00 0 RADIUS 0 0 Framed-User PPP 192.168.96.10 0 0 18 43A13CE87DBE00 73e57ea8afc72d3b test 213.159.102.146 0 Virtual 2005-12-15 12:52:40 2005-12-15 14:10:12 4652 RADIUS 6857793 7229167 User-Request Framed-User PPP 192.168.96.10 0 0 look at id=19 into AcctStopTime and while session OPENS! the value AcctInputOctets AcctOutputOctets == 0 !!! and if session will be open during 20 hourse - we can not know that current value of AcctInputOctets AcctOutputOctets ?! What you think about it ? SE> SELECT SUM(AcctOutputOctets) as download, SUM(AcctInputOctets) as upload SE> GROUP BY Username ORDER BY Username ASC; SE> This should give you a list of your users and their upload and download SE> traffic ( list is sorted ascending by usernames ). SE> Regards, SE> Edvin SE> -----Original Message----- SE> From: freeradius-users-bounces(a)lists.freeradius.org SE> [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Andreas SE> Sokov SE> Sent: Donnerstag, 15. Dezember 2005 11:33 SE> To: freeradius-users(a)lists.freeradius.org SE> Subject: how get current TRAFFIC (ACCT) ? SE> Importance: High SE> Hi, freeradius-users. SE> Linux Debian, # uname -a SE> Linux g48 2.6.14.3-1 #4 Sun Dec 11 05:57:57 MSK 2005 i686 GNU/Linux SE> #freeradius -v SE> freeradius: FreeRADIUS Version 1.0.5, for host , built on Oct 16 2005 at SE> 11:56:56 SE> # mysql -V SE> mysql Ver 14.12 Distrib 5.0.13-rc, for pc-linux-gnu (i486) using readline SE> 5.0 SE> TELL ME PLEASE : HOW I CAN GET CURRENT TRAFFIC INFORMATION ? SE> I need to kno how much traffic user eat before it close your session. SE> Do Know anybody ? SE> I try radwho, radlast - but they show all but acct information SE> Try radacct - but it is not show anything info, just run and no information SE> ... SE> HELP PLEASE. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -- ------------------------------------- Best Regards, Andreas Thursday, December 15, 2005 2:36:16 PM Web-Media L.t.d. +7 (901) 301-5811 ICQ UIN 177624

2 1