July 2005 - Freeradius-Users - lists.freeradius.org

Re: Authentication Responses during error conditions
by Doug Hardie 29 Jul '05

29 Jul '05

I am a bit confused now. I understood that if a module returns RLM_MODULE_FAIL that radiusd would not return an authorization reject. However, it appears that it still does. rad_recv: Access-Request packet from host 127.0.0.1:53579, id=193, length=71 User-Name = "visitor" User-Password = "asdfjkle" Called-Station-Id = "8053342021" Calling-Station-Id = "3232546586" rad_lowerpair: User-Name now 'visitor' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 59 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry visitor at line 51 modcall[authorize]: module "files" returns ok for request 0 rlm_lafn: Found USER_NAME rlm_lafn: Found NAS rlm_lafn: Found Calling ID rlm_lafn: Found Called ID rlm_lafn: Found Hint get_time returns 60 Unable to connect to 0: Can't connect to MSQL server on 0 modcall[authorize]: module "lafn" returns fail for request 0 modcall: group authorize returns fail for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 193 to 127.0.0.1:53579 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 193 with timestamp 42e96be9 Nothing to do. Sleeping until we see a request. zool# ./visitor Received response ID 193, code 3, length = 20 From radiusd.conf: # Authorization. First preprocess (hints and huntgroups files), authorize { preprocess files lafn }

3 5

Simultaneous-Use Problem
by Jeremy Kenney 29 Jul '05

29 Jul '05

I have posted this twice now I was wondering if someone would be kind enough to possibly answer it Hello, I am a very frustrated free radius user at this point. Its most likely my brain not working right but here is my problem I have a free radius server that does authentication for our slipstream accelerator. The accelerator passes an attribute to the radius server and identifies the client into a group. This works fine. How ever I am having problems else where we currently want to use the same radius server to do dialup authentication. It currently is working to do this. We use freeradius with mysql. I am having problems with users dialing into the system more then once from more then one location at the sometime. I.E a simultaneous use problem. I cannot check against the NAS because we dont have our own nases and are doing pass-thru radius authentication. I need to do some kind of simultaneous use checking Im really frustrated can someone point me in the right direction.

3 3

EAP-TTLS and PAP inner tunnel authentication
by lists.mailing＠surasoft.com 29 Jul '05

29 Jul '05

Hi, >From a suggestion on the mailing list I plan on using EAP-TTLS and PAP inner tunnel authentication. The reason I'm going this route is because I want to authenticate against linux user accounts and the password is encrypted in /etc/shadow so the ms-chap route is no good since it can't work with encrypted passwords. How do I configure free radius to work with EAP-TTLS and PAP inner tunnel authentication, I wasn't able to find much on the net. I'm quite a fast learner however. Are there any sample config files for what I'm after? Setting up the clients seems easy from here. http://vuksan.com/linux/dot1x/wpa-client-config.html Sura

2 1

ICRadius to FreeRadius Migration
by Karma Foxx 29 Jul '05

29 Jul '05

Hello all. I've been put in a situation in which I am forced to replace our old icradius server. Upon finding support and development for icradius has been discontinued for quite some time, I was persuaded to give FreeRadius a shot due to its widespread acceptance, praise, and most naturally its snappy web front-end. I'm now stuck with the task of migrating our old (mySQL) databases, as we have far too many users to re-enter manually. Wilst I have done my best to make the original icradius tables congruent with the new freeradius setup, my efforts have been rewarded with a week of frustration. Unfortunately, even the wise google has come up nearly empty handed in our searches for a tutorial or even some small scrap of information relevant to quick-and-painless or just slightly painful migration; thus I turn to this mailing list - if anyone has come across and could point myself and fellow archive-searchers in the direction of a resource no matter how mind-tearing or vague, it would be very much appreciated; any place to start is a good place as I'm just picking this up as I go along. My basic setup is as such: Old ICRadius server -------------- Mandrake 9.1, Apache 2x, icradius 0.18 with php front-end, mysql 4 installed locally New FreeRadius server -------------- Gentoo Linux, apache 2x, php4x, freeradius 1.0.2-5, freeradius-dialupadmin 1.70, mysql installed elsewhere Standalone mySQL Server ------------- Gentoo Linux, Apache 2x, php4x, phpMyAdmin 2.6.3 (which is what I have done the bulk of my table-tinkering with), mySQL 4.0.24 I presently have the old icradius database sitting in the standalone sql server (while the production and up-to-date version remains on the original server) as 'oldradius' and the freeradius installation-script-generated database as 'radius'. All I've really done thus far is modify the structure of the tables in 'oldradius' so that they can be easily copied. Unfortunately, this presents the problem of having several columns with null or incorrect values. It would really help to know if there are some key default values that will get things done even in the dirtiest of manners if anyone is familliar with the differences between icradius and freeradius in dealing with mySQL. Thanks in advance to any who reply; if nothing at all, it will certainly be beneficial to the apparent lack of documentation on these situations. Karma Foxx

3 3

dialup_admin CVS produces checkrad defunct
by Muenz, Michael 29 Jul '05

29 Jul '05

Hi, yesterday I've updated dialup_admin to CVS version. Most things works great, but my radiusd produce many defunct processes now. Any ideas? radius01:/usr/local/dialup_admin/bin# pstree init-+-atd [..] |-mysqld_safe---mysqld---mysqld---22*[mysqld] |-radiusd---radiusd-+-2*[radiusd---6*[checkrad]] | |-radiusd---5*[checkrad] | |-radiusd---10*[checkrad] | `-radiusd---9*[checkrad] radius01:/usr/local/dialup_admin/bin# ps ax [...] 21874 ? Z 0:00 [checkrad <defunct>] 22080 ? Z 0:00 [checkrad <defunct>] 22335 ? Z 0:00 [checkrad <defunct>] 22501 ? Z 0:00 [checkrad <defunct>] [...] I have a second radius machine with an old CVS version (1.75) and there are no defunct's. FreeRadius is running 1.0.4 on both machines, and use mysql for usermanagement. Michael

2 1

Using RADIUS for content filtering.
by Rohaizam Abu Bakar 29 Jul '05

29 Jul '05

Dear all, I've given one assignment to create some sort of tunneling to cache server (netcache) to do some content filtering when browsing. There will be 2 cache-server. One passing all traffic & another one will do content filtering.. When user subscribe to this service (for their children maybe).. When user doing authentication, what should i include in the profile for the traffic to be diverted to cache server that do the filtering? Is it possible to use below? Or pls suggest suitable method.. Login-Service: TCP-Clear Login-IP-Host: 10.1.1.1 Service-Type: Login-User Login-TCP-Port: 80 I've heart about method L2TP tunnelling with ERX/SDX (juniper) .. But that seems costly... thanks.. --haizam

2 1

[ntlm_auth problem with peap] Some users are authenticated some are not
by Ceyhun K� 29 Jul '05

29 Jul '05

Hi, I've setup freeradius 1.0.4 for authenticating wireless users. I use peap authentication with ntlm_auth. Setup work fine for most of the users. My ntlm auth command from radiusd.conf is as follows: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Some user's authentication is rejected with "Logon failure (0xc000006d)" Error. I tried Radius exec--program in command line, it didn't work either. Same message ... Problematic user's active directory authentication works fine for domain. Perhaps it is a bun in ntlm_auth. Any idea?

1 0

german freeradius fourm
by Peter Lehmann 28 Jul '05

28 Jul '05

Hello, Please apologize that the following is in german only. It's an announcement of a german forum about freeradius. --------------- Ich hoffe es ist ok das hier auf die Liste zu schreiben.... Ich habe ein deutschsprachiges Forum zu Freeradius gefunden: www.freeradius.de Es ist noch nicht sehr belebt, aber vielleicht kann man das ja ändern. Enschuldigt bitte, dass ich hier so einfach Werbung dafür mache, aber ich finde es eine gute Sache. Bin persönlich kein Fan von Mailinglisten und finde persönlich einen Austausch auf Deutsch einfacher. Grüße / best regards Peter -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse für Mail, Message, More +++

1 0

Simple question abot Event-Timestamp
by Valeriy V. Peshkoff 28 Jul '05

28 Jul '05

Hello! I need to insert Event-Timestamp in request destinated to some realm. Reading documentation i find only one correct way Here is my preproxy_users DEFAULT Realm == "crossroam.com" Idle-Timeout := `%{Idle-Timeout:-60}`, <- Worked Acct-Interim-Interval := `%{Acct-Interim-Interval:-600}`, <- Worked Class := `%{Class:-78578757_4783748}`, <- Worked Event-Timestamp := `%{Event-Timestamp:-%{l}}` <- Doesn't work. Got this in debug preproxy_users: Matched entry DEFAULT at line 24 radius_xlat: '60' radius_xlat: '600' radius_xlat: '0x31363738375f3934373837' radius_xlat: '' ... Event-Timestamp := "Jan 1 1970 03:00:00 MSK" How can i add correct event-timestamp using preproxy_users? Or may be there is a another way? -- Russia, St. Petersburg Quantum Communications Valeriy V. Peshkov | simps(a)quantum.ru +7 (812) 327-6131 +7 (812) 327-1442

2 1

Simultaneous-Use
by Jeremy Kenney 28 Jul '05

28 Jul '05

Hello, I am a very frustrated free radius user at this point. It's most likely my brain not working right but here is my problem I have a free radius server that does authentication for our slipstream accelerator. The accelerator passes an attribute to the radius server and identifies the client into a group. This works fine. How ever I am having problems else where we currently want to use the same radius server to do dialup authentication. It currently is working to do this. We use freeradius with mysql. I am having problems with users dialing into the system more then once from more then one location at the sometime. I.E a simultaneous use problem. I cannot check against the NAS because we don't have our own nases and are doing pass-thru radius authentication. I need to do some kind of simultaneous use checking I'm really frustrated can someone point me in the right direction.

2 1