July 2005 - Freeradius-Users - lists.freeradius.org

Acct-Unique-Session-Id changing mid-session?
by Roger Kristiansen 04 Jul '05

04 Jul '05

Hi, I'm working on a script for parsing some freeradius log files and getting them into a database, and I've noticed some (to me) strange behaviour. It looks like a few sessions change Acct-Unique-Session-ID mid-session. What I see is that there is issued a "Acct-Status-Type = Start" entry and a few "Alive"-entries, before the "Acct-Unique-Session-Id" field suddenly changes, seemingly out of nowhere, and more "Alive"-entries keep coming with this new ID. This while the user is the same, there has been no new "Stop" and/or "Start" entry, and the "Alive"-entries enter the log at the correct times (15 min. apart). The MAC addressand IP-adress are also the same over all entries. Is this a known issue or some easily explainable behaviour? As far as I know, the server is running version 0.93. I'm sorry if this mail is a bit lacking in technical detail, but I'm not very familiar with RADIUS at all. If some some essential technical info is missing, please tell me, and I will get it from the administrator. :) Regards, Roger Kristiansen

2 1

Unable to install FreeRadius 1.0.4 [HELP PLEASE]
by TeemX 04 Jul '05

04 Jul '05

Hi Guys & Gals, I am having problem on installing my FreeRadius Server Version 1.0.4. I am running at Linux RedHat 9. Errors message as below: gmake[10]: *** [sql_mysql.o] error 1 gmake[10]: leaving directory '/root/freeradius-1.0.4/src/modules/rim_sql/drivers/rlm_sql_mysql' all the way down to gmake[1]: *** [common] Error 1 gmake[1]: Leaving director '/root/freeradius-1.0.4' make: *** [all] Error 2 Could anyone help me on this, I am totally new to FreeRadius. Thanks. Jackie

3 2

Client with Window OS?
by Yam Biz 04 Jul '05

04 Jul '05

-I want to have a small FreeRadius Server with AAA, billing system but i don't have any NAS in NAS list, can you advise me? -Can i have i client with Window OS? -How can FreeRadius supports billing system with pre-paid or post-paid? --Thanks so much-- Yam Biz __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 6

Traffic does not pass trought AP1300
by Sergey Velikanov 04 Jul '05

04 Jul '05

I setup my Radius as described at http://web.archive.org/web/20031206113912/http://www.alphacore.net/spipen/a… My Windows XP SP2 successful Authenticate using EAP-TLS, in radius log i see Sending Access-Accept of id 39 to 192.168.10.100:1645 MS-MPPE-Recv-Key = 0xefc02ac383a3a2faddaad9a7aea6cdab9cfe5a2a8ab6523225b11a321da469f9 MS-MPPE-Send-Key = 0x3d64ab1c9fe9f3aaf81115320f7e1253561415ee882671dda23cbd9181b1c6c1 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Sergey Velikanov" Everything works fine, but from my Windows I can ping nothing I use Cisco AP1300 as AP, and when I type bridge#show dot11 associations 0060.1d1e.245c bridge#show dot11 associations 0060.1d1e.245c Address : 0060.1d1e.245c Name : NONE IP Address : 0.0.0.0 Interface : Dot11Radio 0 Device : unknown Software Version : NONE CCX Version : NONE State : EAP-Assoc Parent : self SSID : protected VLAN : 0 Hops to Infra : 1 Association Id : 84 Clients Associated: 0 Repeaters associated: 0 Tunnel Address : 0.0.0.0 Key Mgmt type : NONE Encryption : WEP Current Rate : 11.0 Capability : Supported Rates : 1.0 2.0 5.5 11.0 Signal Strength : -48 dBm Connected for : 19 seconds Signal Quality : N/A Activity Timeout : 59 seconds Power-save : Off Last Activity : 1 seconds ago Packets Input : 56 Packets Output : 16 Bytes Input : 6723 Bytes Output : 3108 Duplicates Rcvd : 0 Data Retries : 0 >Decrypt Failed : 45 RTS Retries : 0 MIC Failed : 0 MIC Missing : 0 Packets Redirected: 0 Redirect Filtered: 0 it seems that all traffic rejected by AP1300m why? Is it Radius, Cisco or my old orinoco card(I've bought it about 4 years ago) also in cisco's log I see *Mar 1 05:08:00.483: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 0060.1d1e.245c Associated KEY_MGMT[NONE] Is it normal that KEY_MGMT = NONE ? PS: This is my AP1300 config bridge#sh run int dot11Radio 0 Building configuration... Current configuration : 423 bytes ! interface Dot11Radio0 no ip address no ip route-cache ! encryption mode wep mandatory ! ssid protected authentication open eap eap_methods authentication network-eap eap_methods guest-mode ! short-slot-time concatenation speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 rts threshold 4000 station-role root ap-only infrastructure-client bridge-group 1 end

2 1

EAP-TTLS and PEAP auth problem ... sorry!!
by Gandalf the Gray 04 Jul '05

04 Jul '05

I forgot to explain the real problem! I cannot authenticate any user, try to connect to my network through a supplicant, both from Windows and from WPA-supplicant under Linux. It seems no EAP-challenge is really going on. this is the output from tre radius server after a try made by AEGIS client under windows XP, with PEAP __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

EAP-TTLS and PEAP auth problem
by Gandalf the Gray 04 Jul '05

04 Jul '05

Hi, I'm new on this mailing list, please help me clearly. I need to build a Wireless-net based on Freeradius as authentication server, a Cisco aironet 1200 AP, and WPA with TKIP encryption. I need to use TTLS or PEAP, for they allow users to don't user their own certificates, to make connection a little bit easier. when I start my freeradius server, this is what I see: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Because of I'm novice, I think everything is OK. next, I provide my configuration file, everything together, and hope this will help! Thank you sooo much for your attention and help! See you And __________________________________ Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html

1 0

RE: Unable to install FreeRadius 1.0.4 [HELP PLEASE]
by Ross Tsolakidis 03 Jul '05

03 Jul '05

I think you need the mysql-dev libraries/packages. Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of TeemX Sent: Tuesday, 5 July 2005 2:34 AM To: freeradius-users(a)lists.freeradius.org Subject: Unable to install FreeRadius 1.0.4 [HELP PLEASE] Hi Guys & Gals, I am having problem on installing my FreeRadius Server Version 1.0.4. I am running at Linux RedHat 9. Errors message as below: gmake[10]: *** [sql_mysql.o] error 1 gmake[10]: leaving directory '/root/freeradius-1.0.4/src/modules/rim_sql/drivers/rlm_sql_mysql' all the way down to gmake[1]: *** [common] Error 1 gmake[1]: Leaving director '/root/freeradius-1.0.4' make: *** [all] Error 2 Could anyone help me on this, I am totally new to FreeRadius. Thanks. Jackie - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

strangeness with cisco_vsa_hack=yes ...
by Ilia Chipitsine 03 Jul '05

03 Jul '05

Dear Sirs, I'm running freeradius-1.0.4 for h323 accounting from Cisco AS5350. I turned cisco_vsa_hack to "yes", but according to detail (and pgsql-voip module) not all Cisco-VSA are decoded to normal AV pairs: (I replaced several fields with XXXX in order to hide IP addresses) Sat Jul 2 09:26:14 2005 Acct-Session-Id = "00039908" Calling-Station-Id = "73512287317" Called-Station-Id = "73512327225" Cisco-AVPair = "call-id=766F6970 6D726B74 A04FC642 7C760600" h323-setup-time = "09:26:08.476 BST Sat Jul 2 2005" h323-gw-id = "XXXXXXXXX" h323-conf-id = "D0236F56 EA0811D9 B31C9978 D534BC2D" h323-call-origin = "answer" h323-call-type = "VoIP" Cisco-AVPair = "h323-incoming-conf-id=D0236F56 EA0811D9 B31C9978 D534BC2D" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:73512327225" Acct-Input-Octets = 360 Acct-Output-Octets = 5556 Acct-Input-Packets = 67 Acct-Output-Packets = 195 Acct-Session-Time = 0 h323-connect-time = "09:26:14.670 BST Sat Jul 2 2005" h323-disconnect-time = "09:26:14.670 BST Sat Jul 2 2005" h323-disconnect-cause = "10" h323-remote-address = "XXXXXXXXX" Cisco-AVPair = "release-source=2" h323-voice-quality = "0" Cisco-AVPair = "remote-media-address=XXXXXXXXXXX" Cisco-AVPair = "out-trunkgroup-label=Chel" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:1,#:73512287317" User-Name = "mos-spa-gkp-1" Acct-Status-Type = Stop Service-Type = Login-User NAS-IP-Address = XXXXXXXXXXXX Acct-Delay-Time = 0 call-id = "766F6970 6D726B74 A04FC642 7C760600" h323-incoming-conf-id = "D0236F56 EA0811D9 B31C9978 D534BC2D" subscriber = "Unknown" session-protocol = "cisco" gw-rxd-cdn = "ton:0,npi:1,#:73512327225" Client-IP-Address = XXXXXXXXXXX Acct-Unique-Session-Id = "e8c1a697340192ad" Timestamp = 1120292774 as far as I can see, decoded fields: Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "h323-incoming-conf-id=D0236F56 EA0811D9 B31C9978 Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "call-id=766F6970 6D726B74 A04FC642 7C760600" not decoded fields: Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:73512327225" Cisco-AVPair = "release-source=2" Cisco-AVPair = "remote-media-address=XXXXXXXXXXX" Cisco-AVPair = "out-trunkgroup-label=Chel" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:1,#:73512287317" why does it decode just few fields ? what did I do wrong ? Cheers, Ilia Chipitsine

2 1

how to populate Postgresql base with users ?
by Leonardo B. Cuquejo (Arachnius) 02 Jul '05

02 Jul '05

Dear Sirs, I want to implement PPTP server (either mpd or poptop) with CHAP+MPPE authentication against freeradius. I've successfully configured freeradius+postgresql, but I'm lost in the database, I've no idea how to populate database. Can anyone provide me some dump for example ? (including sample user, sample password and sample parameters for connection) Thanks!

2 1

Current CVS logging issue
by Dinko Korunic 01 Jul '05

01 Jul '05

Hi. I believe that it might be a bug in current CVS. I've encountered an issue that FreeRADIUS does not log nor into files, nor into syslog, no matter what the configuration says [always dumps on stdout/stderr]. I've tried to track down the cause, and it might be this: arwen:~/work/cvs/radiusd-cvs/src/main# cvs diff -u mainconfig.c Index: mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.63 diff -u -r1.63 mainconfig.c --- mainconfig.c 26 May 2005 21:26:29 -0000 1.63 +++ mainconfig.c 20 Jun 2005 09:17:45 -0000 @@ -945,8 +945,8 @@ * * This really is a hack, but it works... */ - if ((debug_flag < 2) && - (mainconfig.radlog_dest != RADLOG_STDOUT)) { + if (debug_flag < 2) + { mainconfig.radlog_dest = lrad_str2int(str2dest, radlog_dest, RADLOG_NULL); if (mainconfig.radlog_dest == RADLOG_NULL) { fprintf(stderr, "radiusd: Error: Unknown log_destination %s\n", I believe that mainconfig.radlog_dest doesn't get initialised, since local radlog_dest is used: static char *radlog_dest = NULL; as well as: { "log_destination", PW_TYPE_STRING_PTR, -1, &radlog_dest, "files" }, That would mean that (mainconfig.radlog_dest != RADLOG_STDOUT) is obviously a bogus check, since it should check radlog_dest, rather than mainconfig.radlog_dest. -- NAME:Dinko.kreator.Korunic NOTE:Standard.disclaimer.applies URL:kreator.esa.fer.hr IRC:kre ICQ:16965294 PGP:0xea160d0b

2 2