August 2005 - Freeradius-Users - lists.freeradius.org

simultanius use
by Jeremy Kenney 01 Aug '05

01 Aug '05

Hello ok I'm closer the simultanius use works but its not doing it for the dialup its only doing it for the slipstream-auth group I have a dialup-yes group for allowed dialup customers and it doesn't seem to work Can you help

1 0

XP supplicant and Secure Cerficate acceptance
by jck-freeradius＠southwestern.edu 01 Aug '05

01 Aug '05

I am running FreeRadius 1.0.4 and using XP supplicants. My problem is after authenticating against FreeRadius, XP asks me to OK the server certificate. I do not want to manually validate the server certificate. XP should be able to validte the certificate by itself, as long as the cert has been issued by a valid Certificate Authority. I have tried using certs from DigiCert and Verisign. Does anyone else see this same problem? How can this step be automated so that my users are not requried this additional click? --johnk

3 2

Problems with Simultaneous-Use
by jck-freeradius＠southwestern.edu 01 Aug '05

01 Aug '05

= This is a re-post. I received no help from the previous posting = Hello, I am having problems with Simultaneous-Use and checkrad. I know that checkrad is not running because: grep debug /usr/local/sbin/checkrad # Config: $debug is the file you want to put debug messages in #$debug = ""; $debug = "$logdir/checkrad.log"; and: -- tail -F /var/log/radius/checkrad.log Fri Jul 29 12:57:30 2005 checkrad Usage: checkrad nas_type nas_ip nas_port login session_id -- (nothing new is showing up in the checkrad log file, except for when I run it by hand) I have both the Perl SNMP modules installed, along with NET-SNMP (and the correct syntax for NET used in the checkrad script, even though it should be using the perl modules first). I am able to manually use snmpwalk /fine/. Here is how my SQL table looks: mysql> select * from radgroupcheck; +----+------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+------------+------------------+----+-------+ | 1 | pirate | Simultaneous-Use | := | 2 | | 2 | pirate-stu | Simultaneous-Use | := | 2 | | 3 | pirate-stf | Simultaneous-Use | := | 2 | | 4 | pirate-fac | Simultaneous-Use | := | 2 | | 5 | pirate-its | Simultaneous-Use | := | 1 | +----+------------+------------------+----+-------+ Here are the related sections from my radiusd.conf file: radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 # callerid = "yes" } # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } And here is my sql.conf file: # Simultaneous Use Checking Queries ####################################################################### # simul_count_query - query for the number of current connections # - If this is not defined, no simultaneouls use checking # - will be performed by this module instance # simul_verify_query - query to return details of current connections for verification # - Leave blank or commented out to disable verification step # - Note that the returned field order should not be changed. ####################################################################### # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Here is how my radacct table looks: mysql> select * from radacct order by RadAcctId desc limit 1; +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+ | 281 | 0000019F | c91763dbcdfe02cb | johnk | | 192.168.0.49 | 558 | Wireless-802.11 | 2005-07-29 15:03:06 | 0000-00-00 00:00:00 | 0 | RADIUS | | | 0 | 0 | 0014.691e.e9c0 | 000e.35b5.eb8f | | Framed-User | | | 0 | 0 | +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------- hecate:/etc/raddb # tail naspasswd # WARNING: Always make sure that this file has the "-r------" permission. # And, don't set the passwords on your other systems to the same # passwords that can be found below. # # #203.172.90.118 !root TufFseCrET #203.172.42.152 !root ToTaLCnTl 192.168.0.49 hecate:/etc/raddb # grep 192.168 -A 3 clients.conf client 192.168.0.49 { secret = xXxXxXxX shortname = Aironet1100-johnk nastype = cisco The proper accounting configuration lines have been included in my Cisco AP conf. My username is part of the pirate-its group; 1 connection allowed. What I find interesting is that if I connect once: radwho Login Name What TTY When From Location johnk John Koen shell S534 Fri 14:57 192.168.0 ...then if I open a second connection (from another machine, at the same time as the first connection): radwho Login Name What TTY When From Location johnk John Koen shell S535 Fri 14:58 192.168.0 Notice that radutmp seems to forget about the first connection, and only remember the newest (connection number 2) connection. On this 2nd connection attempt I should be Rejected instead of Accepted. I see nothing in the checkrad log of checkrad running. What else can I try? --johnk - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----- End forwarded message ----- --

1 0

access-challenge
by Srinivasa Rao Chigurupati 01 Aug '05

01 Aug '05

Hi 1. Will FreeRadius challenges with access-challenge if auth-type is PAP? If answer is it depends on some configuration, how to configure it? 2. How FreeRadius understands incoming Radius access-request packet contains PAP authentication information, CHAP authentication information or MS-CHAP authentication information or other authentication information? -- Thanks Srinivasa Rao Chigurupati

2 3

System requirements
by alfonso celestino 01 Aug '05

01 Aug '05

Hi, Can someone help me with the following problem? I need a freeradius Server for a wireless network with Approximately 15,000 users with Approximately 2,000 simultanous users and I need to know which are the system requirements(like CPU, Memory, Processor,...) for a good server performance. thanks in advance Alfonso Celestino DGSCA, UNAM ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 1

WRT54GS (sveasoft) with Freeradius 1.0.2
by Rajeev Pokkyarath 01 Aug '05

01 Aug '05

Hello! I am trying to use Linksys WRT54GS with Firmware_Alchemy-6.0rc3lw031 (sveasoft) against my freeradius server (1.0.2). Basically trying to setup a hotspot scenario. But eventhough I enter a valid username/password in the login page, I am not able to login. I ran the radius server in the debug mode and I see that the server is sending the Access-Accept packet (I also notice that it is re-sending it). Instead of my freeradius server, I tested against the server hosted by chillispot, (https://radius.chillispot.org/radius/) (freeradius?) and it seems to be working fine. Any thoughts that might lead me to the right direction? or any known issues? Cheers! ____________________________________________________ Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs

2 1

OFF-TOPIC - ISDN and 56k modem users
by Kinetix 01 Aug '05

01 Aug '05

Has anyone ever used an eicon diva card for a dial-up server?? I have setup such a server using a DIVA 4BRI card in a Redhat box with mgetty 1.1.33 and pppd-2.4.3 Everything worked OK for the modem users. The dial-up server sent a NAS-Port-Type = Async to the radius server But when I tried with ISDN users I saw that the NAS-Port-Type that the dial-up server sent to radius was Async again Has anyone any idea on how to make pppd send the correct type of NAS-Port-Type to the radius server?

1 0

RE: authenticate machine accounts with ntlm_auth
by martin.p.bradley＠bt.com 01 Aug '05

01 Aug '05

>> j.cluzel wrote: >> Is it possible to authenticate a machine account with ntlm_auth ? >No. AD does not permit that. > Alan DeKok. I'm very frustrated now after spending a couple of weeks trying to get free radius to authenticate my Win2k machine accounts against active directory. :-( Alan, do you know of any way to get this working. I have been assured that Funk can do this, have you any idea how Funk are doing it. Funk costs too much. Maybe I'm not allowed to ask such questions. Regards, Martin.

5 5

Cisco WAP 1200 Accounting for 802.1X PEAP
by Colleen Morrissey 01 Aug '05

01 Aug '05

I am having difficulty getting my Cisco APs (all 1230s) to send accounting information regarding 802.1x PEAP authentications - stop/start info. Does anyone have this working? If so can you please post the AP config. I currently have the following: aaa accounting network eap_methods start-stop group rad_acct I get radius accounting information for exec on the APs (people logging directly into the AP), but not for wireless authentications. So I know I have the radius server and config setup correctly. Thanks Colleen

2 1

Authenticate as computer - Windows XP
by israel＠topazio.com 01 Aug '05

01 Aug '05

Hi, In IAS we do a policy that contain: host/*.teste.com How I can do this in Freeradius for authenticate computer account, striping the computer name for search in OpenLdap. Thanks

2 1