November 2006 - Freeradius-Users - lists.freeradius.org

proxy RADIUS: is fallback actived??
by Santiago Balaguer García 20 Nov '06

20 Nov '06

2 1

Blank usernames
by Marat Rysbekov 20 Nov '06

20 Nov '06

Good day, everyone. I'm trying to setup FreeRadius 1.1.3 to assing IP-addresses based on what NAS the authorization request came from, no matter what username or password was supplied. Some of my configuration: <huntgroups> ... Alpha NAS-IP-Address == 192.168.10.1 Beta NAS-IP-Address == 192.168.20.1 ... <users> ... DEFAULT Auth-Type := Accept, Huntgroup-Name == "Alpha", Pool-Name := "PoolA" DEFAULT Auth-Type := Accept, Huntgroup-Name == "Beta", Pool-Name := "PoolB" ... I specify the IP-pools in <radiusd.conf>, and it works fine, except for one thing: I get no Access-Accept reply whenever the username is left blank (any non-empty username is accepted by the server). So, my question: is there a way to make FreeRadius use the DEFAULT entries when the username is not supplied at all? Thanks.

2 3

RE: freeradius on solaris 10 - next try
by Ramm-Ericson, Johannes 20 Nov '06

20 Nov '06

On Mon, 20 Nov 2006 14:56:00 +0100 (CET), Michael Messner wrote: > hey @all, > > the next try to get freeradius with ldap support on a solaris 10: > > I've installed openldap from > http://sunfreeware.com/indexintel10.html, so > I find the ldap libraries: > > /usr/local/lib/libldap-2.3.so.0 > /usr/local/lib/libldap-2.3.so.0.2.9 > /usr/local/lib/libldap.a > /usr/local/lib/libldap.la > /usr/local/lib/libldap.so > /usr/local/lib/libldap_r-2.3.so.0 > /usr/local/lib/libldap_r-2.3.so.0.2.9 > /usr/local/lib/libldap_r.a > /usr/local/lib/libldap_r.la > /usr/local/lib/libldap_r.so > > but there is no libldap_r which is searched for during configure! > > checking for pthread_create in -lpthread... yes > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > > any ideas? > > ca mIke Try ./configure --with-rlm-ldap-lib-dir=/usr/local/lib (and include all your other configure options aswell of course...) /johannes

1 0

freeradius on solaris 10 - next try
by Michael Messner 20 Nov '06

20 Nov '06

hey @all, the next try to get freeradius with ldap support on a solaris 10: I've installed openldap from http://sunfreeware.com/indexintel10.html, so I find the ldap libraries: /usr/local/lib/libldap-2.3.so.0 /usr/local/lib/libldap-2.3.so.0.2.9 /usr/local/lib/libldap.a /usr/local/lib/libldap.la /usr/local/lib/libldap.so /usr/local/lib/libldap_r-2.3.so.0 /usr/local/lib/libldap_r-2.3.so.0.2.9 /usr/local/lib/libldap_r.a /usr/local/lib/libldap_r.la /usr/local/lib/libldap_r.so but there is no libldap_r which is searched for during configure! checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... no checking for ldap.h... yes configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. any ideas? ca mIke

2 1

RE: configuration problem in Freeradius.
by John Longland 20 Nov '06

20 Nov '06

Also, what does your cleints.conf file look like. Is "johndoe" a user on your system? John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius.org] On Behalf Of Hernan Antolini Sent: 20 November 2006 15:07 To: FreeRadius users mailing list Subject: Re: configuration problem in Freeradius. What's your "radiusd -X" say about it ?, you should start there. Hernan Antolini freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on 11/15/2006 08:02:26 AM: > > hi ! > i got howto of freeradius. I am configuring it on suse 10.1 n i have > performed all steps but getting error. I tried alot to troubleshoot it but > didnt get any success. So i am pasting me error here . Plz help me . > > myserver:~ # radtest johndoe hello localhost 1812 password > Sending Access-Request of id 151 to 127.0.0.1 port 1812 > > > User-Name = "johndoe" > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=151, length=20 > myserver:~ # > > > ------------------------------------------------------------ > > myserver:~ # radiusd -X > Module: Instantiated radutmp (radutmp) > > > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > rad_recv: Access-Request packet from host 127.0.0.1:1025, id=151, length=59 > User-Name = "johndoe" > > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type System > > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > > auth: Failed to validate the user. > rad_lowerpair: User-Name now 'johndoe' > > rad_lowerpair: User-Password now 'hello' > rad_rmspace_pair: User-Name now 'johndoe' > > rad_rmspace_pair: User-Password now 'hello' > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > > rad_check_password: Found Auth-Type System > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > auth: Failed to validate the user. > > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > --- Walking the entire request list --- > Waking up in 1 seconds... > > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > > Sending Access-Reject of id 151 to 127.0.0.1 port 1025 > Waking up in 4 seconds... > --- > Walking the entire request list --- > Cleaning up request 0 ID 151 with timestamp 455743f6 > Nothing to do. > Sleeping until we see a request. > -- > View this message in context: http://www.nabble.com/configuration- > problem-in-Freeradius.-tf2627693.html#a7355750 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

configuration problem in Freeradius.
by capricorn 20 Nov '06

20 Nov '06

hi ! i got howto of freeradius. I am configuring it on suse 10.1 n i have performed all steps but getting error. I tried alot to troubleshoot it but didnt get any success. So i am pasting me error here . Plz help me . myserver:~ # radtest johndoe hello localhost 1812 password Sending Access-Request of id 151 to 127.0.0.1 port 1812 User-Name = "johndoe" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=151, length=20 myserver:~ # ------------------------------------------------------------ myserver:~ # radiusd -X Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1025, id=151, length=59 User-Name = "johndoe" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. rad_lowerpair: User-Name now 'johndoe' rad_lowerpair: User-Password now 'hello' rad_rmspace_pair: User-Name now 'johndoe' rad_rmspace_pair: User-Password now 'hello' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 151 to 127.0.0.1 port 1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 151 with timestamp 455743f6 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/configuration-problem-in-Freeradius.-tf2627693.html#a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

RE: how to allow login only from specified access point?
by Ramm-Ericson, Johannes 20 Nov '06

20 Nov '06

On Sat, 18 Nov 2006 13:54:32 +0100, Norbert Grochal wrote: > I have freeradius serwer with PEAP auth. secrets of nasnames > and user passwords are in mysql. > > Is it possible to set freeradius to send Access-Accept only > where user try to connect to specified access point? I try to > check it by sql query modified by me. > > snip.... < > > My question is as I have written: > Is it possible to set freeradius to send Access-Accept only > where user try to connect to specified access point? > And how to do it ? :-). > > Norboro One place to configure that would be in : /path/to/freeradius/etc/raddb/users. /johannes

2 1

SQLIPPOOL Documentation
by Liborio Marrone 20 Nov '06

20 Nov '06

Hi all, where can I get documentation (howto or whatever) about configuration of ip pools using (my)sql and sqlippool ? Freeradius docs about that is very poor . Thanks in advance. Boris

1 0

Re: PEAPv2 Server
by david＠mitton.com 19 Nov '06

19 Nov '06

Microsoft implements something better known as PEAP v0 see: draft-kamath-pppext-peapv0-00.txt, “Microsoft’s PEAP v0 (Implemented in Windows XP SP1) July 2002, http://www.watersprings. org/pub/id/draft-kamath-pppext-peapv0-00.txt As far as I know, no-one implements PEAP v2, and it's not clear why you would build a server for it if you don't have a client? Dave. ----Original Message---- From: aland(a)deployingradius.com Date: Nov 15, 2006 14:49 To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius. org> Subj: Re: PEAPv2 Server "MURAT SEZGIN" <sezginmurat(a)hotmail.com> wrote: > I am trying to implement a PEAP version 2 > (draft-josefsson-pppext-eap-tls-eap-10.txt) client. I was using "Odyssey > Server Administration" server for PEAP v1 and EAP-TTLS. But the server does > not support PEAP v2. Is there any other server softwares which support PEAP > v2? Or is there any body who tried to test PEAP v2? Microsoft supports PEAPv2, I think. My suggestion is to implement PEAPv2 in a server first, and to test that implementation with the Microsoft clients. Once that works, you then have a server you can use to test your client implementation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

6 8

acct_unique module - Dynamic Client-IP-Address causes duplicate session entries in accounting table
by Gunther 18 Nov '06

18 Nov '06

My set up: multiple servers with FreeRadius 1.1.0, MySQL 5.0.27 with Master-Master replication After some trouble with duplicate entries in the radius accounting table due to non-unique Acct-Session-Id's, I switched to using the acct_unique module. acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } This works fine as long as the Client-IP-Address remains a constant during a session. But when the connection to the ISP drops for a moment, a new Client-IP-Address will be used and the Acct-Unique-Session-Id will change in the middle of a session. This causes a new session to be inserted into the accounting table. The new session simply continues using all the values of the previous session as the NAS is not aware of the Client-IP-Address change. This will cause that the time of the first session and the second session are added, even it is the same session. This is pretty bad for prepaid tickets as their life is shortend. I like to change the acct_unique set up and exchange the Client-IP-Address with another more steady parameter like NAS-Identifier or Called-Station-Id or Calling-Station-Id or Framed-IP-Address. I am going to use the following: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Calling-Station-Id, NAS-Port" } The Calling-Station-Id (end-user MAC address) would not change during a session and is not really user selectable. While the Called-Station-Id and NAS-Identifier could occur multiple times as this might be a configurable NAS parameter. Any recommendations on this?

2 2