December 2006 - Freeradius-Users - lists.freeradius.org

attrs behind a realm
by Santiago Balaguer García 20 Dec '06

20 Dec '06

Hi people, I am using freeradius 1.0.4 for sereral years and I do proxy radius successfully with my roaming patners. However, now I have a roaming patner with the BABEL realm. So, when a BABEL user authenticates in my RADIUS I do proxy radius and BABEL radius server gives me the user attributes. Althought, I want to modify the "WISPr-Redirection-URL" of BABEL user by my value: http://www.akiwifi.es. I try to use attrs file and as I only want to modify BABEL realm. Any suggestion about how to do that?? Example: BABEL ME WISPr-Redirection-URL = http://some.web.com --> WISPr-Redirection-URL = http://akiwifi.es _________________________________________________________________ Prueba algunos de los nuevos servicios en línea que te ofrece Windows Live Ideas: tan nuevos que ni siquiera se han publicado oficialmente todavía. http://ideas.live.com

1 0

freeradius brake down
by S.L. 20 Dec '06

20 Dec '06

Hi, >What platform are you running on?Debian Sarge --------------------------Hirdetés----------------------------- Karib-szigeteki hajóút 194.800 Ft

1 0

ntlm fall-through
by Stieven.Struyf＠komatsu.eu 20 Dec '06

20 Dec '06

All, Does anyone know how i can configure ntlm fall-through, eg. try to authenticate the user local (via password entry in users file) and if the user isn't found use ntlm-auth(or first ntlm and afterwards userfile is also ok)? If i comment out the ntlm-auth line in the mschap section of radiusd.conf the user is authenticate local. I searched the archives and found the same question below, but no answer to the problem. Anyone who can help me with this? http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-August/0466… Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551

2 2

Send atributes to the client
by fjlagos＠vtr.net 19 Dec '06

19 Dec '06

Hello: What file i must set for send some atributes to a Radius client, for example, how can i send the VLAN for some user as soon as he was authenticated? In whish file i must set the attributes for a specific vendor like Juniper ERX atributes? Saludos y Gracias Francisco

2 1

FreeRADIUS SQLite support
by Fenn Bailey 19 Dec '06

19 Dec '06

Hi All, This may be a silly question, but are there any plans/is it possible (or even a good idea) to build in SQLite support to FreeRADIUS? To me it seems like a nice lightweight in-between for SQL DB and local file DB type auth - The convenience of integration of SQL with things like PHP/Perl without the overhead of a MySQL daemon or whatever (ie: handy for embedded devices/etc). >From what I can gather, it is theoretically possible now via FreeRADIUS<->ODBC<->SQLite, but it seems like a bit of a messy way to do it. Thoughts/comments? Cheers, Fenn.

2 1

freeradius brake down
by S.L. 19 Dec '06

19 Dec '06

Hi all,Thanks for the reply Alan.You suggested version 1.1.3 - it's ok - and said that it's peap configuration...so I think I am disconcerted a little...If I want PEAP I have to configure tls section in eap.conf too, otherwise the server fails like this:rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required firstThen I configure tls section and the message is this:rlm_eap: Failed to link EAP-Type/tls: /usr/lib/freeradius/rlm_eap_tls.so: only ET_DYN and ET_EXEC can be loadedradiusd.conf[1939] Unknown module "eap". ----------------------------------------- why unknown?radiusd.conf[1886] Failed to parse authenticate section.Thanks before:S.L. --------------------------Hirdetés----------------------------- Akciós Szilveszteri ajánlatok

2 1

radius hosting
by normalboy 19 Dec '06

19 Dec '06

Hello, is there a free Radius server running somewhere on the internet which i could use? I need to create just 2 accounts, but it has to be a Radius server, and i do not have machine 24/7 on the internet. Thank you.

3 3

realms and local user file processing question
by Michael Hare 19 Dec '06

19 Dec '06

Hello- Having some problems getting a match on the local users file after a successful realm proxy. I would like to have a user be able to log in with different realms and get different IP addresses. I have tried all sorts of formats in the users file. I would have thought that the first was the correct syntax but it didn't work, hence the trial and error. mdhare@test Framed-IP-Address = 146.151.211.254 mdhare Realm == "test" Framed-IP-Address = 146.151.211.254 "mdhare@test" Framed-IP-Address = 146.151.211.254 according to http://wiki.freeradius.org/Proxy#What_Happens "Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL." Here is the debug from a login. How do I further troubleshoot why the local users file is not being matched? -Michael ------------ rad_recv: Access-Request packet from host 144.92.44.114:2523, id=152, length=128 User-Name = "mdhare@test" User-Password = ***** NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: Looking up realm "test" for User-Name = "mdhare@test" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 Sending Access-Request of id 0 to 144.92.254.243 port 1812 User-Name = "mdhare" User-Password = ********* NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Proxy-State = 0x313532 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=31 Service-Type = NAS-Prompt-User Proxy-State = 0x313532 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: leaving group post-proxy (returns noop) for request 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 attr_filter: Matched entry DEFAULT at line 84 modcall[authorize]: module "attr_filter" returns updated for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 ---------------------- problem ---------------------------------- modcall[authorize]: module "files" returns notfound for request 0 ---------------------- problem ---------------------------------- modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 152 to 144.92.44.114 port 2523 Finished request 0 Going to the next request Waking up in 6 seconds... -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188

2 4

RE: Logging additional attributes into sql backend
by Cory Robson 19 Dec '06

19 Dec '06

My upstream provider sends me an account terminate cause in a stop packet in the format Ascend-Disconnect-Cause, how do I get freeradius to map and log this into the sql field 'AcctTerminateCause' I have checked and it is in my dictionary file. Cory

2 1

freeradius brake down
by S.L. 19 Dec '06

19 Dec '06

Hi all,I have built an Access Point with hostapd, and want to authenticate with FreeRADIUS via users file.I wnat to use MSCHAPv2 with PEAP and TLS. my eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no md5{ } leap{ } gtc{ auth-Type = PAP } tls{ privateprivate_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = /dev/null fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 } mschapv2{ } } my users file : test User-Password := "test123" RADIUS message : rad_recv: Access-Request packet from host 192.168.100.247:2055, id=242, length=151 User-Name = "test" NAS-IP-Address = 192.168.100.247 NAS-Port = 0 Called-Station-Id = "00-02-6F-23-86-93:testwlan" Calling-Station-Id = "00-0E-2E-89-44-8F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300090174657374 Message-Authenticator = 0x9938df4722da9c4c77a585cf1740d5ad Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 3 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 242 to 192.168.100.247:2055 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd75423f6525fdaace27f2535ef014611 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.247:2055, id=243, length=240 User-Name = "test" NAS-IP-Address = 192.168.100.247 NAS-Port = 0 Called-Station-Id = "00-02-6F-23-86-93:testwlan" Calling-Station-Id = "00-0E-2E-89-44-8F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204005019800000004616030100410100003d03014587c6af195c3fedb8cea5b9600556a43091e389b2af29691ffbe412eb96478700001600040005000a000900640062000300060013001200630100 State = 0xd75423f6525fdaace27f2535ef014611 Message-Authenticator = 0x944c2fd4e01369d92e721a62300b6d6e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.2.so: undefined symbol: eaptls_process So I have no idea.... Could someone help me? --------------------------Hirdetés----------------------------- Akciós Szilveszteri ajánlatok

2 1