March 2006 - Freeradius-Users - lists.freeradius.org

RE: Still having issue with radtest
by Atkins, Dwane P 27 Mar '06

27 Mar '06

I apologize for not using proper terms since this is new to me, I tend to associate to something I do know. 1.) Since I attempting to use the sql database for authentication purpose, would it be best if I made sure that radius@localhost (my username I chose) be in the users file and also be granted privileges on the sql database (I chose to call it radius as well) 2.) When doing the radtest, would the proper syntax be radtest radius radiustest localhost 1645 baseball (with baseball being the shared secret also entered into the clients.conf file) or should there be quotes around the shared secret. My apologies for calling it a preshare key. This is an IPSec term that I have used for a few years. 3.) I have read documentation. I have bought the O'Reilly Book and read it. I have reinstalled my server and all to no avail. I appreciate the help you all give, but I am stuck. I am sure I overlooked the issue, but at this point, I cannot see it. Thanks again. Dwane ________________________________ From: Atkins, Dwane P Sent: Sat 3/25/2006 11:34 AM To: freeradius-users(a)lists.freeradius.org Subject: Still having issue with radtest A couple questions I have not asked about this issue? Do both the user@localhost and localhost need access to the Sql database. I am at a loss as to why everytime I run this process, it tells me that I have an invalid preshare key. Do they preshare keys need to be in quotes. If I have a user called radius with a password of radiustest and my localhost preshare is BASEBALL, then would my syntax be, radtest radius radiustest localhost 1645 BASEBALL ? Or woudl I need to put quotes around the alpha characters. I cannot move on until I get this resolved obviously and I am not sure where to try. I can get issues resolved with the SQL portion, but to get it to see the local host, I am at a loss. If anyone can think of anything else I can possibly try, please let me know. If not, I appreciate all your efforts. Dwane

3 2

RE: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available?
by Jonathan De Graeve 27 Mar '06

27 Mar '06

Uh, huntgroups? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens John > Mylchreest > Verzonden: maandag 27 maart 2006 15:00 > Aan: FreeRadius users mailing list > Onderwerp: RE: Different user attributes based on NAS-IP-Address? > AlsoSuffixwildcards available? > > Funnily enough, I asked the very same thing recently. We do it quite > crudely at the moment, but it works. > > We add an nshortname field to radreply/anything else necessary, and in > sql.conf we link it to the user reply. Ie: > > Something like this would work: > > authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op > FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = > %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR > radreply.nshortname is NULL) ORDER BY id" > > If you find any cleaner solution using the default schema, I would LOVE to > hear about it, since that's the problem/task I'm currently facing. > > -----Original Message----- > From: freeradius-users- > bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org] On Behalf Of > Andy Coates > Sent: 27 March 2006 13:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Different user attributes based on NAS-IP-Address? Also > Suffixwildcards available? > > > Hey, > > Is this even possible? > > The basic problem is that I have 2 devices that will use the same > username. > For example, one device handles dialup, one handles DSL. I'd like the > user > to have the same username, and depending on the NAS sending the request > the > correct IP/Netmask would be returned. > > I've setup huntgroups for the NAS, and can match them in various setups in > the users file - but this only seems like it would work for group based > attributes (i.e. common fields). Returning unique fields for each user > based on the NAS-IP-Address doesn't seem possible? > > That aside, does anyone know if its possible to use wildcards with Suffix > when stripping usernames? I've tried "@*" or "@*.domain.com" and it > doesn't > seem to match :( > > Thanks in advance, > Andy. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Communications on or through ioko's computer systems may be monitored or > recorded to secure effective system operation and for other lawful > purposes. > > Unless otherwise agreed expressly in writing, this communication is to be > treated as confidential and the information in it may not be used or > disclosed except for the purpose for which it has been sent. If you have > reason to believe that you are not the intended recipient of this > communication, please contact the sender immediately. No employee is > authorised to conclude any binding agreement on behalf of ioko with > another party by e-mail without prior express written confirmation. > > ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Different user attributes based on NAS-IP-Address? Also Suffix wildcards available?
by Andy Coates 27 Mar '06

27 Mar '06

Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy.

2 1

RE: Version 1.1.1 stops responding
by King, Michael 27 Mar '06

27 Mar '06

Mine seg faulted as well.. (This time I didn't overwrite the log) rad2:/home/mking# /usr/sbin/freeradius -X -A >crash.log Segmentation fault rad2:/home/mking# I don't believe running /usr/sbin/freeradius -X -A is capturing anything useful. Is there something else I can do? Here's the last few lines of the freeradius -X -A rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.0.1.32/auth-detail-20060324 modcall[authorize]: module "auth_log" returns ok for request 1002 modcall[authorize]: module "chap" returns noop for request 1002 modcall[authorize]: module "mschap" returns noop for request 1002 rlm_realm: No '@' in User-Name = "BSC\ddelutis", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1002 rlm_eap: EAP packet type response id 28 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1002 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1002 modcall: leaving group authorize (returns updated) for request 1002 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1002 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11

3 2

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 27 Mar '06

27 Mar '06

> > Since you seem to know something about this, can you either: > > > > A) Explain what the "extended key oid nonsense" is? > > B) Point me to some place I can read about it? > > http://www.freeradius.org/doc/ > > See the EAP-TLS stuff. > > Microsoft requires magic stuff in the server certificate, otherwise > the windows supplicants silently stop talking to the AP. Ok, I read the document, but I still do not understand something... I am proxying the packets from the Cisco through the FreeRADIUS server to the IAS server. EAP messages are exchanged between the supplicant and the IAS server; the Cisco AP and FreeRADIUS server do not touch them, correct? They just do RADIUS stuff and encapsulate the EAP messages, right? And, if that is the case, then the IAS server and the supplicant are doing all the TLS stuff. The IAS server obviously supports those OID extensions. So, shouldn't the supplicant work properly? I mean, we are not creating a TLS tunnel from the supplicant to the FreeRADIUS server and another from the FreeRADIUS server to the IAS server -- it should be from the supplicant to the IAS server, encapsulated in RADIUS, proxied through the FreeRADIUS server. And, in that kind of setup, the FreeRADIUS server should not be causing any problems, correct?

2 1

Sqlcounter - Data Download limiting
by Jaco van Tonder 27 Mar '06

27 Mar '06

I would like to use sqlcounter to limit the max number of bytes a user can download via a NAS. My NAS supports this, but I need sqlcounter to return a different attribute (eg. RecvLimit) and not Session-Timeout. I have also seen that this is possible with the counter module but not with sqlcounter Has anyone done this before / or have a patch for the sqlcounter module to enable this Jaco van Tonder

1 0

Zombie accounting processes
by George-Cristian Bîrzan 27 Mar '06

27 Mar '06

Hello! I've been having a rather annoying problem with FreeRADIUS, including version 1.1.0. I've set up authentication and accounting via a Perl script. -- George-Cristian Bîrzan Network Engineer _______________________________________ RCS & RDS Constanta Tel.: +40341.400.401 / +40341.400.402 Fax: +40341.400.450 http://www.rcs-rds.ro _______________________________________ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

4 10

RE: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available?
by John Mylchreest 27 Mar '06

27 Mar '06

Funnily enough, I asked the very same thing recently. We do it quite crudely at the moment, but it works. We add an nshortname field to radreply/anything else necessary, and in sql.conf we link it to the user reply. Ie: Something like this would work: authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR radreply.nshortname is NULL) ORDER BY id" If you find any cleaner solution using the default schema, I would LOVE to hear about it, since that’s the problem/task I'm currently facing. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Andy Coates Sent: 27 March 2006 13:35 To: freeradius-users(a)lists.freeradius.org Subject: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available? Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Multiple Accounting in Radacct
by zack musa 27 Mar '06

27 Mar '06

Hi all. My radius server records to mysql database for every single user session for 3 times in three rows. similar records for 1 single user but the different is in mil.sec. What configuration in freeradius might done this? Is this because the NAS or th radius server? Thanks for any help. --------------------------------- Blab-away for as little as 1¢/min. Make PC-to-Phone Calls using Yahoo! Messenger with Voice.

2 1

proxy installation
by vivek mangai 26 Mar '06

26 Mar '06

1 0