April 2006 - Freeradius-Users - lists.freeradius.org

Other attributes
by JVUVANT Yahoo 03 Apr '06

03 Apr '06

Hi all Does freeradius integer specific attributes from boxes as redback ? if yer, how can we use it ? Thanks Jacques ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

1 0

Setup Freeradius for Challenge response authentication
by Yizhi Lao 03 Apr '06

03 Apr '06

Dear all, I am a new user of freeradius, currently using freeradius 1.1.0 on Redhat Linux. I wish to setup freeradius for a 2 factor authentication, such that: NAS issue an Access-Request to Radius server Radius server authenticate against LDAP once successful -- Radius server then issue an Access-Chanllenge to NAS (second factor, asking for an additional password/token) NAS reply with an Acces-Request Radius server then authenticate the second Access-request and reply to NAS. The above is roughly the authentication flow I wish to achieve. After reading the configuration setup instructions, I still have no clue where to start with the configuration, can some one please enlighten me? Is there a custom built radius module required? Thanks in advance for all the help regards Kaden --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC for low, low rates.

2 4

MACs
by Mordor Networks 03 Apr '06

03 Apr '06

Hello I\'m trying to log the users MAc address using pppoe and FR + mysql i added AVpair to the users file "calling-station-id" but checkval could not find iten rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 21

1 0

Separate query for authentication and authorization
by vignesh 03 Apr '06

03 Apr '06

Hello I want to have multiple queries in RADIUS (e.g. one for prepaid and one for postpaid users). can I do this in Free Radius, if yes how do I specify free radius to execute particular query. Also the authentication and authorization seems to call the same query. Can I have different query fro authentication and authorization. Thanks Vignesh

3 2

rlm_ldap: could not start TLS
by Marc Delisle 03 Apr '06

03 Apr '06

Hi, I'm trying to make freeradius 1.1.0 contact a LDAP server. I configured freeradius --with-edir. The error I get is "rlm_ldap: could not start TLS Can't contact LDAP server" I followed this document http://www.novell.com/coolsolutions/tip/15922.html except that in my case, the LDAP server is on Netware 6.5 SP5. On this Netware server, LDAP responds correctly over SSL, as tested with Novell's ldapsearch on port 636. In radiusd.conf, in the ldap section, I use tls_cacertfile = /usr/local/freeradius/etc/raddb/certs/rootder.b64 which is the self-signed certificate exported from the Netware's CA object. I can provide other details about my "LDAP server" object in Netware upon request. Thanks in advance, Marc Delisle

4 5

Problem with LDAP against Active Directory
by domjullier＠rhone.ch 03 Apr '06

03 Apr '06

Hi folks, I want authenticate users from a WLAN with freeradius. The Users are stored in the Active Directory of a Windows 2003 Server. With some Tutorials from the Internet I have configured freeradius to make that. Unfortunately the Authentication function not succesfully. Thats the output from FreeRadius during the Authentication: rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:08 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:08 2006 : Debug: modcall: entering group authorize for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:18 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall: group authorize returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: Finished request 2 Mon Apr 3 11:12:18 2006 : Debug: Going to the next request Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 Mon Apr 3 11:12:18 2006 : Debug: Discarding duplicate request from client testnet:4596 - ID: 13 Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Cleaning up request 2 ID 13 with timestamp 4430e6e8 Mon Apr 3 11:12:18 2006 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:18 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:18 2006 : Debug: modcall: entering group authorize for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:28 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:28 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall: group authorize returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: Finished request 3 Mon Apr 3 11:12:28 2006 : Debug: Going to the next request Mon Apr 3 11:12:28 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:28 2006 : Debug: Waking up in 6 seconds... Mon Apr 3 11:12:34 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:34 2006 : Debug: Cleaning up request 3 ID 13 with timestamp 4430e6f2 Mon Apr 3 11:12:34 2006 : Debug: Nothing to do. Sleeping until we see a request. Where can I fix the misstake which produce this error? greets dominique

1 0

VLAN and SSID
by Antonio Matera 03 Apr '06

03 Apr '06

Hallo, I have a problem with the authentication on different VLAN. I write for you my example: I have two VLAN (VLAN1 and VLAN2) conneccted to two SSID (SSID1 and SSID2) on my Cisco 1200 AP. I have the same authentication on both connection (EAP-TLS). In my users file I have two user: user1 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN the authentication works fine but , for example, if I connect the WinXP client on the SSID1 with the certificate user of the VLAN2, I have this situation: The client is connected to the VLAN2 but the SSID of the wireless connection is SSID1. It is possible to prevent the connection to the select SSID if the certificate of the user is incorrect? Thanks, bye

4 12

CallingStationId
by Mordor Networks 02 Apr '06

02 Apr '06

Hello, I finally have a working rp-pppoe+pppd+linux+radius+mysql setup handling lots of connections :) I used to handle pppoe connections on freebsd, and when a connection is established, the field "CallingStationId" of the radacct table on mysql had the mac address of the calling user. rp-pppoe (or maybe linux pppd) seems not to do this by default and the field in question is left blank. Does anybody know a way to solve this? Thanks in advance..

3 3

RE: pppoe-server
by Seferovic Edvin 02 Apr '06

02 Apr '06

Hi, 1. try sending the interval in the Acct-Interim-Interval attribute to your pppoe-server 2. try to send the questions to the mailing list Regards, Edvin ________________________________________ From: Wassim abbas [mailto:wassim.abbas@gmail.com] Sent: Montag, 03. April 2006 00:18 To: edvin.seferovic(a)kolp.at Subject: Re: (no subject) Hello 1. modify your pppoe-server to send accouting updates every hour or less How?

1 0

(no subject)
by i-isp＠gmx.at 02 Apr '06

02 Apr '06

hi, i have freeradius + mysql + cisco + pppoe clients. the pppoe client is 3 day online. the radius have 1 line with input/output octets the statistic for the users must to every hours the input/output octets have you a idea? best regrds harald -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

2 3