May 2006 - Freeradius-Users - lists.freeradius.org

Zero Session-Timeout
by Rohaizam Abu Bakar 31 May '06

31 May '06

Dear all, Using FB 6.0, FR 1.0.5 (will upgrade soon) I've problem with timeout... I've set in users file as below in order to load timeout value depending on type of connection (ISDN/PSTN) DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U ISDN}` DEFAULT NAS-Port-Type == "Async", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U PSTN}`value The problem is when "Session-Timeout =0", normally happen when script cannot load value... it will NOT timeout... user till can get connect until manually disconnect... Below is the debug log... Login OK: [integ36] (from client INFRANETTEST port 300 cli 55550000) Sending Access-Accept of id 111 to 10.1.1.1:1645 Session-Timeout = 0 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Framed-Protocol = PPP Service-Type = Framed-User Finished request 89 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.1.1.1:1646, id=97, length=131 Acct-Session-Id = "000000AE" Framed-Protocol = PPP User-Name = "integ36" Acct-Authentic = RADIUS Acct-Status-Type = Start Calling-Station-Id = "55550000" Called-Station-Id = "2426" NAS-Port-Type = Async Connect-Info = "50667/24000 V90/V44/LAPM" NAS-Port = 300 Service-Type = Framed-User NAS-IP-Address = 10.1.1.1 Acct-Delay-Time = 0 . . . . rad_recv: Accounting-Request packet from host 10.1.1.1:1646, id=98, length=173 Acct-Session-Id = "000000AE" Framed-Protocol = PPP Framed-IP-Address = 10.1.1.3 User-Name = "integ36" Acct-Authentic = RADIUS Acct-Session-Time = 26 Acct-Input-Octets = 8110 Acct-Output-Octets = 4998 Acct-Input-Packets = 92 Acct-Output-Packets = 37 Acct-Terminate-Cause = User-Request Acct-Status-Type = Stop Calling-Station-Id = "55550000" Called-Station-Id = "2426" NAS-Port-Type = Async Connect-Info = "50667/24000 V90/V44/LAPM" NAS-Port = 300 Service-Type = Framed-User NAS-IP-Address = 10.1.1.1 Acct-Delay-Time = 0

2 2

Testing jradius+freeradius+oracle
by Zhou Yong Jun 31 May '06

31 May '06

I get the reply message in java application from freeradius, but the reply message have only usergroup reply message and no user reply message. Why? Thanks! 周勇军 TD-TECH OMC 021-50992135

1 0

freeradius 1.1.0 with rp-pppoe 3.8 pppoe-server
by root linux 31 May '06

31 May '06

I have a Red Hat 9.0 system with the following software: - ppp 2.4.4b1 rp-pppoe 3.8 freeradius 1.1.0 I saw the following in /usr/local/share/freeradius/dictionary.roaringpenguin RP-Upstream-Speed-Limit RP-Downstream-Speed-Limit Below is my MySQL result: - mysql> select * from radcheck; +----+----------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-------+ | 1 | guest | Password | == | guest | +----+----------+-----------+----+-------+ mysql> select * from radgroupcheck; +----+--------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+--------------+------------------+----+-------+ | 1 | customer128k | Simultaneous-Use | := | 1 | | 2 | customer128k | Auth-Type | := | Local | +----+--------------+------------------+----+-------+ mysql> select * from radgroupreply; +----+--------------+---------------------------+----+---------------------+------+ | id | GroupName | Attribute | op | Value | prio | +----+--------------+---------------------------+----+---------------------+------+ | 1 | customer128k | Framed-Protocol | = | PPP | 0 | | 2 | customer128k | Framed-Routing | = | Broadcast-Listen | 0 | | 3 | customer128k | Framed-Compression | = | Van-Jacobson-TCP-IP | 0 | | 4 | customer128k | RP-Upstream-Speed-Limit | = | 64 | 0 | | 5 | customer128k | RP-Downstream-Speed-Limit | = | 128 | 0 | | 6 | customer128k | Service-Type | = | Framed-User | 0 | | 7 | customer128k | Framed-MTU | = | 1500 | 0 | +----+--------------+---------------------------+----+---------------------+------+ mysql> select * from usergroup; +----+----------+--------------+ | id | UserName | GroupName | +----+----------+--------------+ | 1 | guest | customer128k | +----+----------+--------------+ Below is my ppp options: - require-pap login lcp-echo-interval 10 lcp-echo-failure 2 ms-dns x.y.100.8 ms-dns x.y.100.2 plugin radius.so plugin radattr.so Below is the command I run for pppoe-server: - pppoe-server -I eth1 -k -L 10.3.0.1 -R 10.3.1.1 I configure a PPPoE client connecting in my Windows XP desktop and successfully connect to the PPPoE server. I did perform a download speed test and the download speed is not correct. I can't get 128kbits but I get the full speed of 1Mbps, why? Doest the attribute field below works for FreeRADIUS? RP-Upstream-Speed-Limit RP-Downstream-Speed-Limit Regards, rootlinux __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 10

1 client unable to authenticate via EAP-TLS
by Terry Zarelli 30 May '06

30 May '06

Hello, I have one client that is having a problem authenticating via wireless EAP-TLS. The client is a Windows XP SP2 computer using a an internal Dell wireless card. The client associates with the access point-a Cisco Aironet 1130-but is continually reports an "attempting to authenticate" message. After, performing a "radiusd -X", I do not see any EAP-start messages; I see the following: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation I continually see these messages for this particular client and subsequently do not see Freeradius process the certificate. Any clues on what may be going on. I am using version 1.1.0. Is any more info needed that I can provide? Below is the log of the EAP conversation: Thank you. ______________________________________________________________________________________________________________________________________________________________________ Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.200.249:32768, id=226, length=175 User-Name = "vallent.com" Calling-Station-Id = "00-90-96-AF-7D-D4" Called-Station-Id = "00-15-2C-49-D6-40:2xe1zpK0" NAS-Port = 4 NAS-IP-Address = 192.168.200.249 NAS-Identifier = "bvwlc01" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x025200060d00 State = 0xed546982f4966349530000881730f5c2 Message-Authenticator = 0x2d0b467fefd65f09ef445907438841a0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: No '@' in User-Name = "vallent.com", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 82 length 6 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> modcall[authorize]: module "eap" returns updated for request 14 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 14 modcall: leaving group authenticate (returns handled) for request 14 Sending Access-Challenge of id 226 to 192.168.200.249 port 32768 EAP-Message = 0x0153040a0dc0000008bd79fa9a8201851f5f94cd707d99f056471b3463d26d105fd500040830820404308202eca003020102020900b257df81a5c93eb0300d06092a864886f70d0101050500308182310b3009060355040613025553311330110603550408130a57617368696e67746f6e311c301a060355040a131356616c6c656e7420436f72706f726174696f6e3121301f06035504031318636572742e62762e616d65722e76616c6c656e742e636f6d311d301b06092a864886f70d010901160e69744076616c6c656e742e636f6d301e170d3036303132363139333733365a170d3039303132353139333733365a308182310b30090603550406 EAP-Message = 0x13025553311330110603550408130a57617368696e67746f6e311c301a060355040a131356616c6c656e7420436f72706f726174696f6e3121301f06035504031318636572742e62762e616d65722e76616c6c656e742e636f6d311d301b06092a864886f70d010901160e69744076616c6c656e742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e11a94e572aaf07801e8ed2702e2f5cf02a30420b854889d760ba754643aee948ed331fbe5a2a24af3a28bba69c8b6d85761972db0be17dff91e4228d19446e932837768eea8bdb65cc712932ff5b5eecc13f763db7d984b925eb47b7c0094db3ac765 EAP-Message = 0x8e38c4bd7d729957fe0c42343aa678872e499c04db70cbdc528f48f0ca93921e434ea7ac11a9a4fd857ba8507589063cc311370fcd6477e3bd4fadb89e842a64d10bf2d1f9deadbf8b8d79a05821712ba49b0478c4c96d55a43031f9951a1def7e12541f1352d36654c06864a540ebafaf21a7744e53f02f78a6c82ff2d7676afea5c576b231829851f10dd1c477677cdaebc7d7f0bb4e170f16d9d7130203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604149070be5fdb372c09f54ecbabfecc4cdc979783 EAP-Message = 0x6d301f0603551d230418301680149070be5fdb372c09f54ecbabfecc4cdc9797836d300d06092a864886f70d010105050003820101000e3e63fd403f29af1912cf95540307a47087bba7cdee6a0657ba7a1f28fd148d93d081abda825b858d9d1351e33dca9b4d8d8f1941995e20173fe22def775aceabd13101ffb42eca6a6497c41e6985d78740173fe1ba1f76db32677053ffa87891213b7df0c2a9d339d61e2595d7658d1e1c3f8a0438a2f91f2cd9060a4b027da0cc75443be746fca0605a37155c84b9e1bff1f84b2f41328aba6b03e55d922a49f70df090d240b1a398fc8dd74aa2450661fbf3cb0d1986863cf41cd0f84366e52251a55a9f70 EAP-Message = 0x0d6b2a92d2b3579d7dfa7601e92a703d17d20f6b0bdf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf82a664f4f7328b73ffccc1f1773d09c Finished request 14 Going to the next request E

4 3

Auth-Type attribute and authorize section
by Nicolas Castel 30 May '06

30 May '06

Hi all, I'm developping some FreeRADIUS modules. In the authorize section, my module set the "Auth-Type" to a specific value to pick my own module in the authorize section. The last one in this section is the FreeRADIUS files module. I use it to perform some tasks if the request is not processed by other modules. Even the Auth-Type has already been set by a precedent module, the request goes through the files modules and match the DEFAULT entry. Is there any possibility not to go through following modules in the authorize section if the Auth-Type has already been set. I mean go directly to the authentication section once the configuration attribute Auth-Type has been set (I would like not to modify the files module code). Thanks in advance

2 2

regular expressions parsing changed in 1.1.2 ?
by Alexander Serkin 30 May '06

30 May '06

Hi, I recently built 1.1.2 and it claims about regular expression in huntgroups: /opt/fr/etc/raddb/huntgroups[87]: Parse error (check) for entry UNKNOWN: Illegal regular expression in attribute: Calling-Station-Id: ?, *, +, or { } not preceded by valid regular expression The string contains: Calling-Station-Id =~ "*" Do i need something like that now: Calling-Station-Id =~ "/*/" ??? -- Sincerely Yours, Alexander

2 1

regular expressions parsing changed in 1.1.2 ?
by Alexander Serkin 30 May '06

30 May '06

Hi, I recently built 1.1.2 and it claims about regular expression in huntgroups: /opt/fr/etc/raddb/huntgroups[87]: Parse error (check) for entry UNKNOWN: Illegal regular expression in attribute: Calling-Station-Id: ?, *, +, or { } not preceded by valid regular expression The string contains: Calling-Station-Id =~ "*" Do i need something like that now: Calling-Station-Id =~ "/*/" ??? -- Sincerely Yours, Alexander

1 0

Session-Octets-Limits
by Mordor Networks 30 May '06

30 May '06

Hello How can i add some attributes to freeradius sql tables , like i want to add Session-Octets-Limits what should i do?

1 0

How to Work on Accounting in Openser + radius
by raviprakash sunkara 30 May '06

30 May '06

Hi Everybody, I need help from you users, That How can we perform the accouting in Openser and Radius, That I want database should in radius + mysql with openser . In openser if I add " save("acc") its give error as " reinstall ser_mysql.sh " how can we do that... And I follow this "http://openser.org/docs/openser-radius-1.0.x.html " for integrating openser + radius But I wnat really how cam we integrate the " opensaer + radius + mysql " with hints or sample file -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com <b>

1 0

Cisco avpair
by Pierre LEONARD 30 May '06

30 May '06

Hi everybody i search an exhaustiv list of cisco avpair parameters that the radius server could return to a cisco router... i hope somebody will be able to help me with an URL or a list. thanks in advance

2 3