August 2007 - Freeradius-Users - lists.freeradius.org

Problems running on Solaris 10
by Paul Goodman 09 Aug '07

09 Aug '07

I have just finished compiling the PAM client module on Solaris 10 (pam_radius-1.3.17). With some minor tweaks, I compiled the module successfully and am using it to authenticate via ssh and sudo. However, I am having difficulty getting su to work. The line I have in /etc/pam.conf is: su auth required pam_radius_auth.so With this configuration, after typing su, I get a password prompt. I enter the correct password, but get the message: su: Sorry This happened on my linux systems as well, until I added the ruser option to the module. On linux, the ruser option allows su to be used successfully. However, on Solaris 10, adding the ruser option causes a segfault and core dump. Again, I get the password prompt and enter the correct password, then get: Segmentation Fault (core dumped) Using mdb to analyze the core file, I see: bash-3.00# mdb corefile Loading modules: [ libc.so.1 ld.so.1 ] > ::status debugging core file of su (32-bit) from XXXXXXX file: /usr/bin/su initial argv: su threading model: multi-threaded status: process terminated by SIGSEGV (Segmentation Fault) Can anyone tell me how to get su working on Solaris 10?

1 0

Patch to fix the 0x thing in *NTPassword LDAP attr... Comments?
by Stefan Adams 09 Aug '07

09 Aug '07

It's been quite a challenge to maintain both radiusNTPassword and sambaNTPassword in a user's LDAP object, especially when radiusNTPassword is just sambaNTPassword, prepended with '0x'. If nothing else, that's redundant. So, what about this patch? It just takes your sambaNTPassword and prepends the necessary '0x' before doing anything with it. Does that make sense? Anything wrong with doing this? Obviouly this patch is teeny and not very profound... For what reason is this avoided? rlm_ldap expects the value to be in hex. OK -- so just immediately assume it's in hex and prepend the '0x'. What about making it a configuration parameter? I'm sure others would like to be able to skip the whole redundant *NTPassword thing, too. Comments encouraged. Thanks!! Stefan # cat /tmp/0x.patch diff -urN freeradius-1.1.7/src/modules/rlm_ldap/rlm_ldap.c freeradius-1.1.7-0x/src/modules/rlm_ldap/rlm_ldap.c --- freeradius-1.1.7/src/modules/rlm_ldap/rlm_ldap.c 2007-08-08 22:57:43.000000000 -0500 +++ freeradius-1.1.7-0x/src/modules/rlm_ldap/rlm_ldap.c 2007-08-08 22:37:56.000000000 -0500 @@ -2498,6 +2498,7 @@ int vals_count; int vals_idx; char *ptr; +char hex[35]; char *value; TLDAP_RADIUS *element; LRAD_TOKEN token, operator; @@ -2517,6 +2518,7 @@ */ if ((vals = ldap_get_values(ld,entry,element->attr)) == NULL) continue; +DEBUG("!!! %s !!!", element->attr); /* * Check whether this is a one-to-one-mapped ldap * attribute or a generic attribute and set flag @@ -2535,6 +2537,9 @@ for (vals_idx = 0; vals_idx < vals_count; vals_idx++) { value = vals[vals_idx]; +sprintf(hex, "0x%s", value); +value = hex; +DEBUG("!!! %s !!!", value); if (is_generic_attribute) { /* * This is a generic attribute.

3 2

Re: Need help in double logins in radacct
by Nachiketa Rajpurohit 09 Aug '07

09 Aug '07

I observed the same double or multiple inserts. with same AcctSessionID and same Start time for some users. This happens with Interim update too. I later changed radius.conf to calculate AcctUniqueID and do updates based on that in sql.conf but this random occurrence did not go away. May be it is because of the delay. Still not sure why multiple inserts. On 8/9/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re : Converting PAP to MS-CHAPV2 (Eshun Benjamin) > 2. Re: Need help in double logins in radacct (Claudiu Filip) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 9 Aug 2007 09:02:22 +0000 (GMT) > From: Eshun Benjamin <bkeshun(a)yahoo.fr> > Subject: Re : Converting PAP to MS-CHAPV2 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <107714.37623.qm(a)web26014.mail.ukl.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Freeradius can dynamically authenticate against PAP or MSCHAP. You > would have to have 2 password db. ( eg. unix passwd and smbpasswd). You can > not use one db for both. It does it like magic :-) if you have to db. > > ================================================== > Benjamin K. Eshun > > ----- Message d'origine ---- > De : Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > ? : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoy? le : Mercredi, 8 Ao?t 2007, 23h46mn 13s > Objet : Re: Converting PAP to MS-CHAPV2 > > Jo?o Mendes wrote: > > HI, > > I was wondering if freeradius could do the following: > > - I have a radius client that needs to talk MS-Chapv2 and a Radius > > server that only talks PAP. > > Can freeradius convert and proxy the request to the server than > > answer to the client?? > > > No, > Amongst other things In order for PAP (Plaintext Authentication > Protocol) to work, the supplicant needs to provide it's credentials in > Plaintext. > MSCHAPv2 only provides hashes on the users credentials. > > Thanks > > Jo?o Mendes > > > > > > > > > > > > > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > > > _____________________________________________________________________________ > Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! > Mail >

2 1

Need help in double logins in radacct
by Nelson Serafica 09 Aug '07

09 Aug '07

Need help! I maintained a dial-up ISP. I'm new to this company and I'm not the one who setup the server. With all 4 freeradius server, one has a problem. It has double logs in mysql (radacct). Meaning two different RadAcctId but with the same AcctSessionId. Is there anyone could help me distinguish why it has double record in mysql. But when in radius logs,it has one request only. Here is the sample: | RadAcctId | AcctSessionId | UserName | | 517069 | 3C001FC0 | foo | | 517071 | 3C001FC0 | foo | | 517075 | 3C001FC0 | foo | Server has 192MB memory and running in 300Mhz processor with kernel version 2.4. I already upgrade to the latest freeradius version but still no luck. Anyone already experienced this kind of problem? Please show me the link or at least the possible solution. ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

2 1

Re : Converting PAP to MS-CHAPV2
by Eshun Benjamin 09 Aug '07

09 Aug '07

Freeradius can dynamically authenticate against PAP or MSCHAP. You would have to have 2 password db. ( eg. unix passwd and smbpasswd). You can not use one db for both. It does it like magic :-) if you have to db. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 8 Août 2007, 23h46mn 13s Objet : Re: Converting PAP to MS-CHAPV2 João Mendes wrote: > HI, > I was wondering if freeradius could do the following: > - I have a radius client that needs to talk MS-Chapv2 and a Radius > server that only talks PAP. > Can freeradius convert and proxy the request to the server than > answer to the client?? > No, Amongst other things In order for PAP (Plaintext Authentication Protocol) to work, the supplicant needs to provide it's credentials in Plaintext. MSCHAPv2 only provides hashes on the users credentials. > Thanks > João Mendes > > > > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

problem with dialup admin, php
by Carl aniams 09 Aug '07

09 Aug '07

hi all, i'm using dialup admin on a freeradius server. i updated the folowing packages: php4 to php5, mysql4 to my sql5 with the corresponding php-mysql 5 when i browse my dialup admin interface the menu buttons do not appear and am rather asked to download the php file(eg buttons.php3) looking in the http error_access.log i have for the dialup admin page the message: undefined variable at ..../buttons.php3 Also all other other software installed containing php scripts and databases(index.php) do not open at all or open partially. i have in my httpd.conf *application*/x-httpd-php .php3 i'm using fedora core 4, freeradius1.1.6 -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

1 0

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 09 Aug '07

09 Aug '07

Hello Ivan, Mon, 06 Aug 2007 12:52:20 +0100, you wrote: From: <tnt(a)kalik.co.yu> >1. Send debug with the Accounting-Request >2. Create an extra field for that attribute (IP address is varchar(15) >type) to the radaact table and add the field and value to the query (so >it's definitely different. > >Ivan Kalik >Kalik Informatika ISP Here is more debug output with accounting request: Finished request 100 Going to the next request Waking up in 5 seconds... rad_recv: Accounting-Request packet from host n.a.s.1:1646, id=239, length=531 Acct-Session-Id = "0024F8FF" Calling-Station-Id = "442098765432" Called-Station-Id = "0002561234567" h323-setup-time = "h323-setup-time=16:53:14.471 GMT+3 Mon Aug 6 2007" h323-gw-id = "h323-gw-id=Rotelkom_Gateway.www.nas.co.ug" h323-conf-id = "h323-conf-id=B4550CDC FAA011D6 887DF94C E05F1EEE" h323-call-origin = "h323-call-origin=answer" h323-call-type = "h323-call-type=VoIP" Cisco-AVPair = "h323-incoming-conf-id=B4550CDC FAA011D6 887DF94C E05F1EEE" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:0002561234567" User-Name = "rem.ote.add.ress" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = 0 Acct-Status-Type = Start Service-Type = Login-User NAS-IP-Address = n.a.s.1 Acct-Delay-Time = 10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 101 modcall[preacct]: module "preprocess" returns noop for request 101 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = n.a.s.1,NAS-IP-Address = n.a.s.1,Acct-Session-Id = "0024F8FF",User-Name = "rem.ote.add.ress"' rlm_acct_unique: Acct-Unique-Session-ID = "ecaef4ac9b6cbafc". modcall[preacct]: module "acct_unique" returns ok for request 101 rlm_realm: No '@' in User-Name = "rem.ote.add.ress", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 101 modcall[preacct]: module "files" returns noop for request 101 modcall: leaving group preacct (returns ok) for request 101 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 101 radius_xlat: '/var/log/radius/radacct/n.a.s.1/detail-20070806' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/n.a.s.1/detail-20070806 modcall[accounting]: module "detail" returns ok for request 101 modcall[accounting]: module "unix" returns noop for request 101 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'rem.ote.add.ress' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 101 radius_xlat: 'rem.ote.add.ress' rlm_sql (sql): sql_set_user escaped user --> 'rem.ote.add.ress' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('0024F8FF', 'ecaef4ac9b6cbafc', 'rem.ote.add.ress', '', 'n.a.s.1', '', '', '2007-08-06 16:53:36', '0', '0', '0', '', '', '0', '0', '0002561234567', '442098765432', '', '', '', '', '10', '0')' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql (sql): Released sql socket id: 8 modcall[accounting]: module "sql" returns ok for request 101 modcall: leaving group accounting (returns ok) for request 101 Sending Accounting-Response of id 239 to n.a.s.1 port 1646 Finished request 101 Going to the next request Waking up in 5 seconds... rad_recv: Accounting-Request packet from host n.a.s.1:1646, id=240, length=542 Acct-Session-Id = "0024F901" Calling-Station-Id = "442098765432" Called-Station-Id = "0002561234567" h323-setup-time = "h323-setup-time=16:53:14.519 GMT+3 Mon Aug 6 2007" h323-gw-id = "h323-gw-id=Rotelkom_Gateway.www.nas.co.ug" h323-conf-id = "h323-conf-id=B4550CDC FAA011D6 887DF94C E05F1EEE" h323-call-origin = "h323-call-origin=originate" h323-call-type = "h323-call-type=Telephony" Cisco-AVPair = "h323-incoming-conf-id=B4550CDC FAA011D6 887DF94C E05F1EEE" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:1,#:0002561234567" User-Name = "rem.ote.add.ress" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = 0 Acct-Status-Type = Start NAS-Port-Type = Async Cisco-NAS-Port = "ISDN 1/5:D:28" NAS-Port = 0 Service-Type = Login-User NAS-IP-Address = n.a.s.1 Acct-Delay-Time = 10 Processing the preacct section of radiu mail:~ # killall radius radius: no process killed mail:~ # /etc/init.d/radiusd start Starting RADIUS daemon done mail:~ # less radiusdebug Cisco-AVPair = "lowater-playout-delay=0 ms" Cisco-AVPair = "gapfill-with-interpolation=0 ms" Cisco-AVPair = "gapfill-with-prediction=0 ms" Cisco-AVPair = "gapfill-with-redundancy=0 ms" Cisco-AVPair = "gapfill-with-silence=0 ms" Cisco-AVPair = "early-packets=0" Cisco-AVPair = "late-packets=0" Cisco-AVPair = "lost-packets=0" Acct-Authentic = 0 Acct-Status-Type = Stop Service-Type = Login-User NAS-IP-Address = n.a.s.1 Acct-Delay-Time = 10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = n.a.s.1,NAS-IP-Address = n.a.s.1,Acct-Session-Id = "0024F503",User-Name = "85.31.4 8.5"' rlm_acct_unique: Acct-Unique-Session-ID = "85c05e6f00c27cfe". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "rem.ote.add.ress", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/radius/radacct/n.a.s.1/detail-20070806' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/n.a.s.1/detail-20070806 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns noop for request 0 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'rem.ote.add.ress' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 0 radius_xlat: 'rem.ote.add.ress' rlm_sql (sql): sql_set_user escaped user --> 'rem.ote.add.ress' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2007-08-06 16:43:42', AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '4 60', AcctTerminateCause = '', AcctStopDelay = '10', ConnectInfo_stop = '' WHERE AcctSessionId = '0024F503' AND UserName = 'rem.ote.add.ress' AND NASIPAddress = 'n.a.s.1'' rlm_sql (sql): Reserving sql socket id: 9 radius_xlat: 'stop packet with zero session length. [user 'rem.ote.add.ress', nas 'n.a.s.1']' rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'rem.ote.add.ress', nas 'n.a.s.1'] rlm_sql (sql): Released sql socket id: 9 radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,NASPortId, NASPortType, AcctStartTime, AcctS topTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingSt ationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('0024F503', '85c05e6f00c27 cfe', 'rem.ote.add.ress', '', 'n.a.s.1', '', '', DATE_SUB('2007-08-06 16:43:42', INTERVAL (0 + 10) SECOND), '2007-08-06 16:43:42', '0', '0', '', '', '0', '460', '00025698765432', '', '', 'rem.ote.add.ress', '', 'rem.ote.add.ress', '0', '10')' rlm_sql (sql): Released sql socket id: 9 modcall[accounting]: module "sql" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 119 to n.a.s.1 port 1646 Finished request 0 Going to the next request n.a.s.1 is the IP address of my local NAS and rem.ote.add.ress is the IP address of the remote router. Regards Timothy

3 4

Freeradius / NAS issue
by Andy Billington 08 Aug '07

08 Aug '07

hi all, I've searched the list for clues but havent' found a resolution for the following: 1. On a testing network, with seven identically configured routers, four connect and three dont. They are all the same make / model. 2. They're all using different usernames and passwords, and the NAS is reporting that RADIUS is rejecting three of them but the other four are OK. 3. The box _is_ multihomed; saw the FAQ and i've set bind and port to the one address I want and also have recompiled with --with-udpfromto 4. I'm seeing fewer errors than I was, but the sites still aren't connecting. 5. When I connect from another site using ntradping to the same FreeRADIUS all seven usernames / passwords work and I get Access-Accept. 6. At the not workign sites, the routers (Draytek) report that the ADSL is in sync, sending an Access-Request, then nine seconds later they drop the PPP session. auth-detail reports the Access-Request properly AFAIK. reply-detail reports the Access-Accept properly. In the radius.log I get Wed Aug 8 18:17:35 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'Redback', nas 'a.b.c.d'] Wed Aug 8 18:17:36 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:36 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:36 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:36 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:41 2007 : Auth: Login OK: [Site14(a)provider.net/<CHAP-Password>] (from client NAS-ocl port 1114112) Wed Aug 8 18:17:43 2007 : Auth: Login OK: [Site11(a)provider.net/<CHAP-Password>] (from client NAS-ocl port 1114112) Wed Aug 8 18:17:44 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:44 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:44 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'Redback', nas 'a.b.c.d'] Wed Aug 8 18:17:45 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:45 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:45 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:45 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:17:50 2007 : Auth: Login OK: [Site14(a)provider.net/<CHAP-Password>] (from client NAS-ocl port 1114112) Wed Aug 8 18:17:50 2007 : Auth: Login incorrect: [Redback/*********] (from client NAS-ocl port 0) Wed Aug 8 18:17:50 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [redback] Wed Aug 8 18:17:50 2007 : Auth: Login incorrect: [redback/*********] (from client NAS-ocl port 0) Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'Site11(a)provider.net', nas 'a.b.c.d'] Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_radutmp: Logout for NAS NAS-ocl port 1114112, but no Login record Wed Aug 8 18:18:02 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'Site14(a)provider.net', nas 'a.b.c.d'] In the detail log I get Wed Aug 8 17:34:02 2007 User-Name = "REMOVED" Acct-Status-Type = Stop Acct-Session-Id = "FF10FFFF584ECD3D-46B9FE2D" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "t6-se1" NAS-Port = 1114112 NAS-Port-Type = Virtual NAS-Port-Id = "L2TP LNS 5164349" Medium-Type = DSL Connect-Info = "155520000/155520000" Platform-Type = SmartEdge-800 OS-Version = "4.0.5.4p1" Acct-Authentic = RADIUS Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IP Tunnel-Server-Endpoint:0 = "192.168.XXX.YYY" Tunnel-Client-Endpoint:0 = "192.168.XXX.ZZZ" Tunnel-Max-Sessions = 2300 Tunnel-Max-Tunnels = 32767 Tunnel-Function = LNS-Only Acct-Session-Time = 0 Acct-Terminate-Cause = User-Request Session-Error-Code = 140 Session-Error-Msg = "Received PPP Terminate Request" Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets-64 = 0x0000000000000000 Acct-Output-Packets-64 = 0x0000000000000000 Acct-Input-Octets-64 = 0x0000000000000000 Acct-Output-Octets-64 = 0x0000000000000000 Acct-Mcast-In-Packets = 0 Acct-Mcast-Out-Packets = 0 Acct-Mcast-In-Octets = 0 Acct-Mcast-Out-Octets = 0 Acct-Mcast-In-Packets-64 = 0x0000000000000000 Acct-Mcast-Out-Packets-64 = 0x0000000000000000 Acct-Mcast-In-Octets-64 = 0x0000000000000000 Acct-Mcast-Out-Octets-64 = 0x0000000000000000 Event-Timestamp = "Aug 8 2007 18:32:50 BST" NAS-IP-Address = a.b.c.d Client-IP-Address = a.b.c.d Acct-Unique-Session-Id = "f727889885172d56" Timestamp = 1186590842 I can't see any differences between the usernames that work and those that dont. FR is using MySQL if that makes a difference. I'm not that concerned about the redback/***** failures as they are keepalives from the NAS, which is 3rd party (I have no access). Thanks in advance for any pointers anyone can give, and very sorry if my searching of the list missed a solution posted previously!! Andy

3 8

Converting PAP to MS-CHAPV2
by João Mendes 08 Aug '07

08 Aug '07

HI, I was wondering if freeradius could do the following: - I have a radius client that needs to talk MS-Chapv2 and a Radius server that only talks PAP. Can freeradius convert and proxy the request to the server than answer to the client?? Thanks João Mendes

4 3

proxy and attribute overrides
by Emmanuel Dreyfus 08 Aug '07

08 Aug '07

Hello Sorry if this is a FAQ, but I have not found the answer, so here I am: I use freeradius-1.1.6. The server do authorization and authentication for a few NAS. Some users have logins in the local realm and others have logins in proxied realms. When a user passes authorization, the server returns a Framed-IP-Address to the NAS. The address depends of the NAS and is selected using huntgroups. I have a problem with users in proxied realms: after proxy authentication is successful, radiusd sends a packet to the NAS with no Framed-IP-Address, or with a Framed-IP-Address taken from the proxy RADIUS server. I want my radius server to choose the Framed-IP-Address and ignore what proxied servers send. This can be acheived uwing the attr_filter module, but that module will only allow selection the address based on the realm. I cannot select through huntgroups, which is what I'm looking for. The workaround I found is to add post_proxy_authorize = yes in the server secion of proxy.conf. That causes the proxied reply to go to the authorization stage again and to have a correct Framed-IP-Address added. That post_proxy_authorize option is documented as depreacted and scheduled for future removal. How can I acheive my setup without it? I'm pretty confident there is a way of doing it, but I have not been able to find it. -- Emmanuel Dreyfus manu(a)netbsd.org

3 8