September 2007 - Freeradius-Users - lists.freeradius.org

access reject packet
by lim chee hong 03 Sep '07

03 Sep '07

[root@localhost raddb]# radtest lim lim localhost 1645 testing123 Sending Access-Request of id 194 to 127.0.0.1 port 1812 User-Name = "lim" User-Password = "lim" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=194, length=20 this is the result when i ran my radtest for my freeradius 1.1.6 in fedora core 2. unfortunely i get the access reject packet for the result.i had edited in my radius.config and client.config but i think i did wrongly since i get the access rejected.anybody know how to solve this problem?where should i correct in the config file. thanks in advance for ur help.i'm new in freeradius and hope tat can seek the help from u all.once again thank you to u all. Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

make errors
by Fred Zinsli 02 Sep '07

02 Sep '07

Hi everyone Doing a brand new install in Ubuntu Draper 6.06 LAMP server. I have downloaded freeradius 1.1.7 and place in in my home directory /home/fredz I have unpacked the file tar -zxvf freeradius-1.1.7.tar.gz Configured it cd /home/fredz/freeradius-1.1.7 ./configure Have gone to make it make and I have the following errors make[6]: *** [rlm_sqlippool.lo] Error 1 make[6]: Leaving directory `/home/fredz/freeradius- 1.1.7/src/modules/rlm_sqlippool' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/fredz/freeradius-1.1.7/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/fredz/freeradius-1.1.7/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/fredz/freeradius-1.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/fredz/freeradius-1.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/fredz/freeradius-1.1.7' make: *** [all] Error 2 I have no idea what to look for or where to look. Any comments would be helpful Regards Fred

2 2

Re: Freeradius help
by Khaldon manIP 02 Sep '07

02 Sep '07

Hi, Thanks for your answer. Actually, I need a more "dynamic" solution. I will have an agreement with a hotspot agregator (like Boingo...) and I will have about 60 millions NAS. The thing is that each NAS have different rates(10 to 20 cent/mn). So, for each user, I have to calculate the remaining session-timeout according to the NAS in which the user wishes to connect to. When the user logs in, I have to run a script which set the session-timeout attribute ( e.g how long the user is allowed to be connected to that specific NAS). When the user logs out, I have to run a script which updates the remaining connection time. I have installed freeradius and phpmyprepaid (with sql_counter module) and everything is working well. The problem with phpmyprepaid is that we invoice the user regardless the NAS in which (s)he is connected to. I hope that my explanation is clear. Thank you very much for your assistance!! Best regards. Khalid On 9/1/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Freeradius help (Khaldon manIP) > 2. Re: Freeradius help (tnt(a)kalik.co.yu) > 3. Proxy accounting information in a diffrect table (justice obrey) > 4. Re: MOTP with freeradius (Alan DeKok) > 5. Re: checkitem problem (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 31 Aug 2007 21:02:44 +0200 > From: "Khaldon manIP" <manvoip(a)gmail.com> > Subject: Freeradius help > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <f90cb76b0708311202u3b8af7fu43a43e5c84037f56(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all, > > I have installed a freeradius server and it works perfectly... > Now, I want to play with the Session-Timeout attribute. I want to set that > value according to the NAS in which the client is connected. > For instance, let us assume a user connect himself to a "Group1 NAS" and > have X seconds session-timeout. But if he would be connected to a "Group2 > NAS", he will have X-10 seconds session-timeout. > > Finally, what I want is: > 1) to run a script that set a session-timeout value according to the NAS > IP > address. > 2) to run a script when the user log out (when the session-timeout > attribute > is updated) > > But I don't know how to do so...I thought about launching scripts but if > you > have a better solution, i'll take it heartily. > > Thanks a lot. > > ps: I sent that mail but it has not been posted....if it has been posted, > sorry in advance... >

1 0

Caveat: schema differences in Acct(Start|Stop)Time
by Stefan Winter 02 Sep '07

02 Sep '07

Hi, (this goes into a Wiki page as well) Today I fell over some caveat when it comes to handling AcctStopTime in databases. In mysql, the schema defines acctstarttime datetime NOT NULL default '0000-00-00 00:00:00', acctstoptime datetime NOT NULL default '0000-00-00 00:00:00', and the accounting queries set a literal '0' on starts. postgresql is different though: AcctStartTime TIMESTAMP with time zone, AcctStopTime TIMESTAMP with time zone, and doesn't set anything on starts, which makes the content a NULL. The difference comes into play for example when you want to delete old records: a DELETE * from radacct WHERE AcctStopTime < $YOUR_THRESHOLD_DATE will a) on postgresql only delete closed sessions older than your threshold age b) on mysql will additionally DELETE ALL YOUR OPEN SESSIONS (because they have AcctStopTime = 0000-00-00 00:00 and that is smaller than your threshold date) I strongly suggest updating CVS head (+will there be a 1.1.8?) with a better schema for mysql (i.e. follow postgresql's NULL). I would do it myself right now, but I'm off for holidays in a few hours. So if someone feels like doing it, there you go. If not: I'll put a Post-It on my computer :-) Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 3

Re: Freeradius help
by Khaldon manIP 01 Sep '07

01 Sep '07

Hi, Thanks for your answer. Actually, I need a more "dynamic" solution. I will have an agreement with a hotspot agregator (like Boingo...) and I will have about 60 millions NAS. The thing is that each NAS have different rates(10 to 20 cent/mn). So, for each user, I have to calculate the remaining session-timeout according to the NAS in which the user wishes to connect to. When the user logs in, I have to run a script which set the session-timeout attribute (e.g how long the user is allowed to be connected to that specific NAS). When the user logs out, I have to run a script which updates the remaining connection time. I have installed freeradius and phpmyprepaid (with sql_counter module) and everything is working well. The problem with phpmyprepaid is that we invoice the user regardless the NAS in which (s)he is connected to. I hope that my explanation is clear. Thank you very much for your assistance!! Best regards. Khalid Date: Fri, 31 Aug 2007 20:25:33 +0100 > From: < tnt(a)kalik.co.yu> > Subject: Re: Freeradius help > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <pAGDDK1m.1188588333.3616070.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > You can set up DEFAULT entries in users file: > > DEFAULT NAS-IP-Address == NAS1IP > Session-Timeout = X > > Same thing for NAS2. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 31/8/2007, "Khaldon manIP" < manvoip(a)gmail.com> pi?e: > > >Hi all, > > > >I have installed a freeradius server and it works perfectly... > >Now, I want to play with the Session-Timeout attribute. I want to set > that > >value according to the NAS in which the client is connected. > >For instance, let us assume a user connect himself to a "Group1 NAS" and > >have X seconds session-timeout. But if he would be connected to a "Group2 > >NAS", he will have X-10 seconds session-timeout. > > > >Finally, what I want is: > >1) to run a script that set a session-timeout value according to the NAS > IP > >address. > >2) to run a script when the user log out (when the session-timeout > attribute > >is updated) > > > >But I don't know how to do so...I thought about launching scripts but if > you > >have a better solution, i'll take it heartily. > > > >Thanks a lot. > > > >ps: I sent that mail but it has not been posted....if it has been posted, > > >sorry in advance... >

2 1

HELP ME: FAILED: MS-CHAP2-Response is incorrect
by hyunok 01 Sep '07

01 Sep '07

Hello, I have a freeradius 1.1.7 server setup with ppp and pptp using a mysql DB for user authentication. --with-mysql-lib-dir=/usr/lib/mysql --with-mysql-include-dir=/usr/include/mysql rpmbuild -bb redhat/freeradius.spec rpm -Uvh freeradius-1.1.7-0.i386.rpm rpm -Uvh freeradius-debuginfo-1.1.7-0.i386.rpm ------------------------------------------------------------- options.pptpd refuse-pap refuse-chap refuse-mschap #require-mppe-128 <==disable require-mschap-v2 plugin radius.so radius-config-file /usr/local/etc/radiusclient/radiusclient.conf plugin radattr.so ------------------------------------------------------------- radiusd.conf use_mppe = no authorize { preprocess chap mschap suffix eap files sql pap } accounting { unix radutmp sql } ------------------------------------------------------------- Here is my debug output: Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32981, id=154, length=151 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser" MS-CHAP-Challenge = 0x46dec3e9097bc536b786971f662d900d MS-CHAP2-Response = 0xf80040b7092f930cb6002b55b7e1d2e1998900000000000000009c17dfe89020dea63a8232e83dffe3600e77bc95a87b1918 Calling-Station-Id = "12x.xx.xx.xx" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32981, id=154, length=151 Sending Access-Reject of id 154 to 127.0.0.1 port 32981 --- Walking the entire request list --- Cleaning up request 0 ID 154 with timestamp 46d95613 Nothing to do. Sleeping until we see a request.

2 1

prevent ldap from searching for groups
by Norbert Wegener 01 Sep '07

01 Sep '07

I am using rlm_ldap (2.0.0-pre2) to check an account for being valid in AD. This works. As I am only interested in one attribute from AD, it would be sufficient, if rlm_ldap would only use "filter" to dive into AD once. How could I prevent rlm_ldap from "Entering ldap_groupcmp()" ? Setting groupname_attribute = NULL groupmembership_filter = NULL only results in an error message "Bad search filter" ..... rlm_ldap: looking for check items in directory...^M rlm_ldap: LDAP attribute primaryGroupID as RADIUS attribute Group-Name == "515"^M rlm_ldap: looking for reply items in directory...^Mrlm_ldap: user host/28tef004.ww006.mycomany.net authorized to use remote access^M rlm_ldap: ldap_release_conn: Release Id: 0^M ++[ldap] returns ok^M How to prevent entering this function?? rlm_ldap: Entering ldap_groupcmp()^M expand: DC=MYCOMPANY,dc=NET -> DC=MYCOMPANY,dc=NET^M expand: NULL -> NULL^M ..... Norbert Wegener

2 8

Problem for IPv6 Connection...
by Vikas Bagora 01 Sep '07

01 Sep '07

Hi All, I want to use the Radius Server where the requesting Client are IPv6 Host. I have changed the clients.conf like : client 2001:0:0:1::9 { secret = pass shortname = admin } I have changed the users file: vikas User-Password == password Service-Type = Administrative-User But, the RADIUS SERVER is showing: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. I have enabled the IPv6 connection line form radiusd.conf file. Is am i require to do any changes which impact of responding to ipv6 client host THANKS IN ADVANCE...I am waiting for early reply. Thanks Vikas S --------------------------------- Got a little couch potato? Check out fun summer activities for kids.

2 4

MOTP with freeradius
by Gaston Bougie 01 Sep '07

01 Sep '07

Hi Gents, I've configured successfully MOTP with xtradius. This way I can do a otp check with a password generated on my mobile (with a java script). see http://motp.sourceforge.net for more information Now I would like to build this functionality with freeradius. I've read that Exec-Program-Wait is ending so I would like to follow procedures and start with rlm_exec. I've read information about it, but find it very poor documented on the freeradius site, so I hope that someone else also bumped in to this startup, or maybe implementation of otpverify. First my setup worked with this user config file, and some other to declare some options: --------------------------- DEFAULT Auth-Type = External Exec-Program-Wait = "/usr/local/bin/otpverify.sh %u %w %S %P %O", Fall-Through = Yes # # Users # test1 Secret = 34963495834, PIN = 1234, Offset = 3600 --------------------------- there was also a execparams file which contained the options for otpverify --------------------------- User-Name u Password w Secret S PIN P Offset O --------------------------- I understand that I must configure something like in the radiusd.conf : --------------------------- modules { exec otpverify { wait = yes program = "/usr/local/bin/otpverify.sh %u %w %S %P %O" input_pairs = request output_pairs = reply } } --------------------------- I think that I miss the basic info, being stuck in the basic points of: - How do I handle the options needed for otpverify.sh (username / password / secret / PIN / offset) - How to call this script for a user Regards, Gaston

2 1