October 2008 - Freeradius-Users - lists.freeradius.org

Status Access from detail authentication log
by Sergio Belkin 22 Oct '08

22 Oct '08

How can I know the status access (reject or accept) reading detail auth_log, for example the following sample say me nothing about it: (Of course I can read on ${logdir}/radius.log, but I'd want to read both status and detail...) thanks in advance Fri Aug 22 10:57:44 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0xae788ba007234884dd1d8bd7ecdff771 Fri Aug 22 10:57:44 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0xda7f4592324f0f212a30c0acda749bb5 Fri Aug 22 10:58:02 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000e01616e6f6e796d6f7573 Message-Authenticator = 0xe2a7de1d4638038263aab02f2c178e0d Fri Aug 22 10:58:02 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x18884817188a5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202003c158000000032160301002d010000290301db97e02140c59157bde3685dd107ffe7d1c657ae7e32604645a150c86764ed0c000002000a0100 Message-Authenticator = 0x0395ed4d6ea9ed5f3e67edec7ae4db83 Fri Aug 22 10:58:02 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x18884817198b5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061500 Message-Authenticator = 0x66565a8f0aad2725f06817b72d0332f9 Fri Aug 22 10:58:02 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x188848171a8c5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061500 Message-Authenticator = 0x391d76eeb7d448bf14a4786b4814d884 Fri Aug 22 10:58:02 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x188848171b8d5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061500 Message-Authenticator = 0x5f951a3937db91d6966a1ad58c7ddbbc Fri Aug 22 10:58:03 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x188848171c8e5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206014815800000013e160301010610000102010024b08087f1fe4a67a5dc9aed4b02f8b4c2102a94bf92f7c5e7fc6ed2b2f9975cd5884e9d3e25fa35c367a76af0723f855fd5672a014242be916746bb465f7bfed4b0b69b39f1687ccf87c5be3591ef0c0d7965e10b78cede3543f1d12e660fa1c8ad6e9d799ceefe8e81a25449fa8470c8500f9252ed54a1c8bc7ce030f82e5b2c6505689240e720aeaa036b3fbb40f941e65dcfa2464a07617116e891da2f9b0e0cb28a148f40c7d8d5477eee83a930c259855e9c5513055b28ddbadfdc73ee1e51c1045f84c7c42deeb5ecbeec05ef2434d9f20863c4a5d5a3188f216589bbd6c68f8b019a0cb0 EAP-Message = 0x49fdf75cc2723f5e6d5815767523a938649edf0ab353ed0d1403010001011603010028d9cf2d07fed18da16f8cfd47a88ad057740e328603dfb12ed6c26b04020cadea66b3fbf7292a25b4 Message-Authenticator = 0x473d475abd749b8881d1ba7f955c6997 Fri Aug 22 10:58:03 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 192.168.134.204 Called-Station-Id = "001d7edc22f4" Calling-Station-Id = "0016447e5a79" NAS-Identifier = "001d7edc22f4" NAS-Port = 29 Framed-MTU = 1400 State = 0x188848171d8f5dcb0bc882eaac65b2e0 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207004f1580000000451703010040bb5dbf55827b2cf722b2ac8309afa04e839f6cc432524a60e4130a25fca5246f1644df960e7e5109e4d728cd1a0e16f53c9741917a95497c068e8cbace5d2ea6 Message-Authenticator = 0xb254f4b7fa9e4b6a8010d27210310955 Fri Aug 22 10:58:03 2008 Packet-Type = Access-Request User-Name = "ngalan" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 111.111.111.111 -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Freeradius Groups and Linux Users
by Samuel TAILLET 22 Oct '08

22 Oct '08

Hello, I have 2 small questions for the ML: 1) when using the auth radius under Linux, I'm still require to create the account on the machine? because I can't do otherwise if it does not work. 2) I can't make groups, such bob has the rights to log on Linux, Ted on Linux, Unix and Fred on The Switch is it possible? Thank you in advance and a + + PS : excuse me for my English level

3 4

Extra fields in accounting
by Jonathan Gazeley 22 Oct '08

22 Oct '08

I have a FreeRadius server, which is running two virtual servers that process requests from different wireless SSIDs. They are set to do accounting to a MySQL database. What I'd like to know is how to add an extra field to say which virtual server the request came from, so I can query on this field when I analyse my accounting records. Is there an easy way of doing this? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

2 2

EAP-AKA server RAND error
by Mohammad Belgaumkar 22 Oct '08

22 Oct '08

Hi I have configured freeradius for EAP AKA by applying the patch. I m using radeapclient to test it. Below is my configuration for server in raddb/users file DEFAULT Auth-Type := EAP, EAP-Type := AKA EAP-Sim-AUTN=0xa0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0 EAP-Aka-IK=0xb0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0 EAP-Aka-CK=0xc0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0 EAP-Sim-RES=0xd0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0 EAP-Sim-RAND=0xe0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0 Bu i get this "eap-aka can not find EAP-Sim-RAND" error in server Please help Regards Mohammad Arif Belgaumkar L&T Infotech Ltd, Whitefield, Bangalore - 66 Ph - 91-80-66242424 extn 2018 www.Lntinfotech.com ( ) L&T Infotech General Business (+) L&T Infotech Internal Use ( ) L&T Infotech Confidential ( ) L&T Infotech Proprietary Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: |------| | [X] | |------|L&T Infotech Proprietary |------| | [ ] | |------|L&T Infotech Confidential |------| | [ ] | |------| L&T Infotech Internal Use Only |------| | [ ] | |------|L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

1 0

Error in the negotiations certificates
by Martin Silvero 22 Oct '08

22 Oct '08

I mean, what I want to achieve is to use tls with certificates for the PC's that want to connect AP of entry, this creates certificates with the following reference: https://lists.freeradius.org/pipermail/freeradius-users/2008-October/msg005… license = certificates for tls , sorry my english (is very bad). then my problem is certificates? but i try many opcion and nothing. I created the certificates according to the README file, then tried and nothing, then did the same thing, but I created a bundle : "cat ca.pem server.pem > cabundle.pem" and convert in the cabundle. der, then import client.p12 and cabundle.der to the laptop, then try and get the last error that you showed.

2 1

EAP SIM error
by Nayan Gjain 22 Oct '08

22 Oct '08

Hi I had configured the freeradius-server-2.1.0 for eap-sim and trying to test it with radeapclient utility, while testing the following error occurs in server -: "EAP SIM error can not initiate sim, no RAND1 attribute" can anyone help me thanks Warm Regards, NAYAN JAIN (280609) SE (Software Engineer - 50PE) Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: L&T Infotech Proprietary L&T Infotech Confidential L&T Infotech Internal Use Only L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

2 1

Dynamic IP assignment problem
by Mr. K 22 Oct '08

22 Oct '08

Hi all, I´m starting on using freeRadius and I´m trying to use ippool to assign an IP dynamically for different users. Using the radiusd –X option, I finally could receive an Accept packet with an IP. The problem is that the IP that I’m receiving is not from the pool defined in the radius.conf file as I will try to show in the logs below. Module: Loaded IPPOOL ippool: session-db = "/usr/freeRadius/raddb/db.ippool" ippool: ip-index = "/usr/freeRadius/raddb/db.ipindex" #### This is the definition used in the radius.conf ippool: range-start = 10.0.10.1 IP address [10.0.10.1] ippool: range-stop = 10.0.10.200 IP address [10.0.10.200] ippool: netmask = 255.255.252.0 IP address [255.255.252.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) detail: detailfile = "/usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Then when I when receiving the IP: rad_recv: Access-Request packet from host 172.16.3.185:1130, id=0, length=64 User-Name = "7875305130@newcomm" User-Password = "7875305130" NAS-Port = 7777 Processing the authorize section of radiusd.conf The process of authorization ends OK, but the assigned IP is from the original main_ippool that I have modified. Login OK: [7875305130@newcomm] (from client iot port 7777) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 172.16.3.185/7777 rlm_ippool: Found a stale entry for ip/port: 172.16.3.171/7777 rlm_ippool: num: 0 rlm_ippool: Searching for an entry for nas/port: 172.16.3.185/7777 rlm_ippool: Allocating ip to nas/port: 172.16.3.185/7777 rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.3.172 to client on nas 172.16.3.185,port 7777 modcall[post-auth]: module "main_pool" returns ok for request 0 radius_xlat: '/usr/freeRadius/log/radius/radacct/172.16.3.185/reply-detail-20081022' rlm_detail: /usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/freeRadius/log/radius/radacct/172.16.3.185/reply-detail-20081022 modcall[post-auth]: module "reply_log" returns ok for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: '7875305130@newcomm' rlm_sql (sql): sql_set_user escaped user --> '7875305130@newcomm' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', '7875305130@newcomm', '7875305130', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', '7875305130@newcomm', '7875305130', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 0 to 172.16.3.185 port 1130 Framed-IP-Address = 172.16.3.172 Framed-IP-Netmask = 255.255.252.0 Finished request 0 I really don’t understand where are stored this IP from the original configuration. Maybe I still have to change any other configuration file, but I don`t realise where. Thanks in advance. Darío -- View this message in context: http://www.nabble.com/Dynamic-IP-assignment-problem-tp20103625p20103625.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

new to freeradius - proxy question
by Paul A 21 Oct '08

21 Oct '08

Hoping someone can help me or point me in the right direction. We currently are running a Livingston radius server that does realm and DNIS proxying. For obvious reasons we want to replace this server with freeradius. My current setup is like this. Livingston radius proxy - let's say it's 1.1.1.1, doing realm and DNIS proxy - which works. A freeradius destination server, 3.3.3.3, that handles usernames with/without realms. Which works with the Livingston proxy server. The new freeradius proxy server that currently only works with realms - let's say its 2.2.2.2 How im testing: In the old Livingston proxy I have this. ####3.3.3.3 somesecret 5500 old 2.2.2.2 somesecret 5500 1812 1813 Here's the problem: My ne freeradius proxy at 2.2.2.2 is doing realm and DNIS proxy but only realm proxy is working. Although it seems like that server is sending all radius packets to the destination server of 3.3.3.3 On this server I do have a DNIS entry on the acct_users file, like this: DEFAULT Called-Station-Id == "5500", Proxy-To-Realm := "realm.net" Fall-Through = No On Freeradius destination server I see start records for users login in with user@realm Oct 21 09:46:02 2008 User-Name = "test" NAS-IP-Address = xx.xx.80.15 Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 751 Ascend-NAS-Port-Format = 2_4_5_5 NAS-Port-Type = Async Service-Type = Framed-User Acct-Status-Type = Start But for users login in without a realm I notice a lot of stop records but the curious thing is that I see some with Ascend-Disconnect-Cause = PPP-PAP-Auth-Failed. So now im wondering if the proxy at 2.2.2.2 is doing something to the packets leaving for 3.3.3.3 that's causing it to fail without the realm at the destination server. Any help would be appreciated. Thanks p.a

2 3

using radtest as a different client..
by Oguzhan Kayhan 21 Oct '08

21 Oct '08

Hello , I just wonder if i can use radtest command as testing from a different client? Such as, Assume i have a client conf for 1.1.1.1 ip add. in my freeradius(2.2.2.2) server. And from 3.3.3.3 client(lets call client3) i am trying to test the connection.like radtest user pass 2.2.2.2 10 secret ?????? ????? There is two optional parameters as i see on man page. PPPhint and nasname. Is it possible to test from client1 as is it is from client2 like radtest user pass 2.2.2.2 10 secret 3.3.3.3 If not, what is the purpose of nasname parameter?? Why i need is , I wanna have server with 2 interfaces and there are 2 different chilli processes are working which authenticates from 2 different virtual freeradius servers. So maybe i can figure out the different client problem via nasnames?? Or not..

4 4

New RADIUS book - Nuevo libro de RADIUS
by nanotech＠terra.es 21 Oct '08

21 Oct '08

Saludos a todos (Hi everybody) He descubierto el lanzamiento de un nuevo libro de RADIUS en la Web: www.radiusdoc.com (Parece muy interesante) I've discovered a new RADIUS book in the website: www.radiusdoc.com (It appears to be very interesting and helpful). Francisco Montes Ahora también puedes acceder a tu correo Terra desde el móvil. Infórmate pinchando aquí.

1 0