November 2008 - Freeradius-Users - lists.freeradius.org

Re: Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo 26 Nov '08

26 Nov '08

Well, you are right I shouldn't post about the MMSC if I know that dont support RADIUS, but as I wrote in the input, the NAS (Huawei PDSN 9660) support RADIUS, and I need to set it up the headsets to being authorized with FreeRADIUS to use EVDO, I think I have a very basic idea, please correct me and give some guidance if you can, -In FreeRADIUS I have to connect it with sql database server (such as mysql), then create a database, then I dont know how to interconnect it with the NAS (my PDSN) -For the PDSN, I think I must enable a interface which connects to the RADIUS server and then authenticate them with a shared secret and then setup a ip pool in the PDSN, please tell me what steps i miss. Thanks again, Aldo > ---------------------------------------------------------------------- > > Date: Wed, 26 Nov 2008 01:02:00 -0800 > From: Aldo <aldo(a)cleartalk.net> > Subject: Re: Re: Can FreeRadius server as AAA for MMSC and EVDO as > well? > > Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the > MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say > nothing about RAIUS. > I know HLR can handle the Phone authorization for data usage, but that > will enable/disable MMSC and EVDO in bundle, lets say I configure the > PDSN with the FreeRADIUS for the EVDO, what do you recommend me to > authenticate MMSC? > > Thanks again. > > >> ---------------------------------------------------------------------- >> >> Date: Wed, 26 Nov 2008 08:30:38 +0100 >> From: Alan DeKok <aland(a)deployingradius.com> >> Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? >> >> Aldo Zavala wrote: >> >> >>> Hello, I in our network we have two data services: >>> 1.- MMSC (Multimedia Message Service Center) >>> 2.- EVDO (Evolution-Data Optimized) >>> >>> I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. >>> >>> Are there more people who figured out how to make possible this configuration-like? >>> >>> >> If those services use RADIUS for authentication, then it's possible. >> See their documentation for the list of features that they support. >> >> Alan DeKok. >> >> >> > > ------------------------------ > > > Date: Wed, 26 Nov 2008 11:14:19 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? > > Aldo wrote: > >> Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the >> MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say >> nothing about RAIUS. >> I know HLR can handle the Phone authorization for data usage, but that >> will enable/disable MMSC and EVDO in bundle, lets say I configure the >> PDSN with the FreeRADIUS for the EVDO, what do you recommend me to >> authenticate MMSC? >> > > If your MMSC doesn't support RADIUS, then you can't do RADIUS. > > If you're not using RADIUS, there's no point asking questions on this > list. > > Alan DeKok. > >

2 1

re:Re: Read radius client from database
by mj mailing lists user 26 Nov '08

26 Nov '08

Hi seems to me you are missing rlm_sql, when I start radiusd -X I get the following lines: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked .. rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret FROM nas this last line is then followed by rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=secretpw .. Maybe you didn't configure sql right. In freeradius2 Uncomment sql in raddb/sites-enabled/default Check you raddb/sql.conf file in freeradius1 uncomment sql (authorize section) in radiusd.conf and adapt sql.conf Michel >Debug Trace: > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /usr/local/etc/raddb/proxy.conf >Config: including file: /usr/local/etc/raddb/clients.conf >Config: including file: /usr/local/etc/raddb/snmp.conf >Config: including file: /usr/local/etc/raddb/jradius.conf >Config: including file: /usr/local/etc/raddb/eap.conf >Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/local/lib >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded jradius > jradius: name = "example" > jradius: primary = "127.0.0.1" > jradius: secondary = "192.168.1.2:1815" > jradius: tertiary = "192.168.1.2:1816" > jradius: timeout = 1 > jradius: onfail = "NOOP" > jradius: keepalive = yes > jradius: connections = 8 >rlm_jradius: configuring jradius server 127.0.0.1:1814 >rlm_jradius: configuring jradius server 192.168.1.2:1815 >rlm_jradius: configuring jradius server 192.168.1.2:1816 >rlm_jradius: starting JRadius connection 0 >rlm_jradius: starting JRadius connection 1 >rlm_jradius: starting JRadius connection 2 >rlm_jradius: starting JRadius connection 3 >rlm_jradius: starting JRadius connection 4 >rlm_jradius: starting JRadius connection 5 >rlm_jradius: starting JRadius connection 6 >rlm_jradius: starting JRadius connection 7 >Module: Instantiated jradius (jradius) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, >Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = >"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. > > >Regards, > >Saeed Akhtar > > > >2008/11/26 <tnt(a)kalik.net> > >> Post the debug of the server startup. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >> Dana 26/11/2008, "Saeed Akhtar" <saeedakhtar.484(a)gmail.com> pi¹e: >> >> >Hi all, >> > >> > I am having problem to configure Radius to read client information from >> >mysql database table "nas". I found an option at last line of sql.conf >> > >> >readclients = yes >> > >> >i uncommented it ... then added record in nas table... then tried to send >> >request from newly added client but it says unknown client.... Can anyone >> >help me in this regard??? Thank you >> >Regards, >> > >> >Saeed Akhtar >> > >> > >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

1 0

EAP2 configuration
by Fernando 26 Nov '08

26 Nov '08

Hi all, What do I need to do for use eap2 module? I want to use GPSK or PSK. Can anybody help me with the configuration? Thanks.

2 13

RSASecurid and PEAP
by Paul TAVERNIER 26 Nov '08

26 Nov '08

Hi i would like to know if this thing (scenario) is possible... 1) i want to authorize/authenticate a user with a couple username/OTPpassword (RSASecurid) through a Freeradius server (i proxy the acces-request to a RSARadius-Securid server). It's ok. 2) (then, if i get an Access-Accept) (in a post-proxy section?) i want to initiate an EAP Challenge between my XP-Wireless-supplicant client and FREERADIUS (not the RSA radius)... Can i configure something like that authorize { ... suffix ... } post-proxy { (if access-accept...) eap } Hope this mail is not too obfuscated...and then is able to be decoded... Regards Paul

2 1

ip pool
by sugiarto tjahyono 26 Nov '08

26 Nov '08

Dear all, I have a few problem. i use ip pool and it's works fine if i define ip pool in mysql. 779084,"test","password","=","test123" 779085,"test","Pool-Name",":=","main_pool1" 779086,"test","Called-Station-Id","=","hostpot1" The problem happened if i have 2 access point in the same area and IP the different is only at called-station-id. what should i set in radius if any user can go to AP 1 with Called-Station-Id 1 or AP 2 with Called-Station-Id 2. if user logged in AP1 they will get main_pool1 and if user logged in AP2 they will get main_pool2 sorry for my bad language:)

2 1

radmin SIGABRTs freeradius 2.1.1
by Norbert Wegener 26 Nov '08

26 Nov '08

I have an input file for radmin with the following content: debug file /var/log/radius/nw2.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' When those commands have been executed and some debugging shows up int the logfile, I want to switch to another log. changing the radmin input file to debug file /var/log/radius/nw3.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' and executing the commands, freeradius in the actual 2.1.1 version dies. This is, what gdb show up: Loaded symbols for /usr/lib64/freeradius/rlm_sql_log.so 0x00002b091e323562 in ?? () from /lib64/libc.so.6 (gdb) cont Continuing. Program received signal SIGABRT, Aborted. [Switching to Thread 47318162851936 (LWP 2820)] 0x00002b091e299b95 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00002b091e299b95 in raise () from /lib64/libc.so.6 #1 0x00002b091e29af90 in abort () from /lib64/libc.so.6 #2 0x00002b091e2d035b in __libc_message () from /lib64/libc.so.6 #3 0x00002b091e2d534e in malloc_printerr () from /lib64/libc.so.6 #4 0x00002b091e2d695c in free () from /lib64/libc.so.6 #5 0x000000000040e748 in command_debug_condition (listener=<value optimized out>, argc=2820, argv=0x6) at command.c:718 #6 0x000000000040ee01 in command_domain_recv (listener=0x726dc0, pfun=<value optimized out>, prequest=<value optimized out>) at command.c:1680 #7 0x000000000041ef10 in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=<value optimized out>) at event.c:2666 #8 0x00002b091d7169c0 in fr_event_loop (el=0x70e980) at event.c:400 #9 0x0000000000418bb1 in main (argc=<value optimized out>, argv=0xe) at radiusd.c:394 Norbert Wegener

4 6

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by hsuan 26 Nov '08

26 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius The server shown the message : [ldap] performing user authorization for ldapuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) expand: dc=mydomain,dc=com -> dc=mydomain,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=com/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 33059 What's the problem ? how can I to fix the error ? Please help me! Regards, Vicky

4 10

Dan Schaffer is out of the office.
by Dan Schaffer 26 Nov '08

26 Nov '08

I will be out of the office starting 11/26/2008 and will not return until 12/01/2008. Thank you and have a nice day, Dan

1 0

Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo Zavala 26 Nov '08

26 Nov '08

Hello, I in our network we have two data services: 1.- MMSC (Multimedia Message Service Center) 2.- EVDO (Evolution-Data Optimized) I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. Are there more people who figured out how to make possible this configuration-like? Thanks in advance Aldo

2 1

Login incorrect (rlm_ldap: User not found)
by hsuan 26 Nov '08

26 Nov '08

Dear all: I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. And I have add a new ldap user "hoyo" and set the user password But when I using "radius -X" to start the radius The server shown the message : ..... [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect (rlm_ldap: User not found): [hoyo/hoyo] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> hoyo attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated ..... .. ... I have set the user "hoyo " password by "ldappasswd -S -x -W -D "cn=Manager,dc=mydomain,dc=com" "cn=hoyo,dc=mydomain,dc=com"" and response as follows : "New password: Re-enter new password: Enter LDAP Password: Result: Success (0)" But why still have error ? how can I to solve the problem ? Regards, Vicky

2 2