December 2008 - Freeradius-Users - lists.freeradius.org

Somewhat OT: Captive portal on acess points instead complex supplicant at level end user?
by Sergio Belkin 02 Jan '09

02 Jan '09

Hi, Currently I'm using: *OpenWRT Kamikaze in AP's *Freeradius 2.1.2 *LDAP End users either use ttls or peap on their notebooks, as I have a LDAP server, each use his username and a password. Problem with this approach is that is somewhat complex for end users, they must either install a software or do a complicated configuration (think in end users terms, please). I'd want to have a open wireless network and that each user access to captive portal and enter his username and password, that captive portal "redirects" request to freeradius and freeradius in turn queries to ldap server. I'd want to know if CoovaAP (or something similar, what?) can perform such task as portal captive installed on APs. I'd be glad to read suggestions Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 6

freeradius on ubuntu 8.04
by John Hottel 31 Dec '08

31 Dec '08

All: I have recently built a new freeradius server. I built an old one a few years ago that has served me very well. I am not sure of the freeradius version on my new server, as i installed it using the apt-get process. The server is working great for the most part, but i am having a weird problem. I am using freeradius to do a radius to ldap conversion. We have Novell Edir 8.7.3 running ldap servers. My old freeradius box is running suse 7.2 and freeradius .0.9.3. It is attaching to the same ldap server and i have no issues with it. My issue is the first ldap connection works great. The first time. I then see a message on the server saying: "Nothing to do. Sleeping until we see a request." If i happen to make a login attempt within 15 seconds of that coming up, i see: "---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... " When i try again, it works. Any ideas what this could be? If you need more info as to my version of freeradius, i will be more then happy to supply the info, if you tell me how to retrieve it :) Thanks for your help! John

3 6

Re: Freeradius-Users Digest, Vol 44, Issue 140
by Eric 31 Dec '08

31 Dec '08

I am sorry I mean that I can't find the problem. the detaild of sending packets are here. Is there any problem? rad_recv: Access-Request packet from host 10.10.10.3:11857, id=216, length=207 Acct-Session-Id = "118382" NAS-IP-Address = 10.10.10.3 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 4 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "192.168.201.59" Tunnel-Client-Endpoint:0 = "192.168.201.59" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d312d34304432454332364243374334 User-Name = "school" User-Password = "123456" rlm_ldap: - authorize rlm_ldap: performing user authorization for school rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 192.168.1.21:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as / to 192.168.1.21:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for school is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 360000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user school authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: Running registered xlat function of module sql-Vpn for string 'SELECT SUM(AcctSessionTime - GREATEST((1228077000 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='school' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > 1228077000 ' rlm_sql (sql-Vpn): - sql_xlat rlm_sql (sql-Vpn): Reserving sql socket id: 4 rlm_sql (sql-Vpn): row[0] returned NULL rlm_sql (sql-Vpn): Released sql socket id: 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "school" with password "123456" rlm_ldap: user DN: uid=school,ou=TEMP,ou=organisations,dc=iut,dc=ac,dc=ir rlm_ldap: (re)connect to 192.168.1.21:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=school,ou=TEMP,ou=organisations,dc=iut,dc=ac,dc=ir/123456 to 192.168.1.21:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user school authenticated succesfully rlm_sql (sql-Vpn): Reserving sql socket id: 3 rlm_sql (sql-Vpn): Released sql socket id: 3 Login OK: [school] (from client VPN port 4 cli 192.168.201.59) rlm_sql (sql-Vpn): Processing sql_postauth rlm_sql (sql-Vpn): Reserving sql socket id: 2 rlm_sql (sql-Vpn): Released sql socket id: 2 Sending Access-Accept of id 216 to 62.60.198.18 port 11857 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Acct-Interim-Interval := 300 Idle-Timeout = 1200 Session-Timeout = 389554 rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, length=260 Acct-Status-Type = Start Acct-Delay-Time = 0 NAS-IP-Address = 10.10.10.3 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 4 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "192.168.201.59" Tunnel-Client-Endpoint:0 = "192.168.201.59" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d312d34304432454332364243374334 Acct-Session-Id = "118382" User-Name = "school" Framed-IP-Address = 10.10.10.4 Framed-MTU = 1400 Session-Timeout = 389554 Idle-Timeout = 1200 Acct-Multi-Session-Id = "953" Acct-Link-Count = 1 Event-Timestamp = "Dec 31 2008 15:45:03 IRST" Acct-Authentic = RADIUS MS-MPPE-Encryption-Types = 0x00000000 Sending Accounting-Response of id 133 to 10.10.10.3 port 11858 > > Message: 2 > Date: Tue, 30 Dec 2008 12:40:27 +0100 > From: <tnt(a)kalik.net> > Subject: Re: freeradius doesn't sent information to mysql > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <DShqoEOi.1230637227.0700950.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > Are we suposed to use a crystal ball or are you going to post the debug? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 30/12/2008, "Eric" <bbahar3(a)gmail.com> pi?e: > > >Hi, > >My freeradius server was working properly and it's tables in mysql had all > >the logs and online users. now the informations of users couldn't be > intered > >in tables . > >what may be the reason? > > > > > > >

2 1

Some Help Regarding Remote Free Radius Server.
by pushpraj nimbalkar 31 Dec '08

31 Dec '08

Hello All, First Of All New Year Wishes to all of you. I have configured freeradius server which is working fine for me. Now my wifi environment is like 2 hotels and radius server in different location. My radius server is kept in head office and i want my hotel wifi users to be authenticated by head office radius server. It's only authentication and accounting. Every Hotel have 1 ADSL connection with one static IP. Then I configured Linksys54GL with chillispot and defined my head office radius server IP address(i.e. public IP address of my radius server.). Now in hotel when user connects to linksys router then router forwards request to ADLS router and ADSL router forwards same request to my Head Office Radius server. But Problem is that radius server rejects request it gives error like : "Ignoring request to authentication address * port 1812 from unknown client 59.181.96.194 port 2054" and when i start radius -X at one place it gives error like rlm_sql (sql): Read entry nasname= 59.181.96.194,shortname=AP2,secret= rlm_sql (sql): Failed to look up hostname 59.181.96.194: ip_nton: Name or service not known It's is the Ip address of my hotel ADSL connection. And ADSL Router dont have any option of defining radius server and secret. Please Help me to sort out this problem. Thanks Pushpraj N.

6 9

FreeRADIUS.net DemoCerts
by Canticle 30 Dec '08

30 Dec '08

Hello all, Does anybody know how to use the FreeRADIUS.net DemoCerts in windows XP? I want to test EAPTLS with a windows XP client. For windows XP certificate management, FreeRADIUS.net-CA.der can't be imported, then I imported FreeRADIUS.net-CA.crt and FreeRADIUS.net-Client.p12. It looks fine, and can be seen in personal certificate and trusted root certificate. But when I set up the wireless interface to support the EAPTLS, it always said there are no available certificate. What is the matter? How to use the files in \etc\raddb\certs\FreeRADIUS.net\DemoCerts for windows client? I can use the Democerts for wpa_supplicant under linux, and the AP used the same setting. Then I think it is the windows XP configuration question. Does anyone know the key point? Thanks. Best Regards, Canticle canticle.zhu(a)gmail.com 2008-12-29

2 1

freeradius doesn't sent information to mysql
by Eric 30 Dec '08

30 Dec '08

Hi, My freeradius server was working properly and it's tables in mysql had all the logs and online users. now the informations of users couldn't be intered in tables . what may be the reason?

2 1

WIMAX problem
by Dimitris Theofilatos 30 Dec '08

30 Dec '08

Hi, I am using freeradius 2.1.3 and i try to enable Wimax support. I built the wimax module and i placed it at the post-auth section of sites-enabled/default file. I use EAP-TTLS with mschap2. At the Access-Accept packet from Freeradius to the ASN-GW i use i can't see any WIMAX VSA's. There are only MS-PPE keys. Also at the log of radiusd i get the next log for wimax module [wimax] MIP-RK = 0xf65a926b20cd57553c06a7a4880bf8aa08eaf40a6426edb4653d4d5e8f7eed3ff9ad4b9fedf9c30d0ea99fef7ae9bfe60afcbe73e56cf41b43d74427ce7f7196 [wimax] MIP-SPI = 6f74f1eb [wimax] WARNING: WiMAX-MN-NAI was not found in the request or in the reply. [wimax] WARNING: We cannot calculate MN-HA keys. [wimax] WARNING: WiMAX-IP-Technology not found in reply. [wimax] WARNING: Not calculating MN-HA keys Do i have to configure something else?

3 14

Help keep the peace in Gaza
by Agus Supriyadi 30 Dec '08

30 Dec '08

1 0

How to run a script after the host disconnect?
by Tiago Resende 29 Dec '08

29 Dec '08

Hi, As Exec-Program-Wait runs before the connection stabilized, I need to run a script after the host disconnect. I'm using Freeradius 2.1.3 and Mikrotik's PPPoE-Server. Someone could help me? Thanks Tiago Resende

3 3

FreeRADIUS 2.0.4, Prefix/Suffix
by Robert Borz 27 Dec '08

27 Dec '08

Hi, I installed FreeRADIUS version 2.0.4 on Debian Lenny from the standard package repositories and setup a simple configuration just authenticating against the users file to test this Prefix/Suffix stuff which I’ll need later in production. It doesn’t matter if I define Prefix or Suffix, they never match – either in the hints nor in the users file. Here’s one of the users file I tried: ----------------- /etc/freeradius/users ----------------- DEFAULT Prefix == "P" Service-Type = Framed-User, Framed-Protocol = PPP DEFAULT Prefix == "C" Service-Type = Framed-User, Framed-Protocol = SLIP "Cpeter" Cleartext-Password := "secret1" "Pjason" Cleartext-Password := "secret2" --------------------------------------------------------- Possibly a bug? Thanks for your help… Robert

3 8