March 2008 - Freeradius-Users - lists.freeradius.org

Incorrect Acct-Session-Id format in Freradius 2.0.2
by banga 14 Mar '08

14 Mar '08

Hi all. I have found that format of Acct-Session-Id has been changed from v.1.x to 2.0.2 At debug I can see Acct-Session-Id = "1234567\000" not Acct-Session-Id = "1234567" (like in v.1.x) Is there any Idea why we get this \000 Acct-Session-Id is using for radacct_acctuniqueid_key (hash) and there are can be a problem between master and slave radius in case then Start record will be in v.1.x and STOP will be in v.2.0.2 where HASH for STOP will be completely different. -- View this message in context: http://www.nabble.com/Incorrect-Acct-Session-Id-format-in-Freradius-2.0.2-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

FreeRadius2.0.2+ mysql +dailupadmin help!
by Lance Buttars 14 Mar '08

14 Mar '08

hi I have successful compiled and can run radiusd -X but the problem is I want to use dailup_admin to configure freeradius. I have mysql install and running the database is running, dialupadmin is working but I don't think radiusd is reading the database and i am not seeing it load the mysql drivers how do I know that its loading the drivers or if it detected mysql when I compiled it? thank you for your support radius:/etc/raddb# radiusd -X > /root/radius radius:/etc/raddb# cat /root/radius FreeRADIUS Version 2.0.2, for host i686-pc-linux-gnu, built on Mar 7 2008 at 20:59:43 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

3 12

Raddius + Windows Vista
by Gustavo Chavelas 14 Mar '08

14 Mar '08

Hi to all friends. I'm new in this list. My problem is this: I have a freeradius-1.1.3-1.2.el5 into a CenOS 5, this is working without problem. The radius is for authenticate a wireless network clients. I have a Windows XP, Windows CE and Pocket PC and work very fine, all clients authenticate very good. My problem is with Window$$ Vista. This Operating System can't connect to my radius. Radius send me a message: Fri Mar 14 23:28:04 2008 : Auth: Login incorrect: [CLIENT/<no User-Password attribute>] (from client AP_RESPALDO port 384 cli MAC_ADRESS) Solve this problem it's very important for me. Somebody can help me? Regards PD: Alguien habla español en esta lista?

3 2

Modifying attributes
by Mikhail Novikov 14 Mar '08

14 Mar '08

Hello. I have another question: FreeRadius is installed and works like proxy RADIUS server. But one attribute in requests should be modified. Proxy have to change this field Nas-Port-ID = GigabitEthernet 0/0/2.12111010:1211-820 to this PortLLID = 1211-820 What should I do? Best regards, Michael Novikov

1 0

RFC 2866 - Accounting ON / Accounting OFF packets
by Arran Cudbard-Bell 14 Mar '08

14 Mar '08

Hi, RFC 2866 (5.5) States 'An Accounting-Request packet MUST have an Acct-Session-Id' but for Accounting Request packets with 'Acct-Status-Type' set to Accounting-On or Accounting-Off, there can be no Acct-Session-Id, as these are global events on the NAS... Unless the NAS is meant to send an Accounting-On or Accounting-Off packet for every session on the access point, when an Accounting-On or Accounting-Off event occurs... Does anyone know of a later RFC that clarifies this ? Also the index 'acctsessiontime' is missing for the radacct table in the default schema; makes the Accounting-On / Accounting-Off queries very slow doing a table scan on 1.4 million rows... Is this intentional or an oversight ? Might be an Idea to specify the default engine as InnoDB for the MySQL schemas. MyISAM (with it's table locks on every update/insert) just doesn't cut it with a reasonably busy RADIUS server; all connections in the db pool get used and users start being rejected. Not good ... Thanks, Arran ** -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

5 13

Freeradius 1.1.7 and EAP-TTLS with PAP as inner authentication
by d_maccari 14 Mar '08

14 Mar '08

I'm using EAP-TTLS with PAP as inner authentication. I'm wondering if it is possible to use a different module than standard PAP (maybe a script) to do the final step of authentication process and, if it is possible, how this script should be done. Bye Dario Maccari P.S. Sorry for previus post made as a reply

1 0

authentication question
by Emre Ersin 14 Mar '08

14 Mar '08

Hi, I am trying to authenticate our wired Windows users by using rlm_perl module over secured IMAP. When I give radtest command with a user-name and user-password it accepts; --------------------------------------------------------------------------- # radtest USERNAME PASSWORD localhost 0 testing123 Sending Access-Request of id 201 to 127.0.0.1 port 1812 User-Name = "USERNAME" User-Password = "PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=201, length=20 --------------------------------------------------------------------------- *Radeapclient also works if I supply User-Password. But xp supplicants (naturally) doesn't send user-passwords while using eap-md5. And I really don't want to create thousands of client certificates. Which protocol do I have to use or... Is it possible? Is there a way to authenticate winxp (and vista (and also Macos users)) users without installing any client program? Supplicant (winxp) ---- NAS (hp2626) -------- WAN | | RS -- rlm_perl ----- IMAP(s) or POP3(s) servers (more than one) Thanks

2 1

Re: RFC 2866 - Accounting ON / Accounting OFF packets
by David Mitton 13 Mar '08

13 Mar '08

3 2

perl and ldap at the same time??
by Oguzhan Kayhan 13 Mar '08

13 Mar '08

Hello, I wonder if i can make a dual authentication check via freeradius. I am using rlm_perl right now for our accounting needs. What i want is to add LDAP auth. Ofcourse i can add this function to perl script that i write but, it is better to use freeradius ldap function. So, is it possible to check ldap if the username not accepted in rlm_perl? Or only one option can be used for authentication?

2 1

Proven Hardware Platfoｒm
by Koichi Yagishita 13 Mar '08

13 Mar '08

Dear All, If you know proven hardware platform operating FreeRADIUS for managing about 1,000 users and 10,000 users, let me know. Best Regards, Yagishita BWA Project Japan Radio Co.,Ltd.

2 1