April 2008 - Freeradius-Users - lists.freeradius.org

eap
by xiningtom_1986 15 Apr '08

15 Apr '08

Hello!I want to know how to add a new eap type in freeradius!I expect your reply!Thank you!

3 4

rlm_detail and the processing of logs into SQL
by A.L.M.Buxey＠lboro.ac.uk 15 Apr '08

15 Apr '08

hi, we're using the detail method to put accounting packets into a file and then using the buffered-sql virtual server to then poll that file and periodically put it into a postgres database. however, we are hitting this little nastiness rlm_sql (sql) in sql_accounting: stop packet with zero session length. our NAS is sending a stop packet with a zero session length to the RADIUS server. at this point, the server gets stuck on this one and spends all its time complaining about this packet - this fills up the radiusd log very quickly (gigabytes of logs within hours) and the detail file is no longer processed. how can this be trivially tweaked so that this doesnt happen? in the database, acctsessiontime field is a bigint and is not enforced to be not null. alan

1 0

Virtual-Server attribute matching in users file.
by Matthew Schumacher 15 Apr '08

15 Apr '08

List, I'm getting some config together to implement virtual servers with freeradius 2.0.3 and I need to offer different attributes when the request comes from different servers. I see that there is a Virtual-Server internal attribute so I thought I could do something like this: DEFAULT Virtual-Server == 'dsl' Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1492 DEFAULT Virtual-Server == 'dialup' Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500 However it's not working. I can see in the debug that it is using the 'dsl' server but I'm not getting any of the attributes. I can set it to use User-Name == 'validuser' and it matches and returns attributes just fine so I'm not thinking it's my config. Also, I'm noticing that the server returns attributes even when the access request is rejected. Anyone know why that is? Thanks, schu

2 2

Re: exec-program-wait problem with freeradius 2.0.3
by Emmanuel Willems 15 Apr '08

15 Apr '08

I added exec in post-auth in sites-enabled/default and sites-enabled/inner-tunnel and it's still no go. Did i miss something? Thankx, Emmanuel Alan DeKok wrote: > Emmanuel Willems wrote: >> > All works well in version 1.1.3 but the script does not get called in >> > version 2.0.3 > > List 'exec' in the "post-auth" section. > > Alan DeKok.

2 1

How do i change the NAS ip address
by johnson elangbam 15 Apr '08

15 Apr '08

hi, I've been configuring free radius 2.0.3, I've configured almost all the files and run successfully for the testing purpose from the localhost by using the "radtest", now I need to implement my radius in the real invironment by putting the NAS ip address, currently my NAS ip address is displayed as 127.0.0.1, I need to change this ip address. Please anybody tell how to change the NAS ip address. Thanks and Regards Elangbam Johnson

2 1

attributes lost
by Marc Boisis-Delavaud 15 Apr '08

15 Apr '08

Hello, When I authenticate in PEAP, my ldap attributes (ex Tunnel-Private- Group-Id) aren't send to the client, why ? Here is my debug: rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusClass as RADIUS attribute Class = 0x4f553d61646d696e3b rlm_ldap: LDAP attribute radiusClass as RADIUS attribute Class = 0x4f553d61646d696e3b rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "1" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel- Type:0 = VLAN WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user mdelavau authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_prof] returns ok ++- group returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok +- entering group session expand: /opt/freeradius/radium/var/log/radius/radutmp -> /opt/ freeradius/radium/var/log/radius/radutmp expand: %{User-Name} -> mdelavau(a)univ-lr.fr ++[radutmp] returns ok Login OK: [mdelavau(a)univ-lr.fr/<via Auth-Type = EAP>] (from client heros59 port 0) +- entering group post-auth expand: /opt/freeradius/radium/var/log/radius/radacct/%{Client-IP- Address}/reply-detail-%Y%m%d -> /opt/freeradius/radium/var/log/radius/ radacct/10.14.0.59/reply-detail-20080414 rlm_detail: /opt/freeradius/radium/var/log/radius/radacct/%{Client-IP- Address}/reply-detail-%Y%m%d expands to /opt/freeradius/radium/var/log/ radius/radacct/10.14.0.59/reply-detail-20080414 expand: %t -> Mon Apr 14 10:04:29 2008 ++[reply_log] returns ok } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 2 Class = 0x4f553d61646d696e3b Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau" PEAP: Processing from tunneled session code 0x730f30 2 Class = 0x4f553d61646d696e3b Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled Sending Access-Challenge of id 233 to 10.14.0.59 port 1645 EAP-Message = 0x010a002b1900170301002091080b47d0c51811b6674b7a649bd231e1f5fea643dd96b28362ea273fe51553 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5e74631eded5f77803ca60988c6d413 Finished request 22. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.14.0.59 port 1645, id=234, length=243 User-Name = "mdelavau(a)univ-lr.fr" Framed-MTU = 1400 Called-Station-Id = "0012.44bd.0b03" Calling-Station-Id = "0019.e304.476e" Cisco-AVPair = "ssid=eduroam" WISPr-Location-Name = "CRI Arpae" Service-Type = Authenticate-Only Message-Authenticator = 0x8cefe9357b38e5f0a52c291945837712 EAP-Message = 0x020a002b19001703010020dc122ffd1ad0290d995b344b65adbda0824e52829616cca6dfb590d9b510b732 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "36654" NAS-Port = 36654 State = 0xe5e74631eded5f77803ca60988c6d413 NAS-IP-Address = 10.14.0.59 NAS-Identifier = "heros59" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "univ-lr.fr" for User-Name = "mdelavau(a)univ-lr.fr " rlm_realm: Found realm "univ-lr.fr" rlm_realm: Adding Stripped-User-Name = "mdelavau" rlm_realm: Proxying request from user mdelavau to realm univ-lr.fr rlm_realm: Adding Realm = "univ-lr.fr" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [mdelavau(a)univ-lr.fr/<via Auth-Type = EAP>] (from client heros59 port 36654 cli 0019.e304.476e) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 234 to 10.14.0.59 port 1645 MS-MPPE-Recv-Key = 0xbf9d41342546813406854e35cabdf79521b33e2c316aff8d599716484cc18c20 MS-MPPE-Send-Key = 0xaff6c3d06041e693b8acb1067d382699f150da706b799e4960ab82be1f25a96a EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau"

4 7

radiusd not starting
by Dr.Peer-Joachim Koch 15 Apr '08

15 Apr '08

Hi, we updated yesterday one of our server running Novell SLES 9. After the update the "raidusd" (not the sles version, self compiled) did not work correctly (the load was getting higher and higher). Therefore I installed the current version of the freeradius-server (2.0.3) from http://download.opensuse.org/repositories/network:/aaa/ After fixing a few things in the /etd/raddb/users the server is running fine, when I do a radiusd -X also radius -f seem's to work. But neither a radiusd not /etc/init.d/freeradius start is launching the radiusd-Daemon. But I can not see WHY the raidusd is not starting as daemon. Any idea ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 2

Freeradius support IAPP (IEEE 802.11f)?
by Yeray Domínguez 14 Apr '08

14 Apr '08

Hello. I'm doing a tutorial of the RADIUS, IAPP and EAP protocols. I've had using FreeRADIUS to explain the practice part of the tutorial. But I don't know if FreeRADIUS support IAPP. Please, it's very important for me to know it. If the response is 'no', could you recommend me another RADIUS server that support IAPP? Thanks. ______________________________________________ Tu correo también desde el móvil. Descárgate gratis Yahoo! Go. http://es.mobile.yahoo.com

2 1

Proxy request after TLS.
by Andrew Olson 14 Apr '08

14 Apr '08

I'd like to proxy a request to another server after the EAP-TLS handshake is finished. I simply want to do a little more authorization that is already setup on another server. My other server is just a simple RADIUS server and doesn't do EAP, so proxying the EAP message won't work. I guess I'm looking for something like proxy-inner-tunnel configuration that is available for PEAP. Is something like this possible? I tried to add the following block to post-auth: update control { FreeRadius-Proxied-To := blah } It returns noop, though. Thanks, Andrew Olson

2 3

hi
by Hafiz Pussah 14 Apr '08

14 Apr '08

Hi I would really appreciate if u could assist me in helping me with commands while using freeradius. Hope to hear from u positively. Yours, Hafiz ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1