August 2008 - Freeradius-Users - lists.freeradius.org

Re: Help needed for radrelay under 1.1.3
by Ryan 14 Aug '08

14 Aug '08

Hi Alan, Thanks for the advice. Will look into upgrading to 2.0.5. As this is production system, will need to plan for it. Best Regards, Ryan > Date: Tue, 12 Aug 2008 17:45:37 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Help needed for radrelay under 1.1.3 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48A1B021.20101(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Ryan wrote: >> Need some help on radrelay for 1.1.3 if possible. > > Upgrade to 2.0.5. The radrelay functionality is integrated into the > server core, and works much better than 1.1.x. > >> Have tried running radrelay in debug mode but was not able to find any >> error other than the following >> rad_verify: Received Accounting-Response packet from client >> xxx.xxx.xxx.xxx port 1813 with invalid signature (err=2)! (Shared >> secret is incorrect.) > > Well... fix that. Really. It's making radrelay not work. > >> Both radius are running 1.1.3. >> >> The error is rather strange as I'm sure that the shared secret is correct. > > (a) the shared secret is wrong. > (b) the MD5 libraries on the system are broken > (c) the memory on the system is corrupt. > > Pick one. > > Alan DeKok.

1 0

MySQL + freeradius problem
by Igor Sawczuk 14 Aug '08

14 Aug '08

Hi, I have problem with freeradius and MySQL. I run successfully freeradius using users file, but I wanted to migrate to MySQL,and from then I have a lot of problems. First of all, I got errors in radius.log that I not understand: Thu Aug 14 16:16:17 2008 : Error: rlm_radutmp: Logout for NAS XXXX port 285213359, but no Login record Thu Aug 14 16:16:17 2008 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'user_XXX', nas '172.16.2.3'] Thu Aug 14 16:16:21 2008 : Auth: Login OK: [user_XXX] (from client XXXX port 285213359 cli #XXX#ZZZ#VVV) I get this logs, when I shutdown old radius, and start new which is using MySQL. I don't know why, NAS is still asking for user_XXX and radius always gives error msg (above). The question is: 1. Should I change something in my radius+MySQL configuration? (for ex. add additional atributes radreply) 2. Should I wait, until everybody logout from old radius, and the start new. Thanks in advance. btw. If you are from Poland, and know how to resolve my problem, answer some questions about radius and you could help me in exchange of good sushi restaurant, please let me now. :)

2 1

Possible bug in unlang?
by Phil Mayers 14 Aug '08

14 Aug '08

We've recently moved our servers to FreeRadius 2, and we've been having reports of some problems with our wireless service. I investigated, and it seems the problem is the following stanza from the "inner-tunnel" config, which I just copied over from the default configs: post-auth { update outer.reply { User-Name = "%{request:User-Name}" } } ...specifically, it seems that the xlat of this string is treating embedded "\" as escape characters. For example; I was unable to stop the radius server, but a tshark capture of a failing user shows me (C: is radius client i.e. the NAS, S: is packet from the radius server); note the "\\" are tshark escaping the data, the actual username is "IC\nyshir" C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge IC\x0ayshir C: access-request IC\x0ayshir S: access-reject Note that the final "access-challenge" sends back IC<newline>ayshir; the AP then carries this over to the next request, which fails. I've solved that problem by removing the "update outer.reply", which leads me to a 2nd question - given that the "eap" module does this anyway (and since it uses a dumb "memcpy", correctly) why is that unlang statement there in the sample configs? Is it necessary? One final thing; can I suggest the attached patch (though it should probably escape the data, since it comes from the user)

2 10

newbe getting mad with error ..
by José Soler 14 Aug '08

14 Aug '08

Hi, I have spenndt the whole day trying to install Freeradius 1.1.3 over a Debian 4.0 machine. I need to use version 1.1.3 since it is the recommended one for another application I am trying to test. Everything went smooth until the last step when I restarted Freeradius after completing the configuration. I do not know how to tackle this one and I am completely desperate...anyone can give me a hint? I got the following: freeradius:/etc/freeradius# freeradius restart Thu Aug 14 17:08:35 2008 : Info: Starting - reading configuration files ... Thu Aug 14 17:08:35 2008 : Error: /etc/freeradius/radiusd.conf[1460]: Line is not in 'attribute = value' format Thu Aug 14 17:08:35 2008 : Error: Errors reading radiusd.conf The mentioned line [1460] in the radius.conf file looks as follows: [1459] query = "SELECT SUM(AcctSessionTime - \ [1460] GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ [1461] FROM radacct WHERE UserName='%{%k}' AND \ [1462] UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" Thanks a lot ! jose No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.3/1610 - Release Date: 13/08/2008 16:14

2 1

PPTP forward port per user
by Sascha Kiefer 14 Aug '08

14 Aug '08

Hi, i would like to be able to forward an internal ports of users through the VPN. The idea is that a user picks 2-3 ports (or maybe just one) tcp port out of a given port-pool, and when he connects to the VPN, this portforwarding is established for him. Any idea how to do this? I'm using pptpd with freeradius + mysql. thanks for a hint. cheers, --sascha

5 6

wpa configuration
by Ahmet DÜLGAR 14 Aug '08

14 Aug '08

hi everyone i am new at freeradius i want to test my configuretion that write in document to use radtest program but i cant run it, i dont know where to write this command, i use opensuse 11 and freeradius 2.0.5 i installed it by yast so when i write the command radtest xxx xxx xxx, linux says unknown command what should i do i couldnt find radtest where to be locate thanks for repply _________________________________________________________________ Gelen kutunuzda hiç yer kalmamasından bıktınız mı? Windows Live Hotmail şimdi size 5GB ÜCRETSİZ depolama alanı sunuyor! Ücretsiz Windows Live Hotmail hesabınızı buradan alın! http://get.live.com/mail/overview

1 1

Trivial patch for rlm_acctlog in 2.0.5
by Kostas Zorbadelos 14 Aug '08

14 Aug '08

Hello to everyone. As we are preparing for migration to 2.X version in some of our production systems, I took a closer look at the sources and found the rlm_acctlog module that allows for the logging of various types of accounting messages in the radius logs. Moreover I saw that syslog support in 2.X is vastly improved over 1.X series. My minor request is, could you include the following patch in later releases (so as to not maintain it internally)? --- rlm_acctlog.c.orig 2007-11-12 00:11:51.000000000 +0200 +++ rlm_acctlog.c 2008-08-08 13:54:34.000000000 +0300 @@ -79,7 +79,7 @@ rlm_acctlog_t *inst; VALUE_PAIR *pair; - char logstr[MAX_STRING_LEN]; + char logstr[1024]; int acctstatustype = 0; The idea is to have a bigger buffer than 253 characters for logging. Some old syslog implementations can have a 1024 character limit I think, so I guess that would be enough :) Thanks and keep up the good work. Kostas Zorbadelos

2 2

Post-proxy Perl script availability
by Julien Leloup 14 Aug '08

14 Aug '08

Hello, I developped a little script in Perl working with FreeRadius v2.x, called in post-proxy section to implement QoS Radius attributes translation from "Class" attribute to Alcatel-Lucent QoS attribute "SLA Profile" and "SUB Profile". It's using a database to get a mapping between this attributes and replace them before sending the response to the client. My question is, do I have to make this script (and SQL schema I suppose) available in the FreeRadius CVS ? I'm not sure it's the kind of script usefull for a large panel of FreeRadius users, but if I have to make it available (maybe to respect GPLv2 or if someone is interested by this script) it's not a problem. Best regards, Julien Leloup Axione 132, boulevard Camélinat 92240 Malakoff, France

2 2

Re: Freeradius in an AD environment on opensuse server
by Roberto S. G. 14 Aug '08

14 Aug '08

>Can I set up freeradius to authenticate with ldaps and be secure? The >ldap would be Microsoft and is on my domain controller. I have >websites using the ldap process but OR do I have to do that samba >thing? It can be done more or less easily, depending on what type of authentication are u doing... If it's plain user/pwd, you can configure freeradius to use LDAP directly. That would be easier. The servers would be your AD servers (you can use all of them if you have more than one), uncomment and configure ldap parts on your FR conf. In order to use ldaps, you just have to enable it in your AD servers if it isn't (just make a netstat looking for por 636 on your AD; if needed, check your windows version on how to enable it), and if you wanna check AD certificates from freeradius when doing connections (it's a good idea), you'll have to import your AD's CA certificate to ./certs on yor FR configuration. It'd run smoothly. bye

1 0

invalid login attempts user lockout
by Sudarshan Soma 14 Aug '08

14 Aug '08

Hi All, Does anyone know of RadiusServer denying access for a particular user after a configurable number of invalid login attempts. I know this can be done on the client side with pam modules. But i thought since radius users are same across multple nodes connected to radiusserver, it would be an useful option to lockout at radius server level. Please let me know if anyone is aware of this scenario. Regards, Pavan.

3 6