January 2009 - Freeradius-Users - lists.freeradius.org

Freeradius & Sybase
by Francesco Toro XB 26 Jan '09

26 Jan '09

Hi All, I'm unsing freeRadius 2.1.3 over SUSE Linux. I'm trying to set SQL accounting with a sybase DB, but unsuccesfully. Anyone can tell me what sybase pluging I have to use? Thnks in advance, Francesco Toro. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Authentication problem FreeRADIUS 2.1.3
by Abu Warez 26 Jan '09

26 Jan '09

Hi, I want to use `files' as the auth method on radius 2.1.3. I added one user to the users file in /etc: "{1}0000001001c2(a)test.com" Service-Type == Framed-User Framed-IP-Address=30.30.30.1, Framed-MTU=1500, Auth-Type=Accept DEFAULT Service-Type == Framed-User Framed-MTU=1500, Session-Timeout=36000, Termination-Action=Radius-Request, Service-Type=Framed-User when i try tu authenticate this user i get the following error: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. I attach the whole debug info: rad_recv: Access-Request packet from host 192.168.0.104 port 49910, id=0, length=141 User-Name = "{1}0000001001c2(a)test.com" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-09-02-10-01-C2" NAS-Port-Type = Ethernet NAS-Port = 0 NAS-Port-Id = "ABC" NAS-IP-Address = 192.168.0.104 Event-Timestamp = "Jan 26 2009 09:16:36 EET" Message-Authenticator = 0x2c7e083eefb7491d0e0a102f16edc446 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "test.com" for User-Name = "{1}0000001001c2(a)test.com" [suffix] No such realm "test.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry {1}0000001001c2(a)test.com at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> {1}0000001001c2(a)test.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Any hints? Thx a lot.

2 1

Love pro skill
by admin877＠viagra.com 26 Jan '09

26 Jan '09

(c) 2009 Pfizer Inc USA. Dear freeradius-users(a)list.xs4all.nl! Doctor Ty! Look our price! http://gtg.addseat.com?ly We do guarantee high-quality medications, instant worldwide delivery and friendly support!

1 0

Cisco Aironet 1130ag dynamic VLAN assignment
by William Graeber 25 Jan '09

25 Jan '09

I have been having trouble recently with getting dynamic VLAN assignment working on my Cisco AP. Clients are successfully authenticating with FreeRADIUS. However, they do not seem to be picking up extra attributes from the "users" file (below is the relevant portion of it). wgraeber NT-Password := "XXX" Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 100 The users are just directed to their original VLAN instead of this portion overriding it. When I try to authenticate to the access point with "radtest," I get the following output: # radtest wgraeber XXX 127.0.0.1 10 XXX Sending Access-Request of id 42 to 127.0.0.1 port 1812 User-Name = "wgraeber" User-Password = "XXX" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=42, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "100" Furthermore, the Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id attributes in the console when actually authenticating and watching the output of "radiusd -X" on another machine. The access point *should* support this out of the box according to the Cisco specs. This is my first FreeRADIUS implementation, so I don't know if I'm missing any magic options. Also, I have searched the archives and tried several suggestions to no avail (in eap.conf, copy_request_to_tunnel and use_tunneled_reply under the PEAP segment). I will happily post more configuration options / debug info if needed. Thanks in advance, William

4 11

Seg Fault - Not much info..
by Thor 25 Jan '09

25 Jan '09

Hi, I'm running Freeradius 2.1.3 on my Ubuntu 8.04 machine. Basically, my setup is a VPN system linked to freeradius via a specialized plugin. Before I updated my freeradius (from the old 1.x), everything was working fine. Now that I have updated to 2.1.3, I can't seem to get it working again. Taking the VPN and plugin out of the mix, I run my freeradius in -X mode, then send a 'radtest' authentication packet. The freeradius server receives the request: rad_recv: Access-Request packet from host 127.0.0.1 port 46625, id=69, length=93 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Then, straight away I am faced with: +- entering group authorize {...} Segmentation fault This is all the info that I am receiving from the freeradius server - and not being very knowledgeable on freeradius - I am pretty stumped as to what my problem is. I have had a glance around the 'authorize' section, and it contains: authorize { preprocess # auth_log chap mschap # digest # IPASS suffix # ntdomain # eap { # ok = return # } # unix # files sql # etc_smbpasswd # ldap # daily # checkval # expiration # logintime pap # Auth-Type Status-Server { # # } } which is exactly as it was on my old version. Any ideas? Thanks.

2 1

regular expression problem on 2.1.3
by Tim Lightfoot 25 Jan '09

25 Jan '09

Hi, I have updated my Freeradius from 2.0.5 to 2.1.3 and am having a problem with the regular expressions I am using in the users file. If I provide a simple example users file I am testing against: DEFAULT NAS-IP-Address =~ "192.168.1.1|10.0.1.1" Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes tim Cleartext-Password := "test123" this gives the following debug output with a test client... [suffix] No '@' in User-Name = "tim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] expand: %{NAS-IP-Address} -> 192.168.1.1 [files] Invalid regular expression : empty (sub)expression <== problem here [files] users: Matched entry tim at line 10 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "tim" with CHAP password [chap] Using clear text password "test123" for user tim authentication. [chap] chap user tim authenticated succesfully ++[chap] returns ok Login OK: [tim] (from client sotalan port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 29 to 192.123.126.98 port 47875 Finished request 0. Even a simpler expression like NAS-IP-Address =~ "192.168" fails with the same message "Invalid regular expression : empty (sub)expression". The same style expressions have been in active use on 2.0.3 and 2.0.5, can anyone offer any advice? Thanks in advance Tim

5 9

two auth on one freeradius
by Hegedus Gabor 25 Jan '09

25 Jan '09

Hi, all! I have a question for you. I have a freeradius server (newest) on ubuntu. Now we use it for authentication: - request comes form the NAS - with LDAP modul, check the username and password, and in the post auth section we have 2 script(external prg) one for good login auth., and one in the auth fail section (bad login). it works and nothing fail. BUT: we want 802.1x auth on lan with this freeradius: - request comes from another NAS (AP) - in the radius we use LDAP modul what is check the username and pass in the same ldap(but not in the same subtree). - we want use eap-ttls, peap... (without certificate). - if it is good simply accept the request no more script. how can i set this two soutions to my (the one)freeradius? how can i do 2 query (what is not same) with ldap module. or sort the request (which nas sent)... everithing interest me. what is the good solution? Thank you, Gabor.

2 1

deletestalesessions
by Alexandre Chapellon 24 Jan '09

24 Jan '09

Hello I would like to have more informations about the deletestalesessions option of rlm_sql. - What does it do? - What's its behaviour? - How does it achieve what it does? regards

3 2

Omitting Password
by tech.subscriptions＠shepherdhill.biz 24 Jan '09

24 Jan '09

Hi, Our users are CDMA phones. The login credentials are: Username: phone_no(a)isp.com Password: phone_no Please is it possible to make the RADIUS Server not to ask for password again and simply use the phone_no stripped from the username? Cheers. Chris.

4 3

Re: Groups Authentication
by tech.subscriptions＠shepherdhill.biz 24 Jan '09

24 Jan '09

Quoting freeradius-users-request(a)lists.freeradius.org: >> I am new to FreeRADIUS. >> >> We have these groups and I wonder if FreeRADIUS is capable of handling >> authentication for them with this time frame: >> >> 1. EASY - 24hrs access valid or 1 month >> 2. BUSY - 24hrs access valid for 14 days >> 3. BUSINESS - 08:00 - 18:00 valid for 1 month >> 4. RELAX - Monday to Thursday 18:00 - 23:00, Friday (08:00) - Sunday (23:00) >> > > Yes. Look up Expiration and Login-Time attributes. Thanks. Definitely Expiration attribute would have to be per user. But which is better/possible for Login-Time - do I create Login-Time attribute for each user or I create each group with Login-Time and assign each user to the group he belongs? Regards, Chris.

2 1