November 2009 - Freeradius-Users - lists.freeradius.org

MPD : mpd-drop-user
by cktan 02 Dec '09

02 Dec '09

Dear all, Is anyone try this attribute /*mpd-drop-user*/ in freeradius with Mysql? MPD support this attribute to check the status of account during it update the accounting and if the value for this attribute become non-zero, it will disconnect the session for the user. We use MPD to setup a PPPoE server with freeradius to provide authentication to users and we have come across to drop the session if the user's account suspended but we have no luck to make it work. Currently we try to put this attribute in radreply table and it doesn't work for us. Looking for your kind information in this matter. Thanks in advance. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 12

Session-Octets-Limit and sqlcounter
by Hamid Reza Hasani 01 Dec '09

01 Dec '09

Hi, I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow: sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } According to the log messages, it shows anything is OK: rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok But in proceeding it shows me what it sent, and there isn't Session-Octets-Limit! as you can see bellow: Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Where is my problem? more log is available at the end of message. Thanks for you helps. ------ Ya Ali Hamid Reza Hasani More Log: Module: Linked to module rlm_sqlcounter Module: Instantiating monthlydownload sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009 rlm_sqlcounter: Counter attribute Monthly-Download-Byte is number 11273 rlm_sqlcounter: Check attribute Max-Monthly-Download is number 11274 rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Next reset 1259613000 [2009-12-01 00:00:00] rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Prev reset 1257021000 [2009-11-01 00:00:00] Module: Checking preacct {...} for more modules to load . . . rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000')' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')}' [monthlydownload] sql_xlat [monthlydownload] expand: %{User-Name} -> hrh [monthlydownload] sql_set_user escaped user --> 'hrh' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [monthlydownload] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')} -> 100213 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user hrh, check_item=600000000, counter=100213 rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok . . . Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Going to the next request Waking up in 4.9 seconds.

5 9

Re: chilli + freeradius + mysql : Password check failed
by David BiTx0 30 Nov '09

30 Nov '09

Hi all, Forgive me for not answering but weekends I do not work J >tnt(a)kalik.net>Is it well written oon the login page? Try simpler password (something>like 12345 - that will work even with CAPS LOCK on). If it still fails>take it up with chillispot people. I have tried with 1234 : --------------------------------- INICIO --------------------------------------------------- Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Nov 30 10:45:56 2009 : Info: ++[sql] returns ok Mon Nov 30 10:45:56 2009 : Info: ++[expiration] returns noop Mon Nov 30 10:45:56 2009 : Info: ++[logintime] returns noop Mon Nov 30 10:45:56 2009 : Info: [pap] Found existing Auth-Type, not changing it. Mon Nov 30 10:45:56 2009 : Info: ++[pap] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Debug: sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'}' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] sql_xlat Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: %{User-Name} -> 9799-8798-3665-6561 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] sql_set_user escaped user --> '9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] row[0] returned NULL Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 3 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'} -> Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: No integer found in string "" Mon Nov 30 10:45:56 2009 : Info: ++[noresetcounter] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Nov 30 10:45:56 2009 : Info: ++[dailycounter] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Nov 30 10:45:56 2009 : Info: ++[monthlycounter] returns noop Mon Nov 30 10:45:56 2009 : Info: Found Auth-Type = CHAP Mon Nov 30 10:45:56 2009 : Info: +- entering group CHAP {...} Mon Nov 30 10:45:56 2009 : Info: [chap] login attempt by "9799-8798-3665-6561" with CHAP password Mon Nov 30 10:45:56 2009 : Info: [chap] Using clear text password "1234" for user 9799-8798-3665-6561 authentication. Mon Nov 30 10:45:56 2009 : Info: [chap] Password check failed Mon Nov 30 10:45:56 2009 : Info: ++[chap] returns reject Mon Nov 30 10:45:56 2009 : Info: Failed to authenticate the user. Mon Nov 30 10:45:56 2009 : Info: Using Post-Auth-Type Reject Mon Nov 30 10:45:56 2009 : Info: +- entering group REJECT {...} Mon Nov 30 10:45:56 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 9799-8798-3665-6561 Mon Nov 30 10:45:56 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Nov 30 10:45:56 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Nov 30 10:45:56 2009 : Info: Delaying reject of request 0 for 1 seconds Mon Nov 30 10:45:56 2009 : Debug: Going to the next request Mon Nov 30 10:45:56 2009 : Debug: Waking up in 0.9 seconds. Mon Nov 30 10:45:57 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.65.99 port 38212 Mon Nov 30 10:45:57 2009 : Debug: Waking up in 4.9 seconds. Mon Nov 30 10:46:02 2009 : Info: Cleaning up request 0 ID 0 with timestamp +40 Mon Nov 30 10:46:02 2009 : Debug: Ready to process requests. --------------------------------------------------- FIN -------------------------------------------------------------------------------------------------- >José Adiel Blandón Rivera canchex(a)gmail.com > >are you using Crypted password in the database? you have to use clear passwords in the database to successful login through chillispot and freeradius. > >Regards I am using Clear passwords : mysql> select * from radcheck; +----+---------------------+--------------------+----+-------+ | id | username | attribute | op | value | +----+---------------------+--------------------+----+-------+ | 2 | 9799-8798-3665-6561 | Cleartext-Password | := | 1234 | +----+---------------------+--------------------+----+-------+ 1 row in set (0.00 sec) mysql> >Charles" charles(a)goma.kivu-online.com > >Whats the version of freeradius are you using? Mon Nov 30 10:45:15 2009 : Info: FreeRADIUS Version 2.1.7, for host i486-pc-linux-gnu, built on Nov 13 2009 at 15:28:37 Mon Nov 30 10:45:15 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Nov 30 10:45:15 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Nov 30 10:45:15 2009 : Info: PARTICULAR PURPOSE. Mon Nov 30 10:45:15 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Nov 30 10:45:15 2009 : Info: GNU General Public License v2. Mon Nov 30 10:45:15 2009 : Info: Starting - reading configuration files ... Regards!! _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

RE: Re: Making certs for Windows users
by Peter Carlstedt 30 Nov '09

30 Nov '09

> Message: 1 > Date: Mon, 30 Nov 2009 09:43:07 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: Making certs for Windows users > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W2C8F3E29E26DE093D3F90B4970(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello everyone. > > I got some questions regarding how to make a certificate that works towards windows clients while running Freeradius with PEAP. > > > > Well I have read on the wiki for Freeradius about making a standalone cert for windows clients (root cert) but why do i need that installed on the windows clients when i want to run peap? Isn?t peap meant to work in the way that you shouldnt have to install stand alone certs in the users computers? > > > > Anyway... I dont really understand what it is that i need to do to make real certificates, I?ve read the "readme" file in raddb/certs but dont understand what it says. I have got ca.cnf anf ca.pem etc since i started the radius server the first time where it said that it made some certs, which i guess it test certificates... the readme file only says that i should remove the old ones but when i try to get into the certs folder through the terminal it says i do not have permission to go into that folder.. Im using Ubuntu Desktop and I dont know a way to get into the folder with the root other than typing "sudo cd certs" which do not work. :/ > > > > Can I ignore the part which says that I need to remove the certs created when i run the server the first time and just do changes in the ca.cnf? > > > > As a sidenote, I?ve never worked with certificates before, I know what they are meant to do but more than that i dont know. > > > > Best regards/ Peter Carlstedt > > > > ------------------------------ > Message: 5 > Date: Mon, 30 Nov 2009 11:15:09 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Making certs for Windows users > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B139B2D.8000006(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Peter Carlstedt wrote: > > I got some questions regarding how to make a certificate that works > > towards windows clients while running Freeradius with PEAP. > > The howto's are detailed, and should be relatively clear. > > > Well I have read on the wiki for Freeradius about making a standalone > > cert for windows clients (root cert) but why do i need that installed on > > the windows clients when i want to run peap? > > Because that's how peap works. > > > Isn?t peap meant to work in > > the way that you shouldnt have to install stand alone certs in the users > > computers? > > No. > > > Anyway... I dont really understand what it is that i need to do to make > > real certificates, I?ve read the "readme" file in raddb/certs but dont > > understand what it says. I have got ca.cnf anf ca.pem etc since i > > started the radius server the first time where it said that it made some > > certs, which i guess it test certificates... the readme file only says > > that i should remove the old ones but when i try to get into the certs > > folder through the terminal it says i do not have permission to go into > > that folder.. Im using Ubuntu Desktop and I dont know a way to get into > > the folder with the root other than typing "sudo cd certs" which do not > > work. :/ > > This is Unix 101. You need to be "root" to edit the files in that > directory. Yes I understand that I need root permissions to edit files in that directory BUT is there anyway to get those permission without having to login with the root account? There are reasons of why you should use "sudo"in the terminal as a normal user instead of logging in as the root user. So what i mean is if there are some kind of command which gives me the same permissions as the root user in the terminal, was thinking about that since you can use the command "gksudo nautilus" to browse through directories which has root permission only. Is there any command which can give me the same permissions in the terminal? > > > Can I ignore the part which says that I need to remove the certs created > > when i run the server the first time and just do changes in the ca.cnf? > > Sure. And then it won't work. > > Alan DeKok. > > So the only differences between the test cert and a real one is only what is written in the ca.cnf? I dont need to add or remove anything or make an extra file or something like that? Sorry for all (maybe stupid) questions but Im new to the thing of creating certs. > ------------------------------ Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

3 2

chilli + freeradius + mysql : Password check failed
by David BiTx0 30 Nov '09

30 Nov '09

Hi all, I have a problem, where I work, I installed a system wifi hotspot (chillispot+freeradius+mysql), all in one machine (debian lenny) for external workers. The problem is that freeradius does not understand the password it receives from chillispot L Fri Nov 27 16:13:30 2009 : Info: [chap] Using clear text password "P1s0S" for user 9799-8798-3665-6561 authentication. Fri Nov 27 16:13:30 2009 : Info: [chap] Password check failed P1s0S is the good passwd !!! This well written in the MySQL . I think that chillispot is using PAP instead of CHAP, I've looked at the code file hotspotlogin.php : --------------------------- hotspotlogin.php ----------------------------------------------------- $response = md5("\0" . $_GET['Password'] . $newchal); $newpwd = pack("a32", $_GET['Password']); $pappassword = implode ("", unpack("H32", ($newpwd ^ $newchal))); ---------------------------- FIN ------------------------------------------------------------------ I don’t now. Thanks J -------- radius –XXX -------------- Fri Nov 27 15:35:29 2009 : Debug: Waking up in 4.9 seconds. Fri Nov 27 15:35:34 2009 : Info: Cleaning up request 12 ID 0 with timestamp +5614 Fri Nov 27 15:35:34 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.65.99 port 54942, id=0, length=229 User-Name = "9799-8798-3665-6561" CHAP-Challenge = 0x6f2ac78657926dd875b49f0178ce89d7 CHAP-Password = 0x00a2d83146dc31d330e294298fafb575c2 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.4 Calling-Station-Id = "00-1C-BF-D3-88-70" Called-Station-Id = "00-0E-7F-FE-01-F9" NAS-Identifier = "nas01" Acct-Session-Id = "4b0fec8100000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x368ff43e6530b497663e3e8b09be3ea8 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Fri Nov 27 16:13:30 2009 : Info: +- entering group authorize {...} Fri Nov 27 16:13:30 2009 : Info: ++[preprocess] returns ok Fri Nov 27 16:13:30 2009 : Info: [chap] Setting 'Auth-Type := CHAP' Fri Nov 27 16:13:30 2009 : Info: ++[chap] returns ok Fri Nov 27 16:13:30 2009 : Info: ++[mschap] returns noop Fri Nov 27 16:13:30 2009 : Info: [suffix] No '@' in User-Name = "9799-8798-3665-6561", looking up realm NULL Fri Nov 27 16:13:30 2009 : Info: [suffix] No such realm "NULL" Fri Nov 27 16:13:30 2009 : Info: ++[suffix] returns noop Fri Nov 27 16:13:30 2009 : Info: [eap] No EAP-Message, not doing EAP Fri Nov 27 16:13:30 2009 : Info: ++[eap] returns noop Fri Nov 27 16:13:30 2009 : Info: ++[unix] returns notfound Fri Nov 27 16:13:30 2009 : Info: ++[files] returns noop Fri Nov 27 16:13:30 2009 : Info: [sql] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Info: [sql] sql_set_user escaped user --> '9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '9799-8798-3665-6561' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] User found in radcheck table Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '9799-8798-3665-6561' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '9799-8798-3665-6561' ORDER BY priority Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1hora' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] User found in group 1hora Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1hora' ORDER BY id Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Nov 27 16:13:30 2009 : Info: ++[sql] returns ok Fri Nov 27 16:13:30 2009 : Info: ++[expiration] returns noop Fri Nov 27 16:13:30 2009 : Info: ++[logintime] returns noop Fri Nov 27 16:13:30 2009 : Info: [pap] Found existing Auth-Type, not changing it. Fri Nov 27 16:13:30 2009 : Info: ++[pap] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'}' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] sql_xlat Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] sql_set_user escaped user --> '9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] row[0] returned NULL Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Released sql socket id: 1 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'} -> Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: No integer found in string "" Fri Nov 27 16:13:30 2009 : Info: ++[noresetcounter] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Fri Nov 27 16:13:30 2009 : Info: ++[dailycounter] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Fri Nov 27 16:13:30 2009 : Info: ++[monthlycounter] returns noop Fri Nov 27 16:13:30 2009 : Info: Found Auth-Type = CHAP Fri Nov 27 16:13:30 2009 : Info: +- entering group CHAP {...} Fri Nov 27 16:13:30 2009 : Info: [chap] login attempt by "9799-8798-3665-6561" with CHAP password Fri Nov 27 16:13:30 2009 : Info: [chap] Using clear text password "P1s0S" for user 9799-8798-3665-6561 authentication. Fri Nov 27 16:13:30 2009 : Info: [chap] Password check failed Fri Nov 27 16:13:30 2009 : Info: ++[chap] returns reject Fri Nov 27 16:13:30 2009 : Info: Failed to authenticate the user. Fri Nov 27 16:13:30 2009 : Info: Using Post-Auth-Type Reject Fri Nov 27 16:13:30 2009 : Info: +- entering group REJECT {...} Fri Nov 27 16:13:30 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Nov 27 16:13:30 2009 : Info: ++[attr_filter.access_reject] returns updated Fri Nov 27 16:13:30 2009 : Info: Delaying reject of request 13 for 1 seconds Fri Nov 27 16:13:30 2009 : Debug: Going to the next request Fri Nov 27 16:13:30 2009 : Debug: Waking up in 0.9 seconds. Fri Nov 27 16:13:31 2009 : Info: Sending delayed reject for request 13 Sending Access-Reject of id 0 to 192.168.65.99 port 54942 Fri Nov 27 16:13:31 2009 : Debug: Waking up in 4.9 seconds. Fri Nov 27 16:13:36 2009 : Info: Cleaning up request 13 ID 0 with timestamp +7896 Fri Nov 27 16:13:36 2009 : Debug: Ready to process requests. ------------------------------ FIN ------------------------------------------------------------------- _________________________________________________________________ Windows Live: Friends get your Flickr, Yelp, and Digg updates when they e-mail you. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

4 5

custom script for access
by d.tom.schmitt＠L-3com.com 30 Nov '09

30 Nov '09

I am new to using freeRADIUS. I tried to post a similar message on the 26th of October but got no responses - thought maybe I messed it up as my first posting. I can create a flat-file and have get successful access using radtest. I have a CentOS 5.2 system running freeRADIUS version 1.1.3. Soon to be upgraded to 5.3. I need to setup an account on the freeRADIUS server that can be accessed by another system as a radius server - not the problem. I then need to have freeRADIUS call a bash shell (or Perl) script that checks additional credentials before allowing or rejecting the user's access. This check can take a multiple seconds to complete so I don't want the original radius request to timeout (not sure if it will though). Think of it as taking the time to have someone lookup and enter a PIN+TOKEN string but after the fact. A very simple example would be: I need to have freeradius verify the passed login/password. (In this case, the password may not be needed to verify access as the script would do the actual validation. Not sure if this is even possible.) Then have freeradius call the script either on the same or another server. Depending upon the outcome determined by the script - either allow or deny the user access. So even if the login/password were correct, the account could be denied from another source. An easy script for testing could be as simple as: If the minute is EVEN = allow in and say an appropriate message If the minute is ODD = do not allow access and say an appropriate message I have read most of the .conf files but am still confused about proxy, etc. Is there a HOW-TO that shows a simple script example? Thanks, Tom Schmitt Senior IT Staff - R&D

2 5

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 30 Nov '09

30 Nov '09

At 06:24 PM 11/25/2009, Ivan Kalik wrote: >Configure AD as ldap server in ldap module (.raddb/modules/ldap). >Then add to users file: > >DEFAULT Ldap-Group == "max_priv_level" or whatever is your group called > Service-Type = NAS-Prompt-User, > cisco-avpair = "shell:priv-lvl=15" closer! First, if I use the account directly: testuser Cleartext-Password := "testpass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I get auth. (so the cisco at least is right, and the base LDAP must be ok, because I get an LDAP success). But when I switch to : DEFAULT Ldap-Group == "Infrastructure" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I get in the logs a failure to find the group: [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ciscorsteeves) [ldap] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (uid=testuser) rlm_ldap: object not found ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ My suspicion is something wrong between base_filter and filter. Sigh.

2 3

Re: Re: Error= Expecting section start brace '{' after "FreeRADIUS Version"
by Yagnesh Dave 30 Nov '09

30 Nov '09

Hi, Thanks for the quick answer. I removed nohup.out and its not throwing that error. But now it is throwing this error. It would be great if you can point out the solution. ############################################### bash-3.00# tail nohup.out simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Could not link driver rlm_sql_mysql: ld.so.1: radiusd: fatal: rlm_sql_mysql.so: open failed: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[161]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Errors initializing modules bash-3.00# ############################################################ Thanks and Regards, Yagnesh Dave. On Mon, 30 Nov 2009 15:20:18 +0530 wrote >Hi, > Hi Everyone, > > I was trying to set-up mysql for logging the accounting logs for the users. I followed the instruction on http://www.frontios.com/freeradius.html and also on http://wiki.freeradius.org/SQL_HOWTO. The I tried to run the FreeRadius server. It did not start and was giving this error as given below, > ############################################################### > including configuration file /usr/local/etc/raddb/sites-enabled/default > including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel > including configuration file /usr/local/etc/raddb/sites-enabled/control-socket > including configuration file /usr/local/etc/raddb/sites-enabled/nohup.out > /usr/local/etc/raddb/sites-enabled/nohup.out[1]: Expecting section start brace '{' after "FreeRADIUS Version" > Errors reading /usr/local/etc/raddb/radiusd.conf > bash-3.00# > ################################################################ as Josip has said - you have a file called 'nohup.out' in your sites-enabled directory. this is a special directory that can only contain FreeRADIUS virtual server files (because it basically loads in sites-enabled/* as servers... this file is messing it up. remove it. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Making certs for Windows users
by Peter Carlstedt 30 Nov '09

30 Nov '09

Hello everyone. I got some questions regarding how to make a certificate that works towards windows clients while running Freeradius with PEAP. Well I have read on the wiki for Freeradius about making a standalone cert for windows clients (root cert) but why do i need that installed on the windows clients when i want to run peap? Isn´t peap meant to work in the way that you shouldnt have to install stand alone certs in the users computers? Anyway... I dont really understand what it is that i need to do to make real certificates, I´ve read the "readme" file in raddb/certs but dont understand what it says. I have got ca.cnf anf ca.pem etc since i started the radius server the first time where it said that it made some certs, which i guess it test certificates... the readme file only says that i should remove the old ones but when i try to get into the certs folder through the terminal it says i do not have permission to go into that folder.. Im using Ubuntu Desktop and I dont know a way to get into the folder with the root other than typing "sudo cd certs" which do not work. :/ Can I ignore the part which says that I need to remove the certs created when i run the server the first time and just do changes in the ca.cnf? As a sidenote, I´ve never worked with certificates before, I know what they are meant to do but more than that i dont know. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Error= Expecting section start brace '{' after "FreeRADIUS Version"
by Yagnesh Dave 30 Nov '09

30 Nov '09

Hi Everyone, I was trying to set-up mysql for logging the accounting logs for the users. I followed the instruction on http://www.frontios.com/freeradius.html and also on http://wiki.freeradius.org/SQL_HOWTO. The I tried to run the FreeRadius server. It did not start and was giving this error as given below, ############################################################### including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/nohup.out /usr/local/etc/raddb/sites-enabled/nohup.out[1]: Expecting section start brace '{' after "FreeRADIUS Version" Errors reading /usr/local/etc/raddb/radiusd.conf bash-3.00# ################################################################ Please help me to overcome this. Thanks and Regards, Yagnesh Dave.

3 2