November 2009 - Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 55, Issue 113
by Peter Carlstedt 25 Nov '09

25 Nov '09

>

2 1

showing NAS-IP of 127.0.01 instead of
by Matt Ashfield 25 Nov '09

25 Nov '09

Hi, I'm running FreeRADIUS Version 2.1.5. We are trying to do system authentication for some users. Doing this by creating huntgroups based on NAS-IP-Address, and then telling that huntgroup to use System for authentication. The problem is that although the Access-Request packet is shown as coming from the correct host, that host's ip address is not showing up as the NAS-IP-Address for that request. Instead, it's showing as 127.0.0.1 as seen below: rad_recv: Access-Request packet from host 192.168.27.7 port 53201, id=130, length=51 User-Name = "xm7z1" User-Password = "abc.123" NAS-IP-Address = 127.0.0.1 I'm wondering what could cause this? Any help is appreciated. Thanks Matt

2 2

Free Radius accounting and duplicate session entries in radacct with different output/input octets
by Ade Slade 25 Nov '09

25 Nov '09

Hey, Firstly, is the accounting part of FreeRadius used by major organisations? Due to the possibility and indeed occurrence of duplicate sessions appearing in the radacct table and other issues I've found, it doesn't seem to be all that robust a solution. I realise freeradius is just reporting what it is sent from the NAS and so is not to blame. Secondly, I've experienced duplicate accounting sessions appearing which report different input/output octets. Over the set of the data, it has happened infrequently but it is undesirable. Comparing the data inserted into the radacct table and the logs, one (or more) of the duplicate sessions will reflect the logs and one of the duplicates will show completely different input/output octets. It's worth noting that these duplicate sessions share the same AcctSessionTime, AcctSessionId, AcctUniqueId and UserName. Any ideas on what the cause of this could be?

2 1

Groups of NASs by IP
by Leighton Man 25 Nov '09

25 Nov '09

Hi, I would like to group NASs by ip address but as I have a few hundred, I don't want to maintain a list. Can I configure ip address ranges in huntgroups eg. Group1 NAS-IP-Address == 192.168.1.101 - 105 If not, can I use regular expressions? How else can I do this? What is the best way? Thanks in advance, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 2

Rejecting auth from a specific realm
by Ben Carbery 25 Nov '09

25 Nov '09

I am using freeradius to proxy eduroam requests. These could be for any number of different realms so I only have a DEFAULT realm configured. I now want to reject authentication to one specific realm (my own) but pass all others. The proxy server can't do this for me so I need to do it before proxying. I have been reading all the man pages but can't figure this out..how where is this done? B

4 9

Re: CUI
by Humberto Cardoza 25 Nov '09

25 Nov '09

Hi All I am a new user with Freeradius, now i have it configured with Mysql but, the problem that i have is that the cui table it is not pupulated with information of the active sessions. i get configured the sql/mysql/cui.conf and all the stuff that i found that is necessary, but it simply doesn't work. So i will appreciate if somebody can give a tip to make it work. Best Regards -- Eng. Humberto Cardoza

3 2

Correct net scheme
by C. Diego Raffaelli A. 24 Nov '09

24 Nov '09

hi all. I would like to apply any kind of authentication for VDSL clients. i am a ISP. i have a "3com Total control" wich provides dial up access to another users, and i think i would use PPPOE in the same 3COM to auth. the other users (VDSL) because they doesn't use a telephone line to connect to my ISP. They are coming from their home by fiber optic to my central switch. 3COM provides PPPOE on his eth interface. currently VDSL users have a bandwith managmnt by a router cisco 3640 and have no any authentication, autorization or accounting. then, i would like to apply any solution for: manage properly the bandwith (¿its ok if the router does?) take PPPOE of 3COM total control (it is a RAS) and (if its necessary), install a freeradius on debian (with mysql and a web admin interface) to create profiles to new users... - i ask: can only the router works as a radius or a RAS and ignore the 3com RAS? can anybody suggest me a better net-scheme for this, watching all the equipement? thanks a lot CDR

1 0

PEAP/SoH patch
by Phil Mayers 24 Nov '09

24 Nov '09

All, I've started to do some work on supporting the SoH messages in PEAPv0, which are supported in WinXP SP3+ and Vista/Win7 So far I've made the necessary (I believe) modifications to the PEAP state machine, and have code to generate the SoH request TLV, but the clients are choking on it. EAP Request, Identity [RFC3748] EAP Response, Identity [RFC3748] EAP Request, PEAP [Palekar] TLSv1 Client Hello EAP Request, PEAP [Palekar] EAP Response, PEAP [Palekar] EAP Request, PEAP [Palekar] EAP Response, PEAP [Palekar] TLSv1 Server Hello, Certificate, Server Hello D TLSv1 Client Key Exchange, Change Cipher Spec, TLSv1 Change Cipher Spec, Encrypted Handshake M EAP Response, PEAP [Palekar] TLSv1 Application Data TLSv1 Application Data TLSv1 Application Data ^^^ containing the SoH requests ...and everything stops Please don't bombard me with "Me too, please send me your patch" requests at this point - it doesn't work, and I can't easily publish a git tree from here anyway. What I'm looking for is help from people for review & implementation - in particular, if there's anyone out there who knows how the hell I get debugging out of WinXP SP3. Could interested and technically capable parties contact me off-list or direct me to a place more appropriate for discussion?

2 1

RE: Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 24 Nov '09

24 Nov '09

Hi, Thanks for the all the pointers, I have got the proxying and post proxy configuration working with your hints. I have one small issue that I need to address. For some of our clients they don't want us to proxy requests before our LAC forwards them. Obviosuly I can configure a default entry in the proxy config so that any domain realm that I havent configured is matched, and specified to be handled locally. The problem comes that I don't know the passwords for all of the individual users that will come thorugh, so effectively I just need to generate an Accept packet whenever I hit this default proxy config. Is there someway I can do this, would I need to configure something within the users file instead or is there something I can add within the authorization section to allow this to work? Any help you can give would be much appreciated. Dan Fisher

2 1

Re: Stripping Realms from SQL Accounting Queries
by Tim Gustafson 24 Nov '09

24 Nov '09

> Perhaps do what is suggested wherever you care to look (this > list, documentation, website, ...) - run server in debug mode > (radiusd -X). Then you will see exactly what is happening. I did that, and it didn't help. I added a realm definition back in to the config file, and here's the debug output now: > [suffix] Looking up realm "soe.ucsc.edu" for User-Name = "tjg(a)soe.ucsc.edu" > [suffix] Found realm "soe.ucsc.edu" > [suffix] Adding Stripped-User-Name = "tjg" > [suffix] Adding Realm = "soe.ucsc.edu" > [suffix] Authentication realm is LOCAL. So far so good... > [ldap] performing user authorization for tjg > [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details > [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tjg) > [ldap] expand: dc=soe,dc=ucsc,dc=edu -> dc=soe,dc=ucsc,dc=edu Depreciated syntax aside, we're still doing good... > [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details > [sql] expand: insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('%{Acct-Session-Id}', '%{Stripped-User-Name:-%{User-Name}}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%S') -> insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('0004F8C5', 'tjg(a)soe.ucsc.edu', '192.168.32.8', '0024.2b58.2f46', '2009-11-23 14:13:42') Doh, no dice! Incidentally, as I mentioned in another reply a few minutes ago, using %{SQL-User-Name} instead of %{User-Name} results in an empty string, and using only %{Stripped-User-Name} also results in an empty string. If you really would like me to, I suppose I could get you the whole debug output, but it's a few thousand lines for a single authorization. Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1