December 2009 - Freeradius-Users - lists.freeradius.org

Rejecting User By their Calling-Station-Id (Mac Address)
by Alex M 26 Dec '09

26 Dec '09

Hey all, i'm coming back here w/ my old question of how to reject users based on their MAC address... but now im running FR 2.x.x So, we have trial access for free, and some people figured that they can re-register new accounts for trial all over again and have fun this way. Well thats not fun for us so we trying to figure out what we can do to reject reqyest from their machines no matter what name they put in. So maybe some one can help me out here. Here is what I tried: *radusergroup* (username, groupename, priority) <all user-names registered> Ban 9999 Test_User Home 1 *radgroupcheck* (groupname, attribute, op, value) Ban Calling-Station-Id == 00:0b:6a:xx:xx:xx Ban Reply-Message == You have been banned Ban Auth-Type := Reject *radcheck* (username, attribute, op, value) Test_User password == letmein So far that dint work at all... I tried changing priority but no matter what I do the user still authorized to enter the network. I'm sure I did something wrong but im not sure what? So maybe some one can help me out? Thanks a lot!

4 10

How freeradius mapping the attributes when save records into radacct table?
by Zhang Shukun 25 Dec '09

25 Dec '09

hi, all Merry Christmas！ i want to how freeradius map the attributes between vendor specific attributes and radius usuall attributes. for example. i have attributes from asterisk send to radius, attributes and data as follows: Acct-Status-Type = Stop Asterisk-Src = "5678" Asterisk-Dst = "4321" Asterisk-Dst-Ctx = "tutorial" Asterisk-Clid = "\"Jane Smith\" <5678>" Asterisk-Chan = "SIP/ivan-00000004" Asterisk-Dst-Chan = "SIP/test-00000005" Asterisk-Last-App = "Dial" Asterisk-Last-Data = "SIP/test" Asterisk-Start-Time = "2009-12-23 16:00:48 +0000" Asterisk-Answer-Time = "2009-12-23 16:00:53 +0000" Asterisk-End-Time = "2009-12-23 16:02:49 +0000" Asterisk-Duration = 121 Asterisk-Bill-Sec = 116 Asterisk-Disposition = "ANSWERED" Asterisk-AMA-Flags = "DOCUMENTATION" Asterisk-Unique-ID = "1261584048.4" User-Name = "SIP/ivan-00000004" Acct-Session-Id = "1261584048.4" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = 127.0.0.1 but when sended to freeradius and saved to mysql table radacct, record shows as follow, | 15 | 1261584048.4 | acb68819c2f8e979 | SIP/ivan-00000004 | | | 127.0.0.1 | 0 | | 2009-12-24 00:02:49 | 2009-12-24 00:02:49 | 0 | | | | 0 | 0 | | | | | | | 0 | 0 | NULL | as you see, many attributes not saved to the table radacct, there are lost. My question is how freeradius know the mapping between them(the attributes)? if i want to change the attributes(add or remove ) for the mapping? what should i do? modify the src codes of freeradius ? or do others -- Thanks, Sucan

2 1

Access-Request / Mandatory Attributes
by rsg 24 Dec '09

24 Dec '09

Hi, I find that FreeRadius server allows access even without either of the mandatory attributes i.e. NAS-Identifier or NAS-IP-Address in the Access Request packet. Is this a deviation from RFC 2865 ? " .....An Access-Request SHOULD contain a User-Name attribute. It MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both)." Can someone clarify this please? Many thanks, rsg.

2 3

error discarding packet
by Alisson 24 Dec '09

24 Dec '09

hi, in another day I posted this same error ' Error: Discarding duplicate request from client ' and the answer was 'your database is slow' so I upgrade my server with more memory, and changed servers variables... but, i'm still having this problem and I dont know what can be -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

6 26

poptop + radius + mysql
by Alessandro Agostini 23 Dec '09

23 Dec '09

Hi to all, I have completed reinstalled all suite on a new Linux box (Centos) for VPN Server. I have installed: - freeradius v.1.1.3 - pptpd v.1.3.4 - radiusclient-ng v.0.5.6.3 freeradius configured with sql backend; with radtest all is ok. pptpd and radiusclient configured as in your guide: http://wiki.freeradius.org/PopTop I try to create tunnel VPN from PC with XP Pro and I see this on pptpd log: Dec 23 16:03:01 ns pptpd[24224]: CTRL: Starting call (launching pppd, opening GR E) Dec 23 16:03:01 ns pppd[24225]: Plugin radius.so loaded. Dec 23 16:03:01 ns pppd[24225]: RADIUS plugin initialized. Dec 23 16:03:01 ns pppd[24225]: Plugin radattr.so loaded. Dec 23 16:03:01 ns pppd[24225]: RADATTR plugin initialized. Dec 23 16:03:01 ns pppd[24225]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. Dec 23 16:03:01 ns pppd[24225]: pptpd-logwtmp: $Version$ Dec 23 16:03:01 ns pppd[24225]: pppd 2.4.4 started by root, uid 0 Dec 23 16:03:01 ns pppd[24225]: Using interface ppp0 Dec 23 16:03:01 ns pppd[24225]: Connect: ppp0 <--> /dev/pts/3 Dec 23 16:03:04 ns pptpd[24224]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Dec 23 16:03:04 ns pppd[24225]: rc_avpair_new: unknown attribute 11 Dec 23 16:03:04 ns pppd[24225]: rc_avpair_new: unknown attribute 25 Dec 23 16:03:14 ns pppd[24225]: Peer agostini failed CHAP authentication Dec 23 16:03:14 ns pppd[24225]: Connection terminated. Dec 23 16:03:14 ns pppd[24225]: Exit. Dec 23 16:03:14 ns pptpd[24224]: CTRL: Client 149.xxx.xxx.xxx control connection finished and this in radiusd -X log: rad_recv: Access-Request packet from host 127.0.0.1:59350, id=41, length=70 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "agostini" Calling-Station-Id = "149.xxx.xxx.xxx" NAS-IP-Address = 149.xxx.yyy.yyy NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'agostini' rlm_sql (sql): sql_set_user escaped user --> 'agostini' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'agostini' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'agostini' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 41 to 127.0.0.1 port 59350 Waking up in 4 seconds... The dictionary.microsoft is generated from schema in your site http://wiki.freeradius.org/PopTop I see onluy User-Name attribute but no the other MS-CHAP.... Can you help me? Have you any idea if there are tools to deep diagnostic for this problem? Thank you in advance and Merry Christmas! Alessandro -- Servizio informatica e comunicazioni CNR - Istituto Fisica Applicata "N.Carrara" Via Madonna del Piano,10 Sesto Fiorentino (FI) --------------------------------------------- http://www.ifac.cnr.it - tel. 055 5226406

5 4

Rate-Limit
by javkhlanbaatar＠nimon.mn 23 Dec '09

23 Dec '09

Hi, I have freeRadius server connected to Cisco Router as PPPoE Server (Remote Access Server). I can limit customers' bandwidth limit by using Rate-limit function. But I want to give unlimited bandwidth to some specified IPs. Also time-based (I mean at the midnight I can give no bandwidth limitation to the customers.) How can I make it in freeradius? Thanks

3 2

Can't load cdr_radius.so module?
by Zhang Shukun 23 Dec '09

23 Dec '09

hi , all when i do the command "module load cdr_radius.so" ,error happens. i have installed radiusclient-ng , what's wrong with it? thanks! error message as follow: ZHANGSHUKUN*CLI> module load cdr_radius.so Unable to load module cdr_radius.so Command 'module load cdr_radius.so' failed. [Dec 23 17:55:41] WARNING[31072]: loader.c:380 load_dynamic_module: Error loading module 'cdr_radius.so': libradiusclient-ng.so.2: cannot open shared object file: No such file or directory [Dec 23 17:55:41] WARNING[31072]: loader.c:730 load_resource: Module 'cdr_radius.so' could not be loaded. -- Regards, Sucan

1 0

How to set servers file in radiusclient-ng install ?
by Zhang Shukun 23 Dec '09

23 Dec '09

hi friend, i see the tutorial in the url http://svn.dd-wrt.com:8000/dd-wrt/browser/src/router/asterisk/doc/radius.txt it says : " Each line contains hostname of a RADIUS server and shared secret used in communication with that server. " is that say i must set the hostname of a RADIUS server, could i set IP addr of the RADIUS server? Thanks! -- Regards, Sucan

2 1

escape in the radius accept
by Ning Shi 22 Dec '09

22 Dec '09

hello folks, I am working on a EAP issue. the user could authenticated ok. however, if the username is like this: "edu\nntest" (wihch is ' 45 44 55 5c 6e 6e 74 65 73 74) then in the radius accept, the username changed to "edu'0x0a'ntest" (45 44 55 0a 6e 74 65 73 74) so the '\n' has been converted to 0x0a. this doesn't affect the authentication but it does affect the display on the authenticator. I tried to search the list but couldn't find similar question. if anyone has any workaround, please advise. I don't have the radius debug log since this is on a production server but I don't have the packet capture in case someone is interested. Regards, -ns

2 1

Virtual Server not setting attributes on reply
by Timothy 22 Dec '09

22 Dec '09

Hi, I'm having problems when using a virtual server. When using the "virtual_server" I'm not getting the reply attributes set. It may be a config thing, but I haven't been able to find where the problem is from the documentation. And I can't understand why there would be the difference. I have 2 realms set using the same virtual server. The only difference is realm TEST1 { virtual_server = test } realm TEST2 { type = radius format = prefix delimiter = "/" authhost = 127.0.0.1:11812 accthost = 127.0.0.1:11813 secret = secret } If I authenticate to TEST1/user My response is "only" a successful auth. If I authenticate to TEST2/user My response is a successful auth WITH Attributes (in this case the attribute I'm setting is Cisco-AVPair = "shell:priv-lvl=15" It appears to me that using the virtual server is stripping the attributes from the reply. Can anyone tell me a) The approprate documentation covering this is so I know. b) What I have done wrong (and where to find the answers) or c) This is an actual bug and someone will look at it Thanks Timothy

3 8