March 2009 - Freeradius-Users - lists.freeradius.org

gigawords and bandwith
by Lars 18 Mar '09

18 Mar '09

Hi, i'm new here and i need your help in the following 2 points. Point 1: Acct-Input/Output-Gigawords Point 2: Bandwithlimit with PPP and PPPoE My system: debian with kernel 2.6.8-2-386, Roaring Penguin PPPoE Version 3.10, PPP 2.4.4 (not quit sure) and MySQL 4.1.10a. Point 1) After I recognized that the accounting data (acct-input/output-octet) will set to zero if the user downloaded more than 4 GB I added to sql.conf and to table radacct the parameter acct-input/output-gigawords. But It won't be filled with data, it's always zero. The sql statements look like this ({acct_table1} and {acct_table2} are both radacct) accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE ${acct_table2} \ SET AcctStopTime = '%S', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ AcctTerminateCause = '%{Acct-Terminate-Cause}', \ AcctStopDelay = '%{Acct-Delay-Time}', \ ConnectInfo_stop = '%{Connect-Info}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into ${acct_table2} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, \ NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, \ AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, \ AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, \ ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', \ DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), \ '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', \ '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" accounting_update_query_alt = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, \ NASPortId, NASPortType, AcctStartTime, AcctSessionTime, \ AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, \ CalledStationId, CallingStationId, ServiceType, FramedProtocol, \ FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', \ DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), \ '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', \ '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" Point 2) I have to limit the user's bandwith so I think about a simple possibility to do that. The best way imho would be an additional entry in "radreplay" for this user. I want to limit on the pppoe-server machine not at the user placed equipment. Is it possible? And if yes: How? Regards Lars

1 0

Re: MS-CHAP2 Failure
by Mike Diggins 18 Mar '09

18 Mar '09

I've made no progress in finding a solution to my MSCHAP problem. To summarize, Winbind and FreeRadius authenticate via PAP fine on both servers (RedHat V5), but MSCHAP fails on one of the two (see below). I tried tar'ing up the entire /etc/raddb directory and copied it to the other machine, but it still fails. I also rejoined the Windows domain, but nothing is working. Does MSCHAP have any other dependency on the system, that PAP doesn't? I don't know where else to look. -Mike On Mon, 16 Mar 2009, Mike Diggins wrote: > > I configured what I thought were two identical FreeRadus 2.1.3 servers. I'm > attempting to do MS-CHAP2 authentication on both, one is working, the other > is not. For the life of me I can't find any difference in their > configuration. > > On my client, I switch the host name between the two servers, everything else > stays the same. One works, one fails, and I don't know why. Below is the > debug output for both the failure and success. PAP authentication works fine > on both with the same id. What the heck have I missed? > > This is the one that fails: > > rad_recv: Access-Request packet from host 192.168.2.15 port 2357, id=26, > length=127 > NAS-Identifier = "test-cam1" > NAS-IP-Address = 192.168.2.15 > MS-CHAP-Challenge = 0xbd4261d677c0d793ee781d7a032218df > MS-CHAP2-Response = > 0xa300ac9567587df3e83b3799dc49a53f433000000000000000007e0e6320a093349fbd0afc94436ed32e1258e26c5463147b > User-Name = "test26" > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "test26", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 5 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Told to do MS-CHAPv2 for test26 with NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > Failed to authenticate the user. > Login incorrect: [test26] (from client 192.168.2.15 port 0) > Using Post-Auth-Type Reject > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> test26 > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 7 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 7 > Sending Access-Reject of id 26 to 192.168.2.15 port 2357 > Waking up in 4.9 seconds. > Cleaning up request 7 ID 26 with timestamp +1885 > Ready to process requests. > > > This one works: > > rad_recv: Access-Request packet from host 192.168.2.15 port 2358, id=115, > length=127 > NAS-Identifier = "test-cam1" > NAS-IP-Address = 192.168.2.15 > MS-CHAP-Challenge = 0xfdd0ccd7059225f80093cea2929eb415 > MS-CHAP2-Response = > 0x780017ff811e7761fc6bd332fb45f4f6b3f50000000000000000b6834efb6626804caf2aa055c5a157851e9bc927698cf23f > User-Name = "test26" > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "test26", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 5 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Told to do MS-CHAPv2 for test26 with NT-Password > [mschap] expand: --username=%{mschap:User-Name:-None} -> > --username=test26 > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 > [mschap] mschap2: fd > [mschap] expand: --challenge=%{mschap:Challenge:-00} -> > --challenge=cc26ba941d6d9678 > [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> > --nt-response=b6834efb6626804caf2aa055c5a157851e9bc927698cf23f > Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B > Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B > Exec-Program: returned: 0 > ++[mschap] returns ok > Login OK: [test26] (from client 192.168.2.15 port 0) > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 115 to 192.168.2.15 port 2358 > MS-CHAP2-Success = > 0x78533d41453631324635393130344535373132364133414234374339463844443541453538384142453943 > Finished request 5. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 5 ID 115 with timestamp +1773 > Ready to process requests. > > -Mike > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

5 7

Relaying of accounting requests between Freeradius servers
by Patric 18 Mar '09

18 Mar '09

Greetings list, I have finally been able to upgrade my secondary freeradius server to 2.1.3 and I must commend everyone on their hard work, the changes are great :) I am having some trouble but would like to clarify my understanding before posting all my problem details in case I have misunderstood something. My question is independent of server or platform version and addresses the fundamental mechanics of the relaying process. I am using a virtual server setup to proxy accounting requests between 2 servers for mirroring purposes. As I understand the process server 1 receives an accounting request, which it will process according to its accounting section (in my case inserted into a table via the sql module). If successful, it will then proxy the request to server 2, which will also process it according to its own accounting section. Server 2 will then attempt to proxy the request to server 1 as per its proxy configuration, but will fail on a duplicate record, which will stop duplication from occuring. Is my understanding in this correct, that server 1 will send the request to server 2, and server 2 will try to send it to server 1 again but will fail with a duplication error? Many thanks Patric

5 10

configuring eap2
by Leonid Sigal 18 Mar '09

18 Mar '09

Hello, could some one with a such experience to provide a STEP BY STEP procedure to configure eap2 module: which configuration files have to be update and how ? Thanks in advance, Leonid.

2 1

FreeRadius only works in debug mode
by Greg.Webster＠westfraser.com 17 Mar '09

17 Mar '09

Hello all, My other email to the list from last week appears to have disappeared into the ether...probably too big with the whole config file. Hopefull someone can offer advice on this issue. If I start up radiusd (on SuSE/OES linux, install from Yast) with the standard script in init.d it doesn't open up the port or authenticate. However, if I add the debug parameter (-x) to that same script, it works just fine. For example, if I change this line in /etc/init.d/radiusd ... startproc $RADIUSD_BIN > /var/log/radius/radius.log ... to this ... startproc $RADIUSD_BIN -x > /var/log/radius/radius.log ... it authenticates beautifully. Googling around it looks like I'm not the only one with this problem, but the only solution seems to be a manual recompile. Help? Thanks in advance! Greg Webster ---------------------------- This e-mail message and any attachments are confidential. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. If you are not the intended recipient, please notify me by return e-mail, do not open any attachment and delete this communication and any copy. Thank you

2 1

Cdv D has sent you a private message
by Cdv D 17 Mar '09

17 Mar '09

1 0

Help with a redirect / splash page for sign up
by Dave Sinclair 17 Mar '09

17 Mar '09

Maybe not perfect for this list, but I gotta think somone on here has done this before. We just got handed over 500 DSL subscribers. Old ISP is dead, no records, no accounting data. Just the ATM PVC's are on our network. I'm trying to figure out how to do a one time redirect so that they sign up into our billing system and once thats done then they have internet access. I'm willing to pay reasonable $$ for somone that knows how to do this using open source tools and our cisco routers. Mucho thanks for the help.

1 0

Cdv D has sent you a private message
by Cdv D 17 Mar '09

17 Mar '09

1 0

Modifying EAP Messages
by Enrique de la Hoz 17 Mar '09

17 Mar '09

Hi everybody, We are trying to develop a module to make possible to add extra information to EAP Messages. We are employing rlm_perlo module. Up to now, we have been able to add new EAP-Message attributes to the RADIUS response packets but we cannot figure out how to modify the current EAP-Message already addedd. It is assumed (from RFC 3579) that multiple EAP Message attributes will be concatenated to form a single EAP Packet but the thing is that we do not receive the added information in our supplicant. Two questions arise: 1) Is it possible to modify EAP-Message attributes from perl modules? 2) If not, should we go through a per EAP-athentication method C source code modification? Thanks in advance, -- Enrique de la Hoz de la Hoz

5 13

Storing hashes in MySQL when using MS_CHAP
by Yuriy Grishin 17 Mar '09

17 Mar '09

Hello, I'm trying to conceal plain-text passwords from my radius.radcheck database in order to it'll be useless if it's stolen. My config is FreeBSD 7.0 + FreeRadius1.1.7 + mpd4 + MySQL-5.0.67 (windowsXP and Vista Clients) Well, I found a solution here http://www.usenet-forums.com/freeradius-users/280602-re-freeradius-mysql-cr… written by Alan DeKok. But I haven't got it working. radcheck was : +----+----------+----------------------+----+---------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------------+----+---------------------------------------+ | 1 | user1 | Password-With-Header | := | {md5}c4ca4238a0b923820dcc509a6f75849b | and raduis -X said : rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "user1" with CHAP password rlm_chap: Could not find clear text password for user user1 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. radiusd's searching a plain-text password. Then I googled a little bit more and found a combination with Attribute='Auth-Type' and Value='Crypt-Local', generated a hash using $ openssl passwd -1 1 $1$HR1R2p.2$7tsK8wE30pDf6AQ6KEi6d/ Unfortunately, it doesn't work too.. It that possible to get hashed passwords together with MS_CHAP? -- Yuriy Grishin.

3 4