May 2009 - Freeradius-Users - lists.freeradius.org

authentication failed because sqlcounter...
by Nizar Zulmi 08 May '09

08 May '09

mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it as default no change i made in noresetcounter module. then i adding noresetcounter in authorize and instantiate section. i have defined 1user named tes and password tes has loged in normally before i add attribut max-all-session in the table radcheck just like this. +----+----------+-----------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+--------+ | 1 | nizar | Password | == | nizar | | 2 | nizar1 | Password | == | nizar1 | | 6 | tes | Max-All-Session | == | 90 | | 4 | tes | Password | == | tes | +----+----------+-----------------+----+--------+ after i adding the attribut max-all-session the user tes cannot login anymore. i do running freeradius in debug mode and the following si the result.. somebody help me please... ================freeradius debug result======= rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194 User-Name = "tes" User-Password = "tes" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-1E-68-23-E9-C8" Called-Station-Id = "00-00-E2-78-FF-39" NAS-Identifier = "nas01" Acct-Session-Id = "4a04816800000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x1c3a148590ef0762aed6069cc9ac0715 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tes", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 radius_xlat: 'tes' rlm_sql (sql): sql_set_user escaped user --> 'tes' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tes' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tes' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tes' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tes' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): No matching entry in the database for request from user [tes] modcall[authorize]: module "sql" returns notfound for request 3 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194 Sending Access-Reject of id 0 to 192.168.0.1 port 56614 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 0 with timestamp 4a048180 Nothing to do. Sleeping until we see a request.

1 0

authentication failed because sqlcounter...
by Nizar Zulmi 08 May '09

08 May '09

mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it as default no change i made in noresetcounter module. then i adding noresetcounter in authorize and instantiate section. i have defined 1user named tes and password tes has loged in normally before i add attribut max-all-session in the table radcheck just like this. +----+----------+-----------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+--------+ | 1 | nizar | Password | == | nizar | | 2 | nizar1 | Password | == | nizar1 | | 6 | tes | Max-All-Session | == | 90 | | 4 | tes | Password | == | tes | +----+----------+-----------------+----+--------+ after i adding the attribut max-all-session the user tes cannot login anymore. i do running freeradius in debug mode and the following si the result.. somebody help me please... ================freeradius debug result======= rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194 User-Name = "tes" User-Password = "tes" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-1E-68-23-E9-C8" Called-Station-Id = "00-00-E2-78-FF-39" NAS-Identifier = "nas01" Acct-Session-Id = "4a04816800000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x1c3a148590ef0762aed6069cc9ac0715 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tes", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 radius_xlat: 'tes' rlm_sql (sql): sql_set_user escaped user --> 'tes' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tes' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tes' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tes' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tes' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): No matching entry in the database for request from user [tes] modcall[authorize]: module "sql" returns notfound for request 3 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194 Sending Access-Reject of id 0 to 192.168.0.1 port 56614 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 0 with timestamp 4a048180 Nothing to do. Sleeping until we see a request.

1 0

Re: Another "package" - set expiry at first use
by Ming-Ching Tiew 08 May '09

08 May '09

--- On Fri, 5/8/09, Ivan Kalik <tnt(a)kalik.net> wrote: > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: Another "package" - set expiry at first use > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Friday, May 8, 2009, 1:05 PM > > Upon successful authentication, > check it is firstuse. If yes, set expiry > > to say 6 months from now. > > > > Use unlang in post-auth: check that there is no session for > that user in > radacct; if none, put adddate(now(),INTERVAL 6 MONTH) into > Tmp-String-0; > if you want to keep it in unlang (don't want to write a > perl script) you > need to convert that from mysql time (yyyy-MM-dd HH:mm:ss) > to Month dd > yyyy HH:mm:ss using mysql time functions (+ concat()) and > store it in > Tmp-String-1; then insert Tmp-String-1 as Expiration value > for that user > in radcheck. > > On second thought, maybe we could implement an alternate scheme which is cheaper. At post-auth, check if a used_flag in the database exists. If not, create one ***AND*** set expiry date. We can't keep this in either radcheck or radreply ( can we ? ), meaning we need another auxilliary table for users, say userinfo table. Regards

2 1

Launch external script after login and logout
by Gianni Olivieri 08 May '09

08 May '09

Hi to all, in a previous verison of freeradius I use the acct_users file to launch a python script after login/logout of a user. the acct_users was so: DEFAULT Acct-Status-Type == "Start" Exec-Program = "/etc/freeradius/SCRIPT/userlogin.py %{User-Name}" DEFAULT Acct-Status-Type == "Stop" Exec-Program = "/etc/freeradius/SCRIPT/userlogout.py %{User-Name} Now with freeradius 2.0.4 this acct_users doesn't work. How can launch a script after a login and a logout? Best regards. -- Gianni Olivieri SICE Telecomunicazioni ------------------------------------ Via Tazio Nuvolari, 53 55061 - Carraia (LU) - ITALY ------------------------------------------------ Tel. +39 0583 980787 Fax +39 0583 981495 www.sicetelecom.it gianni.olivieri(a)sicetelecom.it -----------------------------------------------

3 6

Re: FR Using MAC Authentication
by Steve Wu 08 May '09

08 May '09

Hi Tim - Thanks Tim, that worked, although is that up to each AP manf as to what it sends? I have HP420s. I changed the password field to match the MAC and it authenticated (I think), but I didn't get an IP. The 420 I'm using hands out an IP fine when I turn off the MAC auth and have it wide open, so it's talking to my DHCP server fine. Any more ideas would be greatly appreciated! Thx - Steve Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.10.18.241:9000, id=4, length=138 Acct-Delay-Time = 0 NAS-Identifier = "Enterprise AP" User-Name = "000e35-84610a" Acct-Status-Type = Start Acct-Session-Id = "000e35-84a0414e5" Acct-Authentic = RADIUS NAS-IP-Address = 10.10.18.241 NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000e3584610a" Called-Station-Id = "001321ad8e4e" Service-Type = Framed-User Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 10.10.18.241,NAS-IP-Address = 10.10.18.241,Acct-Session-Id = "000e35-84a0414e5",User-Name = "000e35-84610a"' rlm_acct_unique: Acct-Unique-Session-ID = "3107f7faaae62984". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "000e35-84610a", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/freeradius/radacct/10.10.18.241/detail-20090508' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.10.18.241/detail-20090508 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: '000e35-84610a' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 4 to 10.10.18.241 port 9000 Finished request 1 ----- Original Message ----- From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 8, 2009 11:42:29 AM GMT -05:00 US/Canada Eastern Subject: RE: FR Using MAC Authentication Steve, Your wireless access point is sending the MAC address as the username and password. Change the username and password in the users file and the authentication will work. rad_recv: Access-Request packet from host 10.10.18.241:2160, id=7, length=53 User-Name = "00215c-08b25d" <--- This came from the wireless access point User-Password = "00215c-08b25d" <--- This came from the wireless access point Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org] On Behalf Of Steve Wu Sent: Friday, May 08, 2009 8:35 AM To: freeradius-users(a)lists.freeradius.org Subject: FR Using MAC Authentication Hi - I have just started tinkering with Freeradius, I built an Ubuntu 8.10 server box and installed FR --> sudo apt-get install freeradius*. It installed in a breeze and tested fine. I have setup a HP420 AP for testing, it's chattering with the FR box fine (I think). I want my wireless clients to do MAC authentication via the FR box. I have setup my users file to auth two of my test laptops: 000E35-84610A Auth-Type := Local, User-Password == "esradius" 00215C-08B25D Auth-Type := Local, User-Password == "esradius" When either tries to connect up, in the FR debug I see: rad_recv: Access-Request packet from host 10.10.18.241:2160, id=7, length=53 User-Name = "00215c-08b25d" User-Password = "00215c-08b25d" Processing the authorize section of radiusd.conf The authentication eventually fails: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Why is the User-Password the MAC address and not what is specified in the users file? I have only tweaked the users and clients.conf files. Just simple MAC authentication, that's all I want at this point. Thanks in advance! - Steve - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

FR Using MAC Authentication
by Steve Wu 08 May '09

08 May '09

Hi - I have just started tinkering with Freeradius, I built an Ubuntu 8.10 server box and installed FR --> sudo apt-get install freeradius*. It installed in a breeze and tested fine. I have setup a HP420 AP for testing, it's chattering with the FR box fine (I think). I want my wireless clients to do MAC authentication via the FR box. I have setup my users file to auth two of my test laptops: 000E35-84610A Auth-Type := Local, User-Password == "esradius" 00215C-08B25D Auth-Type := Local, User-Password == "esradius" When either tries to connect up, in the FR debug I see: rad_recv: Access-Request packet from host 10.10.18.241:2160, id=7, length=53 User-Name = "00215c-08b25d" User-Password = "00215c-08b25d" Processing the authorize section of radiusd.conf The authentication eventually fails: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Why is the User-Password the MAC address and not what is specified in the users file? I have only tweaked the users and clients.conf files. Just simple MAC authentication, that's all I want at this point. Thanks in advance! - Steve

5 4

Another "package" - set expiry at first use
by Ming-Ching Tiew 08 May '09

08 May '09

I have another question about implementing another "package" :- Upon successful authentication, check it is firstuse. If yes, set expiry to say 6 months from now. Any advise how to implement this at the radius server ? My first cut thinking will be check 'radacct' for existence of any past usage records. If yes, set expiry 5 months from now. Anyone already has a mysql script written for this ? Regards

2 1

Fair usage package implementation
by Ming-Ching Tiew 08 May '09

08 May '09

I wonder if how such a "package" can be implemented, 1. Unlimited rate normally 2. But when downloaded packets exceed certain defined figure, download rate is trottled. Assumption ========== 1. Assuming the radius client is sending accounting information to the server, and so the downloaded octets can be obtained from the database through some sql query. 2. Assuming the radius client has some radius attributes which can set the download rate, WISPr-Bandwidth-Max-Down for example. One way I could think of is to run a batch job which work out per user octet usage and then set the attribute WISPr-Bandwidth-Max-Down accordingly. But this will have to be per day basis, it might be too late ( after the subscriber have over abused it ). Is there way such a thing can be implemented inside radiusd so that everything happens on the fly ? Regards.

2 1

Graphing - Online users
by AHMED KHIDR 07 May '09

07 May '09

Dear All , I have a question , is there any way to make a graph ( Like mrtg or cacti ) to graph no of online users ?? Regards

1 0

Is PEAP/EAP-MSCHAPv2 with certs a reasonable way to keep untrusted computers off the lan?
by john 07 May '09

07 May '09

Hello all, I want to deny any untrusted computer access to our lan. Lately we've had a lot of students and staff bring laptops into our school and plugging them in to any convenient network port. I want only users with domain credentials using trusted computers on the LAN. My test setup looks like Active Directory <=> winbind <=> Freeradius <=> NAS <=> Supplicant I think that using PEAP/EAP-MSCHAPv2 with client certs may be a reasonable way to proceed but I would like to get a sanity check from folks. 1) Would PEAP/EAP-MSCHAPv2 with client certs accomplish my goal? 2) Is there a better approach? 3) I am not clear on how to force checking of the client cert. I enabled "EAP-TLS-Require-Client-Cert = Yes" under the PEAP section of the eap.conf file but my WindowsXP client was still allowed to authenticate without specifying a root CA. Am I missing the point, if so please guide me. 4) Eventually I'll want to extend this approach to wireless devices so that trusted computers will get LAN services while untrusted computers with valid user credentials will be handed off to a different VLAN. Thanks for your help! John

2 2