July 2009 - Freeradius-Users - lists.freeradius.org

RE: error 734
by Issa Nkusi Karera [MTN Rwanda - MTN Centre] 15 Jul '09

15 Jul '09

Don't worry, the issue is fixed. A vrf congiguration was missing. From: Issa Nkusi Karera [MTN Rwanda - MTN Centre] Sent: Wednesday, July 15, 2009 6:10 PM To: freeradius-users(a)lists.freeradius.org Subject: error 734 Hello folks, Below is log message after an attempt to authenticate. Wed Jul 15 16:31:31 2009 : Auth: Login OK: [test(a)wimax.mtnonline.rw] (from client XX-bras-1 port 0) It is bring error 734 on a windows machine. Therefore, the user cannot be connected. Thanks in advance for you advise. Best regards, Issa This mail has been scanned by Symantec Mail Scan MTN Mail administrator

1 0

problem with checking dhcp-packet type
by Alexander Kubatkin 15 Jul '09

15 Jul '09

Hello. Freeradius 2.1.6 Below of the message translated and not translated code of dhcp-packet from client soho-router TrendNet 631BRP. As i can see, the main problem is a wrong order (for freeradius rules) of dhcp options and that's why such packet did not recognized and did not accepted. When packet is arriving i see "Unknown, or badly formatted DHCP packet". How to fix this? P.S. sorry for my english. ====not translated============== 0000 00 04 23 cc 33 98 00 1b 11 97 74 7e 08 00 45 00 ..#.3... ..t~..E. 0010 01 48 09 78 00 00 40 11 72 5a 59 de a5 01 59 de .H.x..@. rZY...Y. 0020 a5 15 00 43 00 43 01 34 a8 46 01 01 06 01 7c 5e ...C.C.4 .F....|^ 0030 42 a1 00 00 80 00 00 00 00 00 00 00 00 00 00 00 B....... ........ 0040 00 00 59 de e9 01 00 15 17 3a 0c d1 00 00 00 00 ..Y..... .:...... 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0110 00 00 00 00 00 00 63 82 53 63 0c 06 42 65 69 72 ......c. Sc..Beir 0120 65 6c 37 07 01 03 06 2c 0f 2e 2f 35 01 01 52 12 el7...., ../5..R. 0130 01 06 00 04 02 12 00 07 02 08 01 06 00 1b 11 b5 ........ ........ 0140 ef 04 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0150 00 00 00 00 00 00 ...... ================== ======translated by tshark============ Frame 1896 (342 bytes on wire, 342 bytes captured) Arrival Time: Jul 6, 2009 20:49:28.162401000 [Time delta from previous captured frame: 69.069364000 seconds] [Time delta from previous displayed frame: 69.069364000 seconds] [Time since reference or first frame: 42290.060516000 seconds] Frame Number: 1896 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:bootp] Ethernet II, Src: D-Link_97:74:7e (00:1b:11:97:74:7e), Dst: Intel_cc:33:98 (00:04:23:cc:33:98) Destination: Intel_cc:33:98 (00:04:23:cc:33:98) Address: Intel_cc:33:98 (00:04:23:cc:33:98) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_97:74:7e (00:1b:11:97:74:7e) Address: D-Link_97:74:7e (00:1b:11:97:74:7e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 89.222.165.1 (89.222.165.1), Dst: 89.222.165.21 (89.222.165.21) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0978 (2424) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x725a [correct] [Good: True] [Bad : False] Source: 89.222.165.1 (89.222.165.1) Destination: 89.222.165.21 (89.222.165.21) User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67) Source port: bootps (67) Destination port: bootps (67) Length: 308 Checksum: 0xa846 [correct] [Good Checksum: True] [Bad Checksum: False] Bootstrap Protocol Message type: Boot Request (1) Hardware type: Ethernet Hardware address length: 6 Hops: 1 Transaction ID: 0x7c5e42a1 Seconds elapsed: 0 Bootp flags: 0x8000 (Broadcast) 1... .... .... .... = Broadcast flag: Broadcast .000 0000 0000 0000 = Reserved flags: 0x0000 Client IP address: 0.0.0.0 (0.0.0.0) Your (client) IP address: 0.0.0.0 (0.0.0.0) Next server IP address: 0.0.0.0 (0.0.0.0) Relay agent IP address: 89.222.233.1 (89.222.233.1) Client MAC address: IntelCor_3a:0c:d1 (00:15:17:3a:0c:d1) Server host name not given Boot file name not given Magic cookie: (OK) Option: (t=12,l=6) Host Name = "Beirel" Option: (12) Host Name Length: 6 Value: 42656972656C Option: (t=55,l=7) Parameter Request List Option: (55) Parameter Request List Length: 7 Value: 0103062C0F2E2F 1 = Subnet Mask 3 = Router 6 = Domain Name Server 44 = NetBIOS over TCP/IP Name Server 15 = Domain Name 46 = NetBIOS over TCP/IP Node Type 47 = NetBIOS over TCP/IP Scope Option: (t=53,l=1) DHCP Message Type = DHCP Discover Option: (53) DHCP Message Type Length: 1 Value: 01 Option: (t=82,l=18) Agent Information Option Option: (82) Agent Information Option Length: 18 Value: 010600040212000702080106001B11B5EF04 Agent Circuit ID: 000402120007 Agent Remote ID: 0106001B11B5EF04 End Option Padding ============================= -- Alexander Kubatkin

2 12

error 734
by Issa Nkusi Karera [MTN Rwanda - MTN Centre] 15 Jul '09

15 Jul '09

Hello folks, Below is log message after an attempt to authenticate. Wed Jul 15 16:31:31 2009 : Auth: Login OK: [test(a)wimax.mtnonline.rw] (from client XX-bras-1 port 0) It is bring error 734 on a windows machine. Therefore, the user cannot be connected. Thanks in advance for you advise. Best regards, Issa This mail has been scanned by Symantec Mail Scan MTN Mail administrator

1 0

LDAP + TTLS PAP
by jpablorp 15 Jul '09

15 Jul '09

Hi. I've been trying to setup freeradius with LDAP + TTLS PAP. I use the default radius, eap users files configuration, I configure my modules/ldap file to connect to my ldap, sites-avilable/default file to authorize ldap, and ldap.attrmap to check Cleartext-Password against userPassword. Everything seems normal, when I test it with radtest user pass 10.14.56.26 0 secret is accepted. but when i try from mi XP client the debug show this: +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} Here my /sites-avilable/default authorize section: authorize { preprocess chap mschap eap { ok = return } unix files ldap expiration logintime pap } Any Ideas? Thanks. -- View this message in context: http://www.nabble.com/LDAP-%2B-TTLS-PAP-tp24498710p24498710.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Mysql and SHA256 or SHA-2
by Mouncif Benniane 15 Jul '09

15 Jul '09

I am using freeradius 2.1.6 with mysql backend, user's password are stored in database in SHA256 format , question is: does freeradius support this type of encryption?. I know it support SHA-1 and SSHA but it's not what I want. Thank you

1 0

How to reject when a user logs in without realm?
by Navin 15 Jul '09

15 Jul '09

Hi, I am new to radius . hence kindly excuse if my terminologies are different from what is expected. I am using Freeradius Version 1.1.7. Is it possible to reject when a request comes from the NAS server with a user logging in without a realm as suffix? For example, if the FreeRadius server receives an authentication request for the user navin , it has to reject. but if it receives the request as navin(a)freescale.com it has to authenticate him. I tried the below options: I am not using the proxy request support. Hence commenting proxy.conf file and setting proxy_requests = no in the radiusd.conf file. Added the below in the radiusd.conf file with the intention that users of realm freescale.com has to be authenticated and other users should be rejected. realm freescale.com { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL secret = test } In the radiusd.conf under the section realm module config options ignore_null = yes ignore_default = yes for user@realm. In the users file, added navin(a)freescale.com Cleartext-Password := "navin123" meaning authenticate navin having a password navin123. But what i observed is, i get authenticated when i login as navin and also as navin(a)freescale.com . This has been verified with the radtest client program which came along with the freeradius server. Kindly do let me know if the user can be rejected access if he logs in without realm. have a nice day, navin

2 3

Store message "Multiple logins" in MySQL.
by Daniel Aparecido Martins Rosa 15 Jul '09

15 Jul '09

Hi All! I need to register in a database when occurs simultaneous use. Currently I stored by postauth_query through the variable '% (reply: Packet-Type)', but the message is generic, ranging from Access-Reject or Access-Accept. When a connection occurs simultaneously, The freeradius stores the message "Access-Reject" The problem is that this message "Access-Reject" is the same for when an error occurs the user or password invalid. Tell me about that you can do this by setting the Freeradius conf, without changing the source code?

3 4

rlm_ippool performance
by Santosh 15 Jul '09

15 Jul '09

Hi I have a radius test client which can generate 1000's of radius access request in a single second. These radius clients need an IP address. So, I configured local ip ppol to assign ip addresses. When I run the tests I could see that I can scale up at the rate of 5 per second. If I increase the client access rate I run into following issue. I am guessing rlm_ippool is unable to handle so many requests. From Radius.log Error: WARNING: Unresponsive child for request 282, in module main_pool1 component post-auth The question here is will rlm_ippool be able to give away ip addresses to 100's of clients per second? or do I need to look at some thing else? Please suggest. Thanks, Santosh modules/ippool file ippool main_pool1 { range-start = 20.0.1.1 range-stop = 20.0.254.254 netmask = 255.255.0.0 cache-size = 64000 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } users file : sant Cleartext-Password := "sant", Pool-Name := "main_pool1" Fall-Through = Yes, Group = "test1", /sites-enabled/default post-auth { main_pool1 exec Post-Auth-Type REJECT { attr_filter.access_reject } }

2 1

Help required in defining new string Attribute
by Ila Palanisamy 15 Jul '09

15 Jul '09

Hi, I'm new to free radius. I'm trying to assign a new string attribute for a user, but the radius server is not coming up. Can someone help me in defining new string Attribute in freeradius. I have added a new attribute Foundry-INM-Role-AOR-List as string in dictionary and I'm trying to set this attribute for a user. With the below configuration radius server is not coming up. Any help in resolving this issue will be greatly appreciated. My changes are In users =-======== "ila" User-Password := "ila123" Foundry-INM-Privilege:= 4, Foundry-INM-Role-AOR-List := "InmRoles=Fremont ; InmAORs=AOR1" In dictionary.foundry =-============== ATTRIBUTE Foundry-INM-Role-AOR-List 9 string When I start the server, it gives the below message. /etc/raddb/users[107]: Parse error (reply) for entry ila: Invalid octet string "InmRoles=Fremont ; InmAORs=AOR1" for attribute name "Foundry-INM-Role-AOR-List" Errors reading /etc/raddb/users /etc/raddb/modules/files[7]: Instantiation failed for module "files" /etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } With integer attribute alone the radius server is coming up fine. Thanks, Ila.

2 1

How to publish vendor specific dictionary file?
by Ila Palanisamy 15 Jul '09

15 Jul '09

Hi, Whom to send the request to publish vendor specific dictionary file? So that the dictionary file will be available as part of the radius installation. Thanks, Ila.

3 3