January 2010 - Freeradius-Users - lists.freeradius.org

Does FreeRadius support different replies for same user via check-attributes?
by Tobbe & Millan 08 Jan '10

08 Jan '10

Hi! I would like a specific request item to set which attribute to reply. For example... IF; A request comes with User-Name: "XXX", Password: "YYY" and Attribute A = "Go1" The Access-Accept should include Attribute Go="Service1" BUT IF; A request comes with User-Name: "XXX", Password: "YYY" and Attribute A = "Go2" The Access-Accept should include Attribute Go="Service2" Is this possible? Thanks in advance! Tobian

2 1

radiusd -X On First Boot
by Brian Carpio 08 Jan '10

08 Jan '10

I am running RHEL 5.3 and FreeRADIUS Version 2.1.8. When I install freeradius and attempt to start it for the first time using the /etc/init.d/radiusd start script it always fails (only right after freeradius is installed), once i run freeradius with -X (in debug mode) it creates all the keys and such then I can cntrl + c and start free radius from that point forward using the init script... my question is why do I have to do this? Is there anyway around this? Thanks, Brian Carpio

12 28

cisco_vsa_hack
by Joe Maimon 08 Jan '10

08 Jan '10

Does turning on the hack do anything to the attributes other than adding the value to matching defined attributes? From the code: if ((vp->attribute & 0xffff) == 1) { const char *p; DICT_ATTR *dattr; p = vp->vp_strvalue; gettoken(&p, newattr, sizeof(newattr)); if (((dattr = dict_attrbyname(newattr)) != NULL) && (dattr->type == PW_TYPE_STRING)) { VALUE_PAIR *newvp; /* * Make a new attribute. */ newvp = pairmake(newattr, ptr + 1, T_OP_EQ); if (newvp) { pairadd(&vp, newvp); } } } else { /* h322-foo-bar = "h323-foo-bar = baz" */ /* * We strip out the duplicity from the * value field, we use only the value on * the right side of the '=' character. */ strlcpy(newattr, ptr + 1, sizeof(newattr)); strlcpy((char *)vp->vp_strvalue, newattr, sizeof(vp->vp_strvalue)); vp->length = strlen((char *)vp->vp_strvalue); }

2 1

freeradius proxy with 802.1x termination
by jgammons＠gmail.com 07 Jan '10

07 Jan '10

I am attempting to configure freeradius to terminate an 802.1x EAP-TTLS authentication, but forward/proxy the user/pass to another radius server. I can get it to standard proxy, and I can get it to function as a standalone radius server with EAP-TTLS, but can't seem to find any good information on how to do this.... I assume someone has been there done that... any help would be greatly appreciated. Thanks, John

4 6

mschap2 over peap, how to use cleartext password defined on the freeradius server instead of using Windows AD?
by Difan Zhao 07 Jan '10

07 Jan '10

Greetings! I did read the "mschap" module file and I did see that in order to use a cleartext password, I need to set "MS-CHAP-Use-NTLM-Auth := No" however I don't know where to set it. I tried to set it in "hints" file like the following. I added it to the beginning of the file and the rest is just default. enseo_stb MS-CHAP-Use-NTLM-Auth := No The "enseo_stb" is the username. I do see that it matched the line in the preprocess in the debug however the authentication still failed. I don't have this user account set in Windows AD. I do have it set in my users file. Enseo_stb Cleartext-Password := "password" Any advice?? Thank you!! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514

2 1

On-line debugging tool
by Alan DeKok 07 Jan '10

07 Jan '10

I've put a debugging tool online at: http://networkradius.com/ Click on the "debug tool" link on the left, under "News". The page contains instructions for how to get debug output into the form. The main purpose of the tool is to teach people what is important in the debug output, and what can be safely ignored. Important data is highlighted (red, yellow, blue), and less important data is de-emphasized (text is light grey). Each packet received / sent is put into its own text box. This separation allows you to quickly find the output for just one packet out of many. The tool is in "beta", and likely produces less useful output when the server is proxying packets. It's best used to debug local authentication issues. We hope you find the web tool useful. Please send any feedback privately to me. Alan DeKok.

3 5

Radiusd process exited without notice
by Dinh Pham Cong 07 Jan '10

07 Jan '10

Hi all, I noticed that my radiusd process exited silently this morning without any notice before I must start it manually at Mon Dec 21 10:42:23 2009 as you can see in the below log messages. Besides, no crash is recorded in /var/log/messages. Any recommendation to troubleshoot this problem is appreciated. Sun Dec 20 21:37:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.22', nas '10.0.41.137'] Sun Dec 20 21:39:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.70.57', nas '10.0.41.138'] Sun Dec 20 22:00:52 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.222', nas '10.0.41.138'] Sun Dec 20 22:04:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.115.184', nas '10.0.41.138'] Sun Dec 20 22:15:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.66.205', nas '10.0.41.138'] Sun Dec 20 22:33:15 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.99', nas '10.0.41.138'] Sun Dec 20 22:51:12 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.23', nas '10.0.41.137'] Sun Dec 20 23:30:07 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.108.156', nas '10.0.41.138'] Sun Dec 20 23:35:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.64.196', nas '10.0.41.137'] Mon Dec 21 00:35:44 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.91', nas '10.0.41.137'] Mon Dec 21 01:44:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.16.35', nas '10.0.41.138'] Mon Dec 21 03:28:49 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.63', nas '10.0.41.138'] Mon Dec 21 03:55:37 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.182', nas '10.0.41.137'] Mon Dec 21 04:27:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.33.43', nas '10.0.41.137'] Mon Dec 21 05:45:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.32.232', nas '10.0.41.138'] Mon Dec 21 05:55:46 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.204', nas '10.0.41.138'] Mon Dec 21 06:51:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.247', nas '10.0.41.137'] Mon Dec 21 06:56:50 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.21', nas '10.0.41.138'] Mon Dec 21 08:27:47 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.85', nas '10.0.41.138'] Mon Dec 21 08:36:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.138.176', nas '10.0.41.137'] Mon Dec 21 08:42:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.68.198', nas '10.0.41.137'] Mon Dec 21 08:46:53 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.233', nas '10.0.41.137'] Mon Dec 21 09:07:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.49', nas '10.0.41.137'] Mon Dec 21 09:14:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.224', nas '10.0.41.137'] Mon Dec 21 09:36:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.65.233', nas '10.0.41.138'] Mon Dec 21 09:41:02 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.177', nas '10.0.41.138'] Mon Dec 21 10:04:22 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.71', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.107', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.82.155', nas '10.0.41.137'] Mon Dec 21 10:04:24 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.14.240', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.31.29', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.30', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.245', nas '10.0.41.138'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.49', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.84', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.51.7', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.155', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.232', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.37.42', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.183', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.28.249', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.247', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.162', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.116', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.154', nas '10.0.41.138'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.93', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.116', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.54', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.27.8', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.105.31', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.0.44', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.21', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.67.0', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.81.41', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.205', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.112.205', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.53.225', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.170', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.13.15', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.157', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.134', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.19', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.54.41', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.109.253', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.91.90', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.87.73', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.29.105', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn3-sg port 51682 - ID: 192 due to unfinished request 20099379. Giving up on old request. Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.95.191', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.40.108', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.148', nas '10.0.41.137'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn8-tt port 57385 - ID: 143 due to unfinished request 20099602. Giving up on old request. Mon Dec 21 10:04:33 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #71 Mon Dec 21 10:42:23 2009 : Info: Loaded virtual server inner-tunnel Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #5 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #10 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #11 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #12 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #14 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #15 Regards, Dinh

5 14

only accept PEAP-MSCHAPv2 with "EAP-TLS-Require-Client-Cert = Yes"
by Vieri 07 Jan '10

07 Jan '10

Hi, I setup freeradius to accept authentications using PEAP-MSCHAPv2 with client certificates via "EAP-TLS-Require-Client-Cert = Yes". However, clients who authenticate via EAP-TLS also succeed. How can I reject all auth types except PEAP-MSCHAPv2 with "EAP-TLS-Require-Client-Cert = Yes"? (ie. I require both client certificates and username/password.) Thanks, Vieri

2 1

Managing the RADIUS database
by Steve Bertrand 06 Jan '10

06 Jan '10

Hi all, I'm curious to know what you use to manage your RADIUS database, particularly the accounting tables. For quite some time, I was using severely hacked versions of the dialup_admin scripts. Since then, I've written (ie. been writing) an ISP mgmt/accounting system that relies very heavily on the RADIUS accounting information for billing and statistics, but only after the data has been aggregated. During this project, I've also written a basic object-oriented RADIUS module that now houses the aggregation functionality, including being able to go back in time to re-aggregate and re-archive. Because I need to make some functional changes to it, I thought I'd ask here if others would be interested in such a Perl module (and its scripts), and if so, I'll extend it with further functionality after updating the code with the stuff I just didn't know then ;) Currently, it uses plain DBI and only supports MySQL, but I'm going to incorporate much from my other work whereby DBIx::Class is used (to more easily support multiple dbs), expand on the config file, the installer and the documentation. Is using RADIUS accounting stats for billing/logging even done anymore? Steve

4 10

Multiple Realms per NAS
by Nalin Mistry 06 Jan '10

06 Jan '10

We have just installed FreeRADIUS and have basic functionality working for ISP and Hotspot applications. For the ISP application, we would like to specify the realms supported on a NAS basis. Is this feasible and how would one go about configuring it. Thanks in advance...

2 1