March 2010 - Freeradius-Users - lists.freeradius.org

[FreeRADIUS-Statistics-Type to list home agent server and general question about status server]
by Thomas Fagart 06 Mar '10

06 Mar '10

Hello, Here's two questions about radius statistics (status server) 1. By looking at the freeradius-snmp.pl from sky networks, I notice something : - It uses FreeRADIUS-Statistics-Type = 63, and I haven't found documentation about it in status virtual server. By the way, it allows to list radius client ip without knowing them by incrementing the Client Number, which is great. echo "Message-Authenticator = 0xd9380c451e4bf78659144474b673b931, FreeRADIUS-Statistics-Type = 63, FreeRADIUS-Stats-Client-Number = 4" | radclient 127.0.0.1:18120 status adminsecret Then is there a FreeRADIUS-Statistics-Type number to do the same for home server IP (not the 131 one) ? # All packets for a home server IP / port # FreeRADIUS-Statistics-Type = 131 # FreeRADIUS-Stats-Server-IP-Address = 192.168.1.2 # FreeRADIUS-Stats-Server-Port = 1812 2. Another question about specific query for specific client IP www1# echo "Message-Authenticator = 0xd9380c451e4bf78659144474b673b931, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-IP-Address = X, FreeRADIUS-Stats-Server-IP-Address = Y, FreeRADIUS-Stats-Server-Port = 1812" | radclient 127.0.0.1:18120 status adminsecret Received response ID 169, code 2, length = 464 FreeRADIUS-Total-Access-Requests = 398 FreeRADIUS-Total-Access-Accepts = 6322 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 6322 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 12 FreeRADIUS-Total-Accounting-Responses = 24 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Client-IP-Address = X FreeRADIUS-Stats-Server-IP-Address = Y FreeRADIUS-Stats-Server-Port = 1812 FreeRADIUS-Total-Access-Requests = 4 FreeRADIUS-Total-Access-Accepts = 4 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 4 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 7 FreeRADIUS-Total-Accounting-Responses = 7 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 Why does it gives first "global" statistics, and then the statistics we want (eg stat for client) ? Couldn't we have just the one we've done the query for ? Thanx Thomas

2 1

notifying another server on accounting
by Michael Fowler 05 Mar '10

05 Mar '10

Greetings, We have a bit of an odd setup (apparently). We have a vendor that is providing services based on whether a user has an active and authorized session. In order to support this we forward on accounting data with a detail file writer and reader, using the copy-acct-to-home-server as a template. This is using FreeRadius 2.1.8. I have always felt lame ascii drawings help, so this is the setup (in essence): request: NAS -> accounting-server | copy | -> vendor response: NAS <- accounting-server <- vendor Unfortunately, we seem to be hitting a wall in terms of packets transmitted to the vendor. It is my understanding that the detail reader is serial in nature, meaning it only sends one packet to the vendor (in this case), and will not send another until it gets a response. The vendor is over a slow link, or the packets are otherwise delayed, so we are getting a backlog of detail entries. The detail file is filling faster than it can be flushed to the vendor. My question is, how can we fix this? A few ideas have been batted around. One is to write some code (via rlm_perl or rlm_python) that essentially does what the entire writer/reader combination is doing, only in parallel. Meaning, it handles transmitting and retransmitting to the vendor. In the short term this might be viable, but it's reinventing wheels, and it's hard to justify long-term given most of the people dealing with this are not programmers. Another was to somehow load-balance the readers. I cannot find a configuration example to support this, but would it be possible, and more importantly useful, to have multiple readers pointing to the same detail file? Any help or suggestions would be appreciated. Thanks. -- Michael Fowler www.shoebox.net

2 1

Re: Lost and confused
by jin jin 05 Mar '10

05 Mar '10

Message: 1 Date: Fri, 5 Mar 2010 10:27:50 +0700 From: "Fajar A. Nugraha" <fajar(a)fajar.net> Subject: Re: Lost and confused To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <7207d96f1003041927s3ac683d8g1b32a892bb553009(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Please do NOT include entire mail digest content in your mail. It's unnecessary, waste network bandwidth, and prevents other from seeing the point. On Fri, Mar 5, 2010 at 7:44 AM, jin jin <jyajin(a)yahoo.com.sg> wrote: > radiusd: #### Opening IP addresses and Ports #### > listen { > ??? type = "auth" > ??? ipaddr = * > ??? port = 0 > Failed binding to socket: Address already in use > /etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 Try "netstat -anp | grep 1812". It should print what program is using that port. -- Fajar I did what you say and here is the result: lauwk@lauwk-desktop:~$ sudo netstat -anp | grep 1812 [sudo] password for lauwk: udp 0 0 0.0.0.0:1812 0.0.0.0:* 1505/freeradius >From the above I take it that freeRADIUS is using the correct port right? I followed the documents and didn't touch the configuration file at all because I'm a total beginner. What can I do from this part onwards? Thanks for the reply. Sincerely, Jin New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/sg/

4 3

assignement
by omega bk 05 Mar '10

05 Mar '10

hello, to sum up my case. 1) radius authenticate user in users file 2) my client is windows xp wired 3) successfull vlan is set to 100 Tunnel-Type = VLAN, Tunnel-Medium-type = IEEE-802, Tunnel-Private-Group-ID = 100 so, if auth successed the switch assign to vlan100 , it works. (fa0/24) but if auth fails, i'd like to send him to vlan 120 so in my fa0/24 i did: interface FastEthernet0/24 switchport access vlan 100 switchport mode access dot1x pae authenticator dot1x port-control auto dot1x auth-fail vlan 120 => here supposed to send it to vlan 120 spanning-tree portfast BUT, in case of auth failed, it doesn't work Anybody can help me?

2 2

A question about the NAS-Port on FreeRadiusServer 2.1.4 + Postgresql 8.4.2
by 蔡暮章 05 Mar '10

05 Mar '10

Hello, we are working on the FreeRadiusServer 2.1.4 + Postgresql 8.4.2, and trying to authenticate different 'users' according to the NAS-Port in the request packets. We build the db table 'nas' by the scripts nas.sql: /* * Table structure for table 'nas' */ CREATE TABLE nas ( id SERIAL PRIMARY KEY, nasname VARCHAR(128) NOT NULL, shortname VARCHAR(32) NOT NULL, type VARCHAR(30) NOT NULL DEFAULT 'other', ports int4, secret VARCHAR(60) NOT NULL, server VARCHAR(64), community VARCHAR(50), description VARCHAR(200) ); Since the 'ports' column exists in the table 'nas', we wonder if it has some relationship with the NAS-Port in the request packets. We tried some values for the column, but didn't work. Anyone can tell me the meaning of the column 'ports'? Now we can configure a virtual server for each NAS (by the column 'server' of the table 'nas'). Can I configure a virtual server for each NAS-Port? If so, how can I acheive that? Thank you! Best Regards, Alaxis _________________________________________________________________ MSN十年回馈，每位用户可免费获得价值25元的卡巴斯基反病毒软件2010激活码，快来领取！ http://kaba.msn.com.cn/?k=1

3 3

FAILURE at the end of eapol test result
by R C 04 Mar '10

04 Mar '10

Resending in a plain text format... Hi, What does the FAILURE at the end of the eapol test result mean? But, the eap authentication is successful as shown below. Why is there a failure at the end of the result when the eap authentication is successful? Thanks for your help. .... ........ RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 11 57 03 9f b7 b4 cb ef 7a 51 fc c3 34 c4 b5 57 6a a7 08 59 a9 5f 97 cc d9 73 8c 6e e7 d5 f1 f9 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 decapsulated EAP packet (code=3 id=4 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAPOL test timed out EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 220 mismatch: 0 FAILURE thanks, rc.

1 0

FAILURE at the end of eapol test
by R C 04 Mar '10

04 Mar '10

Hi, What does teh FAILURE at the end of the eapol test result mean? But, the eap authentication is successful as shown in green color below. ________________________________ .... ........ RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 11 57 03 9f b7 b4 cb ef 7a 51 fc c3 34 c4 b5 57 6a a7 08 59 a9 5f 97 cc d9 73 8c 6e e7 d5 f1 f9 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 decapsulated EAP packet (code=3 id=4 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAPOL test timed out EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 1b a9 25 20 bf b1 76 b8 d5 88 3f f2 95 85 4e 59 5a a0 fe 55 ec 38 e5 8f e0 ac 31 3f 57 cf 77 c2 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 220 mismatch: 0 FAILURE ________________________________ thanks, rc.

2 1

Re: Lost and confused
by jin jin 04 Mar '10

04 Mar '10

--- On Thu, 4/3/10, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> wrote: From: freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 59, Issue 15 To: freeradius-users(a)lists.freeradius.org Date: Thursday, 4 March, 2010, 7:00 PM Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Lost and confused (jin jin) 2. Re: Can a wpa_supplicant talk to a Free Radius server without a NAS in between? (Alan DeKok) 3. Re: freeradius 1.1.8 hangs in rlm_perl on 64bit (Alan DeKok) 4. Re: vlan and freeradius (Alan DeKok) 5. Re: Lost and confused (Alan DeKok) 6. Re: special query for authentication (Bob Brandt) 7. Threads & Perl (Alexandr Kovalenko) ---------------------------------------------------------------------- Message: 1 Date: Thu, 4 Mar 2010 14:39:46 +0800 (SGT) From: jin jin <jyajin(a)yahoo.com.sg> Subject: Lost and confused To: freeradius-users(a)lists.freeradius.org Message-ID: <535148.16355.qm(a)web76001.mail.sg1.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" This is the first time that I'm trying to set up a freeRADIUS server (Ver 2.1.0) using Ubuntu 9.10 and I'm running into walls. I used the debug mode and this is the output Failed binding to socket: Address already in use /etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 I googled but the closest match was a bug which was fixed earlier on. I'm not really sure what the above meant either. Do I have to connect my freeRADIUS server to my ADSL router first before I run freeRADIUS in debug mode? I am sorry if I have asked a few dumb questions, thanks in advance to the people replying to me. Best regards, ??????????????????? Jin New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/sg/

2 1

License for radperf
by R C 04 Mar '10

04 Mar '10

Hi, In the README for radperf tool, the following gives information about Licensing. I downloaded the tool but am not sure if i can run it without the license as per the highlighted red sections below. Please advise. I just want to run this tool on my machine to load test my radius server. ________________________________ This archive contains the "radperf" tool. It is similar in some ways to the FreeRADIUS "radclient" program, but it is much more capable. See the "radclient.1" file, or "radclient.html" for the documentation. The "lib" directory includes a copy of the FreeRADIUS library, libfreeradius-radius.a, along with a copy of its license, the LGPL. The "share" directory contains a copy of the FreeRADIUS dictionaries, along with a copy of their licenses, the GPL. Please note that the "radperf" program is NOT licensed under the GPL, and it is NOT licensed under the LGPL. Redistribution of any files in this archive is NOT permitted without the prior written permission of Network RADIUS. You may have to set the LD_LIBRARY_PATH appropriately before using radperf. e.g.: $ export LD_LIBRARY_PATH=./lib $ ./radperf ... Please contact Network RADIUS at <sales(a)networkradius.com> toobtain individual licensing for this product. ________________________________ thanks, rc.

2 2

FreeRadius upgrade from 1.3 to 2.0.4
by Trevor Jennings 04 Mar '10

04 Mar '10

Hello, I recently upgraded one of our freeradius servers from 1.3.3 to 2.0.4. We use this for mac authentication for wireless which is working fine and also ldap authentication for our vpn users. The problem I am having with the ldap authentication is that when a user tries to authenticate with their user@domain, it does not work! However, it works fine if the user does not add the domain name. Is there a glitch with v2.0.4 or a configuration issue that I am missing? I am using this in the ldap config:- filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" but the Stripped-User-Name appears to be blank when using debug mode. Cheers, - Trevor

2 2