March 2010 - Freeradius-Users - lists.freeradius.org

Re: NAS type when NAS is stored in SQL?
by John Doppke 19 Mar '10

19 Mar '10

>>> On 3/19/2010 at 1:40 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Do an SQL query. > > %{sql: SELECT ...} > > Alan DeKok. > I was afraid of that. I looked through the code and it appears as if rlm_sql should populate nastype along with shortname, secret, etc. Anyone know why it's not? -John

2 1

EAP (PEAP)+ntlm_auth doesn't send password by it self
by Cesar Ortega 19 Mar '10

19 Mar '10

Good morning fellas, After several unsuccessful attempts I could install Freeradius with OpenSSL support for do ntlm_auth for the users with Active Directory integration. The problem is, when the windows xp machine try to connect to the wireless network, Freeradius (or windows xp machine, reallly dont know) doesn't fill the password field like user-name does. So, Any one knows why it is happening? Because for this reason I get the error in the auithentication (Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) ) Listening on authentication address * port 1645 Listening on accounting address * port 1646 Listening on proxy address * port 1647 Ready to process requests. rad_recv: Access-Request packet from host "AP's IP" port 1645, id=76, length=181 User-Name = "MYDOMAIN\\ortegaca" Framed-MTU = 1400 Called-Station-Id = "0015.62c8.75d0" Calling-Station-Id = "001f.3c2d.78d6" Cisco-AVPair = "ssid=radiusd" Service-Type = Login-User Message-Authenticator = 0x3408edc72d37acf533d28f0b24f43f81 EAP-Message = 0x02020017015044565341323030305c6f72746567616361 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "3259" NAS-Port = 3259 NAS-IP-Address = "AP's IP" NAS-Identifier = "ap" +- entering group authorize {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=ortegaca [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> PDVSA2000\ortegaca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 76 to "AP's IP" port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 76 with timestamp +17 Ready to process requests. Thanks in advance, Cesar _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1

simultaneous-use via exec ?
by power159 19 Mar '10

19 Mar '10

hi all I am trying to load simultaneous-use parameter via exec . I have tried it in any section ( authorize / accounting / post-auth and .. ) at beginning and end of the section , but I dont know why freeradius is not reading it .. its just working when I am using it in sql .

2 1

NAS type when NAS is stored in SQL?
by John Doppke 19 Mar '10

19 Mar '10

I'm using the nas table in mysql to store my clients. I've found that if I try to test for client:nastype, a value is returned only for entries from clients.conf. Is there a way to get the nas type for clients in SQL? John Doppke

2 1

Information not getting into MySQL - UPDATE to radacct
by Steve. Parfitt (Siphon) 19 Mar '10

19 Mar '10

Hi All, I'm using FreeRadius with an ACME NetNet SD. I can see the accounting requests arrive at free radius and it seems to be writing to the MySQL with an UPDATE method yet I never see any information get into the DB. An Example from radius -X rad_recv: Accounting-Request packet from host 10.57.19.30:1103, id=0, length=105 Acct-Status-Type = Accounting-On NAS-IP-Address = 192.168.1.10 NAS-Port = 0 Acct-Session-Id = "SiphonLab#788" Acme-Firmware-Version = "SC6.1.0 MR-1 Patch 4 (Build 348)" Acme-CDR-Sequence-Number = 3938 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 3 modcall[preacct]: module "preprocess" returns noop for request 3 rlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 10.57.19.30,NAS-IP-Address = 192.168.1.10,Acct-Session-Id = "SiphonLab#788",' rlm_acct_unique: Acct-Unique-Session-ID = "4ba5092db9c79961". modcall[preacct]: module "acct_unique" returns ok for request 3 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 3 modcall[preacct]: module "files" returns noop for request 3 modcall: leaving group preacct (returns ok) for request 3 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 3 radius_xlat: '/var/log/radius/radacct/10.57.19.30/detail' rlm_detail: %A/%{Client-IP-Address}/detail expands to /var/log/radius/radacct/10.57.19.30/detail modcall[accounting]: module "detail" returns ok for request 3 modcall[accounting]: module "unix" returns noop for request 3 radius_xlat: '/var/log/radius/radutmp' rlm_radutmp: NAS 192.168.1.10 restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 3 rlm_sql (sql): received Acct On/Off packet radius_xlat: 'UPDATE radacct SET AcctStopTime='2010-03-19 14:10:15', AcctSessionTime=unix_timestamp('2010-03-19 14:10:15') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 14:10:15'' radius_xlat: '/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: UPDATE radacct SET AcctStopTime='2010-03-19 14:10:15', AcctSessionTime=unix_timestamp('2010-03-19 14:10:15') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 14:10:15' rlm_sql (sql): Released sql socket id: 0 modcall[accounting]: module "sql" returns ok for request 3 modcall: leaving group accounting (returns ok) for request 3 Sending Accounting-Response of id 0 to 10.57.19.30 port 1103 However no data is getting to the DB mysql> select * from radacct; Empty set (0.00 sec) If I try the update in MySQL it does not populate mysql> UPDATE radacct SET AcctStopTime='2010-03-19 11:55:14', AcctSessionTime=unix_timestamp('2010-03-19 11:55:14') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 11:55:14'; Query OK, 0 rows affected (0.00 sec) Rows matched: 0 Changed: 0 Warnings: 0 Anyone seen this problem? Any help much appreciated Regards Steve P

2 1

MAC based Vlan problem
by Dr.Peer-Joachim Koch 19 Mar '10

19 Mar '10

Hi, we're using freeradius to switch different computer into various vlans on our switches. We have had a working configuration for freeradius 1.x, but for 2.1.6 (running on SLES) this configuration is working different. We're including a file looking like this: ------------------- # VLAN 14 # # DEFAULT Tunnel-Private-Group-ID = 14, Foundry-802_1x-enable = 0, Fall-Through = 1 # aaabbbcccddd User-Password == "aaabbbcccddd" # VLAN 15 # # DEFAULT Tunnel-Private-Group-ID = 15, Foundry-802_1x-enable = 0, Fall-Through = 1 # bbbcccdddaaa User-Password == "bbbcccdddaaa" --------------------------- On the new freeradius *all* valid mac addresses are getting the vlan Tunnel-Private-Group-ID from the first statement. All other vlan id's are ignored. The advantage was, to group all mac according to the vlan-id. Now you have to add all settings to each mac .... Is there a way to group the mac addresses with one header ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 1

Freeradius and COA
by Johan Meiring 19 Mar '10

19 Mar '10

Hi, I am trying to figure out to use the Coa functionality in Freeradius. I have two seperate questions. 1) For originating a COA packet, is it possible to trigger it from rlm_perl. i.e. cause an "update coa". 2) For receiving a COA packet. How can I "process" it. I see that when perl instantiates, it claims it will use two funtions, send_coa and recv_coa. In what section must I put perl for it to call the functions? I've created a listen section for Coa. Freradius receives it, but "does nothing" and simply sends back an ack. Hope this makes sense... -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

2 3

TLS/SSL Error?
by Mike Diggins 19 Mar '10

19 Mar '10

I just recently enabled a WPA SSID on our wireless network. PEAP with MSCHAP V2 is the EAP method. As far as I know it's working correctly (from all my test clients anyway), but I have seen a number of these messages logged (FreeRadius 2.1.3) and I don't know where they're coming from. My Free radius server has a Thawte Certificate installed. I'm not sure what the message means? Mar 18 15:01:01 rad01 radiusd[8452]: TLS Alert read:fatal:unknown CA Mar 18 15:01:01 rad01 radiusd[8452]: TLS_accept:failed in SSLv3 read client certificate A Mar 18 15:01:01 rad01 radiusd[8452]: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca -Mike

3 2

Enable Volume Based Accounting
by Teguh Kurniawan 19 Mar '10

19 Mar '10

Hi, how to enable traffic volume based accounting on freeradius ? Thank's Teguh

1 0

Clients Configuration on MySQL
by Teguh Kurniawan 19 Mar '10

19 Mar '10

Hi, Could we move clients.conf to mysql table ? How to do that ? Thank's Teguh

2 2