April 2010 - Freeradius-Users - lists.freeradius.org

Log the 802.1x session
by Rosario Lumia 09 Apr '10

09 Apr '10

Hi to all, my question is if it's possible to log the end of a 802.1x session. I need this log for legal reason. I need the start session log which i can get by a mysql query in post-auth session. For the end of 802.1x session? Any ideas? Can freeradius do this in someway? Thanks for answers. Regards -- Rosario L.

4 6

(no subject)
by Richie Lee 09 Apr '10

09 Apr '10

http://nahoniha.t35.com/ _________________________________________________________________ Live connected. Get Hotmail & Messenger on your phone. http://go.microsoft.com/?linkid=9724462

1 0

(no subject)
by Richie Lee 09 Apr '10

09 Apr '10

http://vepuxahu.angelfire.com/ _________________________________________________________________ Got a phone? Get Hotmail & Messenger for mobile! http://go.microsoft.com/?linkid=9724464

1 0

Windows Server 2008 R2 (was already working...)
by mr typo 08 Apr '10

08 Apr '10

hey all, we do have a freeradius server authenticating with ntml_auth against a win 2008r2 server. this was working for several months but for 2 weeks now the authentication does not work anymore. authenticating on the command line with ntlm_auth is still working: [root@wlan ~]# ntlm_auth --request-nt-key --username=xxx password: NT_STATUS_OK: Success (0x0) but when authenticating with the radius server i am getting this in the debug log. (we have no idea why this is happening.. the radius config was not changed for several months.. we got an automatically installed win2008r2 server update (i know bad idea). the domain is running the ad 2008 r2 schema.) ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for asartori(a)fh-salzburg.ac.at with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. thanks for any help. -euro

2 11

Re: Check traffic quota / rlm_sqlcounter
by Alexander 08 Apr '10

08 Apr '10

--- On Wed, 4/7/10, Alan DeKok <aland(a)deployingradius.com> wrote: > > See "man unlang" > Thanks for your hint, Alan. > In the "authorize" section, do: > > if ("%{sql: SELECT ...quota ...}" <= > "%{sql:SELECT ... usage ...}") { > reject > } > I am using the following in the authorize section: if ("%{sql: SELECT Value from radcheck WHERE UserName='%{User-Name}' AND Attribute='Max-Octets';}" <= "%{sql: SELECT (SUM(Ac ctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{User-Name}';}") { reject } Unfortunatly I get: rlm_sql: Failed to create the pair: Invalid octet string "200000000" for attribute name "Max-Octets" Any idea how to fix that? Cheers, Alexander

1 0

(no subject)
by Richie Lee 07 Apr '10

07 Apr '10

http://mitglied.multimania.de/daziwaw/ _________________________________________________________________ Videos that have everyone talking! Now also in HD! http://go.microsoft.com/?linkid=9724465

1 0

(no subject)
by Richie Lee 07 Apr '10

07 Apr '10

http://hohewimi.tripod.com/ _________________________________________________________________ Live connected. Get Hotmail & Messenger on your phone. http://go.microsoft.com/?linkid=9724462

1 0

How to differeniate types of users
by Rob Yamry 07 Apr '10

07 Apr '10

I have Radius v1.1.7 working great with eDirectory/LDAP, both running on SLES 10 SP3. Right now we use it to control access to our wireless in the district, but its sort an all-or-nothing approach right now. What we are trying to accomplish is to have two SSIDs - one for students and one for staff. As its setup now, anybody can connect to either one. How would I be able to differeniate the two users? I can use attributes and such, but how/where would that be defined? Thanks for your help! -Rob

2 2

Check traffic quota / rlm_sqlcounter
by Alexander 07 Apr '10

07 Apr '10

Dear all, please forgive me if this has been answered before but I have searched the list archive, FAQ and docs over and over again, without success so far. What I want to achieve is *traffic quota* enforcement per user at login time. E.g. user is permitted a quota of 100 MB and authentication shall be rejected if the traffic limit is exceeded. What I understood so far is hat I need a script to do a traffic quota check at authentication and configure sqlcounter.conf accordingly. Has anyone done this before with FR 2.1 plus rlm_sqlcounter and MySQL? Would someone share his *script* snippets and relevant config parts with me? Where do I have to include the script in FR to make it work? Help is really appreciated! BTW: I am using a Cisco 7206/NPE-G1 w/ 12.4 as LNS. Cheers, Alexander

2 1

EAP checking certificate CN for WiMAX
by Victor Tangendjaja 07 Apr '10

07 Apr '10

Hi, In WiMAX certificate CN apparently contains MAC address and model name of the device for example "FF1234567890 USB1234". WiMAX standard says and I quote "The MAC" (from the CN) "SHALL be compared with the MAC address in the Calling-Station-Id of the RADIUS Access Request message. If they do not match the authentication SHALL be rejected." I tried to use "check_cert_cn" inside eap.conf this way check_cert_cn = %{Calling-Station-Id} obviously doesn't work because the CN also contains Model name check_cert_cn =~ /^%{Calling-Station-Id} .*/i doesn't work as well because of syntax error is this the correct way or there's a better way? Thanks for your help. Victor

2 1