August 2010 - Freeradius-Users - lists.freeradius.org

Dealing with Incomplete Sessions
by Gabriel Marais 29 Aug '10

29 Aug '10

Hi Guys I was wondering how everyone was dealing with incomplete sessions ? I have some incomplete sessions that are quite old (sometimes days) where it seems like the Stop Accounting packet sever reached my server (or for reason unknown to me). Is it wise to just run a script every x days to append a manual date/time to those sessions ? Thanks, Gabriel

2 1

aaa authentication login and dot1x with one server
by Sascha Frey 29 Aug '10

29 Aug '10

Hi all, I'm trying to set up freeradius to authenticate users logging in to our switches (Cisco IOS) and provide authentication for 802.1X. 1. SSH/Telnet access to our switches for admin users (aaa authentication login) - Every user who is able to login to the server running freeradius should be able to login to the switches (Linux server with libpam-ldapd (nslcd) and pam_access.so to limit access by netgroup) - Using PAM seems to be the right way (direct access to the LDAP database would allow all users and not only certain users with membership in the admin netgroup (pam_access with /etc/security/access.conf) 2. IEEE 802.1X with EAP-TTLS and dynamic VLAN assignment (aaa authentication dot1x) - Using the freeradius LDAP module (direct access to the LDAP database) - 802.1X users are in a separate subtree (ou=dot1x,dc=example,dc=com) How do I setup freeraius to use PAM for authenticating users? How do I combine both functions with different auth methods in one server? I found some howtos for #2, which doesn't seem to be the problem. I appreciate any help. Regards Sascha

1 0

Adding Multiple Cisco-AVPairs using rlm_perl
by James Nedila 29 Aug '10

29 Aug '10

I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response. Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this? Thanks, James

5 8

Simultaneous-Use
by Student University 28 Aug '10

28 Aug '10

Dears , i configured *Simultaneous*-*Use:=1 , i followed the document step by step but i noticed that radutmp not updated and when check this file using radwho i see an entries for previously logged users even i disconnect all users ,,, Best Regard , *

1 0

EAP-MSCHAPv2 and smbpasswd
by Jonathan Black 27 Aug '10

27 Aug '10

I've dug around in documentation looking to find out if EAP-MSCHAPv2 can use the smbpasswd file to authenticate wireless clients. Is it possible to have the smbpasswd file authenticate EAP-MSCHAPv2 requests? Thanks! Jonathan

2 1

usergroup problems with separate auth and accounting databases
by Trey Scarborough 27 Aug '10

27 Aug '10

I have to mysql configurations for one for my authentication request and one for the accounting data. When it make a groupcheck query it is always using the module for the accounting server is there anyway to make this function correctly and have it use the configuration for the authentication database. Any Ideas of why this is happening Here some output while doing a request sql1 is the authentication DB and sql2 is the accounting rad_recv: Access-Request packet from host 127.0.0.1 port 2701, id=94, length=61 User-Name = "user(a)domain.net" CHAP-Password = 0x00000000000000000000000 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "domain.net" for User-Name = "user(a)domain.net" [suffix] No such realm "vortexmail.com" ++[suffix] returns noop [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql1): Reserving sql socket id: 4 [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] User found in radcheck table [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT.................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT .................................. [sql1] sql_groupcmp [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 4 rlm_sql (sql2): Released sql socket id: 4 [sql1] sql_groupcmp finished: User is NOT a member of group active Invalid operator for item Sql-Group: reverting to '==' rlm_sql (sql1): Released sql socket id: 4 ++[sql1] returns ok [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 3 rlm_sql (sql2): Released sql socket id: 3 [files] sql_groupcmp finished: User is NOT a member of group active [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 2 rlm_sql (sql2): Released sql socket id: 2

2 8

How to debug rlm_perl in multithread?
by Eugen Konkov 27 Aug '10

27 Aug '10

HI, FreeRadius. when run radiusd -X it works fine. But when run in multithread (without -X) it core dump after ten or twelve queriest to radiusd. please help any. -- Eugen Konkov mailto:kes-kes@yandex.ru

4 3

user password question
by David Peterson 27 Aug '10

27 Aug '10

Is there a limit to the length of the user password? I have a client trying to connect via EAP-TTLS with the password quikynikinyoky (yeah strange default password eh) but I get a "Wrong MSCHAPv2 response". If I change it to a short one, unl0ck, it works. The username is macaddress(a)WiMax.com by default where the words macaddress are the WAN address of the client. David Peterson Engineer Wireless Connections

2 1

connect java aaplication to radius server using freeradius
by Noura Kossentini 27 Aug '10

27 Aug '10

Hi, In our company it's forbidden to use products with GPL License. So I ca not use Jradius client to connect my client application to a radius server. Since that FreeRadius is distributed under BSD, it's allowed to me to use this library. My queqtion is can you help me on how can I connect and authenticate my java application to a radius server using FreeRadius client?? Thanks in advance

1 0

connect java aaplication to radius server using freeradius
by Noura Kossentini 27 Aug '10

27 Aug '10

Hi, In our company it's forbidden to use products with GPL License. So I ca not use Jradius client to connect my client application to a radius server. Since that FreeRadius is distributed under BSD, it's allowed to me to use this library. My queqtion is can you help me on how can I connect and authenticate my java application to a radius server using FreeRadius client?? Thanks in advance Regards Noura

1 0