September 2010 - Freeradius-Users - lists.freeradius.org

Hello "one radius server and multiple database and multiple dialupadmin"
by sekchel lee 23 Sep '10

23 Sep '10

Hello all one radius ==> freeradius-1.1.7 one mysql server create db ==> db1, db2 , db3, db4 ..... I want multiple dialupadmin dialupadmin1 use ==> db1 dialupadmin2 use ==> db2 dialupadmin3 use ==> db3 dialupadmin4 use ==> db4 .. .. Would it be possible? Please Help me

1 0

Session Resumption fails
by Panagiotis Georgopoulos 23 Sep '10

23 Sep '10

Hello all, I have a client machine that authenticates to FreeRadius using EAP-TTLS over Access_Point_1 just fine. When I roam the client to Access_Point_2 and tries to authenticate again to FreeRadius, session resumption seems to be failing with the following error. Wed Sep 22 22:35:16 2010 : Debug: SSL Connection Established Wed Sep 22 22:35:16 2010 : Debug: SSL Application Data Wed Sep 22 22:35:16 2010 : Info: [ttls] eaptls_process returned 3 Wed Sep 22 22:35:16 2010 : Info: [ttls] Skipping Phase2 due to session resumption Wed Sep 22 22:35:16 2010 : Info: [ttls] WARNING: No information in cached session! Wed Sep 22 22:35:16 2010 : Info: [eap] Freeing handler Wed Sep 22 22:35:16 2010 : Info: ++[eap] returns reject Wed Sep 22 22:35:16 2010 : Info: Failed to authenticate the user. Wed Sep 22 22:35:16 2010 : Info: Using Post-Auth-Type Reject Wed Sep 22 22:35:16 2010 : Info: +- entering group REJECT {...} Wed Sep 22 22:35:16 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> anonymous One thing to note on the above is that there is no cached information, which seems strange as the client was authenticated some minutes over Access_Point_1. The other thing is that user authentication fails completely and the client resides to restart EAP-TTLS from the start that finishes successfully. Do you have any ideas/pointes on how to fix this make session resumption to work propery? Thanks a lot in advance, Panos

2 3

authentication failing
by Marlon Duksa 22 Sep '10

22 Sep '10

Hi - we recently upgraded to version 2.1.8 (freeradius) and my authentication does not work any more. This used to work (configured in Radius): basic-a User-Password == "csetestp" User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Framed-Pool := "21", Class := 2, Session-Timeout := 600, Fall-Through = No This is not pap/chap authentication - our NAS is sending auth-req for a DHCP user. I also tried to change to cleartext-password. Also I tried this: basic-a Auth-Type := Local, User-Password == "csetestp" but no luck This is what I'm getting on Radius: rad_recv: Access-Request packet from host 114.0.1.11 port 50633, id=62, length=78 User-Name = "basic-a" User-Password = "csetestp" NAS-IP-Address = 2.2.2.2 NAS-Port-Type = Ethernet NAS-Port-Id = "1/1/5:4" NAS-Identifier = "right-b4" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "basic-a", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{User-Name} -> basic-a [files] expand: %{User-Name} -> basic-a [files] expand: %{User-Name} -> basic-a [files] expand: %{User-Name} -> basic-a WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry basic-a at line 106 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> basic-a attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 62 to 114.0.1.11 port 50633 Waking up in 4.9 seconds. Cleaning up request 1 ID 62 with timestamp +37 Ready to process requests.

1 2

EAP-SIM Broker?
by Andreas Anderson 22 Sep '10

22 Sep '10

Hi Guys, does someone know a way to do real EAP-SIM authentication with (through!) freeradius? Most if not all GSM-Carriers have radius-servers for their own WiFi-Hotspots, but obviously they wont give anyone access to them but only Hotspot-Roaming-Providers like iPass or WeRoam. Is there some sort of broker-service that would allow this? I would imagine a concept where i pre-filter the authentication requests and only pass the imsi's i want to be able to access our wireless network to the broker for real authentication... This is for my employer, so no problem if there's a fee for this service involved... Regards, Andreas

1 0

2.1.10 upgrade question
by Sallee, Stephen (Jake) 22 Sep '10

22 Sep '10

With the (hopefully) impending release of 2.1.10 I thought to ask: My current FreeRADIUS server I have is compiled from source, when 2.1.10 comes out can I simply recompile and go or do I need to rip out the old version first? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 2

No password configured for the user. Cannot do authentication.
by Jan Strauch 22 Sep '10

22 Sep '10

1 0

how FreeRADIUS creates log files
by Alan Buxey 22 Sep '10

22 Sep '10

hi, when using eg linelog module, FreeRADIUS makes a file - anyone interested in ability for the daemon to make a different TYPE of file - ie a named pipe rather than a plain file? alan

2 2

Insert or Update Username and NAS-Port-Id
by heldt 22 Sep '10

22 Sep '10

Hi! I have a freeradius(2.0.4+dfsg-6) using postgresql and running on Debian Lenny. Everything works great. Now I'm in the position to where I need to insert or update the User-name, NAS-Port-id, NAS-Port-type and NAS-Identiifier to a table in the database each time freeradius receives a request. This would help me keep track on mac/ip -> nas-port-id. Could someone tell me how I can solve this or point me to some documents. When I run radsniff I get the following data: (replaced real IP with 'x') Packet number 22 has just been sniffed From: x.x.x.x:49960 To: x.x.x.x:1812 Type: Access-Request User-Name = "00:73:07:37:5a:e2" User-Password = "" NAS-IP-Address = 172.16.87.2 NAS-Port-Type = Ethernet NAS-Port-Id = "1/1/6:124" NAS-Identifier = "on-kkna-ess-01" Packet number 23 has just been sniffed From: x.x.x.x:49960 To: x.x.x.x:1812 Type: Access-Request User-Name = "192.168.0.12" User-Password = "" NAS-IP-Address = x.x.x.x NAS-Port-Type = Ethernet NAS-Port-Id = "1/1/16:101" NAS-Identifier = "on-kkna-ess-01" Alc-Client-Hardware-Addr = "00:73:06:06:15:59" // Daniel Heldt -- View this message in context: http://freeradius.1045715.n5.nabble.com/Insert-or-Update-Username-and-NAS-P… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

users match list criteria and vendor identification
by Cameron Wood 22 Sep '10

22 Sep '10

Hi I am trying to find a list of the criteria you can use in the users file on the match line, I came across a lengthy list/table earlier but can't seem to find it again. I have looked at the attributes RFC, but I'm looking more for something that will list things like Group-Name, Auth-Type, and more importantly the other possible criteria I can include there. One of the things I am curious to see is if there is a Vendor-ID attribute, does anyone know if there is? Any help is greatly appreciated. Cheers Cam. -- "We are all in the gutter, but some of us are looking at the stars." - Oscar Wilde

2 3

Originate COA home_server
by Johan Meiring 22 Sep '10

22 Sep '10

Hi, I've configured originate COA using the originate-coa as an example. My (relevant/edited for privacy) configuration looks like this: ------------------------------------ client 11.22.33.44 { secret = verysecret shortname = test nastype = other virtual_server = my_virtual_server coa_server = my-coa } home_server my-coa { type = coa ipaddr = 11.22.33.44 port = 3799 secret = blah coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool blah { type = fail-over home_server = my-coa } ------------------------------------- This works perfectly. The home_server_pool seems unnecesary though, but if I leave it out, freeradius -X complains that the home_server does not exist. --------------------------------------------------------------------- /etc/freeradius/sites-enabled/my-config[1]: No such home_server or home_server_pool "my-coa" --------------------------------------------------------------------- It almost seems that the home_server_pool is neccesary to "instantiate" the home_server. Reading proxy.conf and the originate-coa example, it seems that a home_server_pool is only neccesary if you want to actually fail-over/round-robin, etc.... I'm sure I can leave the config as is, as the home_server_pool is never actually referenced. Am I completely confused? -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

2 1