November 2011 - Freeradius-Users - lists.freeradius.org

Freeradius + MySQL + WiFi PEAP authorisation only to a group of users
by Lumir Lindovsky 21 Jan '12

21 Jan '12

Hello, I would like to help with this: I have Freeradius version 2.1.6 I have it running with SQL and DialupAdmin. How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users? I mean that authorised would be only users from group WIFI and not other users belonging to other group like OpenVPN. Now it authorises everybody from the radcheck table. I am very new to radius and even if I was searching the net for some time I cannot find the answer which would fir my needs. Thank you for help! Lumir

4 5

no calling-station-id received
by S Adrian 09 Jan '12

09 Jan '12

Hey everybody .... I don't seem to get a calling-station-id packet when a username is trying to connect. I'm running gentoo and have the following package versions: net-dialup/ppp-2.4.5-r1 USE="activefilter atm dhcp eap-tls pam radius -gtk -ipv6" 0 kB net-dialup/rp-pppoe-3.10-r1 USE="-X" 0 kB net-dialup/freeradius-2.1.7 USE="mysql pam ssl threads udpfromto -bindist -debug -edirectory (-firebird) -frascend -frxp -kerberos -ldap -postgres -snmp" 0 kB Another problem I seem to have is people using the same pool_key in my radippool table :/ Where should I start digging ? Thanks in advance.

4 8

Re: Freeradius with EAP-SIM
by Alan Buxey 05 Jan '12

05 Jan '12

Ready to process requests. ...and that's it. Where's the incoming query to be dealt with? alan -- Message may be brief as it has been sent from my mobile

3 3

802.1x authentication
by gary 11 Dec '11

11 Dec '11

Hi All I am trying to set up 802.1x with EAP PEAP/TTLS method by using intel PROSset client tool with the PC. Sometimes authentication success but mostly it fail. Log attached could someone give me some direction?thanks a lot. Best Regards Gary

5 8

Daily accounting
by David Roze 02 Dec '11

02 Dec '11

Hi everyone, I have seen a lot of people who are trying to get traffic accounting collected at regular intervals to generate graphs and view per day/month etc... I have made a few modifications in order to achieve this. You can see it at http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html It works on Mysql setup but can be adapted to any db. I'd be grateful to get some feedback on this. A lot of ISPs are running into this problem. Hope this helps Regards, David

2 1

annoying stop retransmissions.
by Alexandre Chapellon 01 Dec '11

01 Dec '11

Hello, I have a setup wich Is a follow: NASes ----------------FREERADIUS Auth+live acct ----------------FREERADIUS Acct only In this setup, users connect to NASes, which authenticate them against the front freeradius (Auth + live acct). The front freeradius, maintain a db of the connected users using acct tickets. Basicly it does: INSERT in table upon Start ticket reception DELETE from table upon Stop ticket reception. In turns the front freeradius proxies acct tickets to the back freeradius (Acct only), which keeps track of all sessions doing: INSERT in table upon Start ticket reception UPDATE table upon Stop ticket reception. This work as epected for most of my NASes. Unfortunately, i have some NASes that are behind a satelite link, which is a very unreliable link with regular packets loss. UDP retramission of packet make the systems work even with that kind of link, but I have one scenario that create errors: When a stop ticket is transmitted once and reaches correctly the freradius servers (nas -> front -> back), Session record is deleted from the "live acct" table, packet is then proxied to the 2nd freeradius and session in Acct table is marked as stoped (acctstoptime=something). If the front freeradius acks the Stop packet and that Ack is lost on the link, the NAS retransmit the STOP. Same thing occur,: - front radius tries to delete the sessions using its acct_stop_query, wich result in no line being modified and so tries to run its acct_stop_query_alt (which basicly does the same thind: delete). alt query also modify no lines but no error is logged. retransmitted packet is then proxied to the back server, wich in turns tries ti run its acct_stop_query (tries to update a session with no acctstoptime). That query fails as the previous Stop ticket for that session already updated the recod. It then tries to run the acct_stop_query_alt, which is designed to try to insert a new session record based on the content of the stop ticket (this is done to deal with the case where start ticket is lost and only stop ticket is received, i guess). In my case this last query fails because of some unicity constraint in the oracle database (to prevent one session from being recorded multiple times), and an error is logged in freeradius. I can't really afford to get rid of the unique constraint, and I think changing the acct_stop_query_alt for a non insert statement would not be a good idea either. Does anybody have an idea on how to deal with that (minor) problem so I have no more regular error messages. I was maybe thinking of not proxying to the back server, packets retransmitted du to ACK loss, but I can't really find out how to do that... Thanks for reading that long post (I hope it's understandable enough). -- <http://www.horoa.net> Alexandre Chapellon Ingénierie des systèmes open sources et réseaux. Follow me on twitter: @alxgomz <http://www.twitter.com/alxgomz>

4 9

Fwd: failure log from radius debug
by Jim Pazarena 01 Dec '11

01 Dec '11

please diagnose why radius feels that my server has declined the user/password? both these user attempts used their correct password, yet the log says it was invalid. Thanks! -------- Original Message -------- Subject: failure log from radius debug Date: Tue, 29 Nov 2011 10:50:29 -0800 From: Charlie Root To: jim(a)paz.bz Tue Nov 29 10:42:30 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 209.53.238.13 port 513, id=118, length=95 User-Name = "carlmerk" User-Password = "mushXX" NAS-Port = 15 NAS-Port-Type = Async NAS-Identifier = "ras" Called-Station-Id = "unknown" Calling-Station-Id = "unknown" Service-Type = Framed-User Framed-Protocol = PPP Tue Nov 29 10:44:13 2011 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:13 2011 : Info: +- entering group authorize {...} Tue Nov 29 10:44:13 2011 : Info: ++[preprocess] returns ok Tue Nov 29 10:44:13 2011 : Info: ++[chap] returns noop Tue Nov 29 10:44:13 2011 : Info: ++[mschap] returns noop Tue Nov 29 10:44:13 2011 : Info: ++[digest] returns noop Tue Nov 29 10:44:13 2011 : Info: [suffix] No '@' in User-Name = "carlmerk", looking up realm NULL Tue Nov 29 10:44:13 2011 : Info: [suffix] No such realm "NULL" Tue Nov 29 10:44:13 2011 : Info: ++[suffix] returns noop Tue Nov 29 10:44:13 2011 : Info: [eap] No EAP-Message, not doing EAP Tue Nov 29 10:44:13 2011 : Info: ++[eap] returns noop Tue Nov 29 10:44:13 2011 : Info: [files] users: Matched entry DEFAULT at line 50 Tue Nov 29 10:44:13 2011 : Info: ++[files] returns ok Tue Nov 29 10:44:13 2011 : Info: ++[expiration] returns noop Tue Nov 29 10:44:13 2011 : Info: ++[logintime] returns noop Tue Nov 29 10:44:13 2011 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Nov 29 10:44:13 2011 : Info: ++[pap] returns noop Tue Nov 29 10:44:13 2011 : Info: Found Auth-Type = System Tue Nov 29 10:44:13 2011 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:13 2011 : Info: +- entering group authenticate {...} Tue Nov 29 10:44:13 2011 : Auth: [unix] invalid password "carlmerk" Tue Nov 29 10:44:13 2011 : Info: ++[unix] returns reject Tue Nov 29 10:44:13 2011 : Info: Failed to authenticate the user. Tue Nov 29 10:44:13 2011 : Auth: Login incorrect: [carlmerk/mushXX] (from client localhost port 15 cli unknown) Tue Nov 29 10:44:13 2011 : Info: Using Post-Auth-Type Reject Tue Nov 29 10:44:13 2011 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:13 2011 : Info: +- entering group REJECT {...} Tue Nov 29 10:44:13 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> carlmerk Tue Nov 29 10:44:13 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Nov 29 10:44:13 2011 : Info: ++[attr_filter.access_reject] returns updated Tue Nov 29 10:44:13 2011 : Info: Delaying reject of request 0 for 1 seconds Tue Nov 29 10:44:13 2011 : Debug: Going to the next request Tue Nov 29 10:44:13 2011 : Debug: Waking up in 0.9 seconds. Tue Nov 29 10:44:14 2011 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 118 to 209.53.238.13 port 513 Tue Nov 29 10:44:14 2011 : Debug: Waking up in 4.9 seconds. Tue Nov 29 10:44:19 2011 : Info: Cleaning up request 0 ID 118 with timestamp +103 Tue Nov 29 10:44:19 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 209.53.238.13 port 513, id=119, length=95 User-Name = "carollyn" User-Password = "carolXX" NAS-Port = 2 NAS-Port-Type = Async NAS-Identifier = "ras" Called-Station-Id = "unknown" Calling-Station-Id = "unknown" Service-Type = Framed-User Framed-Protocol = PPP Tue Nov 29 10:44:20 2011 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:20 2011 : Info: +- entering group authorize {...} Tue Nov 29 10:44:20 2011 : Info: ++[preprocess] returns ok Tue Nov 29 10:44:20 2011 : Info: ++[chap] returns noop Tue Nov 29 10:44:20 2011 : Info: ++[mschap] returns noop Tue Nov 29 10:44:20 2011 : Info: ++[digest] returns noop Tue Nov 29 10:44:20 2011 : Info: [suffix] No '@' in User-Name = "carollyn", looking up realm NULL Tue Nov 29 10:44:20 2011 : Info: [suffix] No such realm "NULL" Tue Nov 29 10:44:20 2011 : Info: ++[suffix] returns noop Tue Nov 29 10:44:20 2011 : Info: [eap] No EAP-Message, not doing EAP Tue Nov 29 10:44:20 2011 : Info: ++[eap] returns noop Tue Nov 29 10:44:20 2011 : Info: [files] users: Matched entry DEFAULT at line 50 Tue Nov 29 10:44:20 2011 : Info: ++[files] returns ok Tue Nov 29 10:44:20 2011 : Info: ++[expiration] returns noop Tue Nov 29 10:44:20 2011 : Info: ++[logintime] returns noop Tue Nov 29 10:44:20 2011 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Nov 29 10:44:20 2011 : Info: ++[pap] returns noop Tue Nov 29 10:44:20 2011 : Info: Found Auth-Type = System Tue Nov 29 10:44:20 2011 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:20 2011 : Info: +- entering group authenticate {...} Tue Nov 29 10:44:20 2011 : Auth: [unix] invalid password "carollyn" Tue Nov 29 10:44:20 2011 : Info: ++[unix] returns reject Tue Nov 29 10:44:20 2011 : Info: Failed to authenticate the user. Tue Nov 29 10:44:20 2011 : Auth: Login incorrect: [carollyn/carolXX] (from client localhost port 2 cli unknown) Tue Nov 29 10:44:20 2011 : Info: Using Post-Auth-Type Reject Tue Nov 29 10:44:20 2011 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Nov 29 10:44:20 2011 : Info: +- entering group REJECT {...} Tue Nov 29 10:44:20 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> carollyn Tue Nov 29 10:44:20 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Nov 29 10:44:20 2011 : Info: ++[attr_filter.access_reject] returns updated Tue Nov 29 10:44:20 2011 : Info: Delaying reject of request 1 for 1 seconds Tue Nov 29 10:44:20 2011 : Debug: Going to the next request Tue Nov 29 10:44:20 2011 : Debug: Waking up in 0.9 seconds. Tue Nov 29 10:44:21 2011 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 119 to 209.53.238.13 port 513 Tue Nov 29 10:44:21 2011 : Debug: Waking up in 4.9 seconds. Tue Nov 29 10:44:26 2011 : Info: Cleaning up request 1 ID 119 with timestamp +110 Tue Nov 29 10:44:26 2011 : Info: Ready to process requests. ^\Quit auth# ^Dexit Script done on Tue Nov 29 10:44:31 2011

6 15

Error: Failed to send packet; No response from Server
by suggestme 30 Nov '11

30 Nov '11

Hi, I was successful to install Freeradius 2.1.10 and basic PAP authentication, Authentication against Active Directory was successful when I installed Freeradius for first time. But I had to deinstall and reinstall Freeradius 2.1.10 again due to some missing libraries. I am following the same deployingradius.com site for basic testing. I can start the server in debugging mode successfully using radiusd -X, which shows "Ready to process requests". But while doing basic radtest for PAP authentication it gives error: radclient: Failed to send packet for ID 85: (unknown error) radclient: no response from server for ID 85 socket 3 The last part of debug mode output when I run radiusd -X is: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. The error I got using radtest is as follows: #radtest bob hello localhost 0 testing123 Sending Access-Request of id 85 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = *This is ommitted for privacy, It shows my radius server IP address* NAS-Port = 0 radclient: Failed to send packet for ID 85: (unknown error) Sending Access-Request of id 85 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = *This is ommitted for privacy, It shows my radius server IP address* NAS-Port = 0 radclient: Failed to send packet for ID 85: (unknown error) Sending Access-Request of id 85 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = *This is ommitted for privacy, It shows my radius server IP address* NAS-Port = 0 radclient: Failed to send packet for ID 85: (unknown error) radclient: no response from server for ID 85 socket 3 I was successful to do basic PAP authentication, and also authentication against active directory before. But this time I am getting this error. Can anyone please tell me what might be wrong. Thanks, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Error-Failed-to-send-packet-No-resp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

run radius in debug mode with screen
by Коньков Евгений 30 Nov '11

30 Nov '11

while using this verion FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.1, built on Jan 6 2009 at 10:52:08 I can run radius as /usr/local/bin/screen -d -m /usr/bin/nice -n -20 /r/radiusd debug but with FreeRADIUS Version 2.1.10, for host i386-portbld-freebsd9.0, built on Nov 28 2011 at 00:20:11 it exit without any messages. Can you help me please to resolve this problem? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 1

Connection Lost, tls resumption error
by Andreas Rudat 30 Nov '11

30 Nov '11

Hi, in my enviroment I got three AP's runnning, all with the same essid, after a while the connection seems lost and a reconnection starts to another AP and then I get the resumption error but I have no idea why I lost the connection. No Errors in radius debug and a good reception is given. The resumption error can be only avoid with restarting the wirless device. Thanks

3 3